968 files changed, 10320 insertions, 6604 deletions
diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci
index 34f51100f029..dff1f48d252d 100644
--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@@ -210,3 +210,15 @@ Users:
                firmware assigned instance number of the PCI
                device that can help in understanding the firmware
                intended order of the PCI device.
+What:           /sys/bus/pci/devices/.../d3cold_allowed
+Date:           July 2012
+Contact:        Huang Ying <ying.huang@intel.com>
+Description:
+                d3cold_allowed is bit to control whether the corresponding PCI
+                device can be put into D3Cold state.  If it is cleared, the
+                device will never be put into D3Cold state.  If it is set, the
+                device may be put into D3Cold state if other requirements are
+                satisfied too.  Reading this attribute will show the current
+                value of d3cold_allowed bit.  Writing this attribute will set
+                the value of d3cold_allowed bit.
diff --git a/Documentation/ABI/testing/sysfs-platform-ideapad-laptop b/Documentation/ABI/testing/sysfs-platform-ideapad-laptop
index 814b01354c41..b31e782bd985 100644
--- a/Documentation/ABI/testing/sysfs-platform-ideapad-laptop
+++ b/Documentation/ABI/testing/sysfs-platform-ideapad-laptop
@@ -5,4 +5,15 @@ Contact:	"Ike Panhc <ike.pan@canonical.com>"
 Description:
                Control the power of camera module. 1 means on, 0 means off.
+What:           /sys/devices/platform/ideapad/fan_mode
+Date:           June 2012
+KernelVersion:  3.6
+Contact:        "Maxim Mikityanskiy <maxtram95@gmail.com>"
+Description:
+                Change fan mode
+                There are four available modes:
+                        * 0 -> Super Silent Mode
+                        * 1 -> Standard Mode
+                        * 2 -> Dust Cleaning
+                        * 4 -> Efficient Thermal Dissipation Mode
diff --git a/Documentation/DocBook/media/v4l/vidioc-g-tuner.xml b/Documentation/DocBook/media/v4l/vidioc-g-tuner.xml
index 720395127904..701138f1209d 100644
--- a/Documentation/DocBook/media/v4l/vidioc-g-tuner.xml
+++ b/Documentation/DocBook/media/v4l/vidioc-g-tuner.xml
@@ -125,7 +125,7 @@ the structure refers to a radio tuner the
 <constant>V4L2_TUNER_CAP_NORM</constant> flags can't be used.</para>
 <para>If multiple frequency bands are supported, then
 <structfield>capability</structfield> is the union of all
-<structfield>capability></structfield> fields of each &v4l2-frequency-band;.
+<structfield>capability</structfield> fields of each &v4l2-frequency-band;.
 </para></entry>
          </row>
          <row>
diff --git a/Documentation/block/00-INDEX b/Documentation/block/00-INDEX
index d111e3b23db0..d18ecd827c40 100644
--- a/Documentation/block/00-INDEX
+++ b/Documentation/block/00-INDEX
@@ -3,15 +3,21 @@
 biodoc.txt
        - Notes on the Generic Block Layer Rewrite in Linux 2.5
 capability.txt
-        - Generic Block Device Capability (/sys/block/<disk>/capability)
+        - Generic Block Device Capability (/sys/block/<device>/capability)
+cfq-iosched.txt
+        - CFQ IO scheduler tunables
+data-integrity.txt
+        - Block data integrity
 deadline-iosched.txt
        - Deadline IO scheduler tunables
 ioprio.txt
        - Block io priorities (in CFQ scheduler)
+queue-sysfs.txt
+        - Queue's sysfs entries
 request.txt
        - The members of struct request (in include/linux/blkdev.h)
 stat.txt
-        - Block layer statistics in /sys/block/<dev>/stat
+        - Block layer statistics in /sys/block/<device>/stat
 switching-sched.txt
        - Switching I/O schedulers at runtime
 writeback_cache_control.txt
diff --git a/Documentation/block/cfq-iosched.txt b/Documentation/block/cfq-iosched.txt
index 6d670f570451..d89b4fe724d7 100644
--- a/Documentation/block/cfq-iosched.txt
+++ b/Documentation/block/cfq-iosched.txt
@@ -1,3 +1,14 @@
+CFQ (Complete Fairness Queueing)
+===============================
+The main aim of CFQ scheduler is to provide a fair allocation of the disk
+I/O bandwidth for all the processes which requests an I/O operation.
+CFQ maintains the per process queue for the processes which request I/O
+operation(syncronous requests). In case of asynchronous requests, all the
+requests from all the processes are batched together according to their
+process's I/O priority.
 CFQ ioscheduler tunables
 ========================
@@ -25,6 +36,72 @@ there are multiple spindles behind single LUN (Host based hardware RAID
 controller or for storage arrays), setting slice_idle=0 might end up in better
 throughput and acceptable latencies.
+back_seek_max
+-------------
+This specifies, given in Kbytes, the maximum "distance" for backward seeking.
+The distance is the amount of space from the current head location to the
+sectors that are backward in terms of distance.
+This parameter allows the scheduler to anticipate requests in the "backward"
+direction and consider them as being the "next" if they are within this
+distance from the current head location.
+back_seek_penalty
+-----------------
+This parameter is used to compute the cost of backward seeking. If the
+backward distance of request is just 1/back_seek_penalty from a "front"
+request, then the seeking cost of two requests is considered equivalent.
+So scheduler will not bias toward one or the other request (otherwise scheduler
+will bias toward front request). Default value of back_seek_penalty is 2.
+fifo_expire_async
+-----------------
+This parameter is used to set the timeout of asynchronous requests. Default
+value of this is 248ms.
+fifo_expire_sync
+----------------
+This parameter is used to set the timeout of synchronous requests. Default
+value of this is 124ms. In case to favor synchronous requests over asynchronous
+one, this value should be decreased relative to fifo_expire_async.
+slice_async
+-----------
+This parameter is same as of slice_sync but for asynchronous queue. The
+default value is 40ms.
+slice_async_rq
+--------------
+This parameter is used to limit the dispatching of asynchronous request to
+device request queue in queue's slice time. The maximum number of request that
+are allowed to be dispatched also depends upon the io priority. Default value
+for this is 2.
+slice_sync
+----------
+When a queue is selected for execution, the queues IO requests are only
+executed for a certain amount of time(time_slice) before switching to another
+queue. This parameter is used to calculate the time slice of synchronous
+queue.
+time_slice is computed using the below equation:-
+time_slice = slice_sync + (slice_sync/5 * (4 - prio)). To increase the
+time_slice of synchronous queue, increase the value of slice_sync. Default
+value is 100ms.
+quantum
+-------
+This specifies the number of request dispatched to the device queue. In a
+queue's time slice, a request will not be dispatched if the number of request
+in the device exceeds this parameter. This parameter is used for synchronous
+request.
+In case of storage with several disk, this setting can limit the parallel
+processing of request. Therefore, increasing the value can imporve the
+performace although this can cause the latency of some I/O to increase due
+to more number of requests.
 CFQ IOPS Mode for group scheduling
 ===================================
 Basic CFQ design is to provide priority based time slices. Higher priority
diff --git a/Documentation/block/queue-sysfs.txt b/Documentation/block/queue-sysfs.txt
index 6518a55273e7..e54ac1d53403 100644
--- a/Documentation/block/queue-sysfs.txt
+++ b/Documentation/block/queue-sysfs.txt
@@ -9,20 +9,71 @@ These files are the ones found in the /sys/block/xxx/queue/ directory.
 Files denoted with a RO postfix are readonly and the RW postfix means
 read-write.
+add_random (RW)
+----------------
+This file allows to trun off the disk entropy contribution. Default
+value of this file is '1'(on).
+discard_granularity (RO)
+-----------------------
+This shows the size of internal allocation of the device in bytes, if
+reported by the device. A value of '0' means device does not support
+the discard functionality.
+discard_max_bytes (RO)
+----------------------
+Devices that support discard functionality may have internal limits on
+the number of bytes that can be trimmed or unmapped in a single operation.
+The discard_max_bytes parameter is set by the device driver to the maximum
+number of bytes that can be discarded in a single operation. Discard
+requests issued to the device must not exceed this limit. A discard_max_bytes
+value of 0 means that the device does not support discard functionality.
+discard_zeroes_data (RO)
+------------------------
+When read, this file will show if the discarded block are zeroed by the
+device or not. If its value is '1' the blocks are zeroed otherwise not.
 hw_sector_size (RO)
 -------------------
 This is the hardware sector size of the device, in bytes.
+iostats (RW)
+-------------
+This file is used to control (on/off) the iostats accounting of the
+disk.
+logical_block_size (RO)
+-----------------------
+This is the logcal block size of the device, in bytes.
 max_hw_sectors_kb (RO)
 ----------------------
 This is the maximum number of kilobytes supported in a single data transfer.
+max_integrity_segments (RO)
+---------------------------
+When read, this file shows the max limit of integrity segments as
+set by block layer which a hardware controller can handle.
 max_sectors_kb (RW)
 -------------------
 This is the maximum number of kilobytes that the block layer will allow
 for a filesystem request. Must be smaller than or equal to the maximum
 size allowed by the hardware.
+max_segments (RO)
+-----------------
+Maximum number of segments of the device.
+max_segment_size (RO)
+---------------------
+Maximum segment size of the device.
+minimum_io_size (RO)
+--------------------
+This is the smallest preferred io size reported by the device.
 nomerges (RW)
 -------------
 This enables the user to disable the lookup logic involved with IO
@@ -45,11 +96,24 @@ per-block-cgroup request pool.  IOW, if there are N block cgroups,
 each request queue may have upto N request pools, each independently
 regulated by nr_requests.
+optimal_io_size (RO)
+--------------------
+This is the optimal io size reported by the device.
+physical_block_size (RO)
+------------------------
+This is the physical block size of device, in bytes.
 read_ahead_kb (RW)
 ------------------
 Maximum number of kilobytes to read-ahead for filesystems on this block
 device.
+rotational (RW)
+---------------
+This file is used to stat if the device is of rotational type or
+non-rotational type.
 rq_affinity (RW)
 ----------------
 If this option is '1', the block layer will migrate request completions to the
diff --git a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
index 70cd49b1caa8..1dd622546d06 100644
--- a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
+++ b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
@@ -10,8 +10,8 @@ Required properties:
 - compatible : Should be "fsl,<chip>-esdhc"
 Optional properties:
- fsl,cd-internal : Indicate to use controller internal card detection
+- fsl,cd-controller : Indicate to use controller internal card detection
- fsl,wp-internal : Indicate to use controller internal write protection
+- fsl,wp-controller : Indicate to use controller internal write protection
 Examples:
@@ -19,8 +19,8 @@ esdhc@70004000 {
        compatible = "fsl,imx51-esdhc";
        reg = <0x70004000 0x4000>;
        interrupts = <1>;
-        fsl,cd-internal;
+        fsl,cd-controller;
-        fsl,wp-internal;
+        fsl,wp-controller;
 };
 esdhc@70008000 {
diff --git a/Documentation/devicetree/bindings/regulator/tps6586x.txt b/Documentation/devicetree/bindings/regulator/tps6586x.txt
index d156e1b5db12..da80c2ae0915 100644
--- a/Documentation/devicetree/bindings/regulator/tps6586x.txt
+++ b/Documentation/devicetree/bindings/regulator/tps6586x.txt
@@ -9,9 +9,9 @@ Required properties:
 - regulators: list of regulators provided by this controller, must have
  property "regulator-compatible" to match their hardware counterparts:
  sm[0-2], ldo[0-9] and ldo_rtc
- sm0-supply: The input supply for the SM0.
+- vin-sm0-supply: The input supply for the SM0.
- sm1-supply: The input supply for the SM1.
+- vin-sm1-supply: The input supply for the SM1.
- sm2-supply: The input supply for the SM2.
+- vin-sm2-supply: The input supply for the SM2.
 - vinldo01-supply: The input supply for the LDO1 and LDO2
 - vinldo23-supply: The input supply for the LDO2 and LDO3
 - vinldo4-supply: The input supply for the LDO4
@@ -30,9 +30,9 @@ Example:
                #gpio-cells = <2>;
                gpio-controller;
-                sm0-supply = <&some_reg>;
+                vin-sm0-supply = <&some_reg>;
-                sm1-supply = <&some_reg>;
+                vin-sm1-supply = <&some_reg>;
-                sm2-supply = <&some_reg>;
+                vin-sm2-supply = <&some_reg>;
                vinldo01-supply = <...>;
                vinldo23-supply = <...>;
                vinldo4-supply = <...>;
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index afaff312bf41..f4d8c7105fcd 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -579,7 +579,7 @@ Why:	KVM tracepoints provide mostly equivalent information in a much more
 ----------------------------
 What:   at91-mci driver ("CONFIG_MMC_AT91")
-When:   3.7
+When:   3.8
 Why:    There are two mci drivers: at91-mci and atmel-mci. The PDC support
        was added to atmel-mci as a first step to support more chips.
        Then at91-mci was kept only for old IP versions (on at91rm9200 and
diff --git a/Documentation/filesystems/vfat.txt b/Documentation/filesystems/vfat.txt
index ead764b2728f..de1e6c4dccff 100644
--- a/Documentation/filesystems/vfat.txt
+++ b/Documentation/filesystems/vfat.txt
@@ -137,6 +137,17 @@ errors=panic|continue|remount-ro
                 without doing anything or remount the partition in
                 read-only mode (default behavior).
+discard       -- If set, issues discard/TRIM commands to the block
+                 device when blocks are freed. This is useful for SSD devices
+                 and sparse/thinly-provisoned LUNs.
+nfs           -- This option maintains an index (cache) of directory
+                 inodes by i_logstart which is used by the nfs-related code to
+                 improve look-ups.
+                 Enable this only if you want to export the FAT filesystem
+                 over NFS
 <bool>: 0,1,yes,no,true,false
 TODO
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index 615142da4ef6..157416e78cc4 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -21,6 +21,7 @@ Supported adapters:
  * Intel DH89xxCC (PCH)
  * Intel Panther Point (PCH)
  * Intel Lynx Point (PCH)
+  * Intel Lynx Point-LP (PCH)
   Datasheets: Publicly available at the Intel website
 On Intel Patsburg and later chipsets, both the normal host SMBus controller
diff --git a/Documentation/networking/netconsole.txt b/Documentation/networking/netconsole.txt
index 8d022073e3ef..2e9e0ae2cd45 100644
--- a/Documentation/networking/netconsole.txt
+++ b/Documentation/networking/netconsole.txt
@@ -51,8 +51,23 @@ Built-in netconsole starts immediately after the TCP stack is
 initialized and attempts to bring up the supplied dev at the supplied
 address.
-The remote host can run either 'netcat -u -l -p <port>',
+The remote host has several options to receive the kernel messages,
-'nc -l -u <port>' or syslogd.
+for example:
+1) syslogd
+2) netcat
+   On distributions using a BSD-based netcat version (e.g. Fedora,
+   openSUSE and Ubuntu) the listening port must be specified without
+   the -p switch:
+   'nc -u -l -p <port>' / 'nc -u -l <port>' or
+   'netcat -u -l -p <port>' / 'netcat -u -l <port>'
+3) socat
+   'socat udp-recv:<port> -'
 Dynamic reconfiguration:
 ========================
diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
index e40f4b4e1977..1479aca23744 100644
--- a/Documentation/pinctrl.txt
+++ b/Documentation/pinctrl.txt
@@ -840,9 +840,9 @@ static unsigned long i2c_pin_configs[] = {
 static struct pinctrl_map __initdata mapping[] = {
        PIN_MAP_MUX_GROUP("foo-i2c.0", PINCTRL_STATE_DEFAULT, "pinctrl-foo", "i2c0", "i2c0"),
-        PIN_MAP_MUX_CONFIGS_GROUP("foo-i2c.0", PINCTRL_STATE_DEFAULT, "pinctrl-foo", "i2c0", i2c_grp_configs),
+        PIN_MAP_CONFIGS_GROUP("foo-i2c.0", PINCTRL_STATE_DEFAULT, "pinctrl-foo", "i2c0", i2c_grp_configs),
-        PIN_MAP_MUX_CONFIGS_PIN("foo-i2c.0", PINCTRL_STATE_DEFAULT, "pinctrl-foo", "i2c0scl", i2c_pin_configs),
+        PIN_MAP_CONFIGS_PIN("foo-i2c.0", PINCTRL_STATE_DEFAULT, "pinctrl-foo", "i2c0scl", i2c_pin_configs),
-        PIN_MAP_MUX_CONFIGS_PIN("foo-i2c.0", PINCTRL_STATE_DEFAULT, "pinctrl-foo", "i2c0sda", i2c_pin_configs),
+        PIN_MAP_CONFIGS_PIN("foo-i2c.0", PINCTRL_STATE_DEFAULT, "pinctrl-foo", "i2c0sda", i2c_pin_configs),
 };
 Finally, some devices expect the mapping table to contain certain specific
diff --git a/Documentation/vm/hugetlbpage.txt b/Documentation/vm/hugetlbpage.txt
index f8551b3879f8..4ac359b7aa17 100644
--- a/Documentation/vm/hugetlbpage.txt
+++ b/Documentation/vm/hugetlbpage.txt
@@ -299,11 +299,17 @@ map_hugetlb.c.
 *******************************************************************
 /*
- * hugepage-shm:  see Documentation/vm/hugepage-shm.c
+ * map_hugetlb: see tools/testing/selftests/vm/map_hugetlb.c
 */
 *******************************************************************
 /*
- * hugepage-mmap:  see Documentation/vm/hugepage-mmap.c
+ * hugepage-shm:  see tools/testing/selftests/vm/hugepage-shm.c
+ */
+*******************************************************************
+/*
+ * hugepage-mmap:  see tools/testing/selftests/vm/hugepage-mmap.c
 */
diff --git a/Documentation/w1/slaves/w1_therm b/Documentation/w1/slaves/w1_therm
index 0403aaaba878..874a8ca93feb 100644
--- a/Documentation/w1/slaves/w1_therm
+++ b/Documentation/w1/slaves/w1_therm
@@ -3,6 +3,7 @@ Kernel driver w1_therm
 Supported chips:
  * Maxim ds18*20 based temperature sensors.
+  * Maxim ds1825 based temperature sensors.
 Author: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
@@ -15,6 +16,7 @@ supported family codes:
 W1_THERM_DS18S20        0x10
 W1_THERM_DS1822         0x22
 W1_THERM_DS18B20        0x28
+W1_THERM_DS1825         0x3B
 Support is provided through the sysfs w1_slave file.  Each open and
 read sequence will initiate a temperature conversion then provide two
diff --git a/Documentation/watchdog/src/watchdog-test.c b/Documentation/watchdog/src/watchdog-test.c
index 73ff5cc93e05..3da822967ee0 100644
--- a/Documentation/watchdog/src/watchdog-test.c
+++ b/Documentation/watchdog/src/watchdog-test.c
@@ -31,7 +31,7 @@ static void keep_alive(void)
 * or "-e" to enable the card.
 */
-void term(int sig)
+static void term(int sig)
 {
    close(fd);
    fprintf(stderr, "Stopping watchdog ticks...\n");
diff --git a/MAINTAINERS b/MAINTAINERS
index ed5df6e97ff0..53cc13c82cb1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2217,7 +2217,7 @@ S:	Maintained
 F:      drivers/scsi/tmscsim.*
 DC395x SCSI driver
-M:      Oliver Neukum <oliver@neukum.name>
+M:      Oliver Neukum <oliver@neukum.org>
 M:      Ali Akcaagac <aliakc@web.de>
 M:      Jamie Lenehan <lenehan@twibble.org>
 W:      http://twibble.org/dist/dc395x/
@@ -3388,7 +3388,7 @@ M:	"Wolfram Sang (embedded platforms)" <w.sang@pengutronix.de>
 L:      linux-i2c@vger.kernel.org
 W:      http://i2c.wiki.kernel.org/
 T:      quilt kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-i2c/
-T:      git git://git.fluff.org/bjdooks/linux.git
+T:      git git://git.pengutronix.de/git/wsa/linux.git
 S:      Maintained
 F:      Documentation/i2c/
 F:      drivers/i2c/
@@ -4537,7 +4537,7 @@ S:	Supported
 F:      arch/microblaze/
 MICROTEK X6 SCANNER
-M:      Oliver Neukum <oliver@neukum.name>
+M:      Oliver Neukum <oliver@neukum.org>
 S:      Maintained
 F:      drivers/usb/image/microtek.*
@@ -7076,7 +7076,7 @@ F:	include/linux/mtd/ubi.h
 F:      include/mtd/ubi-user.h
 USB ACM DRIVER
-M:      Oliver Neukum <oliver@neukum.name>
+M:      Oliver Neukum <oliver@neukum.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      Documentation/usb/acm.txt
@@ -7097,7 +7097,7 @@ S:	Supported
 F:      drivers/block/ub.c
 USB CDC ETHERNET DRIVER
-M:      Oliver Neukum <oliver@neukum.name>
+M:      Oliver Neukum <oliver@neukum.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/net/usb/cdc_*.c
@@ -7170,7 +7170,7 @@ F:	drivers/usb/host/isp116x*
 F:      include/linux/usb/isp116x.h
 USB KAWASAKI LSI DRIVER
-M:      Oliver Neukum <oliver@neukum.name>
+M:      Oliver Neukum <oliver@neukum.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/serial/kl5kusb105.*
@@ -7288,6 +7288,12 @@ W:	http://www.connecttech.com
 S:      Supported
 F:      drivers/usb/serial/whiteheat*
+USB SMSC75XX ETHERNET DRIVER
+M:      Steve Glendinning <steve.glendinning@shawell.net>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/usb/smsc75xx.*
 USB SMSC95XX ETHERNET DRIVER
 M:      Steve Glendinning <steve.glendinning@shawell.net>
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index 9cc77acfc881..0f66f146d57e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 6
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc5
 NAME = Saber-toothed Squirrel
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index d5b9b5e645cc..9944dedee5b1 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -18,6 +18,8 @@ config ALPHA
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
        select GENERIC_SMP_IDLE_THREAD
        select GENERIC_CMOS_UPDATE
+        select GENERIC_STRNCPY_FROM_USER
+        select GENERIC_STRNLEN_USER
        help
          The Alpha is a 64-bit general-purpose processor designed and
          marketed by the Digital Equipment Corporation of blessed memory,
diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
index 3bb7ffeae3bc..c2cbe4fc391c 100644
--- a/arch/alpha/include/asm/atomic.h
+++ b/arch/alpha/include/asm/atomic.h
@@ -14,8 +14,8 @@
 */
-#define ATOMIC_INIT(i)          ( (atomic_t) { (i) } )
+#define ATOMIC_INIT(i)          { (i) }
-#define ATOMIC64_INIT(i)        ( (atomic64_t) { (i) } )
+#define ATOMIC64_INIT(i)        { (i) }
 #define atomic_read(v)          (*(volatile int *)&(v)->counter)
 #define atomic64_read(v)        (*(volatile long *)&(v)->counter)
diff --git a/arch/alpha/include/asm/fpu.h b/arch/alpha/include/asm/fpu.h
index db00f7885faa..e477bcd5b94a 100644
--- a/arch/alpha/include/asm/fpu.h
+++ b/arch/alpha/include/asm/fpu.h
@@ -1,7 +1,9 @@
 #ifndef __ASM_ALPHA_FPU_H
 #define __ASM_ALPHA_FPU_H
+#ifdef __KERNEL__
 #include <asm/special_insns.h>
+#endif
 /*
 * Alpha floating-point control register defines:
diff --git a/arch/alpha/include/asm/ptrace.h b/arch/alpha/include/asm/ptrace.h
index fd698a174f26..b87755a19554 100644
--- a/arch/alpha/include/asm/ptrace.h
+++ b/arch/alpha/include/asm/ptrace.h
@@ -76,7 +76,10 @@ struct switch_stack {
 #define task_pt_regs(task) \
  ((struct pt_regs *) (task_stack_page(task) + 2*PAGE_SIZE) - 1)
-#define force_successful_syscall_return() (task_pt_regs(current)->r0 = 0)
+#define current_pt_regs() \
+  ((struct pt_regs *) ((char *)current_thread_info() + 2*PAGE_SIZE) - 1)
+#define force_successful_syscall_return() (current_pt_regs()->r0 = 0)
 #endif
diff --git a/arch/alpha/include/asm/socket.h b/arch/alpha/include/asm/socket.h
index dcb221a4b5be..7d2f75be932e 100644
--- a/arch/alpha/include/asm/socket.h
+++ b/arch/alpha/include/asm/socket.h
@@ -76,9 +76,11 @@
 /* Instruct lower device to use last 4-bytes of skb data as FCS */
 #define SO_NOFCS                43
+#ifdef __KERNEL__
 /* O_NONBLOCK clashes with the bits used for socket types.  Therefore we
 * have to define SOCK_NONBLOCK to a different value here.
 */
 #define SOCK_NONBLOCK   0x40000000
+#endif /* __KERNEL__ */
 #endif /* _ASM_SOCKET_H */
diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index b49ec2f8d6e3..766fdfde2b7a 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -433,36 +433,12 @@ clear_user(void __user *to, long len)
 #undef __module_address
 #undef __module_call
-/* Returns: -EFAULT if exception before terminator, N if the entire
+#define user_addr_max() \
-   buffer filled, else strlen.  */
+        (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL)
-extern long __strncpy_from_user(char *__to, const char __user *__from, long __to_len);
+extern long strncpy_from_user(char *dest, const char __user *src, long count);
+extern __must_check long strlen_user(const char __user *str);
-extern inline long
+extern __must_check long strnlen_user(const char __user *str, long n);
-strncpy_from_user(char *to, const char __user *from, long n)
-{
-        long ret = -EFAULT;
-        if (__access_ok((unsigned long)from, 0, get_fs()))
-                ret = __strncpy_from_user(to, from, n);
-        return ret;
-}
-/* Returns: 0 if bad, string length+1 (memory size) of string if ok */
-extern long __strlen_user(const char __user *);
-extern inline long strlen_user(const char __user *str)
-{
-        return access_ok(VERIFY_READ,str,0) ? __strlen_user(str) : 0;
-}
-/* Returns: 0 if exception before NUL or reaching the supplied limit (N),
- * a value greater than N if the limit would be exceeded, else strlen.  */
-extern long __strnlen_user(const char __user *, long);
-extern inline long strnlen_user(const char __user *str, long n)
-{
-        return access_ok(VERIFY_READ,str,0) ? __strnlen_user(str, n) : 0;
-}
 /*
 * About the exception table:
diff --git a/arch/alpha/include/asm/unistd.h b/arch/alpha/include/asm/unistd.h
index 633b23b0664a..a31a78eac9b9 100644
--- a/arch/alpha/include/asm/unistd.h
+++ b/arch/alpha/include/asm/unistd.h
@@ -465,10 +465,12 @@
 #define __NR_setns                      501
 #define __NR_accept4                    502
 #define __NR_sendmmsg                   503
+#define __NR_process_vm_readv           504
+#define __NR_process_vm_writev          505
 #ifdef __KERNEL__
-#define NR_SYSCALLS                     504
+#define NR_SYSCALLS                     506
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
diff --git a/arch/alpha/include/asm/word-at-a-time.h b/arch/alpha/include/asm/word-at-a-time.h
new file mode 100644
index 000000000000..6b340d0f1521
--- /dev/null
+++ b/arch/alpha/include/asm/word-at-a-time.h
@@ -0,0 +1,55 @@
+#ifndef _ASM_WORD_AT_A_TIME_H
+#define _ASM_WORD_AT_A_TIME_H
+#include <asm/compiler.h>
+/*
+ * word-at-a-time interface for Alpha.
+ */
+/*
+ * We do not use the word_at_a_time struct on Alpha, but it needs to be
+ * implemented to humour the generic code.
+ */
+struct word_at_a_time {
+        const unsigned long unused;
+};
+#define WORD_AT_A_TIME_CONSTANTS { 0 }
+/* Return nonzero if val has a zero */
+static inline unsigned long has_zero(unsigned long val, unsigned long *bits, const struct word_at_a_time *c)
+{
+        unsigned long zero_locations = __kernel_cmpbge(0, val);
+        *bits = zero_locations;
+        return zero_locations;
+}
+static inline unsigned long prep_zero_mask(unsigned long val, unsigned long bits, const struct word_at_a_time *c)
+{
+        return bits;
+}
+#define create_zero_mask(bits) (bits)
+static inline unsigned long find_zero(unsigned long bits)
+{
+#if defined(CONFIG_ALPHA_EV6) && defined(CONFIG_ALPHA_EV67)
+        /* Simple if have CIX instructions */
+        return __kernel_cttz(bits);
+#else
+        unsigned long t1, t2, t3;
+        /* Retain lowest set bit only */
+        bits &= -bits;
+        /* Binary search for lowest set bit */
+        t1 = bits & 0xf0;
+        t2 = bits & 0xcc;
+        t3 = bits & 0xaa;
+        if (t1) t1 = 4;
+        if (t2) t2 = 2;
+        if (t3) t3 = 1;
+        return t1 + t2 + t3;
+#endif
+}
+#endif /* _ASM_WORD_AT_A_TIME_H */
diff --git a/arch/alpha/kernel/alpha_ksyms.c b/arch/alpha/kernel/alpha_ksyms.c
index d96e742d4dc2..15fa821d09cd 100644
--- a/arch/alpha/kernel/alpha_ksyms.c
+++ b/arch/alpha/kernel/alpha_ksyms.c
@@ -52,7 +52,6 @@ EXPORT_SYMBOL(alpha_write_fp_reg_s);
 /* entry.S */
 EXPORT_SYMBOL(kernel_thread);
-EXPORT_SYMBOL(kernel_execve);
 /* Networking helper routines. */
 EXPORT_SYMBOL(csum_tcpudp_magic);
@@ -74,8 +73,6 @@ EXPORT_SYMBOL(alpha_fp_emul);
 */
 EXPORT_SYMBOL(__copy_user);
 EXPORT_SYMBOL(__do_clear_user);
-EXPORT_SYMBOL(__strncpy_from_user);
-EXPORT_SYMBOL(__strnlen_user);
 /* 
 * SMP-specific symbols.
diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S
index 6d159cee5f2f..ec0da0567ab5 100644
--- a/arch/alpha/kernel/entry.S
+++ b/arch/alpha/kernel/entry.S
@@ -663,58 +663,6 @@ kernel_thread:
        br      ret_to_kernel
 .end kernel_thread
-/*
- * kernel_execve(path, argv, envp)
- */
-        .align  4
-        .globl  kernel_execve
-        .ent    kernel_execve
-kernel_execve:
-        /* We can be called from a module.  */
-        ldgp    $gp, 0($27)
-        lda     $sp, -(32+SIZEOF_PT_REGS+8)($sp)
-        .frame  $sp, 32+SIZEOF_PT_REGS+8, $26, 0
-        stq     $26, 0($sp)
-        stq     $16, 8($sp)
-        stq     $17, 16($sp)
-        stq     $18, 24($sp)
-        .prologue 1
-        lda     $16, 32($sp)
-        lda     $17, 0
-        lda     $18, SIZEOF_PT_REGS
-        bsr     $26, memset             !samegp
-        /* Avoid the HAE being gratuitously wrong, which would cause us
-           to do the whole turn off interrupts thing and restore it.  */
-        ldq     $2, alpha_mv+HAE_CACHE
-        stq     $2, 152+32($sp)
-        ldq     $16, 8($sp)
-        ldq     $17, 16($sp)
-        ldq     $18, 24($sp)
-        lda     $19, 32($sp)
-        bsr     $26, do_execve          !samegp
-        ldq     $26, 0($sp)
-        bne     $0, 1f                  /* error! */
-        /* Move the temporary pt_regs struct from its current location
-           to the top of the kernel stack frame.  See copy_thread for
-           details for a normal process.  */
-        lda     $16, 0x4000 - SIZEOF_PT_REGS($8)
-        lda     $17, 32($sp)
-        lda     $18, SIZEOF_PT_REGS
-        bsr     $26, memmove            !samegp
-        /* Take that over as our new stack frame and visit userland!  */
-        lda     $sp, 0x4000 - SIZEOF_PT_REGS($8)
-        br      $31, ret_from_sys_call
-1:      lda     $sp, 32+SIZEOF_PT_REGS+8($sp)
-        ret
-.end kernel_execve
 /*
 * Special system calls.  Most of these are special in that they either
@@ -797,115 +745,6 @@ sys_rt_sigreturn:
 .end sys_rt_sigreturn
        .align  4
-        .globl  sys_sethae
-        .ent    sys_sethae
-sys_sethae:
-        .prologue 0
-        stq     $16, 152($sp)
-        ret
-.end sys_sethae
-        .align  4
-        .globl  osf_getpriority
-        .ent    osf_getpriority
-osf_getpriority:
-        lda     $sp, -16($sp)
-        stq     $26, 0($sp)
-        .prologue 0
-        jsr     $26, sys_getpriority
-        ldq     $26, 0($sp)
-        blt     $0, 1f
-        /* Return value is the unbiased priority, i.e. 20 - prio.
-           This does result in negative return values, so signal
-           no error by writing into the R0 slot.  */
-        lda     $1, 20
-        stq     $31, 16($sp)
-        subl    $1, $0, $0
-        unop
-1:      lda     $sp, 16($sp)
-        ret
-.end osf_getpriority
-        .align  4
-        .globl  sys_getxuid
-        .ent    sys_getxuid
-sys_getxuid:
-        .prologue 0
-        ldq     $2, TI_TASK($8)
-        ldq     $3, TASK_CRED($2)
-        ldl     $0, CRED_UID($3)
-        ldl     $1, CRED_EUID($3)
-        stq     $1, 80($sp)
-        ret
-.end sys_getxuid
-        .align  4
-        .globl  sys_getxgid
-        .ent    sys_getxgid
-sys_getxgid:
-        .prologue 0
-        ldq     $2, TI_TASK($8)
-        ldq     $3, TASK_CRED($2)
-        ldl     $0, CRED_GID($3)
-        ldl     $1, CRED_EGID($3)
-        stq     $1, 80($sp)
-        ret
-.end sys_getxgid
-        .align  4
-        .globl  sys_getxpid
-        .ent    sys_getxpid
-sys_getxpid:
-        .prologue 0
-        ldq     $2, TI_TASK($8)
-        /* See linux/kernel/timer.c sys_getppid for discussion
-           about this loop.  */
-        ldq     $3, TASK_GROUP_LEADER($2)
-        ldq     $4, TASK_REAL_PARENT($3)
-        ldl     $0, TASK_TGID($2)
-1:      ldl     $1, TASK_TGID($4)
-#ifdef CONFIG_SMP
-        mov     $4, $5
-        mb
-        ldq     $3, TASK_GROUP_LEADER($2)
-        ldq     $4, TASK_REAL_PARENT($3)
-        cmpeq   $4, $5, $5
-        beq     $5, 1b
-#endif
-        stq     $1, 80($sp)
-        ret
-.end sys_getxpid
-        .align  4
-        .globl  sys_alpha_pipe
-        .ent    sys_alpha_pipe
-sys_alpha_pipe:
-        lda     $sp, -16($sp)
-        stq     $26, 0($sp)
-        .prologue 0
-        mov     $31, $17
-        lda     $16, 8($sp)
-        jsr     $26, do_pipe_flags
-        ldq     $26, 0($sp)
-        bne     $0, 1f
-        /* The return values are in $0 and $20.  */
-        ldl     $1, 12($sp)
-        ldl     $0, 8($sp)
-        stq     $1, 80+16($sp)
-1:      lda     $sp, 16($sp)
-        ret
-.end sys_alpha_pipe
-        .align  4
        .globl  sys_execve
        .ent    sys_execve
 sys_execve:
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 98a103621af6..bc1acdda7a5e 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1404,3 +1404,52 @@ SYSCALL_DEFINE3(osf_writev, unsigned long, fd,
 }
 #endif
+SYSCALL_DEFINE2(osf_getpriority, int, which, int, who)
+{
+        int prio = sys_getpriority(which, who);
+        if (prio >= 0) {
+                /* Return value is the unbiased priority, i.e. 20 - prio.
+                   This does result in negative return values, so signal
+                   no error */
+                force_successful_syscall_return();
+                prio = 20 - prio;
+        }
+        return prio;
+}
+SYSCALL_DEFINE0(getxuid)
+{
+        current_pt_regs()->r20 = sys_geteuid();
+        return sys_getuid();
+}
+SYSCALL_DEFINE0(getxgid)
+{
+        current_pt_regs()->r20 = sys_getegid();
+        return sys_getgid();
+}
+SYSCALL_DEFINE0(getxpid)
+{
+        current_pt_regs()->r20 = sys_getppid();
+        return sys_getpid();
+}
+SYSCALL_DEFINE0(alpha_pipe)
+{
+        int fd[2];
+        int res = do_pipe_flags(fd, 0);
+        if (!res) {
+                /* The return values are in $0 and $20.  */
+                current_pt_regs()->r20 = fd[1];
+                res = fd[0];
+        }
+        return res;
+}
+SYSCALL_DEFINE1(sethae, unsigned long, val)
+{
+        current_pt_regs()->hae = val;
+        return 0;
+}
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 153d3fce3e8e..d6fde98b74b3 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -455,3 +455,22 @@ get_wchan(struct task_struct *p)
        }
        return pc;
 }
+int kernel_execve(const char *path, const char *const argv[], const char *const envp[])
+{
+        /* Avoid the HAE being gratuitously wrong, which would cause us
+           to do the whole turn off interrupts thing and restore it.  */
+        struct pt_regs regs = {.hae = alpha_mv.hae_cache};
+        int err = do_execve(path, argv, envp, &regs);
+        if (!err) {
+                struct pt_regs *p = current_pt_regs();
+                /* copy regs to normal position and off to userland we go... */
+                *p = regs;
+                __asm__ __volatile__ (
+                        "mov    %0, $sp;"
+                        "br     $31, ret_from_sys_call"
+                        : : "r"(p));
+        }
+        return err;
+}
+EXPORT_SYMBOL(kernel_execve);
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index 87835235f114..2ac6b45c3e00 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -111,7 +111,7 @@ sys_call_table:
        .quad sys_socket
        .quad sys_connect
        .quad sys_accept
-        .quad osf_getpriority                   /* 100 */
+        .quad sys_osf_getpriority                       /* 100 */
        .quad sys_send
        .quad sys_recv
        .quad sys_sigreturn
@@ -522,6 +522,8 @@ sys_call_table:
        .quad sys_setns
        .quad sys_accept4
        .quad sys_sendmmsg
+        .quad sys_process_vm_readv
+        .quad sys_process_vm_writev             /* 505 */
        .size sys_call_table, . - sys_call_table
        .type sys_call_table, @object
diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
index c0a83ab62b78..59660743237c 100644
--- a/arch/alpha/lib/Makefile
+++ b/arch/alpha/lib/Makefile
@@ -31,8 +31,6 @@ lib-y =	__divqu.o __remqu.o __divlu.o __remlu.o \
        $(ev6-y)memchr.o \
        $(ev6-y)copy_user.o \
        $(ev6-y)clear_user.o \
-        $(ev6-y)strncpy_from_user.o \
-        $(ev67-y)strlen_user.o \
        $(ev6-y)csum_ipv6_magic.o \
        $(ev6-y)clear_page.o \
        $(ev6-y)copy_page.o \
diff --git a/arch/alpha/lib/ev6-strncpy_from_user.S b/arch/alpha/lib/ev6-strncpy_from_user.S
deleted file mode 100644
index d2e28178cacc..000000000000
--- a/arch/alpha/lib/ev6-strncpy_from_user.S
+++ /dev/null
@@ -1,424 +0,0 @@
-/*
- * arch/alpha/lib/ev6-strncpy_from_user.S
- * 21264 version contributed by Rick Gorton <rick.gorton@alpha-processor.com>
- *
- * Just like strncpy except in the return value:
- *
- * -EFAULT       if an exception occurs before the terminator is copied.
- * N             if the buffer filled.
- *
- * Otherwise the length of the string is returned.
- *
- * Much of the information about 21264 scheduling/coding comes from:
- *      Compiler Writer's Guide for the Alpha 21264
- *      abbreviated as 'CWG' in other comments here
- *      ftp.digital.com/pub/Digital/info/semiconductor/literature/dsc-library.html
- * Scheduling notation:
- *      E       - either cluster
- *      U       - upper subcluster; U0 - subcluster U0; U1 - subcluster U1
- *      L       - lower subcluster; L0 - subcluster L0; L1 - subcluster L1
- * A bunch of instructions got moved and temp registers were changed
- * to aid in scheduling.  Control flow was also re-arranged to eliminate
- * branches, and to provide longer code sequences to enable better scheduling.
- * A total rewrite (using byte load/stores for start & tail sequences)
- * is desirable, but very difficult to do without a from-scratch rewrite.
- * Save that for the future.
- */
-#include <asm/errno.h>
-#include <asm/regdef.h>
-/* Allow an exception for an insn; exit if we get one.  */
-#define EX(x,y...)                      \
-        99: x,##y;                      \
-        .section __ex_table,"a";        \
-        .long 99b - .;                  \
-        lda $31, $exception-99b($0);    \
-        .previous
-        .set noat
-        .set noreorder
-        .text
-        .globl __strncpy_from_user
-        .ent __strncpy_from_user
-        .frame $30, 0, $26
-        .prologue 0
-        .align 4
-__strncpy_from_user:
-        and     a0, 7, t3       # E : find dest misalignment
-        beq     a2, $zerolength # U :
-        /* Are source and destination co-aligned?  */
-        mov     a0, v0          # E : save the string start
-        xor     a0, a1, t4      # E :
-        EX( ldq_u t1, 0(a1) )   # L : Latency=3 load first quadword
-        ldq_u   t0, 0(a0)       # L : load first (partial) aligned dest quadword
-        addq    a2, t3, a2      # E : bias count by dest misalignment
-        subq    a2, 1, a3       # E :
-        addq    zero, 1, t10    # E :
-        and     t4, 7, t4       # E : misalignment between the two
-        and     a3, 7, t6       # E : number of tail bytes
-        sll     t10, t6, t10    # E : t10 = bitmask of last count byte
-        bne     t4, $unaligned  # U :
-        lda     t2, -1          # E : build a mask against false zero
-        /*
-         * We are co-aligned; take care of a partial first word.
-         * On entry to this basic block:
-         * t0 == the first destination word for masking back in
-         * t1 == the first source word.
-         */
-        srl     a3, 3, a2       # E : a2 = loop counter = (count - 1)/8
-        addq    a1, 8, a1       # E :
-        mskqh   t2, a1, t2      # U :   detection in the src word
-        nop
-        /* Create the 1st output word and detect 0's in the 1st input word.  */
-        mskqh   t1, a1, t3      # U :
-        mskql   t0, a1, t0      # U : assemble the first output word
-        ornot   t1, t2, t2      # E :
-        nop
-        cmpbge  zero, t2, t8    # E : bits set iff null found
-        or      t0, t3, t0      # E :
-        beq     a2, $a_eoc      # U :
-        bne     t8, $a_eos      # U : 2nd branch in a quad.  Bad.
-        /* On entry to this basic block:
-         * t0 == a source quad not containing a null.
-         * a0 - current aligned destination address
-         * a1 - current aligned source address
-         * a2 - count of quadwords to move.
-         * NOTE: Loop improvement - unrolling this is going to be
-         *      a huge win, since we're going to stall otherwise.
-         *      Fix this later.  For _really_ large copies, look
-         *      at using wh64 on a look-ahead basis.  See the code
-         *      in clear_user.S and copy_user.S.
-         * Presumably, since (a0) and (a1) do not overlap (by C definition)
-         * Lots of nops here:
-         *      - Separate loads from stores
-         *      - Keep it to 1 branch/quadpack so the branch predictor
-         *        can train.
-         */
-$a_loop:
-        stq_u   t0, 0(a0)       # L :
-        addq    a0, 8, a0       # E :
-        nop
-        subq    a2, 1, a2       # E :
-        EX( ldq_u t0, 0(a1) )   # L :
-        addq    a1, 8, a1       # E :
-        cmpbge  zero, t0, t8    # E : Stall 2 cycles on t0
-        beq     a2, $a_eoc      # U :
-        beq     t8, $a_loop     # U :
-        nop
-        nop
-        nop
-        /* Take care of the final (partial) word store.  At this point
-         * the end-of-count bit is set in t8 iff it applies.
-         *
-         * On entry to this basic block we have:
-         * t0 == the source word containing the null
-         * t8 == the cmpbge mask that found it.
-         */
-$a_eos:
-        negq    t8, t12         # E : find low bit set
-        and     t8, t12, t12    # E : 
-        /* We're doing a partial word store and so need to combine
-           our source and original destination words.  */
-        ldq_u   t1, 0(a0)       # L :
-        subq    t12, 1, t6      # E :
-        or      t12, t6, t8     # E :
-        zapnot  t0, t8, t0      # U : clear src bytes > null
-        zap     t1, t8, t1      # U : clear dst bytes <= null
-        or      t0, t1, t0      # E :
-        stq_u   t0, 0(a0)       # L :
-        br      $finish_up      # L0 :
-        nop
-        nop
-        /* Add the end-of-count bit to the eos detection bitmask.  */
-        .align 4
-$a_eoc:
-        or      t10, t8, t8
-        br      $a_eos
-        nop
-        nop
-/* The source and destination are not co-aligned.  Align the destination
-   and cope.  We have to be very careful about not reading too much and
-   causing a SEGV.  */
-        .align 4
-$u_head:
-        /* We know just enough now to be able to assemble the first
-           full source word.  We can still find a zero at the end of it
-           that prevents us from outputting the whole thing.
-           On entry to this basic block:
-           t0 == the first dest word, unmasked
-           t1 == the shifted low bits of the first source word
-           t6 == bytemask that is -1 in dest word bytes */
-        EX( ldq_u t2, 8(a1) )   # L : load second src word
-        addq    a1, 8, a1       # E :
-        mskql   t0, a0, t0      # U : mask trailing garbage in dst
-        extqh   t2, a1, t4      # U :
-        or      t1, t4, t1      # E : first aligned src word complete
-        mskqh   t1, a0, t1      # U : mask leading garbage in src
-        or      t0, t1, t0      # E : first output word complete
-        or      t0, t6, t6      # E : mask original data for zero test
-        cmpbge  zero, t6, t8    # E :
-        beq     a2, $u_eocfin   # U :
-        bne     t8, $u_final    # U : bad news - 2nd branch in a quad
-        lda     t6, -1          # E : mask out the bits we have
-        mskql   t6, a1, t6      # U :   already seen
-        stq_u   t0, 0(a0)       # L : store first output word
-        or      t6, t2, t2      # E :
-        cmpbge  zero, t2, t8    # E : find nulls in second partial
-        addq    a0, 8, a0               # E :
-        subq    a2, 1, a2               # E :
-        bne     t8, $u_late_head_exit   # U :
-        nop
-        /* Finally, we've got all the stupid leading edge cases taken care
-           of and we can set up to enter the main loop.  */
-        extql   t2, a1, t1      # U : position hi-bits of lo word
-        EX( ldq_u t2, 8(a1) )   # L : read next high-order source word
-        addq    a1, 8, a1       # E :
-        cmpbge  zero, t2, t8    # E :
-        beq     a2, $u_eoc      # U :
-        bne     t8, $u_eos      # U :
-        nop
-        nop
-        /* Unaligned copy main loop.  In order to avoid reading too much,
-           the loop is structured to detect zeros in aligned source words.
-           This has, unfortunately, effectively pulled half of a loop
-           iteration out into the head and half into the tail, but it does
-           prevent nastiness from accumulating in the very thing we want
-           to run as fast as possible.
-           On entry to this basic block:
-           t1 == the shifted high-order bits from the previous source word
-           t2 == the unshifted current source word
-           We further know that t2 does not contain a null terminator.  */
-        /*
-         * Extra nops here:
-         *      separate load quads from store quads
-         *      only one branch/quad to permit predictor training
-         */
-        .align 4
-$u_loop:
-        extqh   t2, a1, t0      # U : extract high bits for current word
-        addq    a1, 8, a1       # E :
-        extql   t2, a1, t3      # U : extract low bits for next time
-        addq    a0, 8, a0       # E :
-        or      t0, t1, t0      # E : current dst word now complete
-        EX( ldq_u t2, 0(a1) )   # L : load high word for next time
-        subq    a2, 1, a2       # E :
-        nop
-        stq_u   t0, -8(a0)      # L : save the current word
-        mov     t3, t1          # E :
-        cmpbge  zero, t2, t8    # E : test new word for eos
-        beq     a2, $u_eoc      # U :
-        beq     t8, $u_loop     # U :
-        nop
-        nop
-        nop
-        /* We've found a zero somewhere in the source word we just read.
-           If it resides in the lower half, we have one (probably partial)
-           word to write out, and if it resides in the upper half, we
-           have one full and one partial word left to write out.
-           On entry to this basic block:
-           t1 == the shifted high-order bits from the previous source word
-           t2 == the unshifted current source word.  */
-        .align 4
-$u_eos:
-        extqh   t2, a1, t0      # U :
-        or      t0, t1, t0      # E : first (partial) source word complete
-        cmpbge  zero, t0, t8    # E : is the null in this first bit?
-        nop
-        bne     t8, $u_final    # U :
-        stq_u   t0, 0(a0)       # L : the null was in the high-order bits
-        addq    a0, 8, a0       # E :
-        subq    a2, 1, a2       # E :
-        .align 4
-$u_late_head_exit:
-        extql   t2, a1, t0      # U :
-        cmpbge  zero, t0, t8    # E :
-        or      t8, t10, t6     # E :
-        cmoveq  a2, t6, t8      # E :
-        /* Take care of a final (probably partial) result word.
-           On entry to this basic block:
-           t0 == assembled source word
-           t8 == cmpbge mask that found the null.  */
-        .align 4
-$u_final:
-        negq    t8, t6          # E : isolate low bit set
-        and     t6, t8, t12     # E :
-        ldq_u   t1, 0(a0)       # L :
-        subq    t12, 1, t6      # E :
-        or      t6, t12, t8     # E :
-        zapnot  t0, t8, t0      # U : kill source bytes > null
-        zap     t1, t8, t1      # U : kill dest bytes <= null
-        or      t0, t1, t0      # E :
-        stq_u   t0, 0(a0)       # E :
-        br      $finish_up      # U :
-        nop
-        nop
-        .align 4
-$u_eoc:                         # end-of-count
-        extqh   t2, a1, t0      # U :
-        or      t0, t1, t0      # E :
-        cmpbge  zero, t0, t8    # E :
-        nop
-        .align 4
-$u_eocfin:                      # end-of-count, final word
-        or      t10, t8, t8     # E :
-        br      $u_final        # U :
-        nop
-        nop
-        /* Unaligned copy entry point.  */
-        .align 4
-$unaligned:
-        srl     a3, 3, a2       # U : a2 = loop counter = (count - 1)/8
-        and     a0, 7, t4       # E : find dest misalignment
-        and     a1, 7, t5       # E : find src misalignment
-        mov     zero, t0        # E :
-        /* Conditionally load the first destination word and a bytemask
-           with 0xff indicating that the destination byte is sacrosanct.  */
-        mov     zero, t6        # E :
-        beq     t4, 1f          # U :
-        ldq_u   t0, 0(a0)       # L :
-        lda     t6, -1          # E :
-        mskql   t6, a0, t6      # E :
-        nop
-        nop
-        nop
-        .align 4
-1:
-        subq    a1, t4, a1      # E : sub dest misalignment from src addr
-        /* If source misalignment is larger than dest misalignment, we need
-           extra startup checks to avoid SEGV.  */
-        cmplt   t4, t5, t12     # E :
-        extql   t1, a1, t1      # U : shift src into place
-        lda     t2, -1          # E : for creating masks later
-        beq     t12, $u_head    # U :
-        mskqh   t2, t5, t2      # U : begin src byte validity mask
-        cmpbge  zero, t1, t8    # E : is there a zero?
-        nop
-        extql   t2, a1, t2      # U :
-        or      t8, t10, t5     # E : test for end-of-count too
-        cmpbge  zero, t2, t3    # E :
-        cmoveq  a2, t5, t8      # E : Latency=2, extra map slot
-        nop                     # E : goes with cmov
-        andnot  t8, t3, t8      # E :
-        beq     t8, $u_head     # U :
-        nop
-        /* At this point we've found a zero in the first partial word of
-           the source.  We need to isolate the valid source data and mask
-           it into the original destination data.  (Incidentally, we know
-           that we'll need at least one byte of that original dest word.) */
-        ldq_u   t0, 0(a0)       # L :
-        negq    t8, t6          # E : build bitmask of bytes <= zero
-        mskqh   t1, t4, t1      # U :
-        and     t6, t8, t12     # E :
-        subq    t12, 1, t6      # E :
-        or      t6, t12, t8     # E :
-        zapnot  t2, t8, t2      # U : prepare source word; mirror changes
-        zapnot  t1, t8, t1      # U : to source validity mask
-        andnot  t0, t2, t0      # E : zero place for source to reside
-        or      t0, t1, t0      # E : and put it there
-        stq_u   t0, 0(a0)       # L :
-        nop
-        .align 4
-$finish_up:
-        zapnot  t0, t12, t4     # U : was last byte written null?
-        and     t12, 0xf0, t3   # E : binary search for the address of the
-        cmovne  t4, 1, t4       # E : Latency=2, extra map slot
-        nop                     # E : with cmovne
-        and     t12, 0xcc, t2   # E : last byte written
-        and     t12, 0xaa, t1   # E :
-        cmovne  t3, 4, t3       # E : Latency=2, extra map slot
-        nop                     # E : with cmovne
-        bic     a0, 7, t0
-        cmovne  t2, 2, t2       # E : Latency=2, extra map slot
-        nop                     # E : with cmovne
-        nop
-        cmovne  t1, 1, t1       # E : Latency=2, extra map slot
-        nop                     # E : with cmovne
-        addq    t0, t3, t0      # E :
-        addq    t1, t2, t1      # E :
-        addq    t0, t1, t0      # E :
-        addq    t0, t4, t0      # add one if we filled the buffer
-        subq    t0, v0, v0      # find string length
-        ret                     # L0 :
-        .align 4
-$zerolength:
-        nop
-        nop
-        nop
-        clr     v0
-$exception:
-        nop
-        nop
-        nop
-        ret
-        .end __strncpy_from_user
diff --git a/arch/alpha/lib/ev67-strlen_user.S b/arch/alpha/lib/ev67-strlen_user.S
deleted file mode 100644
index 57e0d77b81a6..000000000000
--- a/arch/alpha/lib/ev67-strlen_user.S
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * arch/alpha/lib/ev67-strlen_user.S
- * 21264 version contributed by Rick Gorton <rick.gorton@api-networks.com>
- *
- * Return the length of the string including the NULL terminator
- * (strlen+1) or zero if an error occurred.
- *
- * In places where it is critical to limit the processing time,
- * and the data is not trusted, strnlen_user() should be used.
- * It will return a value greater than its second argument if
- * that limit would be exceeded. This implementation is allowed
- * to access memory beyond the limit, but will not cross a page
- * boundary when doing so.
- *
- * Much of the information about 21264 scheduling/coding comes from:
- *      Compiler Writer's Guide for the Alpha 21264
- *      abbreviated as 'CWG' in other comments here
- *      ftp.digital.com/pub/Digital/info/semiconductor/literature/dsc-library.html
- * Scheduling notation:
- *      E       - either cluster
- *      U       - upper subcluster; U0 - subcluster U0; U1 - subcluster U1
- *      L       - lower subcluster; L0 - subcluster L0; L1 - subcluster L1
- * Try not to change the actual algorithm if possible for consistency.
- */
-#include <asm/regdef.h>
-/* Allow an exception for an insn; exit if we get one.  */
-#define EX(x,y...)                      \
-        99: x,##y;                      \
-        .section __ex_table,"a";        \
-        .long 99b - .;                  \
-        lda v0, $exception-99b(zero);   \
-        .previous
-        .set noreorder
-        .set noat
-        .text
-        .globl __strlen_user
-        .ent __strlen_user
-        .frame sp, 0, ra
-        .align 4
-__strlen_user:
-        ldah    a1, 32767(zero) # do not use plain strlen_user() for strings
-                                # that might be almost 2 GB long; you should
-                                # be using strnlen_user() instead
-        nop
-        nop
-        nop
-        .globl __strnlen_user
-        .align 4
-__strnlen_user:
-        .prologue 0
-        EX( ldq_u t0, 0(a0) )   # L : load first quadword (a0 may be misaligned)
-        lda     t1, -1(zero)    # E :
-        insqh   t1, a0, t1      # U :
-        andnot  a0, 7, v0       # E :
-        or      t1, t0, t0      # E :
-        subq    a0, 1, a0       # E : get our +1 for the return 
-        cmpbge  zero, t0, t1    # E : t1 <- bitmask: bit i == 1 <==> i-th byte == 0
-        subq    a1, 7, t2       # E :
-        subq    a0, v0, t0      # E :
-        bne     t1, $found      # U :
-        addq    t2, t0, t2      # E :
-        addq    a1, 1, a1       # E :
-        nop                     # E :
-        nop                     # E :
-        .align 4
-$loop:  ble     t2, $limit      # U :
-        EX( ldq t0, 8(v0) )     # L :
-        nop                     # E :
-        nop                     # E :
-        cmpbge  zero, t0, t1    # E :
-        subq    t2, 8, t2       # E :
-        addq    v0, 8, v0       # E : addr += 8
-        beq     t1, $loop       # U :
-$found: cttz    t1, t2          # U0 :
-        addq    v0, t2, v0      # E :
-        subq    v0, a0, v0      # E :
-        ret                     # L0 :
-$exception:
-        nop
-        nop
-        nop
-        ret
-        .align 4                # currently redundant
-$limit:
-        nop
-        nop
-        subq    a1, t2, v0
-        ret
-        .end __strlen_user
diff --git a/arch/alpha/lib/strlen_user.S b/arch/alpha/lib/strlen_user.S
deleted file mode 100644
index 508a18e96479..000000000000
--- a/arch/alpha/lib/strlen_user.S
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * arch/alpha/lib/strlen_user.S
- *
- * Return the length of the string including the NUL terminator
- * (strlen+1) or zero if an error occurred.
- *
- * In places where it is critical to limit the processing time,
- * and the data is not trusted, strnlen_user() should be used.
- * It will return a value greater than its second argument if
- * that limit would be exceeded. This implementation is allowed
- * to access memory beyond the limit, but will not cross a page
- * boundary when doing so.
- */
-#include <asm/regdef.h>
-/* Allow an exception for an insn; exit if we get one.  */
-#define EX(x,y...)                      \
-        99: x,##y;                      \
-        .section __ex_table,"a";        \
-        .long 99b - .;                  \
-        lda v0, $exception-99b(zero);   \
-        .previous
-        .set noreorder
-        .set noat
-        .text
-        .globl __strlen_user
-        .ent __strlen_user
-        .frame sp, 0, ra
-        .align 3
-__strlen_user:
-        ldah    a1, 32767(zero) # do not use plain strlen_user() for strings
-                                # that might be almost 2 GB long; you should
-                                # be using strnlen_user() instead
-        .globl __strnlen_user
-        .align 3
-__strnlen_user:
-        .prologue 0
-        EX( ldq_u t0, 0(a0) )   # load first quadword (a0 may be misaligned)
-        lda     t1, -1(zero)
-        insqh   t1, a0, t1
-        andnot  a0, 7, v0
-        or      t1, t0, t0
-        subq    a0, 1, a0       # get our +1 for the return 
-        cmpbge  zero, t0, t1    # t1 <- bitmask: bit i == 1 <==> i-th byte == 0
-        subq    a1, 7, t2
-        subq    a0, v0, t0
-        bne     t1, $found
-        addq    t2, t0, t2
-        addq    a1, 1, a1
-        .align 3
-$loop:  ble     t2, $limit
-        EX( ldq t0, 8(v0) )
-        subq    t2, 8, t2
-        addq    v0, 8, v0       # addr += 8
-        cmpbge  zero, t0, t1
-        beq     t1, $loop
-$found: negq    t1, t2          # clear all but least set bit
-        and     t1, t2, t1
-        and     t1, 0xf0, t2    # binary search for that set bit
-        and     t1, 0xcc, t3
-        and     t1, 0xaa, t4
-        cmovne  t2, 4, t2
-        cmovne  t3, 2, t3
-        cmovne  t4, 1, t4
-        addq    t2, t3, t2
-        addq    v0, t4, v0
-        addq    v0, t2, v0
-        nop                     # dual issue next two on ev4 and ev5
-        subq    v0, a0, v0
-$exception:
-        ret
-        .align 3                # currently redundant
-$limit:
-        subq    a1, t2, v0
-        ret
-        .end __strlen_user
diff --git a/arch/alpha/lib/strncpy_from_user.S b/arch/alpha/lib/strncpy_from_user.S
deleted file mode 100644
index 73ee21160ff7..000000000000
--- a/arch/alpha/lib/strncpy_from_user.S
+++ /dev/null
@@ -1,339 +0,0 @@
-/*
- * arch/alpha/lib/strncpy_from_user.S
- * Contributed by Richard Henderson (rth@tamu.edu)
- *
- * Just like strncpy except in the return value:
- *
- * -EFAULT       if an exception occurs before the terminator is copied.
- * N             if the buffer filled.
- *
- * Otherwise the length of the string is returned.
- */
-#include <asm/errno.h>
-#include <asm/regdef.h>
-/* Allow an exception for an insn; exit if we get one.  */
-#define EX(x,y...)                      \
-        99: x,##y;                      \
-        .section __ex_table,"a";        \
-        .long 99b - .;                  \
-        lda $31, $exception-99b($0);    \
-        .previous
-        .set noat
-        .set noreorder
-        .text
-        .globl __strncpy_from_user
-        .ent __strncpy_from_user
-        .frame $30, 0, $26
-        .prologue 0
-        .align 3
-$aligned:
-        /* On entry to this basic block:
-           t0 == the first destination word for masking back in
-           t1 == the first source word.  */
-        /* Create the 1st output word and detect 0's in the 1st input word.  */
-        lda     t2, -1          # e1    : build a mask against false zero
-        mskqh   t2, a1, t2      # e0    :   detection in the src word
-        mskqh   t1, a1, t3      # e0    :
-        ornot   t1, t2, t2      # .. e1 :
-        mskql   t0, a1, t0      # e0    : assemble the first output word
-        cmpbge  zero, t2, t8    # .. e1 : bits set iff null found
-        or      t0, t3, t0      # e0    :
-        beq     a2, $a_eoc      # .. e1 :
-        bne     t8, $a_eos      # .. e1 :
-        /* On entry to this basic block:
-           t0 == a source word not containing a null.  */
-$a_loop:
-        stq_u   t0, 0(a0)       # e0    :
-        addq    a0, 8, a0       # .. e1 :
-        EX( ldq_u t0, 0(a1) )   # e0    :
-        addq    a1, 8, a1       # .. e1 :
-        subq    a2, 1, a2       # e0    :
-        cmpbge  zero, t0, t8    # .. e1 (stall)
-        beq     a2, $a_eoc      # e1    :
-        beq     t8, $a_loop     # e1    :
-        /* Take care of the final (partial) word store.  At this point
-           the end-of-count bit is set in t8 iff it applies.
-           On entry to this basic block we have:
-           t0 == the source word containing the null
-           t8 == the cmpbge mask that found it.  */
-$a_eos:
-        negq    t8, t12         # e0    : find low bit set
-        and     t8, t12, t12    # e1 (stall)
-        /* For the sake of the cache, don't read a destination word
-           if we're not going to need it.  */
-        and     t12, 0x80, t6   # e0    :
-        bne     t6, 1f          # .. e1 (zdb)
-        /* We're doing a partial word store and so need to combine
-           our source and original destination words.  */
-        ldq_u   t1, 0(a0)       # e0    :
-        subq    t12, 1, t6      # .. e1 :
-        or      t12, t6, t8     # e0    :
-        unop                    #
-        zapnot  t0, t8, t0      # e0    : clear src bytes > null
-        zap     t1, t8, t1      # .. e1 : clear dst bytes <= null
-        or      t0, t1, t0      # e1    :
-1:      stq_u   t0, 0(a0)
-        br      $finish_up
-        /* Add the end-of-count bit to the eos detection bitmask.  */
-$a_eoc:
-        or      t10, t8, t8
-        br      $a_eos
-        /*** The Function Entry Point ***/
-        .align 3
-__strncpy_from_user:
-        mov     a0, v0          # save the string start
-        beq     a2, $zerolength
-        /* Are source and destination co-aligned?  */
-        xor     a0, a1, t1      # e0    :
-        and     a0, 7, t0       # .. e1 : find dest misalignment
-        and     t1, 7, t1       # e0    :
-        addq    a2, t0, a2      # .. e1 : bias count by dest misalignment
-        subq    a2, 1, a2       # e0    :
-        and     a2, 7, t2       # e1    :
-        srl     a2, 3, a2       # e0    : a2 = loop counter = (count - 1)/8
-        addq    zero, 1, t10    # .. e1 :
-        sll     t10, t2, t10    # e0    : t10 = bitmask of last count byte
-        bne     t1, $unaligned  # .. e1 :
-        /* We are co-aligned; take care of a partial first word.  */
-        EX( ldq_u t1, 0(a1) )   # e0    : load first src word
-        addq    a1, 8, a1       # .. e1 :
-        beq     t0, $aligned    # avoid loading dest word if not needed
-        ldq_u   t0, 0(a0)       # e0    :
-        br      $aligned        # .. e1 :
-/* The source and destination are not co-aligned.  Align the destination
-   and cope.  We have to be very careful about not reading too much and
-   causing a SEGV.  */
-        .align 3
-$u_head:
-        /* We know just enough now to be able to assemble the first
-           full source word.  We can still find a zero at the end of it
-           that prevents us from outputting the whole thing.
-           On entry to this basic block:
-           t0 == the first dest word, unmasked
-           t1 == the shifted low bits of the first source word
-           t6 == bytemask that is -1 in dest word bytes */
-        EX( ldq_u t2, 8(a1) )   # e0    : load second src word
-        addq    a1, 8, a1       # .. e1 :
-        mskql   t0, a0, t0      # e0    : mask trailing garbage in dst
-        extqh   t2, a1, t4      # e0    :
-        or      t1, t4, t1      # e1    : first aligned src word complete
-        mskqh   t1, a0, t1      # e0    : mask leading garbage in src
-        or      t0, t1, t0      # e0    : first output word complete
-        or      t0, t6, t6      # e1    : mask original data for zero test
-        cmpbge  zero, t6, t8    # e0    :
-        beq     a2, $u_eocfin   # .. e1 :
-        bne     t8, $u_final    # e1    :
-        lda     t6, -1                  # e1    : mask out the bits we have
-        mskql   t6, a1, t6              # e0    :   already seen
-        stq_u   t0, 0(a0)               # e0    : store first output word
-        or      t6, t2, t2              # .. e1 :
-        cmpbge  zero, t2, t8            # e0    : find nulls in second partial
-        addq    a0, 8, a0               # .. e1 :
-        subq    a2, 1, a2               # e0    :
-        bne     t8, $u_late_head_exit   # .. e1 :
-        /* Finally, we've got all the stupid leading edge cases taken care
-           of and we can set up to enter the main loop.  */
-        extql   t2, a1, t1      # e0    : position hi-bits of lo word
-        EX( ldq_u t2, 8(a1) )   # .. e1 : read next high-order source word
-        addq    a1, 8, a1       # e0    :
-        cmpbge  zero, t2, t8    # e1 (stall)
-        beq     a2, $u_eoc      # e1    :
-        bne     t8, $u_eos      # e1    :
-        /* Unaligned copy main loop.  In order to avoid reading too much,
-           the loop is structured to detect zeros in aligned source words.
-           This has, unfortunately, effectively pulled half of a loop
-           iteration out into the head and half into the tail, but it does
-           prevent nastiness from accumulating in the very thing we want
-           to run as fast as possible.
-           On entry to this basic block:
-           t1 == the shifted high-order bits from the previous source word
-           t2 == the unshifted current source word
-           We further know that t2 does not contain a null terminator.  */
-        .align 3
-$u_loop:
-        extqh   t2, a1, t0      # e0    : extract high bits for current word
-        addq    a1, 8, a1       # .. e1 :
-        extql   t2, a1, t3      # e0    : extract low bits for next time
-        addq    a0, 8, a0       # .. e1 :
-        or      t0, t1, t0      # e0    : current dst word now complete
-        EX( ldq_u t2, 0(a1) )   # .. e1 : load high word for next time
-        stq_u   t0, -8(a0)      # e0    : save the current word
-        mov     t3, t1          # .. e1 :
-        subq    a2, 1, a2       # e0    :
-        cmpbge  zero, t2, t8    # .. e1 : test new word for eos
-        beq     a2, $u_eoc      # e1    :
-        beq     t8, $u_loop     # e1    :
-        /* We've found a zero somewhere in the source word we just read.
-           If it resides in the lower half, we have one (probably partial)
-           word to write out, and if it resides in the upper half, we
-           have one full and one partial word left to write out.
-           On entry to this basic block:
-           t1 == the shifted high-order bits from the previous source word
-           t2 == the unshifted current source word.  */
-$u_eos:
-        extqh   t2, a1, t0      # e0    :
-        or      t0, t1, t0      # e1    : first (partial) source word complete
-        cmpbge  zero, t0, t8    # e0    : is the null in this first bit?
-        bne     t8, $u_final    # .. e1 (zdb)
-        stq_u   t0, 0(a0)       # e0    : the null was in the high-order bits
-        addq    a0, 8, a0       # .. e1 :
-        subq    a2, 1, a2       # e1    :
-$u_late_head_exit:
-        extql   t2, a1, t0      # .. e0 :
-        cmpbge  zero, t0, t8    # e0    :
-        or      t8, t10, t6     # e1    :
-        cmoveq  a2, t6, t8      # e0    :
-        nop                     # .. e1 :
-        /* Take care of a final (probably partial) result word.
-           On entry to this basic block:
-           t0 == assembled source word
-           t8 == cmpbge mask that found the null.  */
-$u_final:
-        negq    t8, t6          # e0    : isolate low bit set
-        and     t6, t8, t12     # e1    :
-        and     t12, 0x80, t6   # e0    : avoid dest word load if we can
-        bne     t6, 1f          # .. e1 (zdb)
-        ldq_u   t1, 0(a0)       # e0    :
-        subq    t12, 1, t6      # .. e1 :
-        or      t6, t12, t8     # e0    :
-        zapnot  t0, t8, t0      # .. e1 : kill source bytes > null
-        zap     t1, t8, t1      # e0    : kill dest bytes <= null
-        or      t0, t1, t0      # e1    :
-1:      stq_u   t0, 0(a0)       # e0    :
-        br      $finish_up
-$u_eoc:                         # end-of-count
-        extqh   t2, a1, t0
-        or      t0, t1, t0
-        cmpbge  zero, t0, t8
-$u_eocfin:                      # end-of-count, final word
-        or      t10, t8, t8
-        br      $u_final
-        /* Unaligned copy entry point.  */
-        .align 3
-$unaligned:
-        EX( ldq_u t1, 0(a1) )   # e0    : load first source word
-        and     a0, 7, t4       # .. e1 : find dest misalignment
-        and     a1, 7, t5       # e0    : find src misalignment
-        /* Conditionally load the first destination word and a bytemask
-           with 0xff indicating that the destination byte is sacrosanct.  */
-        mov     zero, t0        # .. e1 :
-        mov     zero, t6        # e0    :
-        beq     t4, 1f          # .. e1 :
-        ldq_u   t0, 0(a0)       # e0    :
-        lda     t6, -1          # .. e1 :
-        mskql   t6, a0, t6      # e0    :
-1:
-        subq    a1, t4, a1      # .. e1 : sub dest misalignment from src addr
-        /* If source misalignment is larger than dest misalignment, we need
-           extra startup checks to avoid SEGV.  */
-        cmplt   t4, t5, t12     # e1    :
-        extql   t1, a1, t1      # .. e0 : shift src into place
-        lda     t2, -1          # e0    : for creating masks later
-        beq     t12, $u_head    # e1    :
-        mskqh   t2, t5, t2      # e0    : begin src byte validity mask
-        cmpbge  zero, t1, t8    # .. e1 : is there a zero?
-        extql   t2, a1, t2      # e0    :
-        or      t8, t10, t5     # .. e1 : test for end-of-count too
-        cmpbge  zero, t2, t3    # e0    :
-        cmoveq  a2, t5, t8      # .. e1 :
-        andnot  t8, t3, t8      # e0    :
-        beq     t8, $u_head     # .. e1 (zdb)
-        /* At this point we've found a zero in the first partial word of
-           the source.  We need to isolate the valid source data and mask
-           it into the original destination data.  (Incidentally, we know
-           that we'll need at least one byte of that original dest word.) */
-        ldq_u   t0, 0(a0)       # e0    :
-        negq    t8, t6          # .. e1 : build bitmask of bytes <= zero
-        mskqh   t1, t4, t1      # e0    :
-        and     t6, t8, t12     # .. e1 :
-        subq    t12, 1, t6      # e0    :
-        or      t6, t12, t8     # e1    :
-        zapnot  t2, t8, t2      # e0    : prepare source word; mirror changes
-        zapnot  t1, t8, t1      # .. e1 : to source validity mask
-        andnot  t0, t2, t0      # e0    : zero place for source to reside
-        or      t0, t1, t0      # e1    : and put it there
-        stq_u   t0, 0(a0)       # e0    :
-$finish_up:
-        zapnot  t0, t12, t4     # was last byte written null?
-        cmovne  t4, 1, t4
-        and     t12, 0xf0, t3   # binary search for the address of the
-        and     t12, 0xcc, t2   # last byte written
-        and     t12, 0xaa, t1
-        bic     a0, 7, t0
-        cmovne  t3, 4, t3
-        cmovne  t2, 2, t2
-        cmovne  t1, 1, t1
-        addq    t0, t3, t0
-        addq    t1, t2, t1
-        addq    t0, t1, t0
-        addq    t0, t4, t0      # add one if we filled the buffer
-        subq    t0, v0, v0      # find string length
-        ret
-$zerolength:
-        clr     v0
-$exception:
-        ret
-        .end __strncpy_from_user
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index 5eecab1a84ef..0c4132dd3507 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -89,6 +89,8 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
        const struct exception_table_entry *fixup;
        int fault, si_code = SEGV_MAPERR;
        siginfo_t info;
+        unsigned int flags = (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                              (cause > 0 ? FAULT_FLAG_WRITE : 0));
        /* As of EV6, a load into $31/$f31 is a prefetch, and never faults
           (or is suppressed by the PALcode).  Support that for older CPUs
@@ -114,6 +116,7 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
                goto vmalloc_fault;
 #endif
+retry:
        down_read(&mm->mmap_sem);
        vma = find_vma(mm, address);
        if (!vma)
@@ -144,8 +147,11 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
        /* If for any reason at all we couldn't handle the fault,
           make sure we exit gracefully rather than endlessly redo
           the fault.  */
-        fault = handle_mm_fault(mm, vma, address, cause > 0 ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
-        up_read(&mm->mmap_sem);
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
@@ -153,10 +159,26 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
                        goto do_sigbus;
                BUG();
        }
-        if (fault & VM_FAULT_MAJOR)
-                current->maj_flt++;
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
-        else
+                if (fault & VM_FAULT_MAJOR)
-                current->min_flt++;
+                        current->maj_flt++;
+                else
+                        current->min_flt++;
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+                         /* No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+                        goto retry;
+                }
+        }
+        up_read(&mm->mmap_sem);
        return;
        /* Something tried to access memory that isn't in our memory map.
@@ -186,12 +208,14 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
        /* We ran out of memory, or some other thing happened to us that
           made us unable to handle the page fault gracefully.  */
 out_of_memory:
+        up_read(&mm->mmap_sem);
        if (!user_mode(regs))
                goto no_context;
        pagefault_out_of_memory();
        return;
 do_sigbus:
+        up_read(&mm->mmap_sem);
        /* Send a sigbus, regardless of whether we were in kernel
           or user mode.  */
        info.si_signo = SIGBUS;
diff --git a/arch/alpha/oprofile/common.c b/arch/alpha/oprofile/common.c
index a0a5d27aa215..b8ce18f485d3 100644
--- a/arch/alpha/oprofile/common.c
+++ b/arch/alpha/oprofile/common.c
@@ -12,6 +12,7 @@
 #include <linux/smp.h>
 #include <linux/errno.h>
 #include <asm/ptrace.h>
+#include <asm/special_insns.h>
 #include "op_impl.h"
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index e91c7cdc6fe5..2f88d8d97701 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -6,7 +6,7 @@ config ARM
        select HAVE_DMA_API_DEBUG
        select HAVE_IDE if PCI || ISA || PCMCIA
        select HAVE_DMA_ATTRS
-        select HAVE_DMA_CONTIGUOUS if (CPU_V6 || CPU_V6K || CPU_V7)
+        select HAVE_DMA_CONTIGUOUS if MMU
        select HAVE_MEMBLOCK
        select RTC_LIB
        select SYS_SUPPORTS_APM_EMULATION
@@ -38,7 +38,6 @@ config ARM
        select HARDIRQS_SW_RESEND
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
-        select GENERIC_IRQ_PROBE
        select ARCH_WANT_IPC_PARSE_VERSION
        select HARDIRQS_SW_RESEND
        select CPU_PM if (SUSPEND || CPU_IDLE)
@@ -126,11 +125,6 @@ config TRACE_IRQFLAGS_SUPPORT
        bool
        default y
-config GENERIC_LOCKBREAK
-        bool
-        default y
-        depends on SMP && PREEMPT
 config RWSEM_GENERIC_SPINLOCK
        bool
        default y
@@ -2150,6 +2144,7 @@ source "drivers/cpufreq/Kconfig"
 config CPU_FREQ_IMX
        tristate "CPUfreq driver for i.MX CPUs"
        depends on ARCH_MXC && CPU_FREQ
+        select CPU_FREQ_TABLE
        help
          This enables the CPUfreq driver for i.MX CPUs.
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index f15f82bf3a50..e968a52e4881 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -356,15 +356,15 @@ choice
                  is nothing connected to read from the DCC.
        config DEBUG_SEMIHOSTING
-                bool "Kernel low-level debug output via semihosting I"
+                bool "Kernel low-level debug output via semihosting I/O"
                help
                  Semihosting enables code running on an ARM target to use
                  the I/O facilities on a host debugger/emulator through a
-                  simple SVC calls. The host debugger or emulator must have
+                  simple SVC call. The host debugger or emulator must have
                  semihosting enabled for the special svc call to be trapped
                  otherwise the kernel will crash.
-                  This is known to work with OpenOCD, as wellas
+                  This is known to work with OpenOCD, as well as
                  ARM's Fast Models, or any other controlling environment
                  that implements semihosting.
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 30eae87ead6d..a051dfbdd7db 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -284,10 +284,10 @@ zImage Image xipImage bootpImage uImage: vmlinux
 zinstall uinstall install: vmlinux
        $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
-%.dtb:
+%.dtb: scripts
        $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
-dtbs:
+dtbs: scripts
        $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 # We use MRPROPER_FILES and CLEAN_FILES now
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index b8c64b80bafc..81769c1341fa 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -659,10 +659,14 @@ __armv7_mmu_cache_on:
 #ifdef CONFIG_CPU_ENDIAN_BE8
                orr     r0, r0, #1 << 25        @ big-endian page tables
 #endif
+                mrcne   p15, 0, r6, c2, c0, 2   @ read ttb control reg
                orrne   r0, r0, #1              @ MMU enabled
                movne   r1, #0xfffffffd         @ domain 0 = client
+                bic     r6, r6, #1 << 31        @ 32-bit translation system
+                bic     r6, r6, #3 << 0         @ use only ttbr0
                mcrne   p15, 0, r3, c2, c0, 0   @ load page table pointer
                mcrne   p15, 0, r1, c3, c0, 0   @ load domain access control
+                mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
 #endif
                mcr     p15, 0, r0, c7, c5, 4   @ ISB
                mcr     p15, 0, r0, c1, c0, 0   @ load control register
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index 59509c48d7e5..bd0cff3f808c 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -154,5 +154,10 @@
                        #size-cells = <0>;
                        ti,hwmods = "i2c3";
                };
+                wdt2: wdt@44e35000 {
+                        compatible = "ti,omap3-wdt";
+                        ti,hwmods = "wd_timer2";
+                };
        };
 };
diff --git a/arch/arm/boot/dts/at91sam9g25ek.dts b/arch/arm/boot/dts/at91sam9g25ek.dts
index 7829a4d0cb22..96514c134e54 100644
--- a/arch/arm/boot/dts/at91sam9g25ek.dts
+++ b/arch/arm/boot/dts/at91sam9g25ek.dts
@@ -15,7 +15,7 @@
        compatible = "atmel,at91sam9g25ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
        chosen {
-                bootargs = "128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
+                bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
        };
        ahb {
diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
index cd86177a3ea2..59d9789e5508 100644
--- a/arch/arm/boot/dts/imx51-babbage.dts
+++ b/arch/arm/boot/dts/imx51-babbage.dts
@@ -25,8 +25,8 @@
                aips@70000000 { /* aips-1 */
                        spba@70000000 {
                                esdhc@70004000 { /* ESDHC1 */
-                                        fsl,cd-internal;
+                                        fsl,cd-controller;
-                                        fsl,wp-internal;
+                                        fsl,wp-controller;
                                        status = "okay";
                                };
diff --git a/arch/arm/boot/dts/kirkwood-iconnect.dts b/arch/arm/boot/dts/kirkwood-iconnect.dts
index 52d947045106..f8ca6fa88192 100644
--- a/arch/arm/boot/dts/kirkwood-iconnect.dts
+++ b/arch/arm/boot/dts/kirkwood-iconnect.dts
@@ -41,9 +41,13 @@
                };
                power-blue {
                        label = "power:blue";
-                        gpios = <&gpio1 11 0>;
+                        gpios = <&gpio1 10 0>;
                        linux,default-trigger = "timer";
                };
+                power-red {
+                        label = "power:red";
+                        gpios = <&gpio1 11 0>;
+                };
                usb1 {
                        label = "usb1:blue";
                        gpios = <&gpio1 12 0>;
diff --git a/arch/arm/boot/dts/twl6030.dtsi b/arch/arm/boot/dts/twl6030.dtsi
index 3b2f3510d7eb..d351b27d7213 100644
--- a/arch/arm/boot/dts/twl6030.dtsi
+++ b/arch/arm/boot/dts/twl6030.dtsi
@@ -66,6 +66,7 @@
        vcxio: regulator@8 {
                compatible = "ti,twl6030-vcxio";
+                regulator-always-on;
        };
        vusb: regulator@9 {
@@ -74,10 +75,12 @@
        v1v8: regulator@10 {
                compatible = "ti,twl6030-v1v8";
+                regulator-always-on;
        };
        v2v1: regulator@11 {
                compatible = "ti,twl6030-v2v1";
+                regulator-always-on;
        };
        clk32kg: regulator@12 {
diff --git a/arch/arm/configs/armadillo800eva_defconfig b/arch/arm/configs/armadillo800eva_defconfig
index 7d8718468e0d..90610c7030f7 100644
--- a/arch/arm/configs/armadillo800eva_defconfig
+++ b/arch/arm/configs/armadillo800eva_defconfig
@@ -33,7 +33,7 @@ CONFIG_AEABI=y
 CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=tty0 console=ttySC1,115200 earlyprintk=sh-sci.1,115200 ignore_loglevel root=/dev/nfs ip=dhcp nfsroot=,rsize=4096,wsize=4096"
+CONFIG_CMDLINE="console=tty0 console=ttySC1,115200 earlyprintk=sh-sci.1,115200 ignore_loglevel root=/dev/nfs ip=dhcp nfsroot=,rsize=4096,wsize=4096 rw"
 CONFIG_CMDLINE_FORCE=y
 CONFIG_KEXEC=y
 CONFIG_VFP=y
diff --git a/arch/arm/configs/u8500_defconfig b/arch/arm/configs/u8500_defconfig
index 2d4f661d1cf6..da6845493caa 100644
--- a/arch/arm/configs/u8500_defconfig
+++ b/arch/arm/configs/u8500_defconfig
@@ -86,6 +86,7 @@ CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_LM3530=y
 CONFIG_LEDS_LP5521=y
+CONFIG_LEDS_GPIO=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_AB8500=y
 CONFIG_RTC_DRV_PL031=y
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 03fb93621d0d..5c8b3bf4d825 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -320,4 +320,12 @@
        .size \name , . - \name
        .endm
+        .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+#ifndef CONFIG_CPU_USE_DOMAINS
+        adds    \tmp, \addr, #\size - 1
+        sbcccs  \tmp, \tmp, \limit
+        bcs     \bad
+#endif
+        .endm
 #endif /* __ASM_ASSEMBLER_H__ */
diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
index 2ae842df4551..5c44dcb0987b 100644
--- a/arch/arm/include/asm/dma-mapping.h
+++ b/arch/arm/include/asm/dma-mapping.h
@@ -203,6 +203,13 @@ static inline void dma_free_writecombine(struct device *dev, size_t size,
 }
 /*
+ * This can be called during early boot to increase the size of the atomic
+ * coherent DMA pool above the default value of 256KiB. It must be called
+ * before postcore_initcall.
+ */
+extern void __init init_dma_coherent_pool_size(unsigned long size);
+/*
 * This can be called during boot to increase the size of the consistent
 * DMA region above it's default value of 2MB. It must be called before the
 * memory allocator is initialised, i.e. before any core_initcall.
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index e965f1b560f1..5f6ddcc56452 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -187,6 +187,7 @@ static inline unsigned long __phys_to_virt(unsigned long x)
 #define __phys_to_virt(x)       ((x) - PHYS_OFFSET + PAGE_OFFSET)
 #endif
 #endif
+#endif /* __ASSEMBLY__ */
 #ifndef PHYS_OFFSET
 #ifdef PLAT_PHYS_OFFSET
@@ -196,6 +197,8 @@ static inline unsigned long __phys_to_virt(unsigned long x)
 #endif
 #endif
+#ifndef __ASSEMBLY__
 /*
 * PFNs are used to describe any physical page; this means
 * PFN 0 == physical address 0.
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index f66626d71e7d..41dc31f834c3 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -195,6 +195,18 @@ static inline pte_t *pmd_page_vaddr(pmd_t pmd)
 #define pte_clear(mm,addr,ptep) set_pte_ext(ptep, __pte(0), 0)
+#define pte_none(pte)           (!pte_val(pte))
+#define pte_present(pte)        (pte_val(pte) & L_PTE_PRESENT)
+#define pte_write(pte)          (!(pte_val(pte) & L_PTE_RDONLY))
+#define pte_dirty(pte)          (pte_val(pte) & L_PTE_DIRTY)
+#define pte_young(pte)          (pte_val(pte) & L_PTE_YOUNG)
+#define pte_exec(pte)           (!(pte_val(pte) & L_PTE_XN))
+#define pte_special(pte)        (0)
+#define pte_present_user(pte) \
+        ((pte_val(pte) & (L_PTE_PRESENT | L_PTE_USER)) == \
+         (L_PTE_PRESENT | L_PTE_USER))
 #if __LINUX_ARM_ARCH__ < 6
 static inline void __sync_icache_dcache(pte_t pteval)
 {
@@ -206,25 +218,15 @@ extern void __sync_icache_dcache(pte_t pteval);
 static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                              pte_t *ptep, pte_t pteval)
 {
-        if (addr >= TASK_SIZE)
+        unsigned long ext = 0;
-                set_pte_ext(ptep, pteval, 0);
-        else {
+        if (addr < TASK_SIZE && pte_present_user(pteval)) {
                __sync_icache_dcache(pteval);
-                set_pte_ext(ptep, pteval, PTE_EXT_NG);
+                ext |= PTE_EXT_NG;
        }
-}
-#define pte_none(pte)           (!pte_val(pte))
+        set_pte_ext(ptep, pteval, ext);
-#define pte_present(pte)        (pte_val(pte) & L_PTE_PRESENT)
+}
-#define pte_write(pte)          (!(pte_val(pte) & L_PTE_RDONLY))
-#define pte_dirty(pte)          (pte_val(pte) & L_PTE_DIRTY)
-#define pte_young(pte)          (pte_val(pte) & L_PTE_YOUNG)
-#define pte_exec(pte)           (!(pte_val(pte) & L_PTE_XN))
-#define pte_special(pte)        (0)
-#define pte_present_user(pte) \
-        ((pte_val(pte) & (L_PTE_PRESENT | L_PTE_USER)) == \
-         (L_PTE_PRESENT | L_PTE_USER))
 #define PTE_BIT_FUNC(fn,op) \
 static inline pte_t pte_##fn(pte_t pte) { pte_val(pte) op; return pte; }
@@ -251,13 +253,13 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 *
 *   3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
 *   1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
- *   <--------------- offset --------------------> <- type --> 0 0 0
+ *   <--------------- offset ----------------------> < type -> 0 0 0
 *
- * This gives us up to 63 swap files and 32GB per swap file.  Note that
+ * This gives us up to 31 swap files and 64GB per swap file.  Note that
 * the offset field is always non-zero.
 */
 #define __SWP_TYPE_SHIFT        3
-#define __SWP_TYPE_BITS         6
+#define __SWP_TYPE_BITS         5
 #define __SWP_TYPE_MASK         ((1 << __SWP_TYPE_BITS) - 1)
 #define __SWP_OFFSET_SHIFT      (__SWP_TYPE_BITS + __SWP_TYPE_SHIFT)
diff --git a/arch/arm/include/asm/sched_clock.h b/arch/arm/include/asm/sched_clock.h
index e3f757263438..05b8e82ec9f5 100644
--- a/arch/arm/include/asm/sched_clock.h
+++ b/arch/arm/include/asm/sched_clock.h
@@ -10,5 +10,7 @@
 extern void sched_clock_postinit(void);
 extern void setup_sched_clock(u32 (*read)(void), int bits, unsigned long rate);
+extern void setup_sched_clock_needs_suspend(u32 (*read)(void), int bits,
+                unsigned long rate);
 #endif
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 314d4664eae7..99a19512ee26 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -199,6 +199,9 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 {
        pgtable_page_dtor(pte);
+#ifdef CONFIG_ARM_LPAE
+        tlb_add_flush(tlb, addr);
+#else
        /*
         * With the classic ARM MMU, a pte page has two corresponding pmd
         * entries, each covering 1MB.
@@ -206,6 +209,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
        addr &= PMD_MASK;
        tlb_add_flush(tlb, addr + SZ_1M - PAGE_SIZE);
        tlb_add_flush(tlb, addr + SZ_1M);
+#endif
        tlb_remove_page(tlb, pte);
 }
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 479a6352e0b5..77bd79f2ffdb 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -101,28 +101,39 @@ extern int __get_user_1(void *);
 extern int __get_user_2(void *);
 extern int __get_user_4(void *);
-#define __get_user_x(__r2,__p,__e,__s,__i...)                           \
+#define __GUP_CLOBBER_1 "lr", "cc"
+#ifdef CONFIG_CPU_USE_DOMAINS
+#define __GUP_CLOBBER_2 "ip", "lr", "cc"
+#else
+#define __GUP_CLOBBER_2 "lr", "cc"
+#endif
+#define __GUP_CLOBBER_4 "lr", "cc"
+#define __get_user_x(__r2,__p,__e,__l,__s)                              \
           __asm__ __volatile__ (                                       \
                __asmeq("%0", "r0") __asmeq("%1", "r2")                 \
+                __asmeq("%3", "r1")                                     \
                "bl     __get_user_" #__s                               \
                : "=&r" (__e), "=r" (__r2)                              \
-                : "0" (__p)                                             \
+                : "0" (__p), "r" (__l)                                  \
-                : __i, "cc")
+                : __GUP_CLOBBER_##__s)
-#define get_user(x,p)                                                   \
+#define __get_user_check(x,p)                                                   \
        ({                                                              \
+                unsigned long __limit = current_thread_info()->addr_limit - 1; \
                register const typeof(*(p)) __user *__p asm("r0") = (p);\
                register unsigned long __r2 asm("r2");                  \
+                register unsigned long __l asm("r1") = __limit;         \
                register int __e asm("r0");                             \
                switch (sizeof(*(__p))) {                               \
                case 1:                                                 \
-                        __get_user_x(__r2, __p, __e, 1, "lr");          \
+                        __get_user_x(__r2, __p, __e, __l, 1);           \
-                        break;                                          \
+                        break;                                          \
                case 2:                                                 \
-                        __get_user_x(__r2, __p, __e, 2, "r3", "lr");    \
+                        __get_user_x(__r2, __p, __e, __l, 2);           \
                        break;                                          \
                case 4:                                                 \
-                        __get_user_x(__r2, __p, __e, 4, "lr");          \
+                        __get_user_x(__r2, __p, __e, __l, 4);           \
                        break;                                          \
                default: __e = __get_user_bad(); break;                 \
                }                                                       \
@@ -130,42 +141,57 @@ extern int __get_user_4(void *);
                __e;                                                    \
        })
+#define get_user(x,p)                                                   \
+        ({                                                              \
+                might_fault();                                          \
+                __get_user_check(x,p);                                  \
+         })
 extern int __put_user_1(void *, unsigned int);
 extern int __put_user_2(void *, unsigned int);
 extern int __put_user_4(void *, unsigned int);
 extern int __put_user_8(void *, unsigned long long);
-#define __put_user_x(__r2,__p,__e,__s)                                  \
+#define __put_user_x(__r2,__p,__e,__l,__s)                              \
           __asm__ __volatile__ (                                       \
                __asmeq("%0", "r0") __asmeq("%2", "r2")                 \
+                __asmeq("%3", "r1")                                     \
                "bl     __put_user_" #__s                               \
                : "=&r" (__e)                                           \
-                : "0" (__p), "r" (__r2)                                 \
+                : "0" (__p), "r" (__r2), "r" (__l)                      \
                : "ip", "lr", "cc")
-#define put_user(x,p)                                                   \
+#define __put_user_check(x,p)                                                   \
        ({                                                              \
+                unsigned long __limit = current_thread_info()->addr_limit - 1; \
                register const typeof(*(p)) __r2 asm("r2") = (x);       \
                register const typeof(*(p)) __user *__p asm("r0") = (p);\
+                register unsigned long __l asm("r1") = __limit;         \
                register int __e asm("r0");                             \
                switch (sizeof(*(__p))) {                               \
                case 1:                                                 \
-                        __put_user_x(__r2, __p, __e, 1);                \
+                        __put_user_x(__r2, __p, __e, __l, 1);           \
                        break;                                          \
                case 2:                                                 \
-                        __put_user_x(__r2, __p, __e, 2);                \
+                        __put_user_x(__r2, __p, __e, __l, 2);           \
                        break;                                          \
                case 4:                                                 \
-                        __put_user_x(__r2, __p, __e, 4);                \
+                        __put_user_x(__r2, __p, __e, __l, 4);           \
                        break;                                          \
                case 8:                                                 \
-                        __put_user_x(__r2, __p, __e, 8);                \
+                        __put_user_x(__r2, __p, __e, __l, 8);           \
                        break;                                          \
                default: __e = __put_user_bad(); break;                 \
                }                                                       \
                __e;                                                    \
        })
+#define put_user(x,p)                                                   \
+        ({                                                              \
+                might_fault();                                          \
+                __put_user_check(x,p);                                  \
+         })
 #else /* CONFIG_MMU */
 /*
@@ -219,6 +245,7 @@ do {									\
        unsigned long __gu_addr = (unsigned long)(ptr);                 \
        unsigned long __gu_val;                                         \
        __chk_user_ptr(ptr);                                            \
+        might_fault();                                                  \
        switch (sizeof(*(ptr))) {                                       \
        case 1: __get_user_asm_byte(__gu_val,__gu_addr,err);    break;  \
        case 2: __get_user_asm_half(__gu_val,__gu_addr,err);    break;  \
@@ -300,6 +327,7 @@ do {									\
        unsigned long __pu_addr = (unsigned long)(ptr);                 \
        __typeof__(*(ptr)) __pu_val = (x);                              \
        __chk_user_ptr(ptr);                                            \
+        might_fault();                                                  \
        switch (sizeof(*(ptr))) {                                       \
        case 1: __put_user_asm_byte(__pu_val,__pu_addr,err);    break;  \
        case 2: __put_user_asm_half(__pu_val,__pu_addr,err);    break;  \
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index ba386bd94107..281bf3301241 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -159,6 +159,12 @@ static int debug_arch_supported(void)
                arch >= ARM_DEBUG_ARCH_V7_1;
 }
+/* Can we determine the watchpoint access type from the fsr? */
+static int debug_exception_updates_fsr(void)
+{
+        return 0;
+}
 /* Determine number of WRP registers available. */
 static int get_num_wrp_resources(void)
 {
@@ -604,13 +610,14 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
                /* Aligned */
                break;
        case 1:
-                /* Allow single byte watchpoint. */
-                if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
-                        break;
        case 2:
                /* Allow halfword watchpoints and breakpoints. */
                if (info->ctrl.len == ARM_BREAKPOINT_LEN_2)
                        break;
+        case 3:
+                /* Allow single byte watchpoint. */
+                if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
+                        break;
        default:
                ret = -EINVAL;
                goto out;
@@ -619,18 +626,35 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
        info->address &= ~alignment_mask;
        info->ctrl.len <<= offset;
-        /*
+        if (!bp->overflow_handler) {
-         * Currently we rely on an overflow handler to take
+                /*
-         * care of single-stepping the breakpoint when it fires.
+                 * Mismatch breakpoints are required for single-stepping
-         * In the case of userspace breakpoints on a core with V7 debug,
+                 * breakpoints.
-         * we can use the mismatch feature as a poor-man's hardware
+                 */
-         * single-step, but this only works for per-task breakpoints.
+                if (!core_has_mismatch_brps())
-         */
+                        return -EINVAL;
-        if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
-            !core_has_mismatch_brps() || !bp->hw.bp_target)) {
+                /* We don't allow mismatch breakpoints in kernel space. */
-                pr_warning("overflow handler required but none found\n");
+                if (arch_check_bp_in_kernelspace(bp))
-                ret = -EINVAL;
+                        return -EPERM;
+                /*
+                 * Per-cpu breakpoints are not supported by our stepping
+                 * mechanism.
+                 */
+                if (!bp->hw.bp_target)
+                        return -EINVAL;
+                /*
+                 * We only support specific access types if the fsr
+                 * reports them.
+                 */
+                if (!debug_exception_updates_fsr() &&
+                    (info->ctrl.type == ARM_BREAKPOINT_LOAD ||
+                     info->ctrl.type == ARM_BREAKPOINT_STORE))
+                        return -EINVAL;
        }
 out:
        return ret;
 }
@@ -706,10 +730,12 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
                                goto unlock;
                        /* Check that the access type matches. */
-                        access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
+                        if (debug_exception_updates_fsr()) {
-                                 HW_BREAKPOINT_R;
+                                access = (fsr & ARM_FSR_ACCESS_MASK) ?
-                        if (!(access & hw_breakpoint_type(wp)))
+                                          HW_BREAKPOINT_W : HW_BREAKPOINT_R;
-                                goto unlock;
+                                if (!(access & hw_breakpoint_type(wp)))
+                                        goto unlock;
+                        }
                        /* We have a winner. */
                        info->trigger = addr;
diff --git a/arch/arm/kernel/sched_clock.c b/arch/arm/kernel/sched_clock.c
index 27d186abbc06..f4515393248d 100644
--- a/arch/arm/kernel/sched_clock.c
+++ b/arch/arm/kernel/sched_clock.c
@@ -21,6 +21,8 @@ struct clock_data {
        u32 epoch_cyc_copy;
        u32 mult;
        u32 shift;
+        bool suspended;
+        bool needs_suspend;
 };
 static void sched_clock_poll(unsigned long wrap_ticks);
@@ -49,6 +51,9 @@ static unsigned long long cyc_to_sched_clock(u32 cyc, u32 mask)
        u64 epoch_ns;
        u32 epoch_cyc;
+        if (cd.suspended)
+                return cd.epoch_ns;
        /*
         * Load the epoch_cyc and epoch_ns atomically.  We do this by
         * ensuring that we always write epoch_cyc, epoch_ns and
@@ -98,6 +103,13 @@ static void sched_clock_poll(unsigned long wrap_ticks)
        update_sched_clock();
 }
+void __init setup_sched_clock_needs_suspend(u32 (*read)(void), int bits,
+                unsigned long rate)
+{
+        setup_sched_clock(read, bits, rate);
+        cd.needs_suspend = true;
+}
 void __init setup_sched_clock(u32 (*read)(void), int bits, unsigned long rate)
 {
        unsigned long r, w;
@@ -169,11 +181,23 @@ void __init sched_clock_postinit(void)
 static int sched_clock_suspend(void)
 {
        sched_clock_poll(sched_clock_timer.data);
+        if (cd.needs_suspend)
+                cd.suspended = true;
        return 0;
 }
+static void sched_clock_resume(void)
+{
+        if (cd.needs_suspend) {
+                cd.epoch_cyc = read_sched_clock();
+                cd.epoch_cyc_copy = cd.epoch_cyc;
+                cd.suspended = false;
+        }
+}
 static struct syscore_ops sched_clock_ops = {
        .suspend = sched_clock_suspend,
+        .resume = sched_clock_resume,
 };
 static int __init sched_clock_syscore_init(void)
diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index 198b08456e90..26c12c6440fc 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -321,7 +321,7 @@ void store_cpu_topology(unsigned int cpuid)
 * init_cpu_topology is called at boot when only one cpu is running
 * which prevent simultaneous write access to cpu_topology array
 */
-void init_cpu_topology(void)
+void __init init_cpu_topology(void)
 {
        unsigned int cpu;
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index f7945218b8c6..b0179b89a04c 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -420,20 +420,23 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
 #endif
                        instr = *(u32 *) pc;
        } else if (thumb_mode(regs)) {
-                get_user(instr, (u16 __user *)pc);
+                if (get_user(instr, (u16 __user *)pc))
+                        goto die_sig;
                if (is_wide_instruction(instr)) {
                        unsigned int instr2;
-                        get_user(instr2, (u16 __user *)pc+1);
+                        if (get_user(instr2, (u16 __user *)pc+1))
+                                goto die_sig;
                        instr <<= 16;
                        instr |= instr2;
                }
-        } else {
+        } else if (get_user(instr, (u32 __user *)pc)) {
-                get_user(instr, (u32 __user *)pc);
+                goto die_sig;
        }
        if (call_undef_hook(regs, instr) == 0)
                return;
+die_sig:
 #ifdef CONFIG_DEBUG_USER
        if (user_debug & UDBG_UNDEFINED) {
                printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index 2473fd1fd51c..af72969820b4 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -16,13 +16,30 @@ lib-y		:= backtrace.o changebit.o csumipv6.o csumpartial.o   \
                   call_with_stack.o
 mmu-y   := clear_user.o copy_page.o getuser.o putuser.o
-mmu-y   += copy_from_user.o copy_to_user.o
+# the code in uaccess.S is not preemption safe and
+# probably faster on ARMv3 only
+ifeq ($(CONFIG_PREEMPT),y)
+  mmu-y += copy_from_user.o copy_to_user.o
+else
+ifneq ($(CONFIG_CPU_32v3),y)
+  mmu-y += copy_from_user.o copy_to_user.o
+else
+  mmu-y += uaccess.o
+endif
+endif
 # using lib_ here won't override already available weak symbols
 obj-$(CONFIG_UACCESS_WITH_MEMCPY) += uaccess_with_memcpy.o
-lib-$(CONFIG_MMU)               += $(mmu-y)
+lib-$(CONFIG_MMU) += $(mmu-y)
-lib-y                           += io-readsw-armv4.o io-writesw-armv4.o
+ifeq ($(CONFIG_CPU_32v3),y)
+  lib-y += io-readsw-armv3.o io-writesw-armv3.o
+else
+  lib-y += io-readsw-armv4.o io-writesw-armv4.o
+endif
 lib-$(CONFIG_ARCH_RPC)          += ecard.o io-acorn.o floppydma.o
 lib-$(CONFIG_ARCH_SHARK)        += io-shark.o
diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
index d6dacc69254e..395d5fbb8fa2 100644
--- a/arch/arm/lib/delay.c
+++ b/arch/arm/lib/delay.c
@@ -59,6 +59,7 @@ void __init init_current_timer_delay(unsigned long freq)
 {
        pr_info("Switching to timer-based delay loop\n");
        lpj_fine                        = freq / HZ;
+        loops_per_jiffy                 = lpj_fine;
        arm_delay_ops.delay             = __timer_delay;
        arm_delay_ops.const_udelay      = __timer_const_udelay;
        arm_delay_ops.udelay            = __timer_udelay;
diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 11093a7c3e32..9b06bb41fca6 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -16,8 +16,9 @@
 * __get_user_X
 *
 * Inputs:      r0 contains the address
+ *              r1 contains the address limit, which must be preserved
 * Outputs:     r0 is the error code
- *              r2, r3 contains the zero-extended value
+ *              r2 contains the zero-extended value
 *              lr corrupted
 *
 * No other registers must be altered.  (see <asm/uaccess.h>
@@ -27,33 +28,39 @@
 * Note also that it is intended that __get_user_bad is not global.
 */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 ENTRY(__get_user_1)
+        check_uaccess r0, 1, r1, r2, __get_user_bad
 1: TUSER(ldrb)  r2, [r0]
        mov     r0, #0
        mov     pc, lr
 ENDPROC(__get_user_1)
 ENTRY(__get_user_2)
-#ifdef CONFIG_THUMB2_KERNEL
+        check_uaccess r0, 2, r1, r2, __get_user_bad
-2: TUSER(ldrb)  r2, [r0]
+#ifdef CONFIG_CPU_USE_DOMAINS
-3: TUSER(ldrb)  r3, [r0, #1]
+rb      .req    ip
+2:      ldrbt   r2, [r0], #1
+3:      ldrbt   rb, [r0], #0
 #else
-2: TUSER(ldrb)  r2, [r0], #1
+rb      .req    r0
-3: TUSER(ldrb)  r3, [r0]
+2:      ldrb    r2, [r0]
+3:      ldrb    rb, [r0, #1]
 #endif
 #ifndef __ARMEB__
-        orr     r2, r2, r3, lsl #8
+        orr     r2, r2, rb, lsl #8
 #else
-        orr     r2, r3, r2, lsl #8
+        orr     r2, rb, r2, lsl #8
 #endif
        mov     r0, #0
        mov     pc, lr
 ENDPROC(__get_user_2)
 ENTRY(__get_user_4)
+        check_uaccess r0, 4, r1, r2, __get_user_bad
 4: TUSER(ldr)   r2, [r0]
        mov     r0, #0
        mov     pc, lr
diff --git a/arch/arm/lib/io-readsw-armv3.S b/arch/arm/lib/io-readsw-armv3.S
new file mode 100644
index 000000000000..88487c8c4f23
--- /dev/null
+++ b/arch/arm/lib/io-readsw-armv3.S
@@ -0,0 +1,106 @@
+/*
+ *  linux/arch/arm/lib/io-readsw-armv3.S
+ *
+ *  Copyright (C) 1995-2000 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+.Linsw_bad_alignment:
+                adr     r0, .Linsw_bad_align_msg
+                mov     r2, lr
+                b       panic
+.Linsw_bad_align_msg:
+                .asciz  "insw: bad buffer alignment (0x%p, lr=0x%08lX)\n"
+                .align
+.Linsw_align:   tst     r1, #1
+                bne     .Linsw_bad_alignment
+                ldr     r3, [r0]
+                strb    r3, [r1], #1
+                mov     r3, r3, lsr #8
+                strb    r3, [r1], #1
+                subs    r2, r2, #1
+                moveq   pc, lr
+ENTRY(__raw_readsw)
+                teq     r2, #0          @ do we have to check for the zero len?
+                moveq   pc, lr
+                tst     r1, #3
+                bne     .Linsw_align
+.Linsw_aligned: mov     ip, #0xff
+                orr     ip, ip, ip, lsl #8
+                stmfd   sp!, {r4, r5, r6, lr}
+                subs    r2, r2, #8
+                bmi     .Lno_insw_8
+.Linsw_8_lp:    ldr     r3, [r0]
+                and     r3, r3, ip
+                ldr     r4, [r0]
+                orr     r3, r3, r4, lsl #16
+                ldr     r4, [r0]
+                and     r4, r4, ip
+                ldr     r5, [r0]
+                orr     r4, r4, r5, lsl #16
+                ldr     r5, [r0]
+                and     r5, r5, ip
+                ldr     r6, [r0]
+                orr     r5, r5, r6, lsl #16
+                ldr     r6, [r0]
+                and     r6, r6, ip
+                ldr     lr, [r0]
+                orr     r6, r6, lr, lsl #16
+                stmia   r1!, {r3 - r6}
+                subs    r2, r2, #8
+                bpl     .Linsw_8_lp
+                tst     r2, #7
+                ldmeqfd sp!, {r4, r5, r6, pc}
+.Lno_insw_8:    tst     r2, #4
+                beq     .Lno_insw_4
+                ldr     r3, [r0]
+                and     r3, r3, ip
+                ldr     r4, [r0]
+                orr     r3, r3, r4, lsl #16
+                ldr     r4, [r0]
+                and     r4, r4, ip
+                ldr     r5, [r0]
+                orr     r4, r4, r5, lsl #16
+                stmia   r1!, {r3, r4}
+.Lno_insw_4:    tst     r2, #2
+                beq     .Lno_insw_2
+                ldr     r3, [r0]
+                and     r3, r3, ip
+                ldr     r4, [r0]
+                orr     r3, r3, r4, lsl #16
+                str     r3, [r1], #4
+.Lno_insw_2:    tst     r2, #1
+                ldrne   r3, [r0]
+                strneb  r3, [r1], #1
+                movne   r3, r3, lsr #8
+                strneb  r3, [r1]
+                ldmfd   sp!, {r4, r5, r6, pc}
diff --git a/arch/arm/lib/io-writesw-armv3.S b/arch/arm/lib/io-writesw-armv3.S
new file mode 100644
index 000000000000..49b800419e32
--- /dev/null
+++ b/arch/arm/lib/io-writesw-armv3.S
@@ -0,0 +1,126 @@
+/*
+ *  linux/arch/arm/lib/io-writesw-armv3.S
+ *
+ *  Copyright (C) 1995-2000 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+.Loutsw_bad_alignment:
+                adr     r0, .Loutsw_bad_align_msg
+                mov     r2, lr
+                b       panic
+.Loutsw_bad_align_msg:
+                .asciz  "outsw: bad buffer alignment (0x%p, lr=0x%08lX)\n"
+                .align
+.Loutsw_align:  tst     r1, #1
+                bne     .Loutsw_bad_alignment
+                add     r1, r1, #2
+                ldr     r3, [r1, #-4]
+                mov     r3, r3, lsr #16
+                orr     r3, r3, r3, lsl #16
+                str     r3, [r0]
+                subs    r2, r2, #1
+                moveq   pc, lr
+ENTRY(__raw_writesw)
+                teq     r2, #0          @ do we have to check for the zero len?
+                moveq   pc, lr
+                tst     r1, #3
+                bne     .Loutsw_align
+                stmfd   sp!, {r4, r5, r6, lr}
+                subs    r2, r2, #8
+                bmi     .Lno_outsw_8
+.Loutsw_8_lp:   ldmia   r1!, {r3, r4, r5, r6}
+                mov     ip, r3, lsl #16
+                orr     ip, ip, ip, lsr #16
+                str     ip, [r0]
+                mov     ip, r3, lsr #16
+                orr     ip, ip, ip, lsl #16
+                str     ip, [r0]
+                mov     ip, r4, lsl #16
+                orr     ip, ip, ip, lsr #16
+                str     ip, [r0]
+                mov     ip, r4, lsr #16
+                orr     ip, ip, ip, lsl #16
+                str     ip, [r0]
+                mov     ip, r5, lsl #16
+                orr     ip, ip, ip, lsr #16
+                str     ip, [r0]
+                mov     ip, r5, lsr #16
+                orr     ip, ip, ip, lsl #16
+                str     ip, [r0]
+                mov     ip, r6, lsl #16
+                orr     ip, ip, ip, lsr #16
+                str     ip, [r0]
+                mov     ip, r6, lsr #16
+                orr     ip, ip, ip, lsl #16
+                str     ip, [r0]
+                subs    r2, r2, #8
+                bpl     .Loutsw_8_lp
+                tst     r2, #7
+                ldmeqfd sp!, {r4, r5, r6, pc}
+.Lno_outsw_8:   tst     r2, #4
+                beq     .Lno_outsw_4
+                ldmia   r1!, {r3, r4}
+                mov     ip, r3, lsl #16
+                orr     ip, ip, ip, lsr #16
+                str     ip, [r0]
+                mov     ip, r3, lsr #16
+                orr     ip, ip, ip, lsl #16
+                str     ip, [r0]
+                mov     ip, r4, lsl #16
+                orr     ip, ip, ip, lsr #16
+                str     ip, [r0]
+                mov     ip, r4, lsr #16
+                orr     ip, ip, ip, lsl #16
+                str     ip, [r0]
+.Lno_outsw_4:   tst     r2, #2
+                beq     .Lno_outsw_2
+                ldr     r3, [r1], #4
+                mov     ip, r3, lsl #16
+                orr     ip, ip, ip, lsr #16
+                str     ip, [r0]
+                mov     ip, r3, lsr #16
+                orr     ip, ip, ip, lsl #16
+                str     ip, [r0]
+.Lno_outsw_2:   tst     r2, #1
+                ldrne   r3, [r1]
+                movne   ip, r3, lsl #16
+                orrne   ip, ip, ip, lsr #16
+                strne   ip, [r0]
+                ldmfd   sp!, {r4, r5, r6, pc}
diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
index 7db25990c589..3d73dcb959b0 100644
--- a/arch/arm/lib/putuser.S
+++ b/arch/arm/lib/putuser.S
@@ -16,6 +16,7 @@
 * __put_user_X
 *
 * Inputs:      r0 contains the address
+ *              r1 contains the address limit, which must be preserved
 *              r2, r3 contains the value
 * Outputs:     r0 is the error code
 *              lr corrupted
@@ -27,16 +28,19 @@
 * Note also that it is intended that __put_user_bad is not global.
 */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 ENTRY(__put_user_1)
+        check_uaccess r0, 1, r1, ip, __put_user_bad
 1: TUSER(strb)  r2, [r0]
        mov     r0, #0
        mov     pc, lr
 ENDPROC(__put_user_1)
 ENTRY(__put_user_2)
+        check_uaccess r0, 2, r1, ip, __put_user_bad
        mov     ip, r2, lsr #8
 #ifdef CONFIG_THUMB2_KERNEL
 #ifndef __ARMEB__
@@ -60,12 +64,14 @@ ENTRY(__put_user_2)
 ENDPROC(__put_user_2)
 ENTRY(__put_user_4)
+        check_uaccess r0, 4, r1, ip, __put_user_bad
 4: TUSER(str)   r2, [r0]
        mov     r0, #0
        mov     pc, lr
 ENDPROC(__put_user_4)
 ENTRY(__put_user_8)
+        check_uaccess r0, 8, r1, ip, __put_user_bad
 #ifdef CONFIG_THUMB2_KERNEL
 5: TUSER(str)   r2, [r0]
 6: TUSER(str)   r3, [r0, #4]
diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S
new file mode 100644
index 000000000000..5c908b1cb8ed
--- /dev/null
+++ b/arch/arm/lib/uaccess.S
@@ -0,0 +1,564 @@
+/*
+ *  linux/arch/arm/lib/uaccess.S
+ *
+ *  Copyright (C) 1995, 1996,1997,1998 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ *  Routines to block copy data to/from user memory
+ *   These are highly optimised both for the 4k page size
+ *   and for various alignments.
+ */
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+#include <asm/errno.h>
+#include <asm/domain.h>
+                .text
+#define PAGE_SHIFT 12
+/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
+ * Purpose  : copy a block to user memory from kernel memory
+ * Params   : to   - user memory
+ *          : from - kernel memory
+ *          : n    - number of bytes to copy
+ * Returns  : Number of bytes NOT copied.
+ */
+.Lc2u_dest_not_aligned:
+                rsb     ip, ip, #4
+                cmp     ip, #2
+                ldrb    r3, [r1], #1
+USER(   TUSER(  strb)   r3, [r0], #1)                   @ May fault
+                ldrgeb  r3, [r1], #1
+USER(   TUSER(  strgeb) r3, [r0], #1)                   @ May fault
+                ldrgtb  r3, [r1], #1
+USER(   TUSER(  strgtb) r3, [r0], #1)                   @ May fault
+                sub     r2, r2, ip
+                b       .Lc2u_dest_aligned
+ENTRY(__copy_to_user)
+                stmfd   sp!, {r2, r4 - r7, lr}
+                cmp     r2, #4
+                blt     .Lc2u_not_enough
+                ands    ip, r0, #3
+                bne     .Lc2u_dest_not_aligned
+.Lc2u_dest_aligned:
+                ands    ip, r1, #3
+                bne     .Lc2u_src_not_aligned
+/*
+ * Seeing as there has to be at least 8 bytes to copy, we can
+ * copy one word, and force a user-mode page fault...
+ */
+.Lc2u_0fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lc2u_0nowords
+                ldr     r3, [r1], #4
+USER(   TUSER(  str)    r3, [r0], #4)                   @ May fault
+                mov     ip, r0, lsl #32 - PAGE_SHIFT    @ On each page, use a ld/st??t instruction
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lc2u_0fupi
+/*
+ * ip = max no. of bytes to copy before needing another "strt" insn
+ */
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #32
+                blt     .Lc2u_0rem8lp
+.Lc2u_0cpy8lp:  ldmia   r1!, {r3 - r6}
+                stmia   r0!, {r3 - r6}                  @ Shouldnt fault
+                ldmia   r1!, {r3 - r6}
+                subs    ip, ip, #32
+                stmia   r0!, {r3 - r6}                  @ Shouldnt fault
+                bpl     .Lc2u_0cpy8lp
+.Lc2u_0rem8lp:  cmn     ip, #16
+                ldmgeia r1!, {r3 - r6}
+                stmgeia r0!, {r3 - r6}                  @ Shouldnt fault
+                tst     ip, #8
+                ldmneia r1!, {r3 - r4}
+                stmneia r0!, {r3 - r4}                  @ Shouldnt fault
+                tst     ip, #4
+                ldrne   r3, [r1], #4
+        TUSER(  strne) r3, [r0], #4                     @ Shouldnt fault
+                ands    ip, ip, #3
+                beq     .Lc2u_0fupi
+.Lc2u_0nowords: teq     ip, #0
+                beq     .Lc2u_finished
+.Lc2u_nowords:  cmp     ip, #2
+                ldrb    r3, [r1], #1
+USER(   TUSER(  strb)   r3, [r0], #1)                   @ May fault
+                ldrgeb  r3, [r1], #1
+USER(   TUSER(  strgeb) r3, [r0], #1)                   @ May fault
+                ldrgtb  r3, [r1], #1
+USER(   TUSER(  strgtb) r3, [r0], #1)                   @ May fault
+                b       .Lc2u_finished
+.Lc2u_not_enough:
+                movs    ip, r2
+                bne     .Lc2u_nowords
+.Lc2u_finished: mov     r0, #0
+                ldmfd   sp!, {r2, r4 - r7, pc}
+.Lc2u_src_not_aligned:
+                bic     r1, r1, #3
+                ldr     r7, [r1], #4
+                cmp     ip, #2
+                bgt     .Lc2u_3fupi
+                beq     .Lc2u_2fupi
+.Lc2u_1fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lc2u_1nowords
+                mov     r3, r7, pull #8
+                ldr     r7, [r1], #4
+                orr     r3, r3, r7, push #24
+USER(   TUSER(  str)    r3, [r0], #4)                   @ May fault
+                mov     ip, r0, lsl #32 - PAGE_SHIFT
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lc2u_1fupi
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #16
+                blt     .Lc2u_1rem8lp
+.Lc2u_1cpy8lp:  mov     r3, r7, pull #8
+                ldmia   r1!, {r4 - r7}
+                subs    ip, ip, #16
+                orr     r3, r3, r4, push #24
+                mov     r4, r4, pull #8
+                orr     r4, r4, r5, push #24
+                mov     r5, r5, pull #8
+                orr     r5, r5, r6, push #24
+                mov     r6, r6, pull #8
+                orr     r6, r6, r7, push #24
+                stmia   r0!, {r3 - r6}                  @ Shouldnt fault
+                bpl     .Lc2u_1cpy8lp
+.Lc2u_1rem8lp:  tst     ip, #8
+                movne   r3, r7, pull #8
+                ldmneia r1!, {r4, r7}
+                orrne   r3, r3, r4, push #24
+                movne   r4, r4, pull #8
+                orrne   r4, r4, r7, push #24
+                stmneia r0!, {r3 - r4}                  @ Shouldnt fault
+                tst     ip, #4
+                movne   r3, r7, pull #8
+                ldrne   r7, [r1], #4
+                orrne   r3, r3, r7, push #24
+        TUSER(  strne) r3, [r0], #4                     @ Shouldnt fault
+                ands    ip, ip, #3
+                beq     .Lc2u_1fupi
+.Lc2u_1nowords: mov     r3, r7, get_byte_1
+                teq     ip, #0
+                beq     .Lc2u_finished
+                cmp     ip, #2
+USER(   TUSER(  strb)   r3, [r0], #1)                   @ May fault
+                movge   r3, r7, get_byte_2
+USER(   TUSER(  strgeb) r3, [r0], #1)                   @ May fault
+                movgt   r3, r7, get_byte_3
+USER(   TUSER(  strgtb) r3, [r0], #1)                   @ May fault
+                b       .Lc2u_finished
+.Lc2u_2fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lc2u_2nowords
+                mov     r3, r7, pull #16
+                ldr     r7, [r1], #4
+                orr     r3, r3, r7, push #16
+USER(   TUSER(  str)    r3, [r0], #4)                   @ May fault
+                mov     ip, r0, lsl #32 - PAGE_SHIFT
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lc2u_2fupi
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #16
+                blt     .Lc2u_2rem8lp
+.Lc2u_2cpy8lp:  mov     r3, r7, pull #16
+                ldmia   r1!, {r4 - r7}
+                subs    ip, ip, #16
+                orr     r3, r3, r4, push #16
+                mov     r4, r4, pull #16
+                orr     r4, r4, r5, push #16
+                mov     r5, r5, pull #16
+                orr     r5, r5, r6, push #16
+                mov     r6, r6, pull #16
+                orr     r6, r6, r7, push #16
+                stmia   r0!, {r3 - r6}                  @ Shouldnt fault
+                bpl     .Lc2u_2cpy8lp
+.Lc2u_2rem8lp:  tst     ip, #8
+                movne   r3, r7, pull #16
+                ldmneia r1!, {r4, r7}
+                orrne   r3, r3, r4, push #16
+                movne   r4, r4, pull #16
+                orrne   r4, r4, r7, push #16
+                stmneia r0!, {r3 - r4}                  @ Shouldnt fault
+                tst     ip, #4
+                movne   r3, r7, pull #16
+                ldrne   r7, [r1], #4
+                orrne   r3, r3, r7, push #16
+        TUSER(  strne) r3, [r0], #4                     @ Shouldnt fault
+                ands    ip, ip, #3
+                beq     .Lc2u_2fupi
+.Lc2u_2nowords: mov     r3, r7, get_byte_2
+                teq     ip, #0
+                beq     .Lc2u_finished
+                cmp     ip, #2
+USER(   TUSER(  strb)   r3, [r0], #1)                   @ May fault
+                movge   r3, r7, get_byte_3
+USER(   TUSER(  strgeb) r3, [r0], #1)                   @ May fault
+                ldrgtb  r3, [r1], #0
+USER(   TUSER(  strgtb) r3, [r0], #1)                   @ May fault
+                b       .Lc2u_finished
+.Lc2u_3fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lc2u_3nowords
+                mov     r3, r7, pull #24
+                ldr     r7, [r1], #4
+                orr     r3, r3, r7, push #8
+USER(   TUSER(  str)    r3, [r0], #4)                   @ May fault
+                mov     ip, r0, lsl #32 - PAGE_SHIFT
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lc2u_3fupi
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #16
+                blt     .Lc2u_3rem8lp
+.Lc2u_3cpy8lp:  mov     r3, r7, pull #24
+                ldmia   r1!, {r4 - r7}
+                subs    ip, ip, #16
+                orr     r3, r3, r4, push #8
+                mov     r4, r4, pull #24
+                orr     r4, r4, r5, push #8
+                mov     r5, r5, pull #24
+                orr     r5, r5, r6, push #8
+                mov     r6, r6, pull #24
+                orr     r6, r6, r7, push #8
+                stmia   r0!, {r3 - r6}                  @ Shouldnt fault
+                bpl     .Lc2u_3cpy8lp
+.Lc2u_3rem8lp:  tst     ip, #8
+                movne   r3, r7, pull #24
+                ldmneia r1!, {r4, r7}
+                orrne   r3, r3, r4, push #8
+                movne   r4, r4, pull #24
+                orrne   r4, r4, r7, push #8
+                stmneia r0!, {r3 - r4}                  @ Shouldnt fault
+                tst     ip, #4
+                movne   r3, r7, pull #24
+                ldrne   r7, [r1], #4
+                orrne   r3, r3, r7, push #8
+        TUSER(  strne) r3, [r0], #4                     @ Shouldnt fault
+                ands    ip, ip, #3
+                beq     .Lc2u_3fupi
+.Lc2u_3nowords: mov     r3, r7, get_byte_3
+                teq     ip, #0
+                beq     .Lc2u_finished
+                cmp     ip, #2
+USER(   TUSER(  strb)   r3, [r0], #1)                   @ May fault
+                ldrgeb  r3, [r1], #1
+USER(   TUSER(  strgeb) r3, [r0], #1)                   @ May fault
+                ldrgtb  r3, [r1], #0
+USER(   TUSER(  strgtb) r3, [r0], #1)                   @ May fault
+                b       .Lc2u_finished
+ENDPROC(__copy_to_user)
+                .pushsection .fixup,"ax"
+                .align  0
+9001:           ldmfd   sp!, {r0, r4 - r7, pc}
+                .popsection
+/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
+ * Purpose  : copy a block from user memory to kernel memory
+ * Params   : to   - kernel memory
+ *          : from - user memory
+ *          : n    - number of bytes to copy
+ * Returns  : Number of bytes NOT copied.
+ */
+.Lcfu_dest_not_aligned:
+                rsb     ip, ip, #4
+                cmp     ip, #2
+USER(   TUSER(  ldrb)   r3, [r1], #1)                   @ May fault
+                strb    r3, [r0], #1
+USER(   TUSER(  ldrgeb) r3, [r1], #1)                   @ May fault
+                strgeb  r3, [r0], #1
+USER(   TUSER(  ldrgtb) r3, [r1], #1)                   @ May fault
+                strgtb  r3, [r0], #1
+                sub     r2, r2, ip
+                b       .Lcfu_dest_aligned
+ENTRY(__copy_from_user)
+                stmfd   sp!, {r0, r2, r4 - r7, lr}
+                cmp     r2, #4
+                blt     .Lcfu_not_enough
+                ands    ip, r0, #3
+                bne     .Lcfu_dest_not_aligned
+.Lcfu_dest_aligned:
+                ands    ip, r1, #3
+                bne     .Lcfu_src_not_aligned
+/*
+ * Seeing as there has to be at least 8 bytes to copy, we can
+ * copy one word, and force a user-mode page fault...
+ */
+.Lcfu_0fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lcfu_0nowords
+USER(   TUSER(  ldr)    r3, [r1], #4)
+                str     r3, [r0], #4
+                mov     ip, r1, lsl #32 - PAGE_SHIFT    @ On each page, use a ld/st??t instruction
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lcfu_0fupi
+/*
+ * ip = max no. of bytes to copy before needing another "strt" insn
+ */
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #32
+                blt     .Lcfu_0rem8lp
+.Lcfu_0cpy8lp:  ldmia   r1!, {r3 - r6}                  @ Shouldnt fault
+                stmia   r0!, {r3 - r6}
+                ldmia   r1!, {r3 - r6}                  @ Shouldnt fault
+                subs    ip, ip, #32
+                stmia   r0!, {r3 - r6}
+                bpl     .Lcfu_0cpy8lp
+.Lcfu_0rem8lp:  cmn     ip, #16
+                ldmgeia r1!, {r3 - r6}                  @ Shouldnt fault
+                stmgeia r0!, {r3 - r6}
+                tst     ip, #8
+                ldmneia r1!, {r3 - r4}                  @ Shouldnt fault
+                stmneia r0!, {r3 - r4}
+                tst     ip, #4
+        TUSER(  ldrne) r3, [r1], #4                     @ Shouldnt fault
+                strne   r3, [r0], #4
+                ands    ip, ip, #3
+                beq     .Lcfu_0fupi
+.Lcfu_0nowords: teq     ip, #0
+                beq     .Lcfu_finished
+.Lcfu_nowords:  cmp     ip, #2
+USER(   TUSER(  ldrb)   r3, [r1], #1)                   @ May fault
+                strb    r3, [r0], #1
+USER(   TUSER(  ldrgeb) r3, [r1], #1)                   @ May fault
+                strgeb  r3, [r0], #1
+USER(   TUSER(  ldrgtb) r3, [r1], #1)                   @ May fault
+                strgtb  r3, [r0], #1
+                b       .Lcfu_finished
+.Lcfu_not_enough:
+                movs    ip, r2
+                bne     .Lcfu_nowords
+.Lcfu_finished: mov     r0, #0
+                add     sp, sp, #8
+                ldmfd   sp!, {r4 - r7, pc}
+.Lcfu_src_not_aligned:
+                bic     r1, r1, #3
+USER(   TUSER(  ldr)    r7, [r1], #4)                   @ May fault
+                cmp     ip, #2
+                bgt     .Lcfu_3fupi
+                beq     .Lcfu_2fupi
+.Lcfu_1fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lcfu_1nowords
+                mov     r3, r7, pull #8
+USER(   TUSER(  ldr)    r7, [r1], #4)                   @ May fault
+                orr     r3, r3, r7, push #24
+                str     r3, [r0], #4
+                mov     ip, r1, lsl #32 - PAGE_SHIFT
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lcfu_1fupi
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #16
+                blt     .Lcfu_1rem8lp
+.Lcfu_1cpy8lp:  mov     r3, r7, pull #8
+                ldmia   r1!, {r4 - r7}                  @ Shouldnt fault
+                subs    ip, ip, #16
+                orr     r3, r3, r4, push #24
+                mov     r4, r4, pull #8
+                orr     r4, r4, r5, push #24
+                mov     r5, r5, pull #8
+                orr     r5, r5, r6, push #24
+                mov     r6, r6, pull #8
+                orr     r6, r6, r7, push #24
+                stmia   r0!, {r3 - r6}
+                bpl     .Lcfu_1cpy8lp
+.Lcfu_1rem8lp:  tst     ip, #8
+                movne   r3, r7, pull #8
+                ldmneia r1!, {r4, r7}                   @ Shouldnt fault
+                orrne   r3, r3, r4, push #24
+                movne   r4, r4, pull #8
+                orrne   r4, r4, r7, push #24
+                stmneia r0!, {r3 - r4}
+                tst     ip, #4
+                movne   r3, r7, pull #8
+USER(   TUSER(  ldrne) r7, [r1], #4)                    @ May fault
+                orrne   r3, r3, r7, push #24
+                strne   r3, [r0], #4
+                ands    ip, ip, #3
+                beq     .Lcfu_1fupi
+.Lcfu_1nowords: mov     r3, r7, get_byte_1
+                teq     ip, #0
+                beq     .Lcfu_finished
+                cmp     ip, #2
+                strb    r3, [r0], #1
+                movge   r3, r7, get_byte_2
+                strgeb  r3, [r0], #1
+                movgt   r3, r7, get_byte_3
+                strgtb  r3, [r0], #1
+                b       .Lcfu_finished
+.Lcfu_2fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lcfu_2nowords
+                mov     r3, r7, pull #16
+USER(   TUSER(  ldr)    r7, [r1], #4)                   @ May fault
+                orr     r3, r3, r7, push #16
+                str     r3, [r0], #4
+                mov     ip, r1, lsl #32 - PAGE_SHIFT
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lcfu_2fupi
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #16
+                blt     .Lcfu_2rem8lp
+.Lcfu_2cpy8lp:  mov     r3, r7, pull #16
+                ldmia   r1!, {r4 - r7}                  @ Shouldnt fault
+                subs    ip, ip, #16
+                orr     r3, r3, r4, push #16
+                mov     r4, r4, pull #16
+                orr     r4, r4, r5, push #16
+                mov     r5, r5, pull #16
+                orr     r5, r5, r6, push #16
+                mov     r6, r6, pull #16
+                orr     r6, r6, r7, push #16
+                stmia   r0!, {r3 - r6}
+                bpl     .Lcfu_2cpy8lp
+.Lcfu_2rem8lp:  tst     ip, #8
+                movne   r3, r7, pull #16
+                ldmneia r1!, {r4, r7}                   @ Shouldnt fault
+                orrne   r3, r3, r4, push #16
+                movne   r4, r4, pull #16
+                orrne   r4, r4, r7, push #16
+                stmneia r0!, {r3 - r4}
+                tst     ip, #4
+                movne   r3, r7, pull #16
+USER(   TUSER(  ldrne) r7, [r1], #4)                    @ May fault
+                orrne   r3, r3, r7, push #16
+                strne   r3, [r0], #4
+                ands    ip, ip, #3
+                beq     .Lcfu_2fupi
+.Lcfu_2nowords: mov     r3, r7, get_byte_2
+                teq     ip, #0
+                beq     .Lcfu_finished
+                cmp     ip, #2
+                strb    r3, [r0], #1
+                movge   r3, r7, get_byte_3
+                strgeb  r3, [r0], #1
+USER(   TUSER(  ldrgtb) r3, [r1], #0)                   @ May fault
+                strgtb  r3, [r0], #1
+                b       .Lcfu_finished
+.Lcfu_3fupi:    subs    r2, r2, #4
+                addmi   ip, r2, #4
+                bmi     .Lcfu_3nowords
+                mov     r3, r7, pull #24
+USER(   TUSER(  ldr)    r7, [r1], #4)                   @ May fault
+                orr     r3, r3, r7, push #8
+                str     r3, [r0], #4
+                mov     ip, r1, lsl #32 - PAGE_SHIFT
+                rsb     ip, ip, #0
+                movs    ip, ip, lsr #32 - PAGE_SHIFT
+                beq     .Lcfu_3fupi
+                cmp     r2, ip
+                movlt   ip, r2
+                sub     r2, r2, ip
+                subs    ip, ip, #16
+                blt     .Lcfu_3rem8lp
+.Lcfu_3cpy8lp:  mov     r3, r7, pull #24
+                ldmia   r1!, {r4 - r7}                  @ Shouldnt fault
+                orr     r3, r3, r4, push #8
+                mov     r4, r4, pull #24
+                orr     r4, r4, r5, push #8
+                mov     r5, r5, pull #24
+                orr     r5, r5, r6, push #8
+                mov     r6, r6, pull #24
+                orr     r6, r6, r7, push #8
+                stmia   r0!, {r3 - r6}
+                subs    ip, ip, #16
+                bpl     .Lcfu_3cpy8lp
+.Lcfu_3rem8lp:  tst     ip, #8
+                movne   r3, r7, pull #24
+                ldmneia r1!, {r4, r7}                   @ Shouldnt fault
+                orrne   r3, r3, r4, push #8
+                movne   r4, r4, pull #24
+                orrne   r4, r4, r7, push #8
+                stmneia r0!, {r3 - r4}
+                tst     ip, #4
+                movne   r3, r7, pull #24
+USER(   TUSER(  ldrne) r7, [r1], #4)                    @ May fault
+                orrne   r3, r3, r7, push #8
+                strne   r3, [r0], #4
+                ands    ip, ip, #3
+                beq     .Lcfu_3fupi
+.Lcfu_3nowords: mov     r3, r7, get_byte_3
+                teq     ip, #0
+                beq     .Lcfu_finished
+                cmp     ip, #2
+                strb    r3, [r0], #1
+USER(   TUSER(  ldrgeb) r3, [r1], #1)                   @ May fault
+                strgeb  r3, [r0], #1
+USER(   TUSER(  ldrgtb) r3, [r1], #1)                   @ May fault
+                strgtb  r3, [r0], #1
+                b       .Lcfu_finished
+ENDPROC(__copy_from_user)
+                .pushsection .fixup,"ax"
+                .align  0
+                /*
+                 * We took an exception.  r0 contains a pointer to
+                 * the byte not copied.
+                 */
+9001:           ldr     r2, [sp], #4                    @ void *to
+                sub     r2, r0, r2                      @ bytes copied
+                ldr     r1, [sp], #4                    @ unsigned long count
+                subs    r4, r1, r2                      @ bytes left to copy
+                movne   r1, r4
+                blne    __memzero
+                mov     r0, r4
+                ldmfd   sp!, {r4 - r7, pc}
+                .popsection
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index 104ca40d8d18..aaa443b48c91 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -197,7 +197,7 @@ void __init at91rm9200_timer_init(void)
        at91_st_read(AT91_ST_SR);
        /* Make IRQs happen for the system timer */
-        setup_irq(AT91_ID_SYS, &at91rm9200_timer_irq);
+        setup_irq(NR_IRQS_LEGACY + AT91_ID_SYS, &at91rm9200_timer_irq);
        /* The 32KiHz "Slow Clock" (tick every 30517.58 nanoseconds) is used
         * directly for the clocksource and all clockevents, after adjusting
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index 7b9c2ba396ed..bce572a530ef 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -726,6 +726,8 @@ static struct resource rtt_resources[] = {
                .flags  = IORESOURCE_MEM,
        }, {
                .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
        },
 };
@@ -744,10 +746,12 @@ static void __init at91_add_device_rtt_rtc(void)
         * The second resource is needed:
         * GPBR will serve as the storage for RTC time offset
         */
-        at91sam9260_rtt_device.num_resources = 2;
+        at91sam9260_rtt_device.num_resources = 3;
        rtt_resources[1].start = AT91SAM9260_BASE_GPBR +
                                 4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
        rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
index 8df5c1bdff92..bc2590d712d0 100644
--- a/arch/arm/mach-at91/at91sam9261_devices.c
+++ b/arch/arm/mach-at91/at91sam9261_devices.c
@@ -609,6 +609,8 @@ static struct resource rtt_resources[] = {
                .flags  = IORESOURCE_MEM,
        }, {
                .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
        }
 };
@@ -626,10 +628,12 @@ static void __init at91_add_device_rtt_rtc(void)
         * The second resource is needed:
         * GPBR will serve as the storage for RTC time offset
         */
-        at91sam9261_rtt_device.num_resources = 2;
+        at91sam9261_rtt_device.num_resources = 3;
        rtt_resources[1].start = AT91SAM9261_BASE_GPBR +
                                 4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
        rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index eb6bbf86fb9f..9b6ca734f1a9 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -990,6 +990,8 @@ static struct resource rtt0_resources[] = {
                .flags  = IORESOURCE_MEM,
        }, {
                .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
        }
 };
@@ -1006,6 +1008,8 @@ static struct resource rtt1_resources[] = {
                .flags  = IORESOURCE_MEM,
        }, {
                .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
        }
 };
@@ -1027,14 +1031,14 @@ static void __init at91_add_device_rtt_rtc(void)
                 * The second resource is needed only for the chosen RTT:
                 * GPBR will serve as the storage for RTC time offset
                 */
-                at91sam9263_rtt0_device.num_resources = 2;
+                at91sam9263_rtt0_device.num_resources = 3;
                at91sam9263_rtt1_device.num_resources = 1;
                pdev = &at91sam9263_rtt0_device;
                r = rtt0_resources;
                break;
        case 1:
                at91sam9263_rtt0_device.num_resources = 1;
-                at91sam9263_rtt1_device.num_resources = 2;
+                at91sam9263_rtt1_device.num_resources = 3;
                pdev = &at91sam9263_rtt1_device;
                r = rtt1_resources;
                break;
@@ -1047,6 +1051,8 @@ static void __init at91_add_device_rtt_rtc(void)
        pdev->name = "rtc-at91sam9";
        r[1].start = AT91SAM9263_BASE_GPBR + 4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
        r[1].end = r[1].start + 3;
+        r[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        r[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
index 06073996a382..1b47319ca00b 100644
--- a/arch/arm/mach-at91/at91sam9g45_devices.c
+++ b/arch/arm/mach-at91/at91sam9g45_devices.c
@@ -1293,6 +1293,8 @@ static struct resource rtt_resources[] = {
                .flags  = IORESOURCE_MEM,
        }, {
                .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
        }
 };
@@ -1310,10 +1312,12 @@ static void __init at91_add_device_rtt_rtc(void)
         * The second resource is needed:
         * GPBR will serve as the storage for RTC time offset
         */
-        at91sam9g45_rtt_device.num_resources = 2;
+        at91sam9g45_rtt_device.num_resources = 3;
        rtt_resources[1].start = AT91SAM9G45_BASE_GPBR +
                                 4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
        rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
index f09fff932172..b3d365dadef5 100644
--- a/arch/arm/mach-at91/at91sam9rl_devices.c
+++ b/arch/arm/mach-at91/at91sam9rl_devices.c
@@ -688,6 +688,8 @@ static struct resource rtt_resources[] = {
                .flags  = IORESOURCE_MEM,
        }, {
                .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
        }
 };
@@ -705,10 +707,12 @@ static void __init at91_add_device_rtt_rtc(void)
         * The second resource is needed:
         * GPBR will serve as the storage for RTC time offset
         */
-        at91sam9rl_rtt_device.num_resources = 2;
+        at91sam9rl_rtt_device.num_resources = 3;
        rtt_resources[1].start = AT91SAM9RL_BASE_GPBR +
                                 4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
        rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/clock.c b/arch/arm/mach-at91/clock.c
index de2ec6b8fea7..188c82971ebd 100644
--- a/arch/arm/mach-at91/clock.c
+++ b/arch/arm/mach-at91/clock.c
@@ -63,6 +63,12 @@ EXPORT_SYMBOL_GPL(at91_pmc_base);
 #define cpu_has_300M_plla()     (cpu_is_at91sam9g10())
+#define cpu_has_240M_plla()     (cpu_is_at91sam9261() \
+                                || cpu_is_at91sam9263() \
+                                || cpu_is_at91sam9rl())
+#define cpu_has_210M_plla()     (cpu_is_at91sam9260())
 #define cpu_has_pllb()          (!(cpu_is_at91sam9rl() \
                                || cpu_is_at91sam9g45() \
                                || cpu_is_at91sam9x5() \
@@ -706,6 +712,12 @@ static int __init at91_pmc_init(unsigned long main_clock)
        } else if (cpu_has_800M_plla()) {
                if (plla.rate_hz > 800000000)
                        pll_overclock = true;
+        } else if (cpu_has_240M_plla()) {
+                if (plla.rate_hz > 240000000)
+                        pll_overclock = true;
+        } else if (cpu_has_210M_plla()) {
+                if (plla.rate_hz > 210000000)
+                        pll_overclock = true;
        } else {
                if (plla.rate_hz > 209000000)
                        pll_overclock = true;
diff --git a/arch/arm/mach-dove/common.c b/arch/arm/mach-dove/common.c
index 4db5de54b6a7..6321567d8eaa 100644
--- a/arch/arm/mach-dove/common.c
+++ b/arch/arm/mach-dove/common.c
@@ -102,7 +102,8 @@ void __init dove_ehci1_init(void)
 void __init dove_ge00_init(struct mv643xx_eth_platform_data *eth_data)
 {
        orion_ge00_init(eth_data, DOVE_GE00_PHYS_BASE,
-                        IRQ_DOVE_GE00_SUM, IRQ_DOVE_GE00_ERR);
+                        IRQ_DOVE_GE00_SUM, IRQ_DOVE_GE00_ERR,
+                        1600);
 }
 /*****************************************************************************
diff --git a/arch/arm/mach-exynos/mach-origen.c b/arch/arm/mach-exynos/mach-origen.c
index 5ca80307d6d7..4e574c24581c 100644
--- a/arch/arm/mach-exynos/mach-origen.c
+++ b/arch/arm/mach-exynos/mach-origen.c
@@ -42,6 +42,7 @@
 #include <plat/backlight.h>
 #include <plat/fb.h>
 #include <plat/mfc.h>
+#include <plat/hdmi.h>
 #include <mach/ohci.h>
 #include <mach/map.h>
@@ -734,6 +735,11 @@ static void __init origen_bt_setup(void)
        s3c_gpio_setpull(EXYNOS4_GPX2(2), S3C_GPIO_PULL_NONE);
 }
+/* I2C module and id for HDMIPHY */
+static struct i2c_board_info hdmiphy_info = {
+        I2C_BOARD_INFO("hdmiphy-exynos4210", 0x38),
+};
 static void s5p_tv_setup(void)
 {
        /* Direct HPD to HDMI chip */
@@ -781,6 +787,7 @@ static void __init origen_machine_init(void)
        s5p_tv_setup();
        s5p_i2c_hdmiphy_set_platdata(NULL);
+        s5p_hdmi_set_platdata(&hdmiphy_info, NULL, 0);
 #ifdef CONFIG_DRM_EXYNOS
        s5p_device_fimd0.dev.platform_data = &drm_fimd_pdata;
diff --git a/arch/arm/mach-exynos/mach-smdkv310.c b/arch/arm/mach-exynos/mach-smdkv310.c
index 3cfa688d274a..73f2bce097e1 100644
--- a/arch/arm/mach-exynos/mach-smdkv310.c
+++ b/arch/arm/mach-exynos/mach-smdkv310.c
@@ -40,6 +40,7 @@
 #include <plat/mfc.h>
 #include <plat/ehci.h>
 #include <plat/clock.h>
+#include <plat/hdmi.h>
 #include <mach/map.h>
 #include <mach/ohci.h>
@@ -354,6 +355,11 @@ static struct platform_pwm_backlight_data smdkv310_bl_data = {
        .pwm_period_ns  = 1000,
 };
+/* I2C module and id for HDMIPHY */
+static struct i2c_board_info hdmiphy_info = {
+        I2C_BOARD_INFO("hdmiphy-exynos4210", 0x38),
+};
 static void s5p_tv_setup(void)
 {
        /* direct HPD to HDMI chip */
@@ -388,6 +394,7 @@ static void __init smdkv310_machine_init(void)
        s5p_tv_setup();
        s5p_i2c_hdmiphy_set_platdata(NULL);
+        s5p_hdmi_set_platdata(&hdmiphy_info, NULL, 0);
        samsung_keypad_set_platdata(&smdkv310_keypad_data);
diff --git a/arch/arm/mach-gemini/irq.c b/arch/arm/mach-gemini/irq.c
index ca70e5fcc7ac..020852d3bdd8 100644
--- a/arch/arm/mach-gemini/irq.c
+++ b/arch/arm/mach-gemini/irq.c
@@ -17,6 +17,7 @@
 #include <linux/sched.h>
 #include <asm/irq.h>
 #include <asm/mach/irq.h>
+#include <asm/system_misc.h>
 #include <mach/hardware.h>
 #define IRQ_SOURCE(base_addr)   (base_addr + 0x00)
diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index 07f7c226e4cf..d004d37ad9d8 100644
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -9,7 +9,8 @@ obj-$(CONFIG_SOC_IMX27) += clk-imx27.o mm-imx27.o ehci-imx27.o
 obj-$(CONFIG_SOC_IMX31) += mm-imx3.o cpu-imx31.o clk-imx31.o iomux-imx31.o ehci-imx31.o pm-imx3.o
 obj-$(CONFIG_SOC_IMX35) += mm-imx3.o cpu-imx35.o clk-imx35.o ehci-imx35.o pm-imx3.o
-obj-$(CONFIG_SOC_IMX5) += cpu-imx5.o mm-imx5.o clk-imx51-imx53.o ehci-imx5.o pm-imx5.o cpu_op-mx51.o
+imx5-pm-$(CONFIG_PM) += pm-imx5.o
+obj-$(CONFIG_SOC_IMX5) += cpu-imx5.o mm-imx5.o clk-imx51-imx53.o ehci-imx5.o $(imx5-pm-y) cpu_op-mx51.o
 obj-$(CONFIG_COMMON_CLK) += clk-pllv1.o clk-pllv2.o clk-pllv3.o clk-gate2.o \
                            clk-pfd.o clk-busy.o
@@ -70,14 +71,13 @@ obj-$(CONFIG_DEBUG_LL) += lluart.o
 obj-$(CONFIG_HAVE_IMX_GPC) += gpc.o
 obj-$(CONFIG_HAVE_IMX_MMDC) += mmdc.o
 obj-$(CONFIG_HAVE_IMX_SRC) += src.o
-obj-$(CONFIG_CPU_V7) += head-v7.o
+AFLAGS_headsmp.o :=-Wa,-march=armv7-a
-AFLAGS_head-v7.o :=-Wa,-march=armv7-a
+obj-$(CONFIG_SMP) += headsmp.o platsmp.o
-obj-$(CONFIG_SMP) += platsmp.o
 obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o
 obj-$(CONFIG_SOC_IMX6Q) += clk-imx6q.o mach-imx6q.o
 ifeq ($(CONFIG_PM),y)
-obj-$(CONFIG_SOC_IMX6Q) += pm-imx6q.o
+obj-$(CONFIG_SOC_IMX6Q) += pm-imx6q.o headsmp.o
 endif
 # i.MX5 based machines
diff --git a/arch/arm/mach-imx/clk-imx25.c b/arch/arm/mach-imx/clk-imx25.c
index fdd8cc87c9fe..4431a62fff5b 100644
--- a/arch/arm/mach-imx/clk-imx25.c
+++ b/arch/arm/mach-imx/clk-imx25.c
@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void)
        clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0");
        clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0");
        clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0");
-        clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0");
+        clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0");
-        clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0");
+        clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1");
-        clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1");
-        clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1");
        clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0");
        clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0");
        clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0");
diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
index c6422fb10bae..65fb8bcd86cb 100644
--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -230,10 +230,8 @@ int __init mx35_clocks_init()
        clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb");
        clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1");
        clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma");
-        clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0");
+        clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0");
-        clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0");
+        clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1");
-        clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1");
-        clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1");
        /* i.mx35 has the i.mx21 type uart */
        clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0");
        clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0");
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index ea89520b6e22..4233d9e3531d 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -152,7 +152,7 @@ enum mx6q_clks {
        ssi2, ssi3, uart_ipg, uart_serial, usboh3, usdhc1, usdhc2, usdhc3,
        usdhc4, vdo_axi, vpu_axi, cko1, pll1_sys, pll2_bus, pll3_usb_otg,
        pll4_audio, pll5_video, pll6_mlb, pll7_usb_host, pll8_enet, ssi1_ipg,
-        ssi2_ipg, ssi3_ipg, rom, usbphy1, usbphy2,
+        ssi2_ipg, ssi3_ipg, rom, usbphy1, usbphy2, ldb_di0_div_3_5, ldb_di1_div_3_5,
        clk_max
 };
@@ -288,8 +288,10 @@ int __init mx6q_clocks_init(void)
        clk[gpu3d_shader]     = imx_clk_divider("gpu3d_shader",     "gpu3d_shader_sel",  base + 0x18, 29, 3);
        clk[ipu1_podf]        = imx_clk_divider("ipu1_podf",        "ipu1_sel",          base + 0x3c, 11, 3);
        clk[ipu2_podf]        = imx_clk_divider("ipu2_podf",        "ipu2_sel",          base + 0x3c, 16, 3);
-        clk[ldb_di0_podf]     = imx_clk_divider("ldb_di0_podf",     "ldb_di0_sel",       base + 0x20, 10, 1);
+        clk[ldb_di0_div_3_5]  = imx_clk_fixed_factor("ldb_di0_div_3_5", "ldb_di0_sel", 2, 7);
-        clk[ldb_di1_podf]     = imx_clk_divider("ldb_di1_podf",     "ldb_di1_sel",       base + 0x20, 11, 1);
+        clk[ldb_di0_podf]     = imx_clk_divider("ldb_di0_podf",     "ldb_di0_div_3_5",       base + 0x20, 10, 1);
+        clk[ldb_di1_div_3_5]  = imx_clk_fixed_factor("ldb_di1_div_3_5", "ldb_di1_sel", 2, 7);
+        clk[ldb_di1_podf]     = imx_clk_divider("ldb_di1_podf",     "ldb_di1_div_3_5",   base + 0x20, 11, 1);
        clk[ipu1_di0_pre]     = imx_clk_divider("ipu1_di0_pre",     "ipu1_di0_pre_sel",  base + 0x34, 3,  3);
        clk[ipu1_di1_pre]     = imx_clk_divider("ipu1_di1_pre",     "ipu1_di1_pre_sel",  base + 0x34, 12, 3);
        clk[ipu2_di0_pre]     = imx_clk_divider("ipu2_di0_pre",     "ipu2_di0_pre_sel",  base + 0x38, 3,  3);
diff --git a/arch/arm/mach-imx/head-v7.S b/arch/arm/mach-imx/headsmp.S
index 7e49deb128a4..7e49deb128a4 100644
--- a/arch/arm/mach-imx/head-v7.S
+++ b/arch/arm/mach-imx/headsmp.S
diff --git a/arch/arm/mach-imx/hotplug.c b/arch/arm/mach-imx/hotplug.c
index 20ed2d56c1af..f8f7437c83b8 100644
--- a/arch/arm/mach-imx/hotplug.c
+++ b/arch/arm/mach-imx/hotplug.c
@@ -42,22 +42,6 @@ static inline void cpu_enter_lowpower(void)
          : "cc");
 }
-static inline void cpu_leave_lowpower(void)
-{
-        unsigned int v;
-        asm volatile(
-                "mrc    p15, 0, %0, c1, c0, 0\n"
-        "       orr     %0, %0, %1\n"
-        "       mcr     p15, 0, %0, c1, c0, 0\n"
-        "       mrc     p15, 0, %0, c1, c0, 1\n"
-        "       orr     %0, %0, %2\n"
-        "       mcr     p15, 0, %0, c1, c0, 1\n"
-          : "=&r" (v)
-          : "Ir" (CR_C), "Ir" (0x40)
-          : "cc");
-}
 /*
 * platform-specific code to shutdown a CPU
 *
@@ -67,11 +51,10 @@ void platform_cpu_die(unsigned int cpu)
 {
        cpu_enter_lowpower();
        imx_enable_cpu(cpu, false);
-        cpu_do_idle();
-        cpu_leave_lowpower();
-        /* We should never return from idle */
+        /* spin here until hardware takes it down */
-        panic("cpu %d unexpectedly exit from shutdown\n", cpu);
+        while (1)
+                ;
 }
 int platform_cpu_disable(unsigned int cpu)
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 5ec0608f2a76..045b3f6a387d 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -71,7 +71,7 @@ soft:
 /* For imx6q sabrelite board: set KSZ9021RN RGMII pad skew */
 static int ksz9021rn_phy_fixup(struct phy_device *phydev)
 {
-        if (IS_ENABLED(CONFIG_PHYLIB)) {
+        if (IS_BUILTIN(CONFIG_PHYLIB)) {
                /* min rx data delay */
                phy_write(phydev, 0x0b, 0x8105);
                phy_write(phydev, 0x0c, 0x0000);
@@ -112,7 +112,7 @@ put_clk:
 static void __init imx6q_sabrelite_init(void)
 {
-        if (IS_ENABLED(CONFIG_PHYLIB))
+        if (IS_BUILTIN(CONFIG_PHYLIB))
                phy_register_fixup_for_uid(PHY_ID_KSZ9021, MICREL_PHY_ID_MASK,
                                ksz9021rn_phy_fixup);
        imx6q_sabrelite_cko1_setup();
diff --git a/arch/arm/mach-kirkwood/Makefile.boot b/arch/arm/mach-kirkwood/Makefile.boot
index a5717558ee89..a13299d758e1 100644
--- a/arch/arm/mach-kirkwood/Makefile.boot
+++ b/arch/arm/mach-kirkwood/Makefile.boot
@@ -7,7 +7,8 @@ dtb-$(CONFIG_MACH_DLINK_KIRKWOOD_DT) += kirkwood-dns320.dtb
 dtb-$(CONFIG_MACH_DLINK_KIRKWOOD_DT) += kirkwood-dns325.dtb
 dtb-$(CONFIG_MACH_ICONNECT_DT) += kirkwood-iconnect.dtb
 dtb-$(CONFIG_MACH_IB62X0_DT) += kirkwood-ib62x0.dtb
-dtb-$(CONFIG_MACH_TS219_DT)     += kirkwood-qnap-ts219.dtb
+dtb-$(CONFIG_MACH_TS219_DT)     += kirkwood-ts219-6281.dtb
+dtb-$(CONFIG_MACH_TS219_DT)     += kirkwood-ts219-6282.dtb
 dtb-$(CONFIG_MACH_GOFLEXNET_DT) += kirkwood-goflexnet.dtb
 dtb-$(CONFIG_MACH_LSXL_DT) += kirkwood-lschlv2.dtb
 dtb-$(CONFIG_MACH_LSXL_DT) += kirkwood-lsxhl.dtb
diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
index c4b64adcbfce..1201191d7f1b 100644
--- a/arch/arm/mach-kirkwood/common.c
+++ b/arch/arm/mach-kirkwood/common.c
@@ -301,7 +301,7 @@ void __init kirkwood_ge00_init(struct mv643xx_eth_platform_data *eth_data)
 {
        orion_ge00_init(eth_data,
                        GE00_PHYS_BASE, IRQ_KIRKWOOD_GE00_SUM,
-                        IRQ_KIRKWOOD_GE00_ERR);
+                        IRQ_KIRKWOOD_GE00_ERR, 1600);
        /* The interface forgets the MAC address assigned by u-boot if
        the clock is turned off, so claim the clk now. */
        clk_prepare_enable(ge0);
@@ -315,7 +315,7 @@ void __init kirkwood_ge01_init(struct mv643xx_eth_platform_data *eth_data)
 {
        orion_ge01_init(eth_data,
                        GE01_PHYS_BASE, IRQ_KIRKWOOD_GE01_SUM,
-                        IRQ_KIRKWOOD_GE01_ERR);
+                        IRQ_KIRKWOOD_GE01_ERR, 1600);
        clk_prepare_enable(ge1);
 }
@@ -517,6 +517,13 @@ void __init kirkwood_wdt_init(void)
 void __init kirkwood_init_early(void)
 {
        orion_time_set_base(TIMER_VIRT_BASE);
+        /*
+         * Some Kirkwood devices allocate their coherent buffers from atomic
+         * context. Increase size of atomic coherent pool to make sure such
+         * the allocations won't fail.
+         */
+        init_dma_coherent_pool_size(SZ_1M);
 }
 int kirkwood_tclk;
diff --git a/arch/arm/mach-kirkwood/db88f6281-bp-setup.c b/arch/arm/mach-kirkwood/db88f6281-bp-setup.c
index d93359379598..be90b7d0e10b 100644
--- a/arch/arm/mach-kirkwood/db88f6281-bp-setup.c
+++ b/arch/arm/mach-kirkwood/db88f6281-bp-setup.c
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/sizes.h>
 #include <linux/platform_device.h>
 #include <linux/mtd/partitions.h>
 #include <linux/ata_platform.h>
diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c
index 4304f9519372..7e8a5a2e1ec7 100644
--- a/arch/arm/mach-mmp/sram.c
+++ b/arch/arm/mach-mmp/sram.c
@@ -68,7 +68,7 @@ static int __devinit sram_probe(struct platform_device *pdev)
        struct resource *res;
        int ret = 0;
-        if (!pdata && !pdata->pool_name)
+        if (!pdata || !pdata->pool_name)
                return -ENODEV;
        info = kzalloc(sizeof(*info), GFP_KERNEL);
diff --git a/arch/arm/mach-mv78xx0/addr-map.c b/arch/arm/mach-mv78xx0/addr-map.c
index 62b53d710efd..a9bc84180d21 100644
--- a/arch/arm/mach-mv78xx0/addr-map.c
+++ b/arch/arm/mach-mv78xx0/addr-map.c
@@ -37,7 +37,7 @@
 #define WIN0_OFF(n)             (BRIDGE_VIRT_BASE + 0x0000 + ((n) << 4))
 #define WIN8_OFF(n)             (BRIDGE_VIRT_BASE + 0x0900 + (((n) - 8) << 4))
-static void __init __iomem *win_cfg_base(int win)
+static void __init __iomem *win_cfg_base(const struct orion_addr_map_cfg *cfg, int win)
 {
        /*
         * Find the control register base address for this window.
diff --git a/arch/arm/mach-mv78xx0/common.c b/arch/arm/mach-mv78xx0/common.c
index b4c53b846c9c..3057f7d4329a 100644
--- a/arch/arm/mach-mv78xx0/common.c
+++ b/arch/arm/mach-mv78xx0/common.c
@@ -213,7 +213,8 @@ void __init mv78xx0_ge00_init(struct mv643xx_eth_platform_data *eth_data)
 {
        orion_ge00_init(eth_data,
                        GE00_PHYS_BASE, IRQ_MV78XX0_GE00_SUM,
-                        IRQ_MV78XX0_GE_ERR);
+                        IRQ_MV78XX0_GE_ERR,
+                        MV643XX_TX_CSUM_DEFAULT_LIMIT);
 }
@@ -224,7 +225,8 @@ void __init mv78xx0_ge01_init(struct mv643xx_eth_platform_data *eth_data)
 {
        orion_ge01_init(eth_data,
                        GE01_PHYS_BASE, IRQ_MV78XX0_GE01_SUM,
-                        NO_IRQ);
+                        NO_IRQ,
+                        MV643XX_TX_CSUM_DEFAULT_LIMIT);
 }
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index dd2db025f778..346fd26f3aa6 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -62,13 +62,14 @@ config ARCH_OMAP4
        select PM_OPP if PM
        select USB_ARCH_HAS_EHCI if USB_SUPPORT
        select ARM_CPU_SUSPEND if PM
-        select ARCH_NEEDS_CPU_IDLE_COUPLED
+        select ARCH_NEEDS_CPU_IDLE_COUPLED if SMP
 config SOC_OMAP5
        bool "TI OMAP5"
        select CPU_V7
        select ARM_GIC
        select HAVE_SMP
+        select ARM_CPU_SUSPEND if PM
 comment "OMAP Core Type"
        depends on ARCH_OMAP2
@@ -231,10 +232,11 @@ config MACH_OMAP3_PANDORA
        select OMAP_PACKAGE_CBB
        select REGULATOR_FIXED_VOLTAGE if REGULATOR
-config MACH_OMAP3_TOUCHBOOK
+config MACH_TOUCHBOOK
        bool "OMAP3 Touch Book"
        depends on ARCH_OMAP3
        default y
+        select OMAP_PACKAGE_CBB
 config MACH_OMAP_3430SDP
        bool "OMAP 3430 SDP board"
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index f6a24b3f9c4f..34c2c7f59f0a 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -255,7 +255,7 @@ obj-$(CONFIG_MACH_OMAP_3630SDP)		+= board-zoom-display.o
 obj-$(CONFIG_MACH_CM_T35)               += board-cm-t35.o
 obj-$(CONFIG_MACH_CM_T3517)             += board-cm-t3517.o
 obj-$(CONFIG_MACH_IGEP0020)             += board-igep0020.o
-obj-$(CONFIG_MACH_OMAP3_TOUCHBOOK)      += board-omap3touchbook.o
+obj-$(CONFIG_MACH_TOUCHBOOK)            += board-omap3touchbook.o
 obj-$(CONFIG_MACH_OMAP_4430SDP)         += board-4430sdp.o
 obj-$(CONFIG_MACH_OMAP4_PANDA)          += board-omap4panda.o
diff --git a/arch/arm/mach-omap2/board-igep0020.c b/arch/arm/mach-omap2/board-igep0020.c
index 74915295482e..28214483aaba 100644
--- a/arch/arm/mach-omap2/board-igep0020.c
+++ b/arch/arm/mach-omap2/board-igep0020.c
@@ -554,6 +554,8 @@ static const struct usbhs_omap_board_data igep3_usbhs_bdata __initconst = {
 #ifdef CONFIG_OMAP_MUX
 static struct omap_board_mux board_mux[] __initdata = {
+        /* SMSC9221 LAN Controller ETH IRQ (GPIO_176) */
+        OMAP3_MUX(MCSPI1_CS2, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
        { .reg_offset = OMAP_MUX_TERMINATOR },
 };
 #endif
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index ef230a0eb5eb..0d362e9f9cb9 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -58,6 +58,7 @@
 #include "hsmmc.h"
 #include "common-board-devices.h"
+#define OMAP3_EVM_TS_GPIO       175
 #define OMAP3_EVM_EHCI_VBUS     22
 #define OMAP3_EVM_EHCI_SELECT   61
diff --git a/arch/arm/mach-omap2/clock33xx_data.c b/arch/arm/mach-omap2/clock33xx_data.c
index 25bbcc7ca4dc..ae27de8899a6 100644
--- a/arch/arm/mach-omap2/clock33xx_data.c
+++ b/arch/arm/mach-omap2/clock33xx_data.c
@@ -1036,13 +1036,13 @@ static struct omap_clk am33xx_clks[] = {
        CLK(NULL,       "mmu_fck",              &mmu_fck,       CK_AM33XX),
        CLK(NULL,       "smartreflex0_fck",     &smartreflex0_fck,      CK_AM33XX),
        CLK(NULL,       "smartreflex1_fck",     &smartreflex1_fck,      CK_AM33XX),
-        CLK(NULL,       "gpt1_fck",             &timer1_fck,    CK_AM33XX),
+        CLK(NULL,       "timer1_fck",           &timer1_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt2_fck",             &timer2_fck,    CK_AM33XX),
+        CLK(NULL,       "timer2_fck",           &timer2_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt3_fck",             &timer3_fck,    CK_AM33XX),
+        CLK(NULL,       "timer3_fck",           &timer3_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt4_fck",             &timer4_fck,    CK_AM33XX),
+        CLK(NULL,       "timer4_fck",           &timer4_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt5_fck",             &timer5_fck,    CK_AM33XX),
+        CLK(NULL,       "timer5_fck",           &timer5_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt6_fck",             &timer6_fck,    CK_AM33XX),
+        CLK(NULL,       "timer6_fck",           &timer6_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt7_fck",             &timer7_fck,    CK_AM33XX),
+        CLK(NULL,       "timer7_fck",           &timer7_fck,    CK_AM33XX),
        CLK(NULL,       "usbotg_fck",           &usbotg_fck,    CK_AM33XX),
        CLK(NULL,       "ieee5000_fck",         &ieee5000_fck,  CK_AM33XX),
        CLK(NULL,       "wdt1_fck",             &wdt1_fck,      CK_AM33XX),
diff --git a/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c b/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
index a0d68dbecfa3..f99e65cfb862 100644
--- a/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
+++ b/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
@@ -241,6 +241,52 @@ static void omap3_clkdm_deny_idle(struct clockdomain *clkdm)
                _clkdm_del_autodeps(clkdm);
 }
+static int omap3xxx_clkdm_clk_enable(struct clockdomain *clkdm)
+{
+        bool hwsup = false;
+        if (!clkdm->clktrctrl_mask)
+                return 0;
+        hwsup = omap2_cm_is_clkdm_in_hwsup(clkdm->pwrdm.ptr->prcm_offs,
+                                clkdm->clktrctrl_mask);
+        if (hwsup) {
+                /* Disable HW transitions when we are changing deps */
+                _disable_hwsup(clkdm);
+                _clkdm_add_autodeps(clkdm);
+                _enable_hwsup(clkdm);
+        } else {
+                if (clkdm->flags & CLKDM_CAN_FORCE_WAKEUP)
+                        omap3_clkdm_wakeup(clkdm);
+        }
+        return 0;
+}
+static int omap3xxx_clkdm_clk_disable(struct clockdomain *clkdm)
+{
+        bool hwsup = false;
+        if (!clkdm->clktrctrl_mask)
+                return 0;
+        hwsup = omap2_cm_is_clkdm_in_hwsup(clkdm->pwrdm.ptr->prcm_offs,
+                                clkdm->clktrctrl_mask);
+        if (hwsup) {
+                /* Disable HW transitions when we are changing deps */
+                _disable_hwsup(clkdm);
+                _clkdm_del_autodeps(clkdm);
+                _enable_hwsup(clkdm);
+        } else {
+                if (clkdm->flags & CLKDM_CAN_FORCE_SLEEP)
+                        omap3_clkdm_sleep(clkdm);
+        }
+        return 0;
+}
 struct clkdm_ops omap2_clkdm_operations = {
        .clkdm_add_wkdep        = omap2_clkdm_add_wkdep,
        .clkdm_del_wkdep        = omap2_clkdm_del_wkdep,
@@ -267,6 +313,6 @@ struct clkdm_ops omap3_clkdm_operations = {
        .clkdm_wakeup           = omap3_clkdm_wakeup,
        .clkdm_allow_idle       = omap3_clkdm_allow_idle,
        .clkdm_deny_idle        = omap3_clkdm_deny_idle,
-        .clkdm_clk_enable       = omap2_clkdm_clk_enable,
+        .clkdm_clk_enable       = omap3xxx_clkdm_clk_enable,
-        .clkdm_clk_disable      = omap2_clkdm_clk_disable,
+        .clkdm_clk_disable      = omap3xxx_clkdm_clk_disable,
 };
diff --git a/arch/arm/mach-omap2/cm-regbits-34xx.h b/arch/arm/mach-omap2/cm-regbits-34xx.h
index 766338fe4d34..975f6bda0e0b 100644
--- a/arch/arm/mach-omap2/cm-regbits-34xx.h
+++ b/arch/arm/mach-omap2/cm-regbits-34xx.h
@@ -67,6 +67,7 @@
 #define OMAP3430_EN_IVA2_DPLL_MASK                      (0x7 << 0)
 /* CM_IDLEST_IVA2 */
+#define OMAP3430_ST_IVA2_SHIFT                          0
 #define OMAP3430_ST_IVA2_MASK                           (1 << 0)
 /* CM_IDLEST_PLL_IVA2 */
diff --git a/arch/arm/mach-omap2/common-board-devices.c b/arch/arm/mach-omap2/common-board-devices.c
index 14734746457c..c1875862679f 100644
--- a/arch/arm/mach-omap2/common-board-devices.c
+++ b/arch/arm/mach-omap2/common-board-devices.c
@@ -35,16 +35,6 @@ static struct omap2_mcspi_device_config ads7846_mcspi_config = {
        .turbo_mode     = 0,
 };
-/*
- * ADS7846 driver maybe request a gpio according to the value
- * of pdata->get_pendown_state, but we have done this. So set
- * get_pendown_state to avoid twice gpio requesting.
- */
-static int omap3_get_pendown_state(void)
-{
-        return !gpio_get_value(OMAP3_EVM_TS_GPIO);
-}
 static struct ads7846_platform_data ads7846_config = {
        .x_max                  = 0x0fff,
        .y_max                  = 0x0fff,
@@ -55,7 +45,6 @@ static struct ads7846_platform_data ads7846_config = {
        .debounce_rep           = 1,
        .gpio_pendown           = -EINVAL,
        .keep_vref_on           = 1,
-        .get_pendown_state      = &omap3_get_pendown_state,
 };
 static struct spi_board_info ads7846_spi_board_info __initdata = {
diff --git a/arch/arm/mach-omap2/common-board-devices.h b/arch/arm/mach-omap2/common-board-devices.h
index 4c4ef6a6166b..a0b4a42836ab 100644
--- a/arch/arm/mach-omap2/common-board-devices.h
+++ b/arch/arm/mach-omap2/common-board-devices.h
@@ -4,7 +4,6 @@
 #include "twl-common.h"
 #define NAND_BLOCK_SIZE SZ_128K
-#define OMAP3_EVM_TS_GPIO       175
 struct mtd_partition;
 struct ads7846_platform_data;
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index ee05e193fc61..288bee6cbb76 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -238,8 +238,9 @@ int __init omap4_idle_init(void)
        for_each_cpu(cpu_id, cpu_online_mask) {
                dev = &per_cpu(omap4_idle_dev, cpu_id);
                dev->cpu = cpu_id;
+#ifdef CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED
                dev->coupled_cpus = *cpu_online_mask;
+#endif
                cpuidle_register_driver(&omap4_idle_driver);
                if (cpuidle_register_device(dev)) {
diff --git a/arch/arm/mach-omap2/mux.h b/arch/arm/mach-omap2/mux.h
index 471e62a74a16..76f9b3c2f586 100644
--- a/arch/arm/mach-omap2/mux.h
+++ b/arch/arm/mach-omap2/mux.h
@@ -127,7 +127,6 @@ struct omap_mux_partition {
 * @gpio:       GPIO number
 * @muxnames:   available signal modes for a ball
 * @balls:      available balls on the package
- * @partition:  mux partition
 */
 struct omap_mux {
        u16     reg_offset;
diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
index 05fdebfaa195..330d4c6e746b 100644
--- a/arch/arm/mach-omap2/omap-wakeupgen.c
+++ b/arch/arm/mach-omap2/omap-wakeupgen.c
@@ -46,7 +46,7 @@
 static void __iomem *wakeupgen_base;
 static void __iomem *sar_base;
 static DEFINE_SPINLOCK(wakeupgen_lock);
-static unsigned int irq_target_cpu[NR_IRQS];
+static unsigned int irq_target_cpu[MAX_IRQS];
 static unsigned int irq_banks = MAX_NR_REG_BANKS;
 static unsigned int max_irqs = MAX_IRQS;
 static unsigned int omap_secure_apis;
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 6ca8e519968d..37afbd173c2c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1889,6 +1889,7 @@ static int _enable(struct omap_hwmod *oh)
                        _enable_sysc(oh);
                }
        } else {
+                _omap4_disable_module(oh);
                _disable_clocks(oh);
                pr_debug("omap_hwmod: %s: _wait_target_ready: %d\n",
                         oh->name, r);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index c9e38200216b..ce7e6068768f 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -100,9 +100,9 @@ static struct omap_hwmod omap3xxx_mpu_hwmod = {
 /* IVA2 (IVA2) */
 static struct omap_hwmod_rst_info omap3xxx_iva_resets[] = {
-        { .name = "logic", .rst_shift = 0 },
+        { .name = "logic", .rst_shift = 0, .st_shift = 8 },
-        { .name = "seq0", .rst_shift = 1 },
+        { .name = "seq0", .rst_shift = 1, .st_shift = 9 },
-        { .name = "seq1", .rst_shift = 2 },
+        { .name = "seq1", .rst_shift = 2, .st_shift = 10 },
 };
 static struct omap_hwmod omap3xxx_iva_hwmod = {
@@ -112,6 +112,15 @@ static struct omap_hwmod omap3xxx_iva_hwmod = {
        .rst_lines      = omap3xxx_iva_resets,
        .rst_lines_cnt  = ARRAY_SIZE(omap3xxx_iva_resets),
        .main_clk       = "iva2_ck",
+        .prcm = {
+                .omap2 = {
+                        .module_offs = OMAP3430_IVA2_MOD,
+                        .prcm_reg_id = 1,
+                        .module_bit = OMAP3430_CM_FCLKEN_IVA2_EN_IVA2_SHIFT,
+                        .idlest_reg_id = 1,
+                        .idlest_idle_bit = OMAP3430_ST_IVA2_SHIFT,
+                }
+        },
 };
 /* timer class */
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 242aee498ceb..afb60917a948 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -4210,7 +4210,7 @@ static struct omap_hwmod_ocp_if omap44xx_dsp__iva = {
 };
 /* dsp -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_dsp__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_dsp__sl2if = {
        .master         = &omap44xx_dsp_hwmod,
        .slave          = &omap44xx_sl2if_hwmod,
        .clk            = "dpll_iva_m5x2_ck",
@@ -4828,7 +4828,7 @@ static struct omap_hwmod_ocp_if omap44xx_l3_main_2__iss = {
 };
 /* iva -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_iva__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_iva__sl2if = {
        .master         = &omap44xx_iva_hwmod,
        .slave          = &omap44xx_sl2if_hwmod,
        .clk            = "dpll_iva_m5x2_ck",
@@ -5362,7 +5362,7 @@ static struct omap_hwmod_ocp_if omap44xx_l4_wkup__scrm = {
 };
 /* l3_main_2 -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_l3_main_2__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_l3_main_2__sl2if = {
        .master         = &omap44xx_l3_main_2_hwmod,
        .slave          = &omap44xx_sl2if_hwmod,
        .clk            = "l3_div_ck",
@@ -6032,7 +6032,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
        &omap44xx_l4_abe__dmic,
        &omap44xx_l4_abe__dmic_dma,
        &omap44xx_dsp__iva,
-        &omap44xx_dsp__sl2if,
+        /* &omap44xx_dsp__sl2if, */
        &omap44xx_l4_cfg__dsp,
        &omap44xx_l3_main_2__dss,
        &omap44xx_l4_per__dss,
@@ -6068,7 +6068,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
        &omap44xx_l4_per__i2c4,
        &omap44xx_l3_main_2__ipu,
        &omap44xx_l3_main_2__iss,
-        &omap44xx_iva__sl2if,
+        /* &omap44xx_iva__sl2if, */
        &omap44xx_l3_main_2__iva,
        &omap44xx_l4_wkup__kbd,
        &omap44xx_l4_cfg__mailbox,
@@ -6099,7 +6099,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
        &omap44xx_l4_cfg__cm_core,
        &omap44xx_l4_wkup__prm,
        &omap44xx_l4_wkup__scrm,
-        &omap44xx_l3_main_2__sl2if,
+        /* &omap44xx_l3_main_2__sl2if, */
        &omap44xx_l4_abe__slimbus1,
        &omap44xx_l4_abe__slimbus1_dma,
        &omap44xx_l4_per__slimbus2,
diff --git a/arch/arm/mach-omap2/opp4xxx_data.c b/arch/arm/mach-omap2/opp4xxx_data.c
index 2293ba27101b..c95415da23c2 100644
--- a/arch/arm/mach-omap2/opp4xxx_data.c
+++ b/arch/arm/mach-omap2/opp4xxx_data.c
@@ -94,7 +94,7 @@ int __init omap4_opp_init(void)
 {
        int r = -ENODEV;
-        if (!cpu_is_omap44xx())
+        if (!cpu_is_omap443x())
                return r;
        r = omap_init_opp_table(omap44xx_opp_def_list,
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index e4fc88c65dbd..05bd8f02723f 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -272,21 +272,16 @@ void omap_sram_idle(void)
        per_next_state = pwrdm_read_next_pwrst(per_pwrdm);
        core_next_state = pwrdm_read_next_pwrst(core_pwrdm);
-        if (mpu_next_state < PWRDM_POWER_ON) {
+        pwrdm_pre_transition(NULL);
-                pwrdm_pre_transition(mpu_pwrdm);
-                pwrdm_pre_transition(neon_pwrdm);
-        }
        /* PER */
        if (per_next_state < PWRDM_POWER_ON) {
-                pwrdm_pre_transition(per_pwrdm);
                per_going_off = (per_next_state == PWRDM_POWER_OFF) ? 1 : 0;
                omap2_gpio_prepare_for_idle(per_going_off);
        }
        /* CORE */
        if (core_next_state < PWRDM_POWER_ON) {
-                pwrdm_pre_transition(core_pwrdm);
                if (core_next_state == PWRDM_POWER_OFF) {
                        omap3_core_save_context();
                        omap3_cm_save_context();
@@ -339,20 +334,14 @@ void omap_sram_idle(void)
                        omap2_prm_clear_mod_reg_bits(OMAP3430_AUTO_OFF_MASK,
                                               OMAP3430_GR_MOD,
                                               OMAP3_PRM_VOLTCTRL_OFFSET);
-                pwrdm_post_transition(core_pwrdm);
        }
        omap3_intc_resume_idle();
+        pwrdm_post_transition(NULL);
        /* PER */
-        if (per_next_state < PWRDM_POWER_ON) {
+        if (per_next_state < PWRDM_POWER_ON)
                omap2_gpio_resume_after_idle();
-                pwrdm_post_transition(per_pwrdm);
-        }
-        if (mpu_next_state < PWRDM_POWER_ON) {
-                pwrdm_post_transition(mpu_pwrdm);
-                pwrdm_post_transition(neon_pwrdm);
-        }
 }
 static void omap3_pm_idle(void)
diff --git a/arch/arm/mach-omap2/sleep44xx.S b/arch/arm/mach-omap2/sleep44xx.S
index 9f6b83d1b193..91e71d8f46f0 100644
--- a/arch/arm/mach-omap2/sleep44xx.S
+++ b/arch/arm/mach-omap2/sleep44xx.S
@@ -56,9 +56,13 @@ ppa_por_params:
 * The restore function pointer is stored at CPUx_WAKEUP_NS_PA_ADDR_OFFSET.
 * It returns to the caller for CPU INACTIVE and ON power states or in case
 * CPU failed to transition to targeted OFF/DORMANT state.
+ *
+ * omap4_finish_suspend() calls v7_flush_dcache_all() which doesn't save
+ * stack frame and it expects the caller to take care of it. Hence the entire
+ * stack frame is saved to avoid possible stack corruption.
 */
 ENTRY(omap4_finish_suspend)
-        stmfd   sp!, {lr}
+        stmfd   sp!, {r4-r12, lr}
        cmp     r0, #0x0
        beq     do_WFI                          @ No lowpower state, jump to WFI
@@ -226,7 +230,7 @@ scu_gp_clear:
 skip_scu_gp_clear:
        isb
        dsb
-        ldmfd   sp!, {pc}
+        ldmfd   sp!, {r4-r12, pc}
 ENDPROC(omap4_finish_suspend)
 /*
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 2ff6d41ec6c6..2ba4f57dda86 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -260,6 +260,7 @@ static u32 notrace dmtimer_read_sched_clock(void)
        return 0;
 }
+#ifdef CONFIG_OMAP_32K_TIMER
 /* Setup free-running counter for clocksource */
 static int __init omap2_sync32k_clocksource_init(void)
 {
@@ -299,6 +300,12 @@ static int __init omap2_sync32k_clocksource_init(void)
        return ret;
 }
+#else
+static inline int omap2_sync32k_clocksource_init(void)
+{
+        return -ENODEV;
+}
+#endif
 static void __init omap2_gptimer_clocksource_init(int gptimer_id,
                                                const char *fck_source)
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index de47f170ba50..db5ff6642375 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -67,6 +67,7 @@ void __init omap_pmic_init(int bus, u32 clkrate,
                           const char *pmic_type, int pmic_irq,
                           struct twl4030_platform_data *pmic_data)
 {
+        omap_mux_init_signal("sys_nirq", OMAP_PIN_INPUT_PULLUP | OMAP_PIN_OFF_WAKEUPENABLE);
        strncpy(pmic_i2c_board_info.type, pmic_type,
                sizeof(pmic_i2c_board_info.type));
        pmic_i2c_board_info.irq = pmic_irq;
diff --git a/arch/arm/mach-orion5x/common.c b/arch/arm/mach-orion5x/common.c
index 9148b229d0de..410291c67666 100644
--- a/arch/arm/mach-orion5x/common.c
+++ b/arch/arm/mach-orion5x/common.c
@@ -109,7 +109,8 @@ void __init orion5x_eth_init(struct mv643xx_eth_platform_data *eth_data)
 {
        orion_ge00_init(eth_data,
                        ORION5X_ETH_PHYS_BASE, IRQ_ORION5X_ETH_SUM,
-                        IRQ_ORION5X_ETH_ERR);
+                        IRQ_ORION5X_ETH_ERR,
+                        MV643XX_TX_CSUM_DEFAULT_LIMIT);
 }
diff --git a/arch/arm/mach-s3c24xx/include/mach/dma.h b/arch/arm/mach-s3c24xx/include/mach/dma.h
index 454831b66037..ee99fd56c043 100644
--- a/arch/arm/mach-s3c24xx/include/mach/dma.h
+++ b/arch/arm/mach-s3c24xx/include/mach/dma.h
@@ -24,7 +24,8 @@
 */
 enum dma_ch {
-        DMACH_XD0,
+        DMACH_DT_PROP = -1,     /* not yet supported, do not use */
+        DMACH_XD0 = 0,
        DMACH_XD1,
        DMACH_SDI,
        DMACH_SPI0,
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index cf10f92856dc..453a6e50db8b 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -520,13 +520,14 @@ static struct platform_device hdmi_lcdc_device = {
 };
 /* GPIO KEY */
-#define GPIO_KEY(c, g, d) { .code = c, .gpio = g, .desc = d, .active_low = 1 }
+#define GPIO_KEY(c, g, d, ...) \
+        { .code = c, .gpio = g, .desc = d, .active_low = 1, __VA_ARGS__ }
 static struct gpio_keys_button gpio_buttons[] = {
-        GPIO_KEY(KEY_POWER,     GPIO_PORT99,    "SW1"),
+        GPIO_KEY(KEY_POWER,     GPIO_PORT99,    "SW3", .wakeup = 1),
-        GPIO_KEY(KEY_BACK,      GPIO_PORT100,   "SW2"),
+        GPIO_KEY(KEY_BACK,      GPIO_PORT100,   "SW4"),
-        GPIO_KEY(KEY_MENU,      GPIO_PORT97,    "SW3"),
+        GPIO_KEY(KEY_MENU,      GPIO_PORT97,    "SW5"),
-        GPIO_KEY(KEY_HOME,      GPIO_PORT98,    "SW4"),
+        GPIO_KEY(KEY_HOME,      GPIO_PORT98,    "SW6"),
 };
 static struct gpio_keys_platform_data gpio_key_info = {
@@ -901,8 +902,8 @@ static struct platform_device *eva_devices[] __initdata = {
        &camera_device,
        &ceu0_device,
        &fsi_device,
-        &fsi_hdmi_device,
        &fsi_wm8978_device,
+        &fsi_hdmi_device,
 };
 static void __init eva_clock_init(void)
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 7ea2b31e3199..c129542f6aed 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -695,6 +695,7 @@ static struct platform_device usbhs0_device = {
 *  - J30 "open"
 *  - modify usbhs1_get_id() USBHS_HOST -> USBHS_GADGET
 *  - add .get_vbus = usbhs_get_vbus in usbhs1_private
+ *  - check usbhs0_device(pio)/usbhs1_device(irq) order in mackerel_devices.
 */
 #define IRQ8 evt2irq(0x0300)
 #define USB_PHY_MODE            (1 << 4)
@@ -1325,8 +1326,8 @@ static struct platform_device *mackerel_devices[] __initdata = {
        &nor_flash_device,
        &smc911x_device,
        &lcdc_device,
-        &usbhs1_device,
        &usbhs0_device,
+        &usbhs1_device,
        &leds_device,
        &fsi_device,
        &fsi_ak4643_device,
diff --git a/arch/arm/mach-shmobile/board-marzen.c b/arch/arm/mach-shmobile/board-marzen.c
index 3a528cf4366c..fcf5a47f4772 100644
--- a/arch/arm/mach-shmobile/board-marzen.c
+++ b/arch/arm/mach-shmobile/board-marzen.c
@@ -67,7 +67,7 @@ static struct smsc911x_platform_config smsc911x_platdata = {
 static struct platform_device eth_device = {
        .name           = "smsc911x",
-        .id             = 0,
+        .id             = -1,
        .dev  = {
                .platform_data = &smsc911x_platdata,
        },
diff --git a/arch/arm/mach-shmobile/intc-sh73a0.c b/arch/arm/mach-shmobile/intc-sh73a0.c
index ee447404c857..588555a67d9c 100644
--- a/arch/arm/mach-shmobile/intc-sh73a0.c
+++ b/arch/arm/mach-shmobile/intc-sh73a0.c
@@ -259,9 +259,9 @@ static int sh73a0_set_wake(struct irq_data *data, unsigned int on)
        return 0; /* always allow wakeup */
 }
-#define RELOC_BASE 0x1000
+#define RELOC_BASE 0x1200
-/* INTCA IRQ pins at INTCS + 0x1000 to make space for GIC+INTC handling */
+/* INTCA IRQ pins at INTCS + RELOC_BASE to make space for GIC+INTC handling */
 #define INTCS_VECT_RELOC(n, vect) INTCS_VECT((n), (vect) + RELOC_BASE)
 INTC_IRQ_PINS_32(intca_irq_pins, 0xe6900000,
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index c013bbf79cac..53d3d46dec12 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -41,7 +41,6 @@ config MACH_HREFV60
 config MACH_SNOWBALL
        bool "U8500 Snowball platform"
        select MACH_MOP500
-        select LEDS_GPIO
        help
          Include support for the snowball development platform.
diff --git a/arch/arm/mach-ux500/board-mop500-msp.c b/arch/arm/mach-ux500/board-mop500-msp.c
index 996048038743..df15646036aa 100644
--- a/arch/arm/mach-ux500/board-mop500-msp.c
+++ b/arch/arm/mach-ux500/board-mop500-msp.c
@@ -191,9 +191,9 @@ static struct platform_device *db8500_add_msp_i2s(struct device *parent,
        return pdev;
 }
-/* Platform device for ASoC U8500 machine */
+/* Platform device for ASoC MOP500 machine */
-static struct platform_device snd_soc_u8500 = {
+static struct platform_device snd_soc_mop500 = {
-                .name = "snd-soc-u8500",
+                .name = "snd-soc-mop500",
                .id = 0,
                .dev = {
                        .platform_data = NULL,
@@ -227,8 +227,8 @@ int mop500_msp_init(struct device *parent)
 {
        struct platform_device *msp1;
-        pr_info("%s: Register platform-device 'snd-soc-u8500'.\n", __func__);
+        pr_info("%s: Register platform-device 'snd-soc-mop500'.\n", __func__);
-        platform_device_register(&snd_soc_u8500);
+        platform_device_register(&snd_soc_mop500);
        pr_info("Initialize MSP I2S-devices.\n");
        db8500_add_msp_i2s(parent, 0, U8500_MSP0_BASE, IRQ_DB8500_MSP0,
diff --git a/arch/arm/mach-ux500/board-mop500.c b/arch/arm/mach-ux500/board-mop500.c
index 8674a890fd1c..a534d8880de1 100644
--- a/arch/arm/mach-ux500/board-mop500.c
+++ b/arch/arm/mach-ux500/board-mop500.c
@@ -797,6 +797,7 @@ static void __init u8500_init_machine(void)
                                ARRAY_SIZE(mop500_platform_devs));
                mop500_sdi_init(parent);
+                mop500_msp_init(parent);
                i2c0_devs = ARRAY_SIZE(mop500_i2c0_devices);
                i2c_register_board_info(0, mop500_i2c0_devices, i2c0_devs);
                i2c_register_board_info(2, mop500_i2c2_devices,
@@ -804,6 +805,8 @@ static void __init u8500_init_machine(void)
                mop500_uib_init();
+        } else if (of_machine_is_compatible("calaosystems,snowball-a9500")) {
+                mop500_msp_init(parent);
        } else if (of_machine_is_compatible("st-ericsson,hrefv60+")) {
                /*
                 * The HREFv60 board removed a GPIO expander and routed
@@ -815,6 +818,7 @@ static void __init u8500_init_machine(void)
                                ARRAY_SIZE(mop500_platform_devs));
                hrefv60_sdi_init(parent);
+                mop500_msp_init(parent);
                i2c0_devs = ARRAY_SIZE(mop500_i2c0_devices);
                i2c0_devs -= NUM_PRE_V60_I2C0_DEVICES;
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 119bc52ab93e..4e07eec1270d 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -63,10 +63,11 @@ static int contextidr_notifier(struct notifier_block *unused, unsigned long cmd,
        pid = task_pid_nr(thread->task) << ASID_BITS;
        asm volatile(
        "       mrc     p15, 0, %0, c13, c0, 1\n"
-        "       bfi     %1, %0, #0, %2\n"
+        "       and     %0, %0, %2\n"
-        "       mcr     p15, 0, %1, c13, c0, 1\n"
+        "       orr     %0, %0, %1\n"
+        "       mcr     p15, 0, %0, c13, c0, 1\n"
        : "=r" (contextidr), "+r" (pid)
-        : "I" (ASID_BITS));
+        : "I" (~ASID_MASK));
        isb();
        return NOTIFY_OK;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 4e7d1182e8a3..e59c4ab71bcb 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -267,17 +267,19 @@ static void __dma_free_remap(void *cpu_addr, size_t size)
        vunmap(cpu_addr);
 }
+#define DEFAULT_DMA_COHERENT_POOL_SIZE  SZ_256K
 struct dma_pool {
        size_t size;
        spinlock_t lock;
        unsigned long *bitmap;
        unsigned long nr_pages;
        void *vaddr;
-        struct page *page;
+        struct page **pages;
 };
 static struct dma_pool atomic_pool = {
-        .size = SZ_256K,
+        .size = DEFAULT_DMA_COHERENT_POOL_SIZE,
 };
 static int __init early_coherent_pool(char *p)
@@ -287,6 +289,21 @@ static int __init early_coherent_pool(char *p)
 }
 early_param("coherent_pool", early_coherent_pool);
+void __init init_dma_coherent_pool_size(unsigned long size)
+{
+        /*
+         * Catch any attempt to set the pool size too late.
+         */
+        BUG_ON(atomic_pool.vaddr);
+        /*
+         * Set architecture specific coherent pool size only if
+         * it has not been changed by kernel command line parameter.
+         */
+        if (atomic_pool.size == DEFAULT_DMA_COHERENT_POOL_SIZE)
+                atomic_pool.size = size;
+}
 /*
 * Initialise the coherent pool for atomic allocations.
 */
@@ -297,6 +314,7 @@ static int __init atomic_pool_init(void)
        unsigned long nr_pages = pool->size >> PAGE_SHIFT;
        unsigned long *bitmap;
        struct page *page;
+        struct page **pages;
        void *ptr;
        int bitmap_size = BITS_TO_LONGS(nr_pages) * sizeof(long);
@@ -304,21 +322,31 @@ static int __init atomic_pool_init(void)
        if (!bitmap)
                goto no_bitmap;
+        pages = kzalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
+        if (!pages)
+                goto no_pages;
        if (IS_ENABLED(CONFIG_CMA))
                ptr = __alloc_from_contiguous(NULL, pool->size, prot, &page);
        else
                ptr = __alloc_remap_buffer(NULL, pool->size, GFP_KERNEL, prot,
                                           &page, NULL);
        if (ptr) {
+                int i;
+                for (i = 0; i < nr_pages; i++)
+                        pages[i] = page + i;
                spin_lock_init(&pool->lock);
                pool->vaddr = ptr;
-                pool->page = page;
+                pool->pages = pages;
                pool->bitmap = bitmap;
                pool->nr_pages = nr_pages;
                pr_info("DMA: preallocated %u KiB pool for atomic coherent allocations\n",
                       (unsigned)pool->size / 1024);
                return 0;
        }
+no_pages:
        kfree(bitmap);
 no_bitmap:
        pr_err("DMA: failed to allocate %u KiB pool for atomic coherent allocation\n",
@@ -443,27 +471,45 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
        if (pageno < pool->nr_pages) {
                bitmap_set(pool->bitmap, pageno, count);
                ptr = pool->vaddr + PAGE_SIZE * pageno;
-                *ret_page = pool->page + pageno;
+                *ret_page = pool->pages[pageno];
+        } else {
+                pr_err_once("ERROR: %u KiB atomic DMA coherent pool is too small!\n"
+                            "Please increase it with coherent_pool= kernel parameter!\n",
+                            (unsigned)pool->size / 1024);
        }
        spin_unlock_irqrestore(&pool->lock, flags);
        return ptr;
 }
+static bool __in_atomic_pool(void *start, size_t size)
+{
+        struct dma_pool *pool = &atomic_pool;
+        void *end = start + size;
+        void *pool_start = pool->vaddr;
+        void *pool_end = pool->vaddr + pool->size;
+        if (start < pool_start || start >= pool_end)
+                return false;
+        if (end <= pool_end)
+                return true;
+        WARN(1, "Wrong coherent size(%p-%p) from atomic pool(%p-%p)\n",
+             start, end - 1, pool_start, pool_end - 1);
+        return false;
+}
 static int __free_from_pool(void *start, size_t size)
 {
        struct dma_pool *pool = &atomic_pool;
        unsigned long pageno, count;
        unsigned long flags;
-        if (start < pool->vaddr || start > pool->vaddr + pool->size)
+        if (!__in_atomic_pool(start, size))
                return 0;
-        if (start + size > pool->vaddr + pool->size) {
-                WARN(1, "freeing wrong coherent size from pool\n");
-                return 0;
-        }
        pageno = (start - pool->vaddr) >> PAGE_SHIFT;
        count = size >> PAGE_SHIFT;
@@ -1090,10 +1136,22 @@ static int __iommu_remove_mapping(struct device *dev, dma_addr_t iova, size_t si
        return 0;
 }
+static struct page **__atomic_get_pages(void *addr)
+{
+        struct dma_pool *pool = &atomic_pool;
+        struct page **pages = pool->pages;
+        int offs = (addr - pool->vaddr) >> PAGE_SHIFT;
+        return pages + offs;
+}
 static struct page **__iommu_get_pages(void *cpu_addr, struct dma_attrs *attrs)
 {
        struct vm_struct *area;
+        if (__in_atomic_pool(cpu_addr, PAGE_SIZE))
+                return __atomic_get_pages(cpu_addr);
        if (dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs))
                return cpu_addr;
@@ -1103,6 +1161,34 @@ static struct page **__iommu_get_pages(void *cpu_addr, struct dma_attrs *attrs)
        return NULL;
 }
+static void *__iommu_alloc_atomic(struct device *dev, size_t size,
+                                  dma_addr_t *handle)
+{
+        struct page *page;
+        void *addr;
+        addr = __alloc_from_pool(size, &page);
+        if (!addr)
+                return NULL;
+        *handle = __iommu_create_mapping(dev, &page, size);
+        if (*handle == DMA_ERROR_CODE)
+                goto err_mapping;
+        return addr;
+err_mapping:
+        __free_from_pool(addr, size);
+        return NULL;
+}
+static void __iommu_free_atomic(struct device *dev, struct page **pages,
+                                dma_addr_t handle, size_t size)
+{
+        __iommu_remove_mapping(dev, handle, size);
+        __free_from_pool(page_address(pages[0]), size);
+}
 static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
            dma_addr_t *handle, gfp_t gfp, struct dma_attrs *attrs)
 {
@@ -1113,6 +1199,9 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
        *handle = DMA_ERROR_CODE;
        size = PAGE_ALIGN(size);
+        if (gfp & GFP_ATOMIC)
+                return __iommu_alloc_atomic(dev, size, handle);
        pages = __iommu_alloc_buffer(dev, size, gfp);
        if (!pages)
                return NULL;
@@ -1179,6 +1268,11 @@ void arm_iommu_free_attrs(struct device *dev, size_t size, void *cpu_addr,
                return;
        }
+        if (__in_atomic_pool(cpu_addr, size)) {
+                __iommu_free_atomic(dev, pages, handle, size);
+                return;
+        }
        if (!dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs)) {
                unmap_kernel_range((unsigned long)cpu_addr, size);
                vunmap(cpu_addr);
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 77458548e031..40ca11ed6e5f 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -231,8 +231,6 @@ void __sync_icache_dcache(pte_t pteval)
        struct page *page;
        struct address_space *mapping;
-        if (!pte_present_user(pteval))
-                return;
        if (cache_is_vipt_nonaliasing() && !pte_exec(pteval))
                /* only flush non-aliasing VIPT caches for exec mappings */
                return;
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index 6776160618ef..a8ee92da3544 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
 /* permanent static mappings from iotable_init() */
 #define VM_ARM_STATIC_MAPPING   0x40000000
+/* empty mapping */
+#define VM_ARM_EMPTY_MAPPING    0x20000000
 /* mapping type (attributes) for permanent static mappings */
 #define VM_ARM_MTYPE(mt)                ((mt) << 20)
 #define VM_ARM_MTYPE_MASK       (0x1f << 20)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4c2d0451e84a..c2fa21d0103e 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -807,7 +807,7 @@ static void __init pmd_empty_section_gap(unsigned long addr)
        vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
        vm->addr = (void *)addr;
        vm->size = SECTION_SIZE;
-        vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
+        vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING;
        vm->caller = pmd_empty_section_gap;
        vm_area_add_early(vm);
 }
@@ -820,7 +820,7 @@ static void __init fill_pmd_gaps(void)
        /* we're still single threaded hence no lock needed here */
        for (vm = vmlist; vm; vm = vm->next) {
-                if (!(vm->flags & VM_ARM_STATIC_MAPPING))
+                if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING)))
                        continue;
                addr = (unsigned long)vm->addr;
                if (addr < next)
@@ -961,8 +961,8 @@ void __init sanity_check_meminfo(void)
                 * Check whether this memory bank would partially overlap
                 * the vmalloc area.
                 */
-                if (__va(bank->start + bank->size) > vmalloc_min ||
+                if (__va(bank->start + bank->size - 1) >= vmalloc_min ||
-                    __va(bank->start + bank->size) < __va(bank->start)) {
+                    __va(bank->start + bank->size - 1) <= __va(bank->start)) {
                        unsigned long newsize = vmalloc_min - __va(bank->start);
                        printk(KERN_NOTICE "Truncating RAM at %.8llx-%.8llx "
                               "to -%.8llx (vmalloc region overlap).\n",
diff --git a/arch/arm/mm/tlb-v7.S b/arch/arm/mm/tlb-v7.S
index c2021139cb56..ea94765acf9a 100644
--- a/arch/arm/mm/tlb-v7.S
+++ b/arch/arm/mm/tlb-v7.S
@@ -38,10 +38,10 @@ ENTRY(v7wbi_flush_user_tlb_range)
        dsb
        mov     r0, r0, lsr #PAGE_SHIFT         @ align address
        mov     r1, r1, lsr #PAGE_SHIFT
-#ifdef CONFIG_ARM_ERRATA_720789
-        mov     r3, #0
-#else
        asid    r3, r3                          @ mask ASID
+#ifdef CONFIG_ARM_ERRATA_720789
+        ALT_SMP(W(mov)  r3, #0  )
+        ALT_UP(W(nop)           )
 #endif
        orr     r0, r3, r0, lsl #PAGE_SHIFT     @ Create initial MVA
        mov     r1, r1, lsl #PAGE_SHIFT
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index 626ad8cad7a9..938b50a33439 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -189,6 +189,7 @@ struct omap_dm_timer *omap_dm_timer_request(void)
                timer->reserved = 1;
                break;
        }
+        spin_unlock_irqrestore(&dm_timer_lock, flags);
        if (timer) {
                ret = omap_dm_timer_prepare(timer);
@@ -197,7 +198,6 @@ struct omap_dm_timer *omap_dm_timer_request(void)
                        timer = NULL;
                }
        }
-        spin_unlock_irqrestore(&dm_timer_lock, flags);
        if (!timer)
                pr_debug("%s: timer request failed!\n", __func__);
@@ -220,6 +220,7 @@ struct omap_dm_timer *omap_dm_timer_request_specific(int id)
                        break;
                }
        }
+        spin_unlock_irqrestore(&dm_timer_lock, flags);
        if (timer) {
                ret = omap_dm_timer_prepare(timer);
@@ -228,7 +229,6 @@ struct omap_dm_timer *omap_dm_timer_request_specific(int id)
                        timer = NULL;
                }
        }
-        spin_unlock_irqrestore(&dm_timer_lock, flags);
        if (!timer)
                pr_debug("%s: timer%d request failed!\n", __func__, id);
@@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(omap_dm_timer_enable);
 void omap_dm_timer_disable(struct omap_dm_timer *timer)
 {
-        pm_runtime_put(&timer->pdev->dev);
+        pm_runtime_put_sync(&timer->pdev->dev);
 }
 EXPORT_SYMBOL_GPL(omap_dm_timer_disable);
diff --git a/arch/arm/plat-omap/include/plat/cpu.h b/arch/arm/plat-omap/include/plat/cpu.h
index 68b180edcfff..bb5d08a70dbc 100644
--- a/arch/arm/plat-omap/include/plat/cpu.h
+++ b/arch/arm/plat-omap/include/plat/cpu.h
@@ -372,7 +372,8 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define cpu_class_is_omap1()    (cpu_is_omap7xx() || cpu_is_omap15xx() || \
                                cpu_is_omap16xx())
 #define cpu_class_is_omap2()    (cpu_is_omap24xx() || cpu_is_omap34xx() || \
-                                cpu_is_omap44xx() || soc_is_omap54xx())
+                                cpu_is_omap44xx() || soc_is_omap54xx() || \
+                                soc_is_am33xx())
 /* Various silicon revisions for omap2 */
 #define OMAP242X_CLASS          0x24200024
diff --git a/arch/arm/plat-omap/include/plat/multi.h b/arch/arm/plat-omap/include/plat/multi.h
index 045e320f1067..324d31b14852 100644
--- a/arch/arm/plat-omap/include/plat/multi.h
+++ b/arch/arm/plat-omap/include/plat/multi.h
@@ -108,4 +108,13 @@
 # endif
 #endif
+#ifdef CONFIG_SOC_AM33XX
+# ifdef OMAP_NAME
+#  undef  MULTI_OMAP2
+#  define MULTI_OMAP2
+# else
+#  define OMAP_NAME am33xx
+# endif
+#endif
 #endif  /* __PLAT_OMAP_MULTI_H */
diff --git a/arch/arm/plat-omap/include/plat/uncompress.h b/arch/arm/plat-omap/include/plat/uncompress.h
index b8d19a136781..7f7b112acccb 100644
--- a/arch/arm/plat-omap/include/plat/uncompress.h
+++ b/arch/arm/plat-omap/include/plat/uncompress.h
@@ -110,7 +110,7 @@ static inline void flush(void)
        _DEBUG_LL_ENTRY(mach, AM33XX_UART##p##_BASE, OMAP_PORT_SHIFT,   \
                AM33XXUART##p)
-static inline void __arch_decomp_setup(unsigned long arch_id)
+static inline void arch_decomp_setup(void)
 {
        int port = 0;
@@ -198,8 +198,6 @@ static inline void __arch_decomp_setup(unsigned long arch_id)
        } while (0);
 }
-#define arch_decomp_setup()     __arch_decomp_setup(arch_id)
 /*
 * nothing to do
 */
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 766181cb5c95..024f3b08db29 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -68,6 +68,7 @@
 static unsigned long omap_sram_start;
 static void __iomem *omap_sram_base;
+static unsigned long omap_sram_skip;
 static unsigned long omap_sram_size;
 static void __iomem *omap_sram_ceil;
@@ -106,6 +107,7 @@ static int is_sram_locked(void)
 */
 static void __init omap_detect_sram(void)
 {
+        omap_sram_skip = SRAM_BOOTLOADER_SZ;
        if (cpu_class_is_omap2()) {
                if (is_sram_locked()) {
                        if (cpu_is_omap34xx()) {
@@ -113,6 +115,7 @@ static void __init omap_detect_sram(void)
                                if ((omap_type() == OMAP2_DEVICE_TYPE_EMU) ||
                                    (omap_type() == OMAP2_DEVICE_TYPE_SEC)) {
                                        omap_sram_size = 0x7000; /* 28K */
+                                        omap_sram_skip += SZ_16K;
                                } else {
                                        omap_sram_size = 0x8000; /* 32K */
                                }
@@ -175,8 +178,10 @@ static void __init omap_map_sram(void)
                return;
 #ifdef CONFIG_OMAP4_ERRATA_I688
+        if (cpu_is_omap44xx()) {
                omap_sram_start += PAGE_SIZE;
                omap_sram_size -= SZ_16K;
+        }
 #endif
        if (cpu_is_omap34xx()) {
                /*
@@ -203,8 +208,8 @@ static void __init omap_map_sram(void)
         * Looks like we need to preserve some bootloader code at the
         * beginning of SRAM for jumping to flash for reboot to work...
         */
-        memset_io(omap_sram_base + SRAM_BOOTLOADER_SZ, 0,
+        memset_io(omap_sram_base + omap_sram_skip, 0,
-                  omap_sram_size - SRAM_BOOTLOADER_SZ);
+                  omap_sram_size - omap_sram_skip);
 }
 /*
@@ -218,7 +223,7 @@ void *omap_sram_push_address(unsigned long size)
 {
        unsigned long available, new_ceil = (unsigned long)omap_sram_ceil;
-        available = omap_sram_ceil - (omap_sram_base + SRAM_BOOTLOADER_SZ);
+        available = omap_sram_ceil - (omap_sram_base + omap_sram_skip);
        if (size > available) {
                pr_err("Not enough space in SRAM\n");
diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
index d245a87dc014..b8b747a9d360 100644
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -291,10 +291,12 @@ static struct platform_device orion_ge00 = {
 void __init orion_ge00_init(struct mv643xx_eth_platform_data *eth_data,
                            unsigned long mapbase,
                            unsigned long irq,
-                            unsigned long irq_err)
+                            unsigned long irq_err,
+                            unsigned int tx_csum_limit)
 {
        fill_resources(&orion_ge00_shared, orion_ge00_shared_resources,
                       mapbase + 0x2000, SZ_16K - 1, irq_err);
+        orion_ge00_shared_data.tx_csum_limit = tx_csum_limit;
        ge_complete(&orion_ge00_shared_data,
                    orion_ge00_resources, irq, &orion_ge00_shared,
                    eth_data, &orion_ge00);
@@ -343,10 +345,12 @@ static struct platform_device orion_ge01 = {
 void __init orion_ge01_init(struct mv643xx_eth_platform_data *eth_data,
                            unsigned long mapbase,
                            unsigned long irq,
-                            unsigned long irq_err)
+                            unsigned long irq_err,
+                            unsigned int tx_csum_limit)
 {
        fill_resources(&orion_ge01_shared, orion_ge01_shared_resources,
                       mapbase + 0x2000, SZ_16K - 1, irq_err);
+        orion_ge01_shared_data.tx_csum_limit = tx_csum_limit;
        ge_complete(&orion_ge01_shared_data,
                    orion_ge01_resources, irq, &orion_ge01_shared,
                    eth_data, &orion_ge01);
diff --git a/arch/arm/plat-orion/include/plat/common.h b/arch/arm/plat-orion/include/plat/common.h
index e00fdb213609..ae2377ef63e5 100644
--- a/arch/arm/plat-orion/include/plat/common.h
+++ b/arch/arm/plat-orion/include/plat/common.h
@@ -39,12 +39,14 @@ void __init orion_rtc_init(unsigned long mapbase,
 void __init orion_ge00_init(struct mv643xx_eth_platform_data *eth_data,
                            unsigned long mapbase,
                            unsigned long irq,
-                            unsigned long irq_err);
+                            unsigned long irq_err,
+                            unsigned int tx_csum_limit);
 void __init orion_ge01_init(struct mv643xx_eth_platform_data *eth_data,
                            unsigned long mapbase,
                            unsigned long irq,
-                            unsigned long irq_err);
+                            unsigned long irq_err,
+                            unsigned int tx_csum_limit);
 void __init orion_ge10_init(struct mv643xx_eth_platform_data *eth_data,
                            unsigned long mapbase,
diff --git a/arch/arm/plat-s3c24xx/dma.c b/arch/arm/plat-s3c24xx/dma.c
index 28f898f75380..db98e7021f0d 100644
--- a/arch/arm/plat-s3c24xx/dma.c
+++ b/arch/arm/plat-s3c24xx/dma.c
@@ -430,7 +430,7 @@ s3c2410_dma_canload(struct s3c2410_dma_chan *chan)
 * when necessary.
 */
-int s3c2410_dma_enqueue(unsigned int channel, void *id,
+int s3c2410_dma_enqueue(enum dma_ch channel, void *id,
                        dma_addr_t data, int size)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
index 74e31ce35538..fc49f3dabd76 100644
--- a/arch/arm/plat-samsung/devs.c
+++ b/arch/arm/plat-samsung/devs.c
@@ -32,6 +32,8 @@
 #include <linux/platform_data/s3c-hsudc.h>
 #include <linux/platform_data/s3c-hsotg.h>
+#include <media/s5p_hdmi.h>
 #include <asm/irq.h>
 #include <asm/pmu.h>
 #include <asm/mach/arch.h>
@@ -748,7 +750,8 @@ void __init s5p_i2c_hdmiphy_set_platdata(struct s3c2410_platform_i2c *pd)
        if (!pd) {
                pd = &default_i2c_data;
-                if (soc_is_exynos4210())
+                if (soc_is_exynos4210() ||
+                    soc_is_exynos4212() || soc_is_exynos4412())
                        pd->bus_num = 8;
                else if (soc_is_s5pv210())
                        pd->bus_num = 3;
@@ -759,6 +762,30 @@ void __init s5p_i2c_hdmiphy_set_platdata(struct s3c2410_platform_i2c *pd)
        npd = s3c_set_platdata(pd, sizeof(struct s3c2410_platform_i2c),
                               &s5p_device_i2c_hdmiphy);
 }
+struct s5p_hdmi_platform_data s5p_hdmi_def_platdata;
+void __init s5p_hdmi_set_platdata(struct i2c_board_info *hdmiphy_info,
+                                  struct i2c_board_info *mhl_info, int mhl_bus)
+{
+        struct s5p_hdmi_platform_data *pd = &s5p_hdmi_def_platdata;
+        if (soc_is_exynos4210() ||
+            soc_is_exynos4212() || soc_is_exynos4412())
+                pd->hdmiphy_bus = 8;
+        else if (soc_is_s5pv210())
+                pd->hdmiphy_bus = 3;
+        else
+                pd->hdmiphy_bus = 0;
+        pd->hdmiphy_info = hdmiphy_info;
+        pd->mhl_info = mhl_info;
+        pd->mhl_bus = mhl_bus;
+        s3c_set_platdata(pd, sizeof(struct s5p_hdmi_platform_data),
+                         &s5p_device_hdmi);
+}
 #endif /* CONFIG_S5P_DEV_I2C_HDMIPHY */
 /* I2S */
diff --git a/arch/arm/plat-samsung/include/plat/hdmi.h b/arch/arm/plat-samsung/include/plat/hdmi.h
new file mode 100644
index 000000000000..331d046ac2c5
--- /dev/null
+++ b/arch/arm/plat-samsung/include/plat/hdmi.h
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics Co.Ltd
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#ifndef __PLAT_SAMSUNG_HDMI_H
+#define __PLAT_SAMSUNG_HDMI_H __FILE__
+extern void s5p_hdmi_set_platdata(struct i2c_board_info *hdmiphy_info,
+                                  struct i2c_board_info *mhl_info, int mhl_bus);
+#endif /* __PLAT_SAMSUNG_HDMI_H */
diff --git a/arch/arm/plat-samsung/pm.c b/arch/arm/plat-samsung/pm.c
index 64ab65f0fdbc..15070284343e 100644
--- a/arch/arm/plat-samsung/pm.c
+++ b/arch/arm/plat-samsung/pm.c
@@ -74,7 +74,7 @@ unsigned char pm_uart_udivslot;
 #ifdef CONFIG_SAMSUNG_PM_DEBUG
-struct pm_uart_save uart_save[CONFIG_SERIAL_SAMSUNG_UARTS];
+static struct pm_uart_save uart_save[CONFIG_SERIAL_SAMSUNG_UARTS];
 static void s3c_pm_save_uart(unsigned int uart, struct pm_uart_save *save)
 {
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index fb849d044bde..c834b32af275 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -719,8 +719,10 @@ static int __init vfp_init(void)
                        if ((fmrx(MVFR1) & 0x000fff00) == 0x00011100)
                                elf_hwcap |= HWCAP_NEON;
 #endif
+#ifdef CONFIG_VFPv3
                        if ((fmrx(MVFR1) & 0xf0000000) == 0x10000000)
                                elf_hwcap |= HWCAP_VFPv4;
+#endif
                }
        }
        return 0;
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index f34861920634..c7092e6057c5 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -38,6 +38,7 @@ config BLACKFIN
        select GENERIC_ATOMIC64
        select GENERIC_IRQ_PROBE
        select IRQ_PER_CPU if SMP
+        select USE_GENERIC_SMP_HELPERS if SMP
        select HAVE_NMI_WATCHDOG if NMI_WATCHDOG
        select GENERIC_SMP_IDLE_THREAD
        select ARCH_USES_GETTIMEOFFSET if !GENERIC_CLOCKEVENTS
diff --git a/arch/blackfin/Makefile b/arch/blackfin/Makefile
index d3d7e64ca96d..66cf00095b84 100644
--- a/arch/blackfin/Makefile
+++ b/arch/blackfin/Makefile
@@ -20,7 +20,6 @@ endif
 KBUILD_AFLAGS           += $(call cc-option,-mno-fdpic)
 KBUILD_CFLAGS_MODULE    += -mlong-calls
 LDFLAGS                 += -m elf32bfin
-KALLSYMS         += --symbol-prefix=_
 KBUILD_DEFCONFIG := BF537-STAMP_defconfig
diff --git a/arch/blackfin/include/asm/smp.h b/arch/blackfin/include/asm/smp.h
index dc3d144b4bb5..9631598dcc5d 100644
--- a/arch/blackfin/include/asm/smp.h
+++ b/arch/blackfin/include/asm/smp.h
@@ -18,6 +18,8 @@
 #define raw_smp_processor_id()  blackfin_core_id()
 extern void bfin_relocate_coreb_l1_mem(void);
+extern void arch_send_call_function_single_ipi(int cpu);
+extern void arch_send_call_function_ipi_mask(const struct cpumask *mask);
 #if defined(CONFIG_SMP) && defined(CONFIG_ICACHE_FLUSH_L1)
 asmlinkage void blackfin_icache_flush_range_l1(unsigned long *ptr);
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index 00bbe672b3b3..a40151306b77 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -48,10 +48,13 @@ unsigned long blackfin_iflush_l1_entry[NR_CPUS];
 struct blackfin_initial_pda __cpuinitdata initial_pda_coreb;
-#define BFIN_IPI_TIMER        0
+enum ipi_message_type {
-#define BFIN_IPI_RESCHEDULE   1
+        BFIN_IPI_TIMER,
-#define BFIN_IPI_CALL_FUNC    2
+        BFIN_IPI_RESCHEDULE,
-#define BFIN_IPI_CPU_STOP     3
+        BFIN_IPI_CALL_FUNC,
+        BFIN_IPI_CALL_FUNC_SINGLE,
+        BFIN_IPI_CPU_STOP,
+};
 struct blackfin_flush_data {
        unsigned long start;
@@ -60,35 +63,20 @@ struct blackfin_flush_data {
 void *secondary_stack;
-struct smp_call_struct {
-        void (*func)(void *info);
-        void *info;
-        int wait;
-        cpumask_t *waitmask;
-};
 static struct blackfin_flush_data smp_flush_data;
 static DEFINE_SPINLOCK(stop_lock);
-struct ipi_message {
-        unsigned long type;
-        struct smp_call_struct call_struct;
-};
 /* A magic number - stress test shows this is safe for common cases */
 #define BFIN_IPI_MSGQ_LEN 5
 /* Simple FIFO buffer, overflow leads to panic */
-struct ipi_message_queue {
+struct ipi_data {
-        spinlock_t lock;
        unsigned long count;
-        unsigned long head; /* head of the queue */
+        unsigned long bits;
-        struct ipi_message ipi_message[BFIN_IPI_MSGQ_LEN];
 };
-static DEFINE_PER_CPU(struct ipi_message_queue, ipi_msg_queue);
+static DEFINE_PER_CPU(struct ipi_data, bfin_ipi);
 static void ipi_cpu_stop(unsigned int cpu)
 {
@@ -129,28 +117,6 @@ static void ipi_flush_icache(void *info)
        blackfin_icache_flush_range(fdata->start, fdata->end);
 }
-static void ipi_call_function(unsigned int cpu, struct ipi_message *msg)
-{
-        int wait;
-        void (*func)(void *info);
-        void *info;
-        func = msg->call_struct.func;
-        info = msg->call_struct.info;
-        wait = msg->call_struct.wait;
-        func(info);
-        if (wait) {
-#ifdef __ARCH_SYNC_CORE_DCACHE
-                /*
-                 * 'wait' usually means synchronization between CPUs.
-                 * Invalidate D cache in case shared data was changed
-                 * by func() to ensure cache coherence.
-                 */
-                resync_core_dcache();
-#endif
-                cpumask_clear_cpu(cpu, msg->call_struct.waitmask);
-        }
-}
 /* Use IRQ_SUPPLE_0 to request reschedule.
 * When returning from interrupt to user space,
 * there is chance to reschedule */
@@ -172,152 +138,95 @@ void ipi_timer(void)
 static irqreturn_t ipi_handler_int1(int irq, void *dev_instance)
 {
-        struct ipi_message *msg;
+        struct ipi_data *bfin_ipi_data;
-        struct ipi_message_queue *msg_queue;
        unsigned int cpu = smp_processor_id();
-        unsigned long flags;
+        unsigned long pending;
+        unsigned long msg;
        platform_clear_ipi(cpu, IRQ_SUPPLE_1);
-        msg_queue = &__get_cpu_var(ipi_msg_queue);
+        bfin_ipi_data = &__get_cpu_var(bfin_ipi);
-        spin_lock_irqsave(&msg_queue->lock, flags);
+        while ((pending = xchg(&bfin_ipi_data->bits, 0)) != 0) {
+                msg = 0;
-        while (msg_queue->count) {
+                do {
-                msg = &msg_queue->ipi_message[msg_queue->head];
+                        msg = find_next_bit(&pending, BITS_PER_LONG, msg + 1);
-                switch (msg->type) {
+                        switch (msg) {
-                case BFIN_IPI_TIMER:
+                        case BFIN_IPI_TIMER:
-                        ipi_timer();
+                                ipi_timer();
-                        break;
+                                break;
-                case BFIN_IPI_RESCHEDULE:
+                        case BFIN_IPI_RESCHEDULE:
-                        scheduler_ipi();
+                                scheduler_ipi();
-                        break;
+                                break;
-                case BFIN_IPI_CALL_FUNC:
+                        case BFIN_IPI_CALL_FUNC:
-                        ipi_call_function(cpu, msg);
+                                generic_smp_call_function_interrupt();
-                        break;
+                                break;
-                case BFIN_IPI_CPU_STOP:
-                        ipi_cpu_stop(cpu);
+                        case BFIN_IPI_CALL_FUNC_SINGLE:
-                        break;
+                                generic_smp_call_function_single_interrupt();
-                default:
+                                break;
-                        printk(KERN_CRIT "CPU%u: Unknown IPI message 0x%lx\n",
-                               cpu, msg->type);
+                        case BFIN_IPI_CPU_STOP:
-                        break;
+                                ipi_cpu_stop(cpu);
-                }
+                                break;
-                msg_queue->head++;
+                        }
-                msg_queue->head %= BFIN_IPI_MSGQ_LEN;
+                } while (msg < BITS_PER_LONG);
-                msg_queue->count--;
+                smp_mb();
        }
-        spin_unlock_irqrestore(&msg_queue->lock, flags);
        return IRQ_HANDLED;
 }
-static void ipi_queue_init(void)
+static void bfin_ipi_init(void)
 {
        unsigned int cpu;
-        struct ipi_message_queue *msg_queue;
+        struct ipi_data *bfin_ipi_data;
        for_each_possible_cpu(cpu) {
-                msg_queue = &per_cpu(ipi_msg_queue, cpu);
+                bfin_ipi_data = &per_cpu(bfin_ipi, cpu);
-                spin_lock_init(&msg_queue->lock);
+                bfin_ipi_data->bits = 0;
-                msg_queue->count = 0;
+                bfin_ipi_data->count = 0;
-                msg_queue->head = 0;
        }
 }
-static inline void smp_send_message(cpumask_t callmap, unsigned long type,
+void send_ipi(const struct cpumask *cpumask, enum ipi_message_type msg)
-                                        void (*func) (void *info), void *info, int wait)
 {
        unsigned int cpu;
-        struct ipi_message_queue *msg_queue;
+        struct ipi_data *bfin_ipi_data;
-        struct ipi_message *msg;
+        unsigned long flags;
-        unsigned long flags, next_msg;
-        cpumask_t waitmask; /* waitmask is shared by all cpus */
+        local_irq_save(flags);
-        cpumask_copy(&waitmask, &callmap);
+        for_each_cpu(cpu, cpumask) {
-        for_each_cpu(cpu, &callmap) {
+                bfin_ipi_data = &per_cpu(bfin_ipi, cpu);
-                msg_queue = &per_cpu(ipi_msg_queue, cpu);
+                smp_mb();
-                spin_lock_irqsave(&msg_queue->lock, flags);
+                set_bit(msg, &bfin_ipi_data->bits);
-                if (msg_queue->count < BFIN_IPI_MSGQ_LEN) {
+                bfin_ipi_data->count++;
-                        next_msg = (msg_queue->head + msg_queue->count)
-                                        % BFIN_IPI_MSGQ_LEN;
-                        msg = &msg_queue->ipi_message[next_msg];
-                        msg->type = type;
-                        if (type == BFIN_IPI_CALL_FUNC) {
-                                msg->call_struct.func = func;
-                                msg->call_struct.info = info;
-                                msg->call_struct.wait = wait;
-                                msg->call_struct.waitmask = &waitmask;
-                        }
-                        msg_queue->count++;
-                } else
-                        panic("IPI message queue overflow\n");
-                spin_unlock_irqrestore(&msg_queue->lock, flags);
                platform_send_ipi_cpu(cpu, IRQ_SUPPLE_1);
        }
-        if (wait) {
+        local_irq_restore(flags);
-                while (!cpumask_empty(&waitmask))
-                        blackfin_dcache_invalidate_range(
-                                (unsigned long)(&waitmask),
-                                (unsigned long)(&waitmask));
-#ifdef __ARCH_SYNC_CORE_DCACHE
-                /*
-                 * Invalidate D cache in case shared data was changed by
-                 * other processors to ensure cache coherence.
-                 */
-                resync_core_dcache();
-#endif
-        }
 }
-int smp_call_function(void (*func)(void *info), void *info, int wait)
+void arch_send_call_function_single_ipi(int cpu)
 {
-        cpumask_t callmap;
+        send_ipi(cpumask_of(cpu), BFIN_IPI_CALL_FUNC_SINGLE);
-        preempt_disable();
-        cpumask_copy(&callmap, cpu_online_mask);
-        cpumask_clear_cpu(smp_processor_id(), &callmap);
-        if (!cpumask_empty(&callmap))
-                smp_send_message(callmap, BFIN_IPI_CALL_FUNC, func, info, wait);
-        preempt_enable();
-        return 0;
 }
-EXPORT_SYMBOL_GPL(smp_call_function);
-int smp_call_function_single(int cpuid, void (*func) (void *info), void *info,
+void arch_send_call_function_ipi_mask(const struct cpumask *mask)
-                                int wait)
 {
-        unsigned int cpu = cpuid;
+        send_ipi(mask, BFIN_IPI_CALL_FUNC);
-        cpumask_t callmap;
-        if (cpu_is_offline(cpu))
-                return 0;
-        cpumask_clear(&callmap);
-        cpumask_set_cpu(cpu, &callmap);
-        smp_send_message(callmap, BFIN_IPI_CALL_FUNC, func, info, wait);
-        return 0;
 }
-EXPORT_SYMBOL_GPL(smp_call_function_single);
 void smp_send_reschedule(int cpu)
 {
-        cpumask_t callmap;
+        send_ipi(cpumask_of(cpu), BFIN_IPI_RESCHEDULE);
-        /* simply trigger an ipi */
-        cpumask_clear(&callmap);
-        cpumask_set_cpu(cpu, &callmap);
-        smp_send_message(callmap, BFIN_IPI_RESCHEDULE, NULL, NULL, 0);
        return;
 }
 void smp_send_msg(const struct cpumask *mask, unsigned long type)
 {
-        smp_send_message(*mask, type, NULL, NULL, 0);
+        send_ipi(mask, type);
 }
 void smp_timer_broadcast(const struct cpumask *mask)
@@ -333,7 +242,7 @@ void smp_send_stop(void)
        cpumask_copy(&callmap, cpu_online_mask);
        cpumask_clear_cpu(smp_processor_id(), &callmap);
        if (!cpumask_empty(&callmap))
-                smp_send_message(callmap, BFIN_IPI_CPU_STOP, NULL, NULL, 0);
+                send_ipi(&callmap, BFIN_IPI_CPU_STOP);
        preempt_enable();
@@ -436,7 +345,7 @@ void __init smp_prepare_boot_cpu(void)
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
        platform_prepare_cpus(max_cpus);
-        ipi_queue_init();
+        bfin_ipi_init();
        platform_request_ipi(IRQ_SUPPLE_0, ipi_handler_int0);
        platform_request_ipi(IRQ_SUPPLE_1, ipi_handler_int1);
 }
diff --git a/arch/c6x/Kconfig b/arch/c6x/Kconfig
index 052f81a76239..983c859e40b7 100644
--- a/arch/c6x/Kconfig
+++ b/arch/c6x/Kconfig
@@ -6,6 +6,7 @@
 config C6X
        def_bool y
        select CLKDEV_LOOKUP
+        select GENERIC_ATOMIC64
        select GENERIC_IRQ_SHOW
        select HAVE_ARCH_TRACEHOOK
        select HAVE_DMA_API_DEBUG
diff --git a/arch/c6x/include/asm/cache.h b/arch/c6x/include/asm/cache.h
index 6d521d96d941..09c5a0f5f4d1 100644
--- a/arch/c6x/include/asm/cache.h
+++ b/arch/c6x/include/asm/cache.h
@@ -1,7 +1,7 @@
 /*
 *  Port on Texas Instruments TMS320C6x architecture
 *
- *  Copyright (C) 2005, 2006, 2009, 2010 Texas Instruments Incorporated
+ *  Copyright (C) 2005, 2006, 2009, 2010, 2012 Texas Instruments Incorporated
 *  Author: Aurelien Jacquiot (aurelien.jacquiot@jaluna.com)
 *
 *  This program is free software; you can redistribute it and/or modify
@@ -16,9 +16,14 @@
 /*
 * Cache line size
 */
-#define L1D_CACHE_BYTES   64
+#define L1D_CACHE_SHIFT   6
-#define L1P_CACHE_BYTES   32
+#define L1D_CACHE_BYTES   (1 << L1D_CACHE_SHIFT)
-#define L2_CACHE_BYTES    128
+#define L1P_CACHE_SHIFT   5
+#define L1P_CACHE_BYTES   (1 << L1P_CACHE_SHIFT)
+#define L2_CACHE_SHIFT    7
+#define L2_CACHE_BYTES    (1 << L2_CACHE_SHIFT)
 /*
 * L2 used as cache
@@ -29,7 +34,8 @@
 * For practical reasons the L1_CACHE_BYTES defines should not be smaller than
 * the L2 line size
 */
-#define L1_CACHE_BYTES        L2_CACHE_BYTES
+#define L1_CACHE_SHIFT        L2_CACHE_SHIFT
+#define L1_CACHE_BYTES        (1 << L1_CACHE_SHIFT)
 #define L2_CACHE_ALIGN_LOW(x) \
        (((x) & ~(L2_CACHE_BYTES - 1)))
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 954d81e2e837..7913695b2fcb 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -234,5 +234,4 @@ CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRC_T10DIF=y
-CONFIG_MISC_DEVICES=y
 CONFIG_INTEL_IOMMU=y
diff --git a/arch/ia64/configs/gensparse_defconfig b/arch/ia64/configs/gensparse_defconfig
index 91c41ecfa6d9..f8e913365423 100644
--- a/arch/ia64/configs/gensparse_defconfig
+++ b/arch/ia64/configs/gensparse_defconfig
@@ -209,4 +209,3 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_MUTEXES=y
 CONFIG_CRYPTO_MD5=y
-CONFIG_MISC_DEVICES=y
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 4a469907f04a..b22df9410dce 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -5,6 +5,7 @@ config M68K
        select HAVE_AOUT if MMU
        select HAVE_GENERIC_HARDIRQS
        select GENERIC_IRQ_SHOW
+        select GENERIC_ATOMIC64
        select ARCH_HAVE_NMI_SAFE_CMPXCHG if RMW_INSNS
        select GENERIC_CPU_DEVICES
        select GENERIC_STRNCPY_FROM_USER if MMU
diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
index 82068349a2bb..c4eb79edecec 100644
--- a/arch/m68k/Kconfig.cpu
+++ b/arch/m68k/Kconfig.cpu
@@ -28,6 +28,7 @@ config COLDFIRE
        select CPU_HAS_NO_BITFIELDS
        select CPU_HAS_NO_MULDIV64
        select GENERIC_CSUM
+        select HAVE_CLK
 endchoice
@@ -58,7 +59,6 @@ config MCPU32
 config M68020
        bool "68020 support"
        depends on MMU
-        select GENERIC_ATOMIC64
        select CPU_HAS_ADDRESS_SPACES
        help
          If you anticipate running this kernel on a computer with a MC68020
@@ -69,7 +69,6 @@ config M68020
 config M68030
        bool "68030 support"
        depends on MMU && !MMU_SUN3
-        select GENERIC_ATOMIC64
        select CPU_HAS_ADDRESS_SPACES
        help
          If you anticipate running this kernel on a computer with a MC68030
@@ -79,7 +78,6 @@ config M68030
 config M68040
        bool "68040 support"
        depends on MMU && !MMU_SUN3
-        select GENERIC_ATOMIC64
        select CPU_HAS_ADDRESS_SPACES
        help
          If you anticipate running this kernel on a computer with a MC68LC040
@@ -90,7 +88,6 @@ config M68040
 config M68060
        bool "68060 support"
        depends on MMU && !MMU_SUN3
-        select GENERIC_ATOMIC64
        select CPU_HAS_ADDRESS_SPACES
        help
          If you anticipate running this kernel on a computer with a MC68060
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 331d574df99c..faf65286574e 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -89,6 +89,7 @@ config ATH79
        select CEVT_R4K
        select CSRC_R4K
        select DMA_NONCOHERENT
+        select HAVE_CLK
        select IRQ_CPU
        select MIPS_MACHINE
        select SYS_HAS_CPU_MIPS32_R2
diff --git a/arch/mips/alchemy/board-mtx1.c b/arch/mips/alchemy/board-mtx1.c
index 99969484c475..a124c251c0c9 100644
--- a/arch/mips/alchemy/board-mtx1.c
+++ b/arch/mips/alchemy/board-mtx1.c
@@ -228,6 +228,8 @@ static int mtx1_pci_idsel(unsigned int devsel, int assert)
         * adapter on the mtx-1 "singleboard" variant. It triggers a custom
         * logic chip connected to EXT_IO3 (GPIO1) to suppress IDSEL signals.
         */
+        udelay(1);
        if (assert && devsel != 0)
                /* Suppress signal to Cardbus */
                alchemy_gpio_set_value(1, 0);   /* set EXT_IO3 OFF */
diff --git a/arch/mips/ath79/dev-usb.c b/arch/mips/ath79/dev-usb.c
index 36e9570e7bc4..b2a2311ec85b 100644
--- a/arch/mips/ath79/dev-usb.c
+++ b/arch/mips/ath79/dev-usb.c
@@ -145,6 +145,8 @@ static void __init ar7240_usb_setup(void)
        ath79_ohci_resources[0].start = AR7240_OHCI_BASE;
        ath79_ohci_resources[0].end = AR7240_OHCI_BASE + AR7240_OHCI_SIZE - 1;
+        ath79_ohci_resources[1].start = ATH79_CPU_IRQ_USB;
+        ath79_ohci_resources[1].end = ATH79_CPU_IRQ_USB;
        platform_device_register(&ath79_ohci_device);
 }
diff --git a/arch/mips/ath79/gpio.c b/arch/mips/ath79/gpio.c
index 29054f211832..48fe762d2526 100644
--- a/arch/mips/ath79/gpio.c
+++ b/arch/mips/ath79/gpio.c
@@ -188,8 +188,10 @@ void __init ath79_gpio_init(void)
        if (soc_is_ar71xx())
                ath79_gpio_count = AR71XX_GPIO_COUNT;
-        else if (soc_is_ar724x())
+        else if (soc_is_ar7240())
-                ath79_gpio_count = AR724X_GPIO_COUNT;
+                ath79_gpio_count = AR7240_GPIO_COUNT;
+        else if (soc_is_ar7241() || soc_is_ar7242())
+                ath79_gpio_count = AR7241_GPIO_COUNT;
        else if (soc_is_ar913x())
                ath79_gpio_count = AR913X_GPIO_COUNT;
        else if (soc_is_ar933x())
diff --git a/arch/mips/bcm63xx/dev-spi.c b/arch/mips/bcm63xx/dev-spi.c
index e39f73048d4f..f1c9c3e2f678 100644
--- a/arch/mips/bcm63xx/dev-spi.c
+++ b/arch/mips/bcm63xx/dev-spi.c
@@ -106,11 +106,15 @@ int __init bcm63xx_spi_register(void)
        if (BCMCPU_IS_6338() || BCMCPU_IS_6348()) {
                spi_resources[0].end += BCM_6338_RSET_SPI_SIZE - 1;
                spi_pdata.fifo_size = SPI_6338_MSG_DATA_SIZE;
+                spi_pdata.msg_type_shift = SPI_6338_MSG_TYPE_SHIFT;
+                spi_pdata.msg_ctl_width = SPI_6338_MSG_CTL_WIDTH;
        }
        if (BCMCPU_IS_6358() || BCMCPU_IS_6368()) {
                spi_resources[0].end += BCM_6358_RSET_SPI_SIZE - 1;
                spi_pdata.fifo_size = SPI_6358_MSG_DATA_SIZE;
+                spi_pdata.msg_type_shift = SPI_6358_MSG_TYPE_SHIFT;
+                spi_pdata.msg_ctl_width = SPI_6358_MSG_CTL_WIDTH;
        }
        bcm63xx_spi_regs_init();
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 7fb1f222b8a5..274cd4fad30c 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -61,6 +61,12 @@ static void octeon_irq_set_ciu_mapping(int irq, int line, int bit,
        octeon_irq_ciu_to_irq[line][bit] = irq;
 }
+static void octeon_irq_force_ciu_mapping(struct irq_domain *domain,
+                                         int irq, int line, int bit)
+{
+        irq_domain_associate(domain, irq, line << 6 | bit);
+}
 static int octeon_coreid_for_cpu(int cpu)
 {
 #ifdef CONFIG_SMP
@@ -183,19 +189,9 @@ static void __init octeon_irq_init_core(void)
                mutex_init(&cd->core_irq_mutex);
                irq = OCTEON_IRQ_SW0 + i;
-                switch (irq) {
+                irq_set_chip_data(irq, cd);
-                case OCTEON_IRQ_TIMER:
+                irq_set_chip_and_handler(irq, &octeon_irq_chip_core,
-                case OCTEON_IRQ_SW0:
+                                         handle_percpu_irq);
-                case OCTEON_IRQ_SW1:
-                case OCTEON_IRQ_5:
-                case OCTEON_IRQ_PERF:
-                        irq_set_chip_data(irq, cd);
-                        irq_set_chip_and_handler(irq, &octeon_irq_chip_core,
-                                                 handle_percpu_irq);
-                        break;
-                default:
-                        break;
-                }
        }
 }
@@ -890,7 +886,6 @@ static int octeon_irq_gpio_xlat(struct irq_domain *d,
        unsigned int type;
        unsigned int pin;
        unsigned int trigger;
-        struct octeon_irq_gpio_domain_data *gpiod;
        if (d->of_node != node)
                return -EINVAL;
@@ -925,8 +920,7 @@ static int octeon_irq_gpio_xlat(struct irq_domain *d,
                break;
        }
        *out_type = type;
-        gpiod = d->host_data;
+        *out_hwirq = pin;
-        *out_hwirq = gpiod->base_hwirq + pin;
        return 0;
 }
@@ -996,19 +990,21 @@ static int octeon_irq_ciu_map(struct irq_domain *d,
 static int octeon_irq_gpio_map(struct irq_domain *d,
                               unsigned int virq, irq_hw_number_t hw)
 {
-        unsigned int line = hw >> 6;
+        struct octeon_irq_gpio_domain_data *gpiod = d->host_data;
-        unsigned int bit = hw & 63;
+        unsigned int line, bit;
        if (!octeon_irq_virq_in_range(virq))
                return -EINVAL;
+        hw += gpiod->base_hwirq;
+        line = hw >> 6;
+        bit = hw & 63;
        if (line > 1 || octeon_irq_ciu_to_irq[line][bit] != 0)
                return -EINVAL;
        octeon_irq_set_ciu_mapping(virq, line, bit,
                                   octeon_irq_gpio_chip,
                                   octeon_irq_handle_gpio);
        return 0;
 }
@@ -1149,6 +1145,7 @@ static void __init octeon_irq_init_ciu(void)
        struct irq_chip *chip_wd;
        struct device_node *gpio_node;
        struct device_node *ciu_node;
+        struct irq_domain *ciu_domain = NULL;
        octeon_irq_init_ciu_percpu();
        octeon_irq_setup_secondary = octeon_irq_setup_secondary_ciu;
@@ -1177,31 +1174,6 @@ static void __init octeon_irq_init_ciu(void)
        /* Mips internal */
        octeon_irq_init_core();
-        /* CIU_0 */
-        for (i = 0; i < 16; i++)
-                octeon_irq_set_ciu_mapping(i + OCTEON_IRQ_WORKQ0, 0, i + 0, chip, handle_level_irq);
-        octeon_irq_set_ciu_mapping(OCTEON_IRQ_MBOX0, 0, 32, chip_mbox, handle_percpu_irq);
-        octeon_irq_set_ciu_mapping(OCTEON_IRQ_MBOX1, 0, 33, chip_mbox, handle_percpu_irq);
-        for (i = 0; i < 4; i++)
-                octeon_irq_set_ciu_mapping(i + OCTEON_IRQ_PCI_INT0, 0, i + 36, chip, handle_level_irq);
-        for (i = 0; i < 4; i++)
-                octeon_irq_set_ciu_mapping(i + OCTEON_IRQ_PCI_MSI0, 0, i + 40, chip, handle_level_irq);
-        octeon_irq_set_ciu_mapping(OCTEON_IRQ_RML, 0, 46, chip, handle_level_irq);
-        for (i = 0; i < 4; i++)
-                octeon_irq_set_ciu_mapping(i + OCTEON_IRQ_TIMER0, 0, i + 52, chip, handle_edge_irq);
-        octeon_irq_set_ciu_mapping(OCTEON_IRQ_USB0, 0, 56, chip, handle_level_irq);
-        octeon_irq_set_ciu_mapping(OCTEON_IRQ_BOOTDMA, 0, 63, chip, handle_level_irq);
-        /* CIU_1 */
-        for (i = 0; i < 16; i++)
-                octeon_irq_set_ciu_mapping(i + OCTEON_IRQ_WDOG0, 1, i + 0, chip_wd, handle_level_irq);
-        octeon_irq_set_ciu_mapping(OCTEON_IRQ_USB1, 1, 17, chip, handle_level_irq);
        gpio_node = of_find_compatible_node(NULL, NULL, "cavium,octeon-3860-gpio");
        if (gpio_node) {
                struct octeon_irq_gpio_domain_data *gpiod;
@@ -1219,10 +1191,35 @@ static void __init octeon_irq_init_ciu(void)
        ciu_node = of_find_compatible_node(NULL, NULL, "cavium,octeon-3860-ciu");
        if (ciu_node) {
-                irq_domain_add_tree(ciu_node, &octeon_irq_domain_ciu_ops, NULL);
+                ciu_domain = irq_domain_add_tree(ciu_node, &octeon_irq_domain_ciu_ops, NULL);
                of_node_put(ciu_node);
        } else
-                pr_warn("Cannot find device node for cavium,octeon-3860-ciu.\n");
+                panic("Cannot find device node for cavium,octeon-3860-ciu.");
+        /* CIU_0 */
+        for (i = 0; i < 16; i++)
+                octeon_irq_force_ciu_mapping(ciu_domain, i + OCTEON_IRQ_WORKQ0, 0, i + 0);
+        octeon_irq_set_ciu_mapping(OCTEON_IRQ_MBOX0, 0, 32, chip_mbox, handle_percpu_irq);
+        octeon_irq_set_ciu_mapping(OCTEON_IRQ_MBOX1, 0, 33, chip_mbox, handle_percpu_irq);
+        for (i = 0; i < 4; i++)
+                octeon_irq_force_ciu_mapping(ciu_domain, i + OCTEON_IRQ_PCI_INT0, 0, i + 36);
+        for (i = 0; i < 4; i++)
+                octeon_irq_force_ciu_mapping(ciu_domain, i + OCTEON_IRQ_PCI_MSI0, 0, i + 40);
+        octeon_irq_force_ciu_mapping(ciu_domain, OCTEON_IRQ_RML, 0, 46);
+        for (i = 0; i < 4; i++)
+                octeon_irq_force_ciu_mapping(ciu_domain, i + OCTEON_IRQ_TIMER0, 0, i + 52);
+        octeon_irq_force_ciu_mapping(ciu_domain, OCTEON_IRQ_USB0, 0, 56);
+        octeon_irq_force_ciu_mapping(ciu_domain, OCTEON_IRQ_BOOTDMA, 0, 63);
+        /* CIU_1 */
+        for (i = 0; i < 16; i++)
+                octeon_irq_set_ciu_mapping(i + OCTEON_IRQ_WDOG0, 1, i + 0, chip_wd, handle_level_irq);
+        octeon_irq_force_ciu_mapping(ciu_domain, OCTEON_IRQ_USB1, 1, 17);
        /* Enable the CIU lines */
        set_c0_status(STATUSF_IP3 | STATUSF_IP2);
diff --git a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
index 1caa78ad06d5..dde504477fac 100644
--- a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
+++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
@@ -393,7 +393,8 @@
 #define AR71XX_GPIO_REG_FUNC            0x28
 #define AR71XX_GPIO_COUNT               16
-#define AR724X_GPIO_COUNT               18
+#define AR7240_GPIO_COUNT               18
+#define AR7241_GPIO_COUNT               20
 #define AR913X_GPIO_COUNT               22
 #define AR933X_GPIO_COUNT               30
 #define AR934X_GPIO_COUNT               23
diff --git a/arch/mips/include/asm/mach-ath79/cpu-feature-overrides.h b/arch/mips/include/asm/mach-ath79/cpu-feature-overrides.h
index 4476fa03bf36..6ddae926bf79 100644
--- a/arch/mips/include/asm/mach-ath79/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-ath79/cpu-feature-overrides.h
@@ -42,7 +42,6 @@
 #define cpu_has_mips64r1        0
 #define cpu_has_mips64r2        0
-#define cpu_has_dsp             0
 #define cpu_has_mipsmt          0
 #define cpu_has_64bits          0
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_spi.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_spi.h
index 7d98dbe5d4b5..c9bae1362606 100644
--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_spi.h
+++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_spi.h
@@ -9,6 +9,8 @@ int __init bcm63xx_spi_register(void);
 struct bcm63xx_spi_pdata {
        unsigned int    fifo_size;
+        unsigned int    msg_type_shift;
+        unsigned int    msg_ctl_width;
        int             bus_num;
        int             num_chipselect;
        u32             speed_hz;
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
index 4ccc2a748aff..61f2a2a5099d 100644
--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
+++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_regs.h
@@ -1054,7 +1054,8 @@
 #define SPI_6338_FILL_BYTE              0x07
 #define SPI_6338_MSG_TAIL               0x09
 #define SPI_6338_RX_TAIL                0x0b
-#define SPI_6338_MSG_CTL                0x40
+#define SPI_6338_MSG_CTL                0x40    /* 8-bits register */
+#define SPI_6338_MSG_CTL_WIDTH          8
 #define SPI_6338_MSG_DATA               0x41
 #define SPI_6338_MSG_DATA_SIZE          0x3f
 #define SPI_6338_RX_DATA                0x80
@@ -1070,7 +1071,8 @@
 #define SPI_6348_FILL_BYTE              0x07
 #define SPI_6348_MSG_TAIL               0x09
 #define SPI_6348_RX_TAIL                0x0b
-#define SPI_6348_MSG_CTL                0x40
+#define SPI_6348_MSG_CTL                0x40    /* 8-bits register */
+#define SPI_6348_MSG_CTL_WIDTH          8
 #define SPI_6348_MSG_DATA               0x41
 #define SPI_6348_MSG_DATA_SIZE          0x3f
 #define SPI_6348_RX_DATA                0x80
@@ -1078,6 +1080,7 @@
 /* BCM 6358 SPI core */
 #define SPI_6358_MSG_CTL                0x00    /* 16-bits register */
+#define SPI_6358_MSG_CTL_WIDTH          16
 #define SPI_6358_MSG_DATA               0x02
 #define SPI_6358_MSG_DATA_SIZE          0x21e
 #define SPI_6358_RX_DATA                0x400
@@ -1094,6 +1097,7 @@
 /* BCM 6358 SPI core */
 #define SPI_6368_MSG_CTL                0x00    /* 16-bits register */
+#define SPI_6368_MSG_CTL_WIDTH          16
 #define SPI_6368_MSG_DATA               0x02
 #define SPI_6368_MSG_DATA_SIZE          0x21e
 #define SPI_6368_RX_DATA                0x400
@@ -1115,7 +1119,10 @@
 #define SPI_HD_W                        0x01
 #define SPI_HD_R                        0x02
 #define SPI_BYTE_CNT_SHIFT              0
-#define SPI_MSG_TYPE_SHIFT              14
+#define SPI_6338_MSG_TYPE_SHIFT         6
+#define SPI_6348_MSG_TYPE_SHIFT         6
+#define SPI_6358_MSG_TYPE_SHIFT         14
+#define SPI_6368_MSG_TYPE_SHIFT         14
 /* Command */
 #define SPI_CMD_NOOP                    0x00
diff --git a/arch/mips/include/asm/mach-cavium-octeon/irq.h b/arch/mips/include/asm/mach-cavium-octeon/irq.h
index 418992042f6f..c22a3078bf11 100644
--- a/arch/mips/include/asm/mach-cavium-octeon/irq.h
+++ b/arch/mips/include/asm/mach-cavium-octeon/irq.h
@@ -21,14 +21,10 @@ enum octeon_irq {
        OCTEON_IRQ_TIMER,
 /* sources in CIU_INTX_EN0 */
        OCTEON_IRQ_WORKQ0,
-        OCTEON_IRQ_GPIO0 = OCTEON_IRQ_WORKQ0 + 16,
+        OCTEON_IRQ_WDOG0 = OCTEON_IRQ_WORKQ0 + 16,
-        OCTEON_IRQ_WDOG0 = OCTEON_IRQ_GPIO0 + 16,
        OCTEON_IRQ_WDOG15 = OCTEON_IRQ_WDOG0 + 15,
        OCTEON_IRQ_MBOX0 = OCTEON_IRQ_WDOG0 + 16,
        OCTEON_IRQ_MBOX1,
-        OCTEON_IRQ_UART0,
-        OCTEON_IRQ_UART1,
-        OCTEON_IRQ_UART2,
        OCTEON_IRQ_PCI_INT0,
        OCTEON_IRQ_PCI_INT1,
        OCTEON_IRQ_PCI_INT2,
@@ -38,8 +34,6 @@ enum octeon_irq {
        OCTEON_IRQ_PCI_MSI2,
        OCTEON_IRQ_PCI_MSI3,
-        OCTEON_IRQ_TWSI,
-        OCTEON_IRQ_TWSI2,
        OCTEON_IRQ_RML,
        OCTEON_IRQ_TIMER0,
        OCTEON_IRQ_TIMER1,
@@ -47,8 +41,6 @@ enum octeon_irq {
        OCTEON_IRQ_TIMER3,
        OCTEON_IRQ_USB0,
        OCTEON_IRQ_USB1,
-        OCTEON_IRQ_MII0,
-        OCTEON_IRQ_MII1,
        OCTEON_IRQ_BOOTDMA,
 #ifndef CONFIG_PCI_MSI
        OCTEON_IRQ_LAST = 127
diff --git a/arch/mips/include/asm/module.h b/arch/mips/include/asm/module.h
index 7531ecd654d6..dca8bce8c7ab 100644
--- a/arch/mips/include/asm/module.h
+++ b/arch/mips/include/asm/module.h
@@ -10,6 +10,7 @@ struct mod_arch_specific {
        struct list_head dbe_list;
        const struct exception_table_entry *dbe_start;
        const struct exception_table_entry *dbe_end;
+        struct mips_hi16 *r_mips_hi16_list;
 };
 typedef uint8_t Elf64_Byte;             /* Type for a 8-bit quantity.  */
diff --git a/arch/mips/include/asm/r4k-timer.h b/arch/mips/include/asm/r4k-timer.h
index a37d12b3b61c..afe9e0e03fe9 100644
--- a/arch/mips/include/asm/r4k-timer.h
+++ b/arch/mips/include/asm/r4k-timer.h
@@ -12,16 +12,16 @@
 #ifdef CONFIG_SYNC_R4K
-extern void synchronise_count_master(void);
+extern void synchronise_count_master(int cpu);
-extern void synchronise_count_slave(void);
+extern void synchronise_count_slave(int cpu);
 #else
-static inline void synchronise_count_master(void)
+static inline void synchronise_count_master(int cpu)
 {
 }
-static inline void synchronise_count_slave(void)
+static inline void synchronise_count_slave(int cpu)
 {
 }
diff --git a/arch/mips/kernel/module.c b/arch/mips/kernel/module.c
index a5066b1c3de3..4f8c3cba8c0c 100644
--- a/arch/mips/kernel/module.c
+++ b/arch/mips/kernel/module.c
@@ -39,8 +39,6 @@ struct mips_hi16 {
        Elf_Addr value;
 };
-static struct mips_hi16 *mips_hi16_list;
 static LIST_HEAD(dbe_list);
 static DEFINE_SPINLOCK(dbe_lock);
@@ -128,8 +126,8 @@ static int apply_r_mips_hi16_rel(struct module *me, u32 *location, Elf_Addr v)
        n->addr = (Elf_Addr *)location;
        n->value = v;
-        n->next = mips_hi16_list;
+        n->next = me->arch.r_mips_hi16_list;
-        mips_hi16_list = n;
+        me->arch.r_mips_hi16_list = n;
        return 0;
 }
@@ -142,18 +140,28 @@ static int apply_r_mips_hi16_rela(struct module *me, u32 *location, Elf_Addr v)
        return 0;
 }
+static void free_relocation_chain(struct mips_hi16 *l)
+{
+        struct mips_hi16 *next;
+        while (l) {
+                next = l->next;
+                kfree(l);
+                l = next;
+        }
+}
 static int apply_r_mips_lo16_rel(struct module *me, u32 *location, Elf_Addr v)
 {
        unsigned long insnlo = *location;
+        struct mips_hi16 *l;
        Elf_Addr val, vallo;
        /* Sign extend the addend we extract from the lo insn.  */
        vallo = ((insnlo & 0xffff) ^ 0x8000) - 0x8000;
-        if (mips_hi16_list != NULL) {
+        if (me->arch.r_mips_hi16_list != NULL) {
-                struct mips_hi16 *l;
+                l = me->arch.r_mips_hi16_list;
-                l = mips_hi16_list;
                while (l != NULL) {
                        struct mips_hi16 *next;
                        unsigned long insn;
@@ -188,7 +196,7 @@ static int apply_r_mips_lo16_rel(struct module *me, u32 *location, Elf_Addr v)
                        l = next;
                }
-                mips_hi16_list = NULL;
+                me->arch.r_mips_hi16_list = NULL;
        }
        /*
@@ -201,6 +209,9 @@ static int apply_r_mips_lo16_rel(struct module *me, u32 *location, Elf_Addr v)
        return 0;
 out_danger:
+        free_relocation_chain(l);
+        me->arch.r_mips_hi16_list = NULL;
        pr_err("module %s: dangerous R_MIPS_LO16 REL relocation\n", me->name);
        return -ENOEXEC;
@@ -273,6 +284,7 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strtab,
        pr_debug("Applying relocate section %u to %u\n", relsec,
               sechdrs[relsec].sh_info);
+        me->arch.r_mips_hi16_list = NULL;
        for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
                /* This is where to make the change */
                location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
@@ -296,6 +308,19 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strtab,
                        return res;
        }
+        /*
+         * Normally the hi16 list should be deallocated at this point.  A
+         * malformed binary however could contain a series of R_MIPS_HI16
+         * relocations not followed by a R_MIPS_LO16 relocation.  In that
+         * case, free up the list and return an error.
+         */
+        if (me->arch.r_mips_hi16_list) {
+                free_relocation_chain(me->arch.r_mips_hi16_list);
+                me->arch.r_mips_hi16_list = NULL;
+                return -ENOEXEC;
+        }
        return 0;
 }
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 31637d8c8738..9005bf9fb859 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -130,7 +130,7 @@ asmlinkage __cpuinit void start_secondary(void)
        cpu_set(cpu, cpu_callin_map);
-        synchronise_count_slave();
+        synchronise_count_slave(cpu);
        /*
         * irq will be enabled in ->smp_finish(), enabling it too early
@@ -173,7 +173,6 @@ void smp_send_stop(void)
 void __init smp_cpus_done(unsigned int max_cpus)
 {
        mp_ops->cpus_done();
-        synchronise_count_master();
 }
 /* called from main before smp_init() */
@@ -206,6 +205,7 @@ int __cpuinit __cpu_up(unsigned int cpu, struct task_struct *tidle)
        while (!cpu_isset(cpu, cpu_callin_map))
                udelay(100);
+        synchronise_count_master(cpu);
        return 0;
 }
diff --git a/arch/mips/kernel/sync-r4k.c b/arch/mips/kernel/sync-r4k.c
index 842d55e411fd..7f1eca3858de 100644
--- a/arch/mips/kernel/sync-r4k.c
+++ b/arch/mips/kernel/sync-r4k.c
@@ -28,12 +28,11 @@ static atomic_t __cpuinitdata count_reference = ATOMIC_INIT(0);
 #define COUNTON 100
 #define NR_LOOPS 5
-void __cpuinit synchronise_count_master(void)
+void __cpuinit synchronise_count_master(int cpu)
 {
        int i;
        unsigned long flags;
        unsigned int initcount;
-        int nslaves;
 #ifdef CONFIG_MIPS_MT_SMTC
        /*
@@ -43,8 +42,7 @@ void __cpuinit synchronise_count_master(void)
        return;
 #endif
-        printk(KERN_INFO "Synchronize counters across %u CPUs: ",
+        printk(KERN_INFO "Synchronize counters for CPU %u: ", cpu);
-               num_online_cpus());
        local_irq_save(flags);
@@ -52,7 +50,7 @@ void __cpuinit synchronise_count_master(void)
         * Notify the slaves that it's time to start
         */
        atomic_set(&count_reference, read_c0_count());
-        atomic_set(&count_start_flag, 1);
+        atomic_set(&count_start_flag, cpu);
        smp_wmb();
        /* Count will be initialised to current timer for all CPU's */
@@ -69,10 +67,9 @@ void __cpuinit synchronise_count_master(void)
         * two CPUs.
         */
-        nslaves = num_online_cpus()-1;
        for (i = 0; i < NR_LOOPS; i++) {
-                /* slaves loop on '!= ncpus' */
+                /* slaves loop on '!= 2' */
-                while (atomic_read(&count_count_start) != nslaves)
+                while (atomic_read(&count_count_start) != 1)
                        mb();
                atomic_set(&count_count_stop, 0);
                smp_wmb();
@@ -89,7 +86,7 @@ void __cpuinit synchronise_count_master(void)
                /*
                 * Wait for all slaves to leave the synchronization point:
                 */
-                while (atomic_read(&count_count_stop) != nslaves)
+                while (atomic_read(&count_count_stop) != 1)
                        mb();
                atomic_set(&count_count_start, 0);
                smp_wmb();
@@ -97,6 +94,7 @@ void __cpuinit synchronise_count_master(void)
        }
        /* Arrange for an interrupt in a short while */
        write_c0_compare(read_c0_count() + COUNTON);
+        atomic_set(&count_start_flag, 0);
        local_irq_restore(flags);
@@ -108,11 +106,10 @@ void __cpuinit synchronise_count_master(void)
        printk("done.\n");
 }
-void __cpuinit synchronise_count_slave(void)
+void __cpuinit synchronise_count_slave(int cpu)
 {
        int i;
        unsigned int initcount;
-        int ncpus;
 #ifdef CONFIG_MIPS_MT_SMTC
        /*
@@ -127,16 +124,15 @@ void __cpuinit synchronise_count_slave(void)
         * so we first wait for the master to say everyone is ready
         */
-        while (!atomic_read(&count_start_flag))
+        while (atomic_read(&count_start_flag) != cpu)
                mb();
        /* Count will be initialised to next expire for all CPU's */
        initcount = atomic_read(&count_reference);
-        ncpus = num_online_cpus();
        for (i = 0; i < NR_LOOPS; i++) {
                atomic_inc(&count_count_start);
-                while (atomic_read(&count_count_start) != ncpus)
+                while (atomic_read(&count_count_start) != 2)
                        mb();
                /*
@@ -146,7 +142,7 @@ void __cpuinit synchronise_count_slave(void)
                        write_c0_count(initcount);
                atomic_inc(&count_count_stop);
-                while (atomic_read(&count_count_stop) != ncpus)
+                while (atomic_read(&count_count_stop) != 2)
                        mb();
        }
        /* Arrange for an interrupt in a short while */
diff --git a/arch/mips/mti-malta/malta-pci.c b/arch/mips/mti-malta/malta-pci.c
index 284dea54faf5..2147cb34e705 100644
--- a/arch/mips/mti-malta/malta-pci.c
+++ b/arch/mips/mti-malta/malta-pci.c
@@ -252,16 +252,3 @@ void __init mips_pcibios_init(void)
        register_pci_controller(controller);
 }
-/* Enable PCI 2.1 compatibility in PIIX4 */
-static void __devinit quirk_dlcsetup(struct pci_dev *dev)
-{
-        u8 odlc, ndlc;
-        (void) pci_read_config_byte(dev, 0x82, &odlc);
-        /* Enable passive releases and delayed transaction */
-        ndlc = odlc | 7;
-        (void) pci_write_config_byte(dev, 0x82, ndlc);
-}
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_0,
-        quirk_dlcsetup);
diff --git a/arch/mips/pci/pci-ar724x.c b/arch/mips/pci/pci-ar724x.c
index 414a7459858d..86d77a666458 100644
--- a/arch/mips/pci/pci-ar724x.c
+++ b/arch/mips/pci/pci-ar724x.c
@@ -23,9 +23,12 @@
 #define AR724X_PCI_MEM_BASE     0x10000000
 #define AR724X_PCI_MEM_SIZE     0x08000000
+#define AR724X_PCI_REG_RESET            0x18
 #define AR724X_PCI_REG_INT_STATUS       0x4c
 #define AR724X_PCI_REG_INT_MASK         0x50
+#define AR724X_PCI_RESET_LINK_UP        BIT(0)
 #define AR724X_PCI_INT_DEV0             BIT(14)
 #define AR724X_PCI_IRQ_COUNT            1
@@ -38,6 +41,15 @@ static void __iomem *ar724x_pci_ctrl_base;
 static u32 ar724x_pci_bar0_value;
 static bool ar724x_pci_bar0_is_cached;
+static bool ar724x_pci_link_up;
+static inline bool ar724x_pci_check_link(void)
+{
+        u32 reset;
+        reset = __raw_readl(ar724x_pci_ctrl_base + AR724X_PCI_REG_RESET);
+        return reset & AR724X_PCI_RESET_LINK_UP;
+}
 static int ar724x_pci_read(struct pci_bus *bus, unsigned int devfn, int where,
                            int size, uint32_t *value)
@@ -46,6 +58,9 @@ static int ar724x_pci_read(struct pci_bus *bus, unsigned int devfn, int where,
        void __iomem *base;
        u32 data;
+        if (!ar724x_pci_link_up)
+                return PCIBIOS_DEVICE_NOT_FOUND;
        if (devfn)
                return PCIBIOS_DEVICE_NOT_FOUND;
@@ -96,6 +111,9 @@ static int ar724x_pci_write(struct pci_bus *bus, unsigned int devfn, int where,
        u32 data;
        int s;
+        if (!ar724x_pci_link_up)
+                return PCIBIOS_DEVICE_NOT_FOUND;
        if (devfn)
                return PCIBIOS_DEVICE_NOT_FOUND;
@@ -280,6 +298,10 @@ int __init ar724x_pcibios_init(int irq)
        if (ar724x_pci_ctrl_base == NULL)
                goto err_unmap_devcfg;
+        ar724x_pci_link_up = ar724x_pci_check_link();
+        if (!ar724x_pci_link_up)
+                pr_warn("ar724x: PCIe link is down\n");
        ar724x_pci_irq_init(irq);
        register_pci_controller(&ar724x_pci_controller);
diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
index 6c6defc24619..af9cf30ed474 100644
--- a/arch/parisc/include/asm/atomic.h
+++ b/arch/parisc/include/asm/atomic.h
@@ -141,7 +141,7 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
 #define atomic_sub_and_test(i,v)        (atomic_sub_return((i),(v)) == 0)
-#define ATOMIC_INIT(i)  ((atomic_t) { (i) })
+#define ATOMIC_INIT(i)  { (i) }
 #define smp_mb__before_atomic_dec()     smp_mb()
 #define smp_mb__after_atomic_dec()      smp_mb()
@@ -150,7 +150,7 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
 #ifdef CONFIG_64BIT
-#define ATOMIC64_INIT(i) ((atomic64_t) { (i) })
+#define ATOMIC64_INIT(i) { (i) }
 static __inline__ s64
 __atomic64_add_return(s64 i, atomic64_t *v)
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index d4b94b395c16..2c05a9292a81 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -309,7 +309,7 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
                cregs->ksp = (unsigned long)stack
                        + (pregs->gr[21] & (THREAD_SIZE - 1));
                cregs->gr[30] = usp;
-                if (p->personality == PER_HPUX) {
+                if (personality(p->personality) == PER_HPUX) {
 #ifdef CONFIG_HPUX
                        cregs->kpc = (unsigned long) &hpux_child_return;
 #else
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index c9b932260f47..7426e40699bd 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -225,12 +225,12 @@ long parisc_personality(unsigned long personality)
        long err;
        if (personality(current->personality) == PER_LINUX32
-            && personality == PER_LINUX)
+            && personality(personality) == PER_LINUX)
-                personality = PER_LINUX32;
+                personality = (personality & ~PER_MASK) | PER_LINUX32;
        err = sys_personality(personality);
-        if (err == PER_LINUX32)
+        if (personality(err) == PER_LINUX32)
-                err = PER_LINUX;
+                err = (err & ~PER_MASK) | PER_LINUX;
        return err;
 }
diff --git a/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi b/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi
index 8d35d2c1f694..4f9c9f682ecf 100644
--- a/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p4080si-post.dtsi
@@ -345,6 +345,13 @@
 /include/ "qoriq-duart-1.dtsi"
 /include/ "qoriq-gpio-0.dtsi"
 /include/ "qoriq-usb2-mph-0.dtsi"
+        usb@210000 {
+                compatible = "fsl-usb2-mph-v1.6", "fsl,mpc85xx-usb2-mph", "fsl-usb2-mph";
+                port0;
+        };
 /include/ "qoriq-usb2-dr-0.dtsi"
+        usb@211000 {
+                compatible = "fsl-usb2-dr-v1.6", "fsl,mpc85xx-usb2-dr", "fsl-usb2-dr";
+        };
 /include/ "qoriq-sec4.0-0.dtsi"
 };
diff --git a/arch/powerpc/configs/85xx/p1023rds_defconfig b/arch/powerpc/configs/85xx/p1023rds_defconfig
index f4337bacd0e7..26e541c4662b 100644
--- a/arch/powerpc/configs/85xx/p1023rds_defconfig
+++ b/arch/powerpc/configs/85xx/p1023rds_defconfig
@@ -6,28 +6,27 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_AUDIT=y
-CONFIG_SPARSE_IRQ=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_KALLSYMS_ALL=y
-CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_EMBEDDED=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
 CONFIG_P1023_RDS=y
 CONFIG_QUICC_ENGINE=y
 CONFIG_QE_GPIO=y
 CONFIG_CPM2=y
-CONFIG_GPIO_MPC8XXX=y
 CONFIG_HIGHMEM=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_BINFMT_MISC=m
 CONFIG_MATH_EMULATION=y
@@ -63,11 +62,11 @@ CONFIG_INET_ESP=y
 CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
 CONFIG_PROC_DEVICETREE=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=131072
-CONFIG_MISC_DEVICES=y
 CONFIG_EEPROM_LEGACY=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
@@ -80,15 +79,14 @@ CONFIG_SATA_FSL=y
 CONFIG_SATA_SIL24=y
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
+CONFIG_FS_ENET=y
+CONFIG_FSL_PQ_MDIO=y
+CONFIG_E1000E=y
 CONFIG_MARVELL_PHY=y
 CONFIG_DAVICOM_PHY=y
 CONFIG_CICADA_PHY=y
 CONFIG_VITESSE_PHY=y
 CONFIG_FIXED_PHY=y
-CONFIG_NET_ETHERNET=y
-CONFIG_FS_ENET=y
-CONFIG_E1000E=y
-CONFIG_FSL_PQ_MDIO=y
 CONFIG_INPUT_FF_MEMLESS=m
 # CONFIG_INPUT_MOUSEDEV is not set
 # CONFIG_INPUT_KEYBOARD is not set
@@ -98,16 +96,15 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=2
 CONFIG_SERIAL_8250_RUNTIME_UARTS=2
-CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_DETECT_IRQ=y
 CONFIG_SERIAL_8250_RSA=y
 CONFIG_SERIAL_QE=m
-CONFIG_HW_RANDOM=y
 CONFIG_NVRAM=y
 CONFIG_I2C=y
 CONFIG_I2C_CPM=m
 CONFIG_I2C_MPC=y
+CONFIG_GPIO_MPC8XXX=y
 # CONFIG_HWMON is not set
 CONFIG_VIDEO_OUTPUT_CONTROL=y
 CONFIG_SOUND=y
@@ -123,7 +120,6 @@ CONFIG_DMADEVICES=y
 CONFIG_FSL_DMA=y
 # CONFIG_NET_DMA is not set
 CONFIG_STAGING=y
-# CONFIG_STAGING_EXCLUDE_BUILD is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
@@ -150,22 +146,15 @@ CONFIG_QNX4FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
 CONFIG_NFS_V4=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_MAC_PARTITION=y
 CONFIG_CRC_T10DIF=y
 CONFIG_FRAME_WARN=8092
 CONFIG_DEBUG_FS=y
-CONFIG_DEBUG_KERNEL=y
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_DEBUG_BUGVERBOSE is not set
 CONFIG_DEBUG_INFO=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
diff --git a/arch/powerpc/configs/corenet32_smp_defconfig b/arch/powerpc/configs/corenet32_smp_defconfig
index cbb98c1234fd..8b3d57c1ebe8 100644
--- a/arch/powerpc/configs/corenet32_smp_defconfig
+++ b/arch/powerpc/configs/corenet32_smp_defconfig
@@ -6,8 +6,8 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_AUDIT=y
-CONFIG_SPARSE_IRQ=y
+CONFIG_NO_HZ=y
-CONFIG_RCU_TRACE=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -21,23 +21,22 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
 CONFIG_P2041_RDB=y
 CONFIG_P3041_DS=y
 CONFIG_P4080_DS=y
 CONFIG_P5020_DS=y
 CONFIG_HIGHMEM=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_BINFMT_MISC=m
 CONFIG_KEXEC=y
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_FORCE_MAX_ZONEORDER=13
-CONFIG_FSL_LBC=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
-CONFIG_PCI_MSI=y
 # CONFIG_PCIEASPM is not set
+CONFIG_PCI_MSI=y
 CONFIG_RAPIDIO=y
 CONFIG_FSL_RIO=y
 CONFIG_NET=y
@@ -70,6 +69,7 @@ CONFIG_INET_IPCOMP=y
 CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
@@ -77,17 +77,14 @@ CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
 CONFIG_MTD_CFI_AMDSTD=y
 CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_M25P80=y
 CONFIG_MTD_NAND=y
-CONFIG_MTD_NAND_ECC=y
-CONFIG_MTD_NAND_IDS=y
-CONFIG_MTD_NAND_FSL_IFC=y
 CONFIG_MTD_NAND_FSL_ELBC=y
-CONFIG_MTD_M25P80=y
+CONFIG_MTD_NAND_FSL_IFC=y
 CONFIG_PROC_DEVICETREE=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=131072
-CONFIG_MISC_DEVICES=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
 CONFIG_BLK_DEV_SR=y
@@ -115,11 +112,9 @@ CONFIG_SERIO_LIBPS2=y
 CONFIG_PPC_EPAPR_HV_BYTECHAN=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_DETECT_IRQ=y
 CONFIG_SERIAL_8250_RSA=y
-CONFIG_HW_RANDOM=y
 CONFIG_NVRAM=y
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
@@ -132,7 +127,6 @@ CONFIG_SPI_FSL_ESPI=y
 CONFIG_VIDEO_OUTPUT_CONTROL=y
 CONFIG_USB_HID=m
 CONFIG_USB=y
-CONFIG_USB_DEVICEFS=y
 CONFIG_USB_MON=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_FSL=y
@@ -142,8 +136,6 @@ CONFIG_USB_OHCI_HCD_PPC_OF_LE=y
 CONFIG_USB_STORAGE=y
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
-CONFIG_MMC_SDHCI_OF=y
-CONFIG_MMC_SDHCI_OF_ESDHC=y
 CONFIG_EDAC=y
 CONFIG_EDAC_MM_EDAC=y
 CONFIG_EDAC_MPC85XX=y
@@ -170,19 +162,16 @@ CONFIG_HUGETLBFS=y
 CONFIG_JFFS2_FS=y
 CONFIG_CRAMFS=y
 CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
 CONFIG_NFS_V4=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_MAC_PARTITION=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_UTF8=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_SHIRQ=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_DEBUG_INFO=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_RCU_TRACE=y
 CONFIG_CRYPTO_NULL=y
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_MD4=y
diff --git a/arch/powerpc/configs/corenet64_smp_defconfig b/arch/powerpc/configs/corenet64_smp_defconfig
index dd89de8b0b7f..0516e22ca3de 100644
--- a/arch/powerpc/configs/corenet64_smp_defconfig
+++ b/arch/powerpc/configs/corenet64_smp_defconfig
@@ -56,6 +56,7 @@ CONFIG_INET_ESP=y
 CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index 15130066e5e2..07b7f2af2dca 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -1,8 +1,10 @@
+CONFIG_PPC64=y
+CONFIG_ALTIVEC=y
+CONFIG_SMP=y
+CONFIG_NR_CPUS=4
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_BLK_DEV_INITRD=y
@@ -13,15 +15,16 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_PARTITION_ADVANCED=y
+# CONFIG_PPC_PSERIES is not set
-CONFIG_MAC_PARTITION=y
-CONFIG_SMP=y
-CONFIG_NR_CPUS=4
-CONFIG_KEXEC=y
-# CONFIG_RELOCATABLE is not set
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_PMAC64=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_KEXEC=y
+CONFIG_IRQ_ALL_CPUS=y
+# CONFIG_MIGRATION is not set
 CONFIG_PCI_MSI=y
 CONFIG_NET=y
 CONFIG_PACKET=y
@@ -49,6 +52,7 @@ CONFIG_NF_CT_NETLINK=m
 CONFIG_NF_CONNTRACK_IPV4=m
 CONFIG_IP_NF_QUEUE=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_PROC_DEVICETREE=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
@@ -56,6 +60,8 @@ CONFIG_BLK_DEV_RAM_SIZE=65536
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_IDE=y
 CONFIG_BLK_DEV_IDECD=y
+CONFIG_BLK_DEV_IDE_PMAC=y
+CONFIG_BLK_DEV_IDE_PMAC_ATA100FIRST=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
 CONFIG_BLK_DEV_SR=y
@@ -79,24 +85,33 @@ CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
-CONFIG_MACINTOSH_DRIVERS=y
+CONFIG_IEEE1394=y
+CONFIG_IEEE1394_OHCI1394=y
+CONFIG_IEEE1394_SBP2=m
+CONFIG_IEEE1394_ETH1394=m
+CONFIG_IEEE1394_RAWIO=y
+CONFIG_IEEE1394_VIDEO1394=m
+CONFIG_IEEE1394_DV1394=m
+CONFIG_ADB_PMU=y
+CONFIG_PMAC_SMU=y
 CONFIG_MAC_EMUMOUSEBTN=y
+CONFIG_THERM_PM72=y
+CONFIG_WINDFARM=y
+CONFIG_WINDFARM_PM81=y
+CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM112=y
+CONFIG_WINDFARM_PM121=y
 CONFIG_NETDEVICES=y
-CONFIG_BONDING=m
 CONFIG_DUMMY=m
-CONFIG_MII=y
+CONFIG_BONDING=m
 CONFIG_TUN=m
+CONFIG_NET_ETHERNET=y
+CONFIG_MII=y
+CONFIG_SUNGEM=y
 CONFIG_ACENIC=m
 CONFIG_ACENIC_OMIT_TIGON_I=y
-CONFIG_TIGON3=y
 CONFIG_E1000=y
-CONFIG_SUNGEM=y
+CONFIG_TIGON3=y
-CONFIG_PPP=m
-CONFIG_PPP_BSDCOMP=m
-CONFIG_PPP_DEFLATE=m
-CONFIG_PPPOE=m
-CONFIG_PPP_ASYNC=m
-CONFIG_PPP_SYNC_TTY=m
 CONFIG_USB_CATC=m
 CONFIG_USB_KAWETH=m
 CONFIG_USB_PEGASUS=m
@@ -106,24 +121,36 @@ CONFIG_USB_USBNET=m
 # CONFIG_USB_NET_NET1080 is not set
 # CONFIG_USB_NET_CDC_SUBSET is not set
 # CONFIG_USB_NET_ZAURUS is not set
+CONFIG_PPP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPPOE=m
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_JOYDEV=m
 CONFIG_INPUT_EVDEV=y
+# CONFIG_KEYBOARD_ATKBD is not set
 # CONFIG_MOUSE_PS2 is not set
+# CONFIG_SERIO_I8042 is not set
 # CONFIG_SERIO_SERPORT is not set
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_HW_RANDOM is not set
 CONFIG_GEN_RTC=y
 CONFIG_RAW_DRIVER=y
 CONFIG_I2C_CHARDEV=y
 # CONFIG_HWMON is not set
-CONFIG_AGP=y
+CONFIG_AGP=m
-CONFIG_DRM=y
+CONFIG_AGP_UNINORTH=m
-CONFIG_DRM_NOUVEAU=y
 CONFIG_VIDEO_OUTPUT_CONTROL=m
+CONFIG_FB=y
 CONFIG_FIRMWARE_EDID=y
 CONFIG_FB_TILEBLITTING=y
+CONFIG_FB_OF=y
+CONFIG_FB_NVIDIA=y
+CONFIG_FB_NVIDIA_I2C=y
 CONFIG_FB_RADEON=y
+# CONFIG_VGA_CONSOLE is not set
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
@@ -131,7 +158,15 @@ CONFIG_SND_SEQUENCER=m
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_POWERMAC=m
+CONFIG_SND_AOA=m
+CONFIG_SND_AOA_FABRIC_LAYOUT=m
+CONFIG_SND_AOA_ONYX=m
+CONFIG_SND_AOA_TAS=m
+CONFIG_SND_AOA_TOONIE=m
 CONFIG_SND_USB_AUDIO=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
 CONFIG_HID_GYRATION=y
 CONFIG_LOGITECH_FF=y
 CONFIG_HID_PANTHERLORD=y
@@ -139,12 +174,13 @@ CONFIG_HID_PETALYNX=y
 CONFIG_HID_SAMSUNG=y
 CONFIG_HID_SONY=y
 CONFIG_HID_SUNPLUS=y
-CONFIG_HID_PID=y
-CONFIG_USB_HIDDEV=y
 CONFIG_USB=y
+CONFIG_USB_DEVICEFS=y
 CONFIG_USB_MON=y
 CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_HCD_PPC_OF is not set
 CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PPC_OF_BE=y
 CONFIG_USB_ACM=m
 CONFIG_USB_PRINTER=y
 CONFIG_USB_STORAGE=y
@@ -208,6 +244,8 @@ CONFIG_REISERFS_FS_POSIX_ACL=y
 CONFIG_REISERFS_FS_SECURITY=y
 CONFIG_XFS_FS=m
 CONFIG_XFS_POSIX_ACL=y
+CONFIG_INOTIFY=y
+CONFIG_AUTOFS_FS=m
 CONFIG_ISO9660_FS=y
 CONFIG_JOLIET=y
 CONFIG_ZISOFS=y
@@ -221,12 +259,14 @@ CONFIG_HFS_FS=m
 CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3=y
 CONFIG_NFS_V3_ACL=y
 CONFIG_NFS_V4=y
 CONFIG_NFSD=y
 CONFIG_NFSD_V3_ACL=y
 CONFIG_NFSD_V4=y
 CONFIG_CIFS=m
+CONFIG_PARTITION_ADVANCED=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_CODEPAGE_1250=y
 CONFIG_NLS_CODEPAGE_1251=y
@@ -234,23 +274,29 @@ CONFIG_NLS_ASCII=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
+CONFIG_CRC_T10DIF=y
+CONFIG_LIBCRC32C=m
 CONFIG_MAGIC_SYSRQ=y
-# CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_MUTEXES=y
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_LATENCYTOP=y
-CONFIG_STRICT_DEVMEM=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_BOOTX_TEXT=y
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES=m
 CONFIG_CRYPTO_ANUBIS=m
+CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAST5=m
 CONFIG_CRYPTO_CAST6=m
@@ -260,6 +306,3 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 # CONFIG_CRYPTO_HW is not set
-# CONFIG_VIRTUALIZATION is not set
-CONFIG_CRC_T10DIF=y
-CONFIG_LIBCRC32C=m
diff --git a/arch/powerpc/configs/mpc83xx_defconfig b/arch/powerpc/configs/mpc83xx_defconfig
index 5aac9a8bc53b..9352e4430c3b 100644
--- a/arch/powerpc/configs/mpc83xx_defconfig
+++ b/arch/powerpc/configs/mpc83xx_defconfig
@@ -2,12 +2,12 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
 # CONFIG_PPC_CHRP is not set
 # CONFIG_PPC_PMAC is not set
 CONFIG_PPC_83xx=y
@@ -25,7 +25,6 @@ CONFIG_ASP834x=y
 CONFIG_QUICC_ENGINE=y
 CONFIG_QE_GPIO=y
 CONFIG_MATH_EMULATION=y
-CONFIG_SPARSE_IRQ=y
 CONFIG_PCI=y
 CONFIG_NET=y
 CONFIG_PACKET=y
@@ -42,10 +41,9 @@ CONFIG_INET_ESP=y
 # CONFIG_INET_LRO is not set
 # CONFIG_IPV6 is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_OF_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
@@ -64,15 +62,14 @@ CONFIG_ATA=y
 CONFIG_SATA_FSL=y
 CONFIG_SATA_SIL=y
 CONFIG_NETDEVICES=y
+CONFIG_MII=y
+CONFIG_UCC_GETH=y
+CONFIG_GIANFAR=y
 CONFIG_MARVELL_PHY=y
 CONFIG_DAVICOM_PHY=y
 CONFIG_VITESSE_PHY=y
 CONFIG_ICPLUS_PHY=y
 CONFIG_FIXED_PHY=y
-CONFIG_NET_ETHERNET=y
-CONFIG_MII=y
-CONFIG_GIANFAR=y
-CONFIG_UCC_GETH=y
 CONFIG_INPUT_FF_MEMLESS=m
 # CONFIG_INPUT_MOUSEDEV is not set
 # CONFIG_INPUT_KEYBOARD is not set
@@ -112,17 +109,12 @@ CONFIG_RTC_DRV_DS1374=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-CONFIG_INOTIFY=y
 CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
 CONFIG_NFS_V4=y
 CONFIG_ROOT_NFS=y
-CONFIG_PARTITION_ADVANCED=y
 CONFIG_CRC_T10DIF=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_SHA256=y
diff --git a/arch/powerpc/configs/mpc85xx_defconfig b/arch/powerpc/configs/mpc85xx_defconfig
index 03ee911c4577..8b5bda27d248 100644
--- a/arch/powerpc/configs/mpc85xx_defconfig
+++ b/arch/powerpc/configs/mpc85xx_defconfig
@@ -5,7 +5,9 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_AUDIT=y
-CONFIG_SPARSE_IRQ=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -17,6 +19,8 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
 CONFIG_MPC8540_ADS=y
 CONFIG_MPC8560_ADS=y
 CONFIG_MPC85xx_CDS=y
@@ -40,8 +44,6 @@ CONFIG_SBC8548=y
 CONFIG_QUICC_ENGINE=y
 CONFIG_QE_GPIO=y
 CONFIG_HIGHMEM=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BINFMT_MISC=m
 CONFIG_MATH_EMULATION=y
 CONFIG_FORCE_MAX_ZONEORDER=12
@@ -74,36 +76,25 @@ CONFIG_INET_ESP=y
 CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
 CONFIG_FTL=y
-CONFIG_MTD_GEN_PROBE=y
+CONFIG_MTD_CFI=y
-CONFIG_MTD_MAP_BANK_WIDTH_1=y
-CONFIG_MTD_MAP_BANK_WIDTH_2=y
-CONFIG_MTD_MAP_BANK_WIDTH_4=y
-CONFIG_MTD_CFI_I1=y
-CONFIG_MTD_CFI_I2=y
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_CFI_UTIL=y
 CONFIG_MTD_PHYSMAP_OF=y
-CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_M25P80=y
-CONFIG_MTD_OF_PARTS=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_FSL_ELBC=y
 CONFIG_MTD_NAND_FSL_IFC=y
-CONFIG_MTD_NAND_IDS=y
-CONFIG_MTD_NAND_ECC=y
-CONFIG_MTD_M25P80=y
 CONFIG_PROC_DEVICETREE=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=131072
-CONFIG_MISC_DEVICES=y
 CONFIG_EEPROM_LEGACY=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
@@ -115,6 +106,7 @@ CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_FSL=y
 CONFIG_PATA_ALI=y
+CONFIG_PATA_VIA=y
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
 CONFIG_FS_ENET=y
@@ -134,7 +126,6 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=2
 CONFIG_SERIAL_8250_RUNTIME_UARTS=2
-CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_DETECT_IRQ=y
 CONFIG_SERIAL_8250_RSA=y
@@ -183,7 +174,6 @@ CONFIG_HID_SAMSUNG=y
 CONFIG_HID_SONY=y
 CONFIG_HID_SUNPLUS=y
 CONFIG_USB=y
-CONFIG_USB_DEVICEFS=y
 CONFIG_USB_MON=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_FSL=y
@@ -229,18 +219,13 @@ CONFIG_QNX4FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
 CONFIG_NFS_V4=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_MAC_PARTITION=y
 CONFIG_CRC_T10DIF=y
 CONFIG_DEBUG_FS=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_DEBUG_INFO=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
diff --git a/arch/powerpc/configs/mpc85xx_smp_defconfig b/arch/powerpc/configs/mpc85xx_smp_defconfig
index fdfa84dc908f..b0974e7e98ae 100644
--- a/arch/powerpc/configs/mpc85xx_smp_defconfig
+++ b/arch/powerpc/configs/mpc85xx_smp_defconfig
@@ -7,7 +7,9 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_AUDIT=y
-CONFIG_SPARSE_IRQ=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -19,6 +21,8 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
 CONFIG_MPC8540_ADS=y
 CONFIG_MPC8560_ADS=y
 CONFIG_MPC85xx_CDS=y
@@ -42,8 +46,6 @@ CONFIG_SBC8548=y
 CONFIG_QUICC_ENGINE=y
 CONFIG_QE_GPIO=y
 CONFIG_HIGHMEM=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BINFMT_MISC=m
 CONFIG_MATH_EMULATION=y
 CONFIG_IRQ_ALL_CPUS=y
@@ -77,36 +79,25 @@ CONFIG_INET_ESP=y
 CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
 CONFIG_FTL=y
-CONFIG_MTD_GEN_PROBE=y
+CONFIG_MTD_CFI=y
-CONFIG_MTD_MAP_BANK_WIDTH_1=y
-CONFIG_MTD_MAP_BANK_WIDTH_2=y
-CONFIG_MTD_MAP_BANK_WIDTH_4=y
-CONFIG_MTD_CFI_I1=y
-CONFIG_MTD_CFI_I2=y
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_CFI_UTIL=y
 CONFIG_MTD_PHYSMAP_OF=y
-CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_M25P80=y
-CONFIG_MTD_OF_PARTS=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_FSL_ELBC=y
 CONFIG_MTD_NAND_FSL_IFC=y
-CONFIG_MTD_NAND_IDS=y
-CONFIG_MTD_NAND_ECC=y
-CONFIG_MTD_M25P80=y
 CONFIG_PROC_DEVICETREE=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=131072
-CONFIG_MISC_DEVICES=y
 CONFIG_EEPROM_LEGACY=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
@@ -137,7 +128,6 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=2
 CONFIG_SERIAL_8250_RUNTIME_UARTS=2
-CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_DETECT_IRQ=y
 CONFIG_SERIAL_8250_RSA=y
@@ -186,7 +176,6 @@ CONFIG_HID_SAMSUNG=y
 CONFIG_HID_SONY=y
 CONFIG_HID_SUNPLUS=y
 CONFIG_USB=y
-CONFIG_USB_DEVICEFS=y
 CONFIG_USB_MON=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_FSL=y
@@ -232,18 +221,13 @@ CONFIG_QNX4FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
 CONFIG_NFS_V4=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_MAC_PARTITION=y
 CONFIG_CRC_T10DIF=y
 CONFIG_DEBUG_FS=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_DEBUG_INFO=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index 50d82c8a037f..b3c083de17ad 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -553,9 +553,7 @@ static inline int cpu_has_feature(unsigned long feature)
                & feature);
 }
-#ifdef CONFIG_HAVE_HW_BREAKPOINT
 #define HBP_NUM 1
-#endif /* CONFIG_HAVE_HW_BREAKPOINT */
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
index 50ea12fd7bf5..a8bf5c673a3c 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -33,6 +33,7 @@
 #include <asm/kvm_asm.h>
 #include <asm/processor.h>
 #include <asm/page.h>
+#include <asm/cacheflush.h>
 #define KVM_MAX_VCPUS           NR_CPUS
 #define KVM_MAX_VCORES          NR_CPUS
diff --git a/arch/powerpc/include/asm/kvm_ppc.h b/arch/powerpc/include/asm/kvm_ppc.h
index 0124937a23b9..e006f0bdea95 100644
--- a/arch/powerpc/include/asm/kvm_ppc.h
+++ b/arch/powerpc/include/asm/kvm_ppc.h
@@ -219,4 +219,16 @@ void kvmppc_claim_lpid(long lpid);
 void kvmppc_free_lpid(long lpid);
 void kvmppc_init_lpid(unsigned long nr_lpids);
+static inline void kvmppc_mmu_flush_icache(pfn_t pfn)
+{
+        /* Clear i-cache for new pages */
+        struct page *page;
+        page = pfn_to_page(pfn);
+        if (!test_bit(PG_arch_1, &page->flags)) {
+                flush_dcache_icache_page(page);
+                set_bit(PG_arch_1, &page->flags);
+        }
+}
 #endif /* __POWERPC_KVM_PPC_H__ */
diff --git a/arch/powerpc/include/asm/mpic_msgr.h b/arch/powerpc/include/asm/mpic_msgr.h
index 326d33ca55cd..d4f471fb1031 100644
--- a/arch/powerpc/include/asm/mpic_msgr.h
+++ b/arch/powerpc/include/asm/mpic_msgr.h
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/spinlock.h>
 #include <asm/smp.h>
+#include <asm/io.h>
 struct mpic_msgr {
        u32 __iomem *base;
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index 53b6dfa83344..54b73a28c205 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -386,6 +386,7 @@ extern unsigned long cpuidle_disable;
 enum idle_boot_override {IDLE_NO_OVERRIDE = 0, IDLE_POWERSAVE_OFF};
 extern int powersave_nap;       /* set if nap mode can be used in idle loop */
+extern void power7_nap(void);
 #ifdef CONFIG_PSERIES_IDLE
 extern void update_smt_snooze_delay(int snooze);
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 85b05c463fae..e8995727b1c1 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -76,6 +76,7 @@ int main(void)
        DEFINE(SIGSEGV, SIGSEGV);
        DEFINE(NMI_MASK, NMI_MASK);
        DEFINE(THREAD_DSCR, offsetof(struct thread_struct, dscr));
+        DEFINE(THREAD_DSCR_INHERIT, offsetof(struct thread_struct, dscr_inherit));
 #else
        DEFINE(THREAD_INFO, offsetof(struct task_struct, stack));
 #endif /* CONFIG_PPC64 */
diff --git a/arch/powerpc/kernel/dbell.c b/arch/powerpc/kernel/dbell.c
index 5b25c8060fd6..a892680668d8 100644
--- a/arch/powerpc/kernel/dbell.c
+++ b/arch/powerpc/kernel/dbell.c
@@ -28,6 +28,8 @@ void doorbell_setup_this_cpu(void)
 void doorbell_cause_ipi(int cpu, unsigned long data)
 {
+        /* Order previous accesses vs. msgsnd, which is treated as a store */
+        mb();
        ppc_msgsnd(PPC_DBELL, 0, data);
 }
diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c
index 2d7bb8ced136..e4897523de41 100644
--- a/arch/powerpc/kernel/dma-iommu.c
+++ b/arch/powerpc/kernel/dma-iommu.c
@@ -83,11 +83,10 @@ static int dma_iommu_dma_supported(struct device *dev, u64 mask)
                return 0;
        }
-        if ((tbl->it_offset + tbl->it_size) > (mask >> IOMMU_PAGE_SHIFT)) {
+        if (tbl->it_offset > (mask >> IOMMU_PAGE_SHIFT)) {
-                dev_info(dev, "Warning: IOMMU window too big for device mask\n");
+                dev_info(dev, "Warning: IOMMU offset too big for device mask\n");
-                dev_info(dev, "mask: 0x%08llx, table end: 0x%08lx\n",
+                dev_info(dev, "mask: 0x%08llx, table offset: 0x%08lx\n",
-                                mask, (tbl->it_offset + tbl->it_size) <<
+                                mask, tbl->it_offset << IOMMU_PAGE_SHIFT);
-                                IOMMU_PAGE_SHIFT);
                return 0;
        } else
                return 1;
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 4b01a25e29ef..b40e0b4815b3 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -370,6 +370,12 @@ _GLOBAL(ret_from_fork)
        li      r3,0
        b       syscall_exit
+        .section        ".toc","aw"
+DSCR_DEFAULT:
+        .tc dscr_default[TC],dscr_default
+        .section        ".text"
 /*
 * This routine switches between two different tasks.  The process
 * state of one is saved on its kernel stack.  Then the state
@@ -509,9 +515,6 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
        mr      r1,r8           /* start using new stack pointer */
        std     r7,PACAKSAVE(r13)
-        ld      r6,_CCR(r1)
-        mtcrf   0xFF,r6
 #ifdef CONFIG_ALTIVEC
 BEGIN_FTR_SECTION
        ld      r0,THREAD_VRSAVE(r4)
@@ -520,14 +523,22 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif /* CONFIG_ALTIVEC */
 #ifdef CONFIG_PPC64
 BEGIN_FTR_SECTION
+        lwz     r6,THREAD_DSCR_INHERIT(r4)
+        ld      r7,DSCR_DEFAULT@toc(2)
        ld      r0,THREAD_DSCR(r4)
-        cmpd    r0,r25
+        cmpwi   r6,0
-        beq     1f
+        bne     1f
+        ld      r0,0(r7)
+1:      cmpd    r0,r25
+        beq     2f
        mtspr   SPRN_DSCR,r0
-1:      
+2:
 END_FTR_SECTION_IFSET(CPU_FTR_DSCR)
 #endif
+        ld      r6,_CCR(r1)
+        mtcrf   0xFF,r6
        /* r3-r13 are destroyed -- Cort */
        REST_8GPRS(14, r1)
        REST_10GPRS(22, r1)
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index e894515e77bb..39aa97d3ff88 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -186,7 +186,7 @@ hardware_interrupt_hv:
        KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0x800)
        MASKABLE_EXCEPTION_PSERIES(0x900, 0x900, decrementer)
-        MASKABLE_EXCEPTION_HV(0x980, 0x982, decrementer)
+        STD_EXCEPTION_HV(0x980, 0x982, hdecrementer)
        STD_EXCEPTION_PSERIES(0xa00, 0xa00, trap_0a)
        KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xa00)
@@ -486,6 +486,7 @@ machine_check_common:
        STD_EXCEPTION_COMMON_ASYNC(0x500, hardware_interrupt, do_IRQ)
        STD_EXCEPTION_COMMON_ASYNC(0x900, decrementer, .timer_interrupt)
+        STD_EXCEPTION_COMMON(0x980, hdecrementer, .hdec_interrupt)
        STD_EXCEPTION_COMMON(0xa00, trap_0a, .unknown_exception)
        STD_EXCEPTION_COMMON(0xb00, trap_0b, .unknown_exception)
        STD_EXCEPTION_COMMON(0xd00, single_step, .single_step_exception)
diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
index f3a82dde61db..956a4c496de9 100644
--- a/arch/powerpc/kernel/hw_breakpoint.c
+++ b/arch/powerpc/kernel/hw_breakpoint.c
@@ -253,7 +253,7 @@ int __kprobes hw_breakpoint_handler(struct die_args *args)
        /* Do not emulate user-space instructions, instead single-step them */
        if (user_mode(regs)) {
-                bp->ctx->task->thread.last_hit_ubp = bp;
+                current->thread.last_hit_ubp = bp;
                regs->msr |= MSR_SE;
                goto out;
        }
diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
index 7140d838339e..e11863f4e595 100644
--- a/arch/powerpc/kernel/idle_power7.S
+++ b/arch/powerpc/kernel/idle_power7.S
@@ -28,7 +28,9 @@ _GLOBAL(power7_idle)
        lwz     r4,ADDROFF(powersave_nap)(r3)
        cmpwi   0,r4,0
        beqlr
+        /* fall through */
+_GLOBAL(power7_nap)
        /* NAP is a state loss, we create a regs frame on the
         * stack, fill it up with the state we care about and
         * stick a pointer to it in PACAR1. We really only
diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
index 782bd0a3c2f0..c470a40b29f5 100644
--- a/arch/powerpc/kernel/kgdb.c
+++ b/arch/powerpc/kernel/kgdb.c
@@ -25,6 +25,7 @@
 #include <asm/processor.h>
 #include <asm/machdep.h>
 #include <asm/debug.h>
+#include <linux/slab.h>
 /*
 * This table contains the mapping between PowerPC hardware trap types, and
@@ -101,6 +102,21 @@ static int computeSignal(unsigned int tt)
        return SIGHUP;          /* default for things we don't know about */
 }
+/**
+ *
+ *      kgdb_skipexception - Bail out of KGDB when we've been triggered.
+ *      @exception: Exception vector number
+ *      @regs: Current &struct pt_regs.
+ *
+ *      On some architectures we need to skip a breakpoint exception when
+ *      it occurs after a breakpoint has been removed.
+ *
+ */
+int kgdb_skipexception(int exception, struct pt_regs *regs)
+{
+        return kgdb_isremovedbreak(regs->nip);
+}
 static int kgdb_call_nmi_hook(struct pt_regs *regs)
 {
        kgdb_nmicallback(raw_smp_processor_id(), regs);
@@ -138,6 +154,8 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
 static int kgdb_singlestep(struct pt_regs *regs)
 {
        struct thread_info *thread_info, *exception_thread_info;
+        struct thread_info *backup_current_thread_info = \
+                (struct thread_info *)kmalloc(sizeof(struct thread_info), GFP_KERNEL);
        if (user_mode(regs))
                return 0;
@@ -155,13 +173,17 @@ static int kgdb_singlestep(struct pt_regs *regs)
        thread_info = (struct thread_info *)(regs->gpr[1] & ~(THREAD_SIZE-1));
        exception_thread_info = current_thread_info();
-        if (thread_info != exception_thread_info)
+        if (thread_info != exception_thread_info) {
+                /* Save the original current_thread_info. */
+                memcpy(backup_current_thread_info, exception_thread_info, sizeof *thread_info);
                memcpy(exception_thread_info, thread_info, sizeof *thread_info);
+        }
        kgdb_handle_exception(0, SIGTRAP, 0, regs);
        if (thread_info != exception_thread_info)
-                memcpy(thread_info, exception_thread_info, sizeof *thread_info);
+                /* Restore current_thread_info lastly. */
+                memcpy(exception_thread_info, backup_current_thread_info, sizeof *thread_info);
        return 1;
 }
@@ -410,7 +432,6 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
 #else
                        linux_regs->msr |= MSR_SE;
 #endif
-                        kgdb_single_step = 1;
                        atomic_set(&kgdb_cpu_doing_single_step,
                                   raw_smp_processor_id());
                }
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 710f400476de..1a1f2ddfb581 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -802,16 +802,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
 #endif /* CONFIG_PPC_STD_MMU_64 */
 #ifdef CONFIG_PPC64 
        if (cpu_has_feature(CPU_FTR_DSCR)) {
-                if (current->thread.dscr_inherit) {
+                p->thread.dscr_inherit = current->thread.dscr_inherit;
-                        p->thread.dscr_inherit = 1;
+                p->thread.dscr = current->thread.dscr;
-                        p->thread.dscr = current->thread.dscr;
-                } else if (0 != dscr_default) {
-                        p->thread.dscr_inherit = 1;
-                        p->thread.dscr = dscr_default;
-                } else {
-                        p->thread.dscr_inherit = 0;
-                        p->thread.dscr = 0;
-                }
        }
 #endif
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 0321007086f7..8d4214afc21d 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -198,8 +198,15 @@ void smp_muxed_ipi_message_pass(int cpu, int msg)
        struct cpu_messages *info = &per_cpu(ipi_message, cpu);
        char *message = (char *)&info->messages;
+        /*
+         * Order previous accesses before accesses in the IPI handler.
+         */
+        smp_mb();
        message[msg] = 1;
-        mb();
+        /*
+         * cause_ipi functions are required to include a full barrier
+         * before doing whatever causes the IPI.
+         */
        smp_ops->cause_ipi(cpu, info->data);
 }
@@ -211,7 +218,7 @@ irqreturn_t smp_ipi_demux(void)
        mb();   /* order any irq clear */
        do {
-                all = xchg_local(&info->messages, 0);
+                all = xchg(&info->messages, 0);
 #ifdef __BIG_ENDIAN
                if (all & (1 << (24 - 8 * PPC_MSG_CALL_FUNCTION)))
diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c
index f2496f2faecc..4e3cc47f26b9 100644
--- a/arch/powerpc/kernel/syscalls.c
+++ b/arch/powerpc/kernel/syscalls.c
@@ -107,11 +107,11 @@ long ppc64_personality(unsigned long personality)
        long ret;
        if (personality(current->personality) == PER_LINUX32
-            && personality == PER_LINUX)
+            && personality(personality) == PER_LINUX)
-                personality = PER_LINUX32;
+                personality = (personality & ~PER_MASK) | PER_LINUX32;
        ret = sys_personality(personality);
-        if (ret == PER_LINUX32)
+        if (personality(ret) == PER_LINUX32)
-                ret = PER_LINUX;
+                ret = (ret & ~PER_MASK) | PER_LINUX;
        return ret;
 }
 #endif
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 3529446c2abd..8302af649219 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -194,6 +194,14 @@ static ssize_t show_dscr_default(struct device *dev,
        return sprintf(buf, "%lx\n", dscr_default);
 }
+static void update_dscr(void *dummy)
+{
+        if (!current->thread.dscr_inherit) {
+                current->thread.dscr = dscr_default;
+                mtspr(SPRN_DSCR, dscr_default);
+        }
+}
 static ssize_t __used store_dscr_default(struct device *dev,
                struct device_attribute *attr, const char *buf,
                size_t count)
@@ -206,6 +214,8 @@ static ssize_t __used store_dscr_default(struct device *dev,
                return -EINVAL;
        dscr_default = val;
+        on_each_cpu(update_dscr, NULL, 1);
        return count;
 }
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index be171ee73bf8..e49e93191b69 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -535,6 +535,15 @@ void timer_interrupt(struct pt_regs * regs)
        trace_timer_interrupt_exit(regs);
 }
+/*
+ * Hypervisor decrementer interrupts shouldn't occur but are sometimes
+ * left pending on exit from a KVM guest.  We don't need to do anything
+ * to clear them, as they are edge-triggered.
+ */
+void hdec_interrupt(struct pt_regs *regs)
+{
+}
 #ifdef CONFIG_SUSPEND
 static void generic_suspend_disable_irqs(void)
 {
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 158972341a2d..ae0843fa7a61 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -972,8 +972,9 @@ static int emulate_instruction(struct pt_regs *regs)
                        cpu_has_feature(CPU_FTR_DSCR)) {
                PPC_WARN_EMULATED(mtdscr, regs);
                rd = (instword >> 21) & 0x1f;
-                mtspr(SPRN_DSCR, regs->gpr[rd]);
+                current->thread.dscr = regs->gpr[rd];
                current->thread.dscr_inherit = 1;
+                mtspr(SPRN_DSCR, current->thread.dscr);
                return 0;
        }
 #endif
diff --git a/arch/powerpc/kvm/book3s_32_mmu_host.c b/arch/powerpc/kvm/book3s_32_mmu_host.c
index f922c29bb234..837f13e7b6bf 100644
--- a/arch/powerpc/kvm/book3s_32_mmu_host.c
+++ b/arch/powerpc/kvm/book3s_32_mmu_host.c
@@ -211,6 +211,9 @@ next_pteg:
                pteg1 |= PP_RWRX;
        }
+        if (orig_pte->may_execute)
+                kvmppc_mmu_flush_icache(hpaddr >> PAGE_SHIFT);
        local_irq_disable();
        if (pteg[rr]) {
diff --git a/arch/powerpc/kvm/book3s_64_mmu_host.c b/arch/powerpc/kvm/book3s_64_mmu_host.c
index 10fc8ec9d2a8..0688b6b39585 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_host.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_host.c
@@ -126,6 +126,8 @@ int kvmppc_mmu_map_page(struct kvm_vcpu *vcpu, struct kvmppc_pte *orig_pte)
        if (!orig_pte->may_execute)
                rflags |= HPTE_R_N;
+        else
+                kvmppc_mmu_flush_icache(hpaddr >> PAGE_SHIFT);
        hash = hpt_hash(va, PTE_SIZE, MMU_SEGSIZE_256M);
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 5a84c8d3d040..44b72feaff7d 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1421,13 +1421,13 @@ _GLOBAL(kvmppc_h_cede)
        sync                    /* order setting ceded vs. testing prodded */
        lbz     r5,VCPU_PRODDED(r3)
        cmpwi   r5,0
-        bne     1f
+        bne     kvm_cede_prodded
        li      r0,0            /* set trap to 0 to say hcall is handled */
        stw     r0,VCPU_TRAP(r3)
        li      r0,H_SUCCESS
        std     r0,VCPU_GPR(R3)(r3)
 BEGIN_FTR_SECTION
-        b       2f              /* just send it up to host on 970 */
+        b       kvm_cede_exit   /* just send it up to host on 970 */
 END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_206)
        /*
@@ -1446,7 +1446,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_206)
        or      r4,r4,r0
        PPC_POPCNTW(R7,R4)
        cmpw    r7,r8
-        bge     2f
+        bge     kvm_cede_exit
        stwcx.  r4,0,r6
        bne     31b
        li      r0,1
@@ -1555,7 +1555,8 @@ kvm_end_cede:
        b       hcall_real_fallback
        /* cede when already previously prodded case */
-1:      li      r0,0
+kvm_cede_prodded:
+        li      r0,0
        stb     r0,VCPU_PRODDED(r3)
        sync                    /* order testing prodded vs. clearing ceded */
        stb     r0,VCPU_CEDED(r3)
@@ -1563,7 +1564,8 @@ kvm_end_cede:
        blr
        /* we've ceded but we want to give control to the host */
-2:      li      r3,H_TOO_HARD
+kvm_cede_exit:
+        li      r3,H_TOO_HARD
        blr
 secondary_too_late:
diff --git a/arch/powerpc/kvm/e500_tlb.c b/arch/powerpc/kvm/e500_tlb.c
index c510fc961302..a2b66717813d 100644
--- a/arch/powerpc/kvm/e500_tlb.c
+++ b/arch/powerpc/kvm/e500_tlb.c
@@ -322,11 +322,11 @@ static inline void kvmppc_e500_ref_release(struct tlbe_ref *ref)
 static void clear_tlb1_bitmap(struct kvmppc_vcpu_e500 *vcpu_e500)
 {
        if (vcpu_e500->g2h_tlb1_map)
-                memset(vcpu_e500->g2h_tlb1_map,
+                memset(vcpu_e500->g2h_tlb1_map, 0,
-                       sizeof(u64) * vcpu_e500->gtlb_params[1].entries, 0);
+                       sizeof(u64) * vcpu_e500->gtlb_params[1].entries);
        if (vcpu_e500->h2g_tlb1_rmap)
-                memset(vcpu_e500->h2g_tlb1_rmap,
+                memset(vcpu_e500->h2g_tlb1_rmap, 0,
-                       sizeof(unsigned int) * host_tlb_params[1].entries, 0);
+                       sizeof(unsigned int) * host_tlb_params[1].entries);
 }
 static void clear_tlb_privs(struct kvmppc_vcpu_e500 *vcpu_e500)
@@ -539,6 +539,9 @@ static inline void kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
        kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize,
                                ref, gvaddr, stlbe);
+        /* Clear i-cache for new pages */
+        kvmppc_mmu_flush_icache(pfn);
 }
 /* XXX only map the one-one case, for now use TLB0 */
diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
index dd223b3eb333..17e5b2364312 100644
--- a/arch/powerpc/lib/code-patching.c
+++ b/arch/powerpc/lib/code-patching.c
@@ -20,7 +20,7 @@ int patch_instruction(unsigned int *addr, unsigned int instr)
 {
        int err;
-        err = __put_user(instr, addr);
+        __put_user_size(instr, addr, 4, err);
        if (err)
                return err;
        asm ("dcbst 0, %0; sync; icbi 0,%0; sync; isync" : : "r" (addr));
diff --git a/arch/powerpc/lib/copyuser_power7.S b/arch/powerpc/lib/copyuser_power7.S
index f9ede7c6606e..0d24ff15f5f6 100644
--- a/arch/powerpc/lib/copyuser_power7.S
+++ b/arch/powerpc/lib/copyuser_power7.S
@@ -288,7 +288,7 @@ err1;	stb	r0,0(r3)
        std     r0,16(r1)
        stdu    r1,-STACKFRAMESIZE(r1)
        bl      .enter_vmx_usercopy
-        cmpwi   r3,0
+        cmpwi   cr1,r3,0
        ld      r0,STACKFRAMESIZE+16(r1)
        ld      r3,STACKFRAMESIZE+48(r1)
        ld      r4,STACKFRAMESIZE+56(r1)
@@ -326,38 +326,7 @@ err1;	stb	r0,0(r3)
        dcbt    r0,r8,0b01010   /* GO */
 .machine pop
-        /*
+        beq     cr1,.Lunwind_stack_nonvmx_copy
-         * We prefetch both the source and destination using enhanced touch
-         * instructions. We use a stream ID of 0 for the load side and
-         * 1 for the store side.
-         */
-        clrrdi  r6,r4,7
-        clrrdi  r9,r3,7
-        ori     r9,r9,1         /* stream=1 */
-        srdi    r7,r5,7         /* length in cachelines, capped at 0x3FF */
-        cmpldi  cr1,r7,0x3FF
-        ble     cr1,1f
-        li      r7,0x3FF
-1:      lis     r0,0x0E00       /* depth=7 */
-        sldi    r7,r7,7
-        or      r7,r7,r0
-        ori     r10,r7,1        /* stream=1 */
-        lis     r8,0x8000       /* GO=1 */
-        clrldi  r8,r8,32
-.machine push
-.machine "power4"
-        dcbt    r0,r6,0b01000
-        dcbt    r0,r7,0b01010
-        dcbtst  r0,r9,0b01000
-        dcbtst  r0,r10,0b01010
-        eieio
-        dcbt    r0,r8,0b01010   /* GO */
-.machine pop
-        beq     .Lunwind_stack_nonvmx_copy
        /*
         * If source and destination are not relatively aligned we use a
diff --git a/arch/powerpc/lib/memcpy_power7.S b/arch/powerpc/lib/memcpy_power7.S
index 0efdc51bc716..7ba6c96de778 100644
--- a/arch/powerpc/lib/memcpy_power7.S
+++ b/arch/powerpc/lib/memcpy_power7.S
@@ -222,7 +222,7 @@ _GLOBAL(memcpy_power7)
        std     r0,16(r1)
        stdu    r1,-STACKFRAMESIZE(r1)
        bl      .enter_vmx_copy
-        cmpwi   r3,0
+        cmpwi   cr1,r3,0
        ld      r0,STACKFRAMESIZE+16(r1)
        ld      r3,STACKFRAMESIZE+48(r1)
        ld      r4,STACKFRAMESIZE+56(r1)
@@ -260,7 +260,7 @@ _GLOBAL(memcpy_power7)
        dcbt    r0,r8,0b01010   /* GO */
 .machine pop
-        beq     .Lunwind_stack_nonvmx_copy
+        beq     cr1,.Lunwind_stack_nonvmx_copy
        /*
         * If source and destination are not relatively aligned we use a
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index baaafde7d135..fbdad0e3929a 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -469,6 +469,7 @@ void flush_dcache_icache_page(struct page *page)
        __flush_dcache_icache_phys(page_to_pfn(page) << PAGE_SHIFT);
 #endif
 }
+EXPORT_SYMBOL(flush_dcache_icache_page);
 void clear_user_page(void *page, unsigned long vaddr, struct page *pg)
 {
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 39b159751c35..59213cfaeca9 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1436,11 +1436,11 @@ static long vphn_get_associativity(unsigned long cpu,
 /*
 * Update the node maps and sysfs entries for each cpu whose home node
- * has changed.
+ * has changed. Returns 1 when the topology has changed, and 0 otherwise.
 */
 int arch_update_cpu_topology(void)
 {
-        int cpu, nid, old_nid;
+        int cpu, nid, old_nid, changed = 0;
        unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
        struct device *dev;
@@ -1466,9 +1466,10 @@ int arch_update_cpu_topology(void)
                dev = get_cpu_device(cpu);
                if (dev)
                        kobject_uevent(&dev->kobj, KOBJ_CHANGE);
+                changed = 1;
        }
-        return 1;
+        return changed;
 }
 static void topology_work_fn(struct work_struct *work)
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 77b49ddda9d3..7cd2dbd6e4c4 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -1431,7 +1431,7 @@ static void perf_event_interrupt(struct pt_regs *regs)
                if (!event->hw.idx || is_limited_pmc(event->hw.idx))
                        continue;
                val = read_pmc(event->hw.idx);
-                if ((int)val < 0) {
+                if (pmc_overflow(val)) {
                        /* event has overflowed */
                        found = 1;
                        record_and_restart(event, val, regs);
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 3ef46254c35b..7698b6e13c57 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -106,14 +106,6 @@ static void pnv_smp_cpu_kill_self(void)
 {
        unsigned int cpu;
-        /* If powersave_nap is enabled, use NAP mode, else just
-         * spin aimlessly
-         */
-        if (!powersave_nap) {
-                generic_mach_cpu_die();
-                return;
-        }
        /* Standard hot unplug procedure */
        local_irq_disable();
        idle_task_exit();
@@ -128,7 +120,7 @@ static void pnv_smp_cpu_kill_self(void)
         */
        mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
        while (!generic_check_cpu_restart(cpu)) {
-                power7_idle();
+                power7_nap();
                if (!generic_check_cpu_restart(cpu)) {
                        DBG("CPU%d Unexpected exit while offline !\n", cpu);
                        /* We may be getting an IPI, so we re-enable
diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
index a7b2a600d0a4..c37f46136321 100644
--- a/arch/powerpc/sysdev/fsl_pci.c
+++ b/arch/powerpc/sysdev/fsl_pci.c
@@ -465,7 +465,7 @@ int __init fsl_add_bridge(struct device_node *dev, int is_primary)
                        iounmap(hose->cfg_data);
                iounmap(hose->cfg_addr);
                pcibios_free_controller(hose);
-                return 0;
+                return -ENODEV;
        }
        setup_pci_cmd(hose);
@@ -827,6 +827,7 @@ struct device_node *fsl_pci_primary;
 void __devinit fsl_pci_init(void)
 {
+        int ret;
        struct device_node *node;
        struct pci_controller *hose;
        dma_addr_t max = 0xffffffff;
@@ -855,10 +856,12 @@ void __devinit fsl_pci_init(void)
                        if (!fsl_pci_primary)
                                fsl_pci_primary = node;
-                        fsl_add_bridge(node, fsl_pci_primary == node);
+                        ret = fsl_add_bridge(node, fsl_pci_primary == node);
-                        hose = pci_find_hose_for_OF_device(node);
+                        if (ret == 0) {
-                        max = min(max, hose->dma_window_base_cur +
+                                hose = pci_find_hose_for_OF_device(node);
-                                        hose->dma_window_size);
+                                max = min(max, hose->dma_window_base_cur +
+                                                hose->dma_window_size);
+                        }
                }
        }
diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c
index 483d8fa72e8b..e961f8c4a8f0 100644
--- a/arch/powerpc/sysdev/mpic_msgr.c
+++ b/arch/powerpc/sysdev/mpic_msgr.c
@@ -14,6 +14,9 @@
 #include <linux/list.h>
 #include <linux/of_platform.h>
 #include <linux/errno.h>
+#include <linux/err.h>
+#include <linux/export.h>
+#include <linux/slab.h>
 #include <asm/prom.h>
 #include <asm/hw_irq.h>
 #include <asm/ppc-pci.h>
diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c
index 14469cf9df68..df0fc5821469 100644
--- a/arch/powerpc/sysdev/xics/icp-hv.c
+++ b/arch/powerpc/sysdev/xics/icp-hv.c
@@ -65,7 +65,11 @@ static inline void icp_hv_set_xirr(unsigned int value)
 static inline void icp_hv_set_qirr(int n_cpu , u8 value)
 {
        int hw_cpu = get_hard_smp_processor_id(n_cpu);
-        long rc = plpar_hcall_norets(H_IPI, hw_cpu, value);
+        long rc;
+        /* Make sure all previous accesses are ordered before IPI sending */
+        mb();
+        rc = plpar_hcall_norets(H_IPI, hw_cpu, value);
        if (rc != H_SUCCESS) {
                pr_err("%s: bad return code qirr cpu=%d hw_cpu=%d mfrr=0x%x "
                        "returned %ld\n", __func__, n_cpu, hw_cpu, value, rc);
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index eab3492a45c5..9b49c65ee7a4 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -17,6 +17,7 @@
 #include <linux/reboot.h>
 #include <linux/delay.h>
 #include <linux/kallsyms.h>
+#include <linux/kmsg_dump.h>
 #include <linux/cpumask.h>
 #include <linux/export.h>
 #include <linux/sysrq.h>
@@ -894,13 +895,13 @@ cmds(struct pt_regs *excp)
 #endif
                default:
                        printf("Unrecognized command: ");
-                        do {
+                        do {
                                if (' ' < cmd && cmd <= '~')
                                        putchar(cmd);
                                else
                                        printf("\\x%x", cmd);
                                cmd = inchar();
-                        } while (cmd != '\n'); 
+                        } while (cmd != '\n');
                        printf(" (type ? for help)\n");
                        break;
                }
@@ -1097,7 +1098,7 @@ static long check_bp_loc(unsigned long addr)
        return 1;
 }
-static char *breakpoint_help_string = 
+static char *breakpoint_help_string =
    "Breakpoint command usage:\n"
    "b                show breakpoints\n"
    "b <addr> [cnt]   set breakpoint at given instr addr\n"
@@ -1193,7 +1194,7 @@ bpt_cmds(void)
        default:
                termch = cmd;
-                cmd = skipbl();
+                cmd = skipbl();
                if (cmd == '?') {
                        printf(breakpoint_help_string);
                        break;
@@ -1359,7 +1360,7 @@ static void xmon_show_stack(unsigned long sp, unsigned long lr,
                                       sp + REGS_OFFSET);
                                break;
                        }
-                        printf("--- Exception: %lx %s at ", regs.trap,
+                        printf("--- Exception: %lx %s at ", regs.trap,
                               getvecname(TRAP(&regs)));
                        pc = regs.nip;
                        lr = regs.link;
@@ -1623,14 +1624,14 @@ static void super_regs(void)
        cmd = skipbl();
        if (cmd == '\n') {
-                unsigned long sp, toc;
+                unsigned long sp, toc;
                asm("mr %0,1" : "=r" (sp) :);
                asm("mr %0,2" : "=r" (toc) :);
                printf("msr  = "REG"  sprg0= "REG"\n",
                       mfmsr(), mfspr(SPRN_SPRG0));
                printf("pvr  = "REG"  sprg1= "REG"\n",
-                       mfspr(SPRN_PVR), mfspr(SPRN_SPRG1)); 
+                       mfspr(SPRN_PVR), mfspr(SPRN_SPRG1));
                printf("dec  = "REG"  sprg2= "REG"\n",
                       mfspr(SPRN_DEC), mfspr(SPRN_SPRG2));
                printf("sp   = "REG"  sprg3= "REG"\n", sp, mfspr(SPRN_SPRG3));
@@ -1783,7 +1784,7 @@ byterev(unsigned char *val, int size)
 static int brev;
 static int mnoread;
-static char *memex_help_string = 
+static char *memex_help_string =
    "Memory examine command usage:\n"
    "m [addr] [flags] examine/change memory\n"
    "  addr is optional.  will start where left off.\n"
@@ -1798,7 +1799,7 @@ static char *memex_help_string =
    "NOTE: flags are saved as defaults\n"
    "";
-static char *memex_subcmd_help_string = 
+static char *memex_subcmd_help_string =
    "Memory examine subcommands:\n"
    "  hexval   write this val to current location\n"
    "  'string' write chars from string to this location\n"
@@ -2064,7 +2065,7 @@ prdump(unsigned long adrs, long ndump)
                nr = mread(adrs, temp, r);
                adrs += nr;
                for (m = 0; m < r; ++m) {
-                        if ((m & (sizeof(long) - 1)) == 0 && m > 0)
+                        if ((m & (sizeof(long) - 1)) == 0 && m > 0)
                                putchar(' ');
                        if (m < nr)
                                printf("%.2x", temp[m]);
@@ -2072,7 +2073,7 @@ prdump(unsigned long adrs, long ndump)
                                printf("%s", fault_chars[fault_type]);
                }
                for (; m < 16; ++m) {
-                        if ((m & (sizeof(long) - 1)) == 0)
+                        if ((m & (sizeof(long) - 1)) == 0)
                                putchar(' ');
                        printf("  ");
                }
@@ -2148,45 +2149,28 @@ print_address(unsigned long addr)
 void
 dump_log_buf(void)
 {
-        const unsigned long size = 128;
+        struct kmsg_dumper dumper = { .active = 1 };
-        unsigned long end, addr;
+        unsigned char buf[128];
-        unsigned char buf[size + 1];
+        size_t len;
-        addr = 0;
+        if (setjmp(bus_error_jmp) != 0) {
-        buf[size] = '\0';
+                printf("Error dumping printk buffer!\n");
+                return;
-        if (setjmp(bus_error_jmp) != 0) {
+        }
-                printf("Unable to lookup symbol __log_buf!\n");
-                return;
+        catch_memory_errors = 1;
-        }
+        sync();
-        catch_memory_errors = 1;
+        kmsg_dump_rewind_nolock(&dumper);
-        sync();
+        while (kmsg_dump_get_line_nolock(&dumper, false, buf, sizeof(buf), &len)) {
-        addr = kallsyms_lookup_name("__log_buf");
+                buf[len] = '\0';
+                printf("%s", buf);
-        if (! addr)
+        }
-                printf("Symbol __log_buf not found!\n");
-        else {
+        sync();
-                end = addr + (1 << CONFIG_LOG_BUF_SHIFT);
+        /* wait a little while to see if we get a machine check */
-                while (addr < end) {
+        __delay(200);
-                        if (! mread(addr, buf, size)) {
+        catch_memory_errors = 0;
-                                printf("Can't read memory at address 0x%lx\n", addr);
-                                break;
-                        }
-                        printf("%s", buf);
-                        if (strlen(buf) < size)
-                                break;
-                        addr += size;
-                }
-        }
-        sync();
-        /* wait a little while to see if we get a machine check */
-        __delay(200);
-        catch_memory_errors = 0;
 }
 /*
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 32e8449640fa..9b94a160fe7f 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -180,7 +180,8 @@ extern char elf_platform[];
 #define ELF_PLATFORM (elf_platform)
 #ifndef CONFIG_64BIT
-#define SET_PERSONALITY(ex) set_personality(PER_LINUX)
+#define SET_PERSONALITY(ex) \
+        set_personality(PER_LINUX | (current->personality & (~PER_MASK)))
 #else /* CONFIG_64BIT */
 #define SET_PERSONALITY(ex)                                     \
 do {                                                            \
diff --git a/arch/s390/include/asm/posix_types.h b/arch/s390/include/asm/posix_types.h
index 7bcc14e395f0..bf2a2ad2f800 100644
--- a/arch/s390/include/asm/posix_types.h
+++ b/arch/s390/include/asm/posix_types.h
@@ -13,6 +13,7 @@
 */
 typedef unsigned long   __kernel_size_t;
+typedef long            __kernel_ssize_t;
 #define __kernel_size_t __kernel_size_t
 typedef unsigned short  __kernel_old_dev_t;
@@ -25,7 +26,6 @@ typedef unsigned short  __kernel_mode_t;
 typedef unsigned short  __kernel_ipc_pid_t;
 typedef unsigned short  __kernel_uid_t;
 typedef unsigned short  __kernel_gid_t;
-typedef int             __kernel_ssize_t;
 typedef int             __kernel_ptrdiff_t;
 #else /* __s390x__ */
@@ -35,7 +35,6 @@ typedef unsigned int    __kernel_mode_t;
 typedef int             __kernel_ipc_pid_t;
 typedef unsigned int    __kernel_uid_t;
 typedef unsigned int    __kernel_gid_t;
-typedef long            __kernel_ssize_t;
 typedef long            __kernel_ptrdiff_t;
 typedef unsigned long   __kernel_sigset_t;      /* at least 32 bits */
diff --git a/arch/s390/include/asm/smp.h b/arch/s390/include/asm/smp.h
index a0a8340daafa..ce26ac3cb162 100644
--- a/arch/s390/include/asm/smp.h
+++ b/arch/s390/include/asm/smp.h
@@ -44,6 +44,7 @@ static inline void smp_call_online_cpu(void (*func)(void *), void *data)
 }
 static inline int smp_find_processor_id(int address) { return 0; }
+static inline int smp_store_status(int cpu) { return 0; }
 static inline int smp_vcpu_scheduled(int cpu) { return 1; }
 static inline void smp_yield_cpu(int cpu) { }
 static inline void smp_yield(void) { }
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index a1e9d69a9c90..584b93674ea4 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -169,7 +169,7 @@ static ssize_t hw_interval_write(struct file *file, char const __user *buf,
        if (*offset)
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        if (val < oprofile_min_interval)
                oprofile_hw_interval = oprofile_min_interval;
@@ -212,7 +212,7 @@ static ssize_t hwsampler_zero_write(struct file *file, char const __user *buf,
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        if (val != 0)
                return -EINVAL;
@@ -243,7 +243,7 @@ static ssize_t hwsampler_kernel_write(struct file *file, char const __user *buf,
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        if (val != 0 && val != 1)
@@ -278,7 +278,7 @@ static ssize_t hwsampler_user_write(struct file *file, char const __user *buf,
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        if (val != 0 && val != 1)
@@ -317,7 +317,7 @@ static ssize_t timer_enabled_write(struct file *file, char const __user *buf,
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        if (val != 0 && val != 1)
diff --git a/arch/um/os-Linux/time.c b/arch/um/os-Linux/time.c
index f60238559af3..0748fe0c8a73 100644
--- a/arch/um/os-Linux/time.c
+++ b/arch/um/os-Linux/time.c
@@ -114,7 +114,7 @@ static void deliver_alarm(void)
        skew += this_tick - last_tick;
        while (skew >= one_tick) {
-                alarm_handler(SIGVTALRM, NULL);
+                alarm_handler(SIGVTALRM, NULL, NULL);
                skew -= one_tick;
        }
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index b0c5276861ec..682e9c210baa 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -27,6 +27,10 @@ ifeq ($(CONFIG_X86_32),y)
        KBUILD_CFLAGS += -msoft-float -mregparm=3 -freg-struct-return
+        # Never want PIC in a 32-bit kernel, prevent breakage with GCC built
+        # with nonstandard options
+        KBUILD_CFLAGS += -fno-pic
        # prevent gcc from keeping the stack 16 byte aligned
        KBUILD_CFLAGS += $(call cc-option,-mpreferred-stack-boundary=2)
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index 5a747dd884db..f7535bedc33f 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -57,7 +57,7 @@ KBUILD_CFLAGS	:= $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
                   -Wall -Wstrict-prototypes \
                   -march=i386 -mregparm=3 \
                   -include $(srctree)/$(src)/code16gcc.h \
-                   -fno-strict-aliasing -fomit-frame-pointer \
+                   -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
                   $(call cc-option, -ffreestanding) \
                   $(call cc-option, -fno-toplevel-reorder,\
                        $(call cc-option, -fno-unit-at-a-time)) \
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index b315a33867f2..33692eaabab5 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -12,8 +12,7 @@
 * Simple spin lock operations.  There are two variants, one clears IRQ's
 * on the local processor, one does not.
 *
- * These are fair FIFO ticket locks, which are currently limited to 256
+ * These are fair FIFO ticket locks, which support up to 2^16 CPUs.
- * CPUs.
 *
 * (the type definitions are in asm/spinlock_types.h)
 */
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index afb7ff79a29f..ced4534baed5 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -165,7 +165,7 @@ static const unsigned char * const k7_nops[ASM_NOP_MAX+2] =
 #endif
 #ifdef P6_NOP1
-static const unsigned char  __initconst_or_module p6nops[] =
+static const unsigned char p6nops[] =
 {
        P6_NOP1,
        P6_NOP2,
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index a6c64aaddf9a..c265593ec2cd 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1356,6 +1356,16 @@ static void setup_ioapic_irq(unsigned int irq, struct irq_cfg *cfg,
        if (!IO_APIC_IRQ(irq))
                return;
+        /*
+         * For legacy irqs, cfg->domain starts with cpu 0. Now that IO-APIC
+         * can handle this irq and the apic driver is finialized at this point,
+         * update the cfg->domain.
+         */
+        if (irq < legacy_pic->nr_legacy_irqs &&
+            cpumask_equal(cfg->domain, cpumask_of(0)))
+                apic->vector_allocation_domain(0, cfg->domain,
+                                               apic->target_cpus());
        if (assign_irq_vector(irq, cfg, apic->target_cpus()))
                return;
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 46d8786d655e..a5fbc3c5fccc 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -144,6 +144,8 @@ static int __init x86_xsave_setup(char *s)
 {
        setup_clear_cpu_cap(X86_FEATURE_XSAVE);
        setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
+        setup_clear_cpu_cap(X86_FEATURE_AVX);
+        setup_clear_cpu_cap(X86_FEATURE_AVX2);
        return 1;
 }
 __setup("noxsave", x86_xsave_setup);
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 382366977d4c..0d3d63afa76a 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1522,8 +1522,16 @@ static struct perf_guest_switch_msr *intel_guest_get_msrs(int *nr)
        arr[0].msr = MSR_CORE_PERF_GLOBAL_CTRL;
        arr[0].host = x86_pmu.intel_ctrl & ~cpuc->intel_ctrl_guest_mask;
        arr[0].guest = x86_pmu.intel_ctrl & ~cpuc->intel_ctrl_host_mask;
+        /*
+         * If PMU counter has PEBS enabled it is not enough to disable counter
+         * on a guest entry since PEBS memory write can overshoot guest entry
+         * and corrupt guest memory. Disabling PEBS solves the problem.
+         */
+        arr[1].msr = MSR_IA32_PEBS_ENABLE;
+        arr[1].host = cpuc->pebs_enabled;
+        arr[1].guest = 0;
-        *nr = 1;
+        *nr = 2;
        return arr;
 }
@@ -2000,6 +2008,7 @@ __init int intel_pmu_init(void)
                break;
        case 28: /* Atom */
+        case 54: /* Cedariew */
                memcpy(hw_cache_event_ids, atom_hw_cache_event_ids,
                       sizeof(hw_cache_event_ids));
diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
index 520b4265fcd2..da02e9cc3754 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
@@ -686,7 +686,8 @@ void intel_pmu_lbr_init_atom(void)
         * to have an operational LBR which can freeze
         * on PMU interrupt
         */
-        if (boot_cpu_data.x86_mask < 10) {
+        if (boot_cpu_data.x86_model == 28
+            && boot_cpu_data.x86_mask < 10) {
                pr_cont("LBR disabled due to erratum");
                return;
        }
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 7563fda9f033..0a5571080e74 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -796,7 +796,6 @@ static struct intel_uncore_type *nhm_msr_uncores[] = {
 DEFINE_UNCORE_FORMAT_ATTR(event5, event, "config:1-5");
 DEFINE_UNCORE_FORMAT_ATTR(counter, counter, "config:6-7");
-DEFINE_UNCORE_FORMAT_ATTR(mm_cfg, mm_cfg, "config:63");
 DEFINE_UNCORE_FORMAT_ATTR(match, match, "config1:0-63");
 DEFINE_UNCORE_FORMAT_ATTR(mask, mask, "config2:0-63");
@@ -902,16 +901,21 @@ static struct attribute_group nhmex_uncore_cbox_format_group = {
        .attrs = nhmex_uncore_cbox_formats_attr,
 };
+/* msr offset for each instance of cbox */
+static unsigned nhmex_cbox_msr_offsets[] = {
+        0x0, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0, 0x240, 0x2c0,
+};
 static struct intel_uncore_type nhmex_uncore_cbox = {
        .name                   = "cbox",
        .num_counters           = 6,
-        .num_boxes              = 8,
+        .num_boxes              = 10,
        .perf_ctr_bits          = 48,
        .event_ctl              = NHMEX_C0_MSR_PMON_EV_SEL0,
        .perf_ctr               = NHMEX_C0_MSR_PMON_CTR0,
        .event_mask             = NHMEX_PMON_RAW_EVENT_MASK,
        .box_ctl                = NHMEX_C0_MSR_PMON_GLOBAL_CTL,
-        .msr_offset             = NHMEX_C_MSR_OFFSET,
+        .msr_offsets            = nhmex_cbox_msr_offsets,
        .pair_ctr_ctl           = 1,
        .ops                    = &nhmex_uncore_ops,
        .format_group           = &nhmex_uncore_cbox_format_group
@@ -1032,24 +1036,22 @@ static struct intel_uncore_type nhmex_uncore_bbox = {
 static int nhmex_sbox_hw_config(struct intel_uncore_box *box, struct perf_event *event)
 {
-        struct hw_perf_event_extra *reg1 = &event->hw.extra_reg;
+        struct hw_perf_event *hwc = &event->hw;
-        struct hw_perf_event_extra *reg2 = &event->hw.branch_reg;
+        struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
+        struct hw_perf_event_extra *reg2 = &hwc->branch_reg;
-        if (event->attr.config & NHMEX_S_PMON_MM_CFG_EN) {
+        /* only TO_R_PROG_EV event uses the match/mask register */
-                reg1->config = event->attr.config1;
+        if ((hwc->config & NHMEX_PMON_CTL_EV_SEL_MASK) !=
-                reg2->config = event->attr.config2;
+            NHMEX_S_EVENT_TO_R_PROG_EV)
-        } else {
+                return 0;
-                reg1->config = ~0ULL;
-                reg2->config = ~0ULL;
-        }
        if (box->pmu->pmu_idx == 0)
                reg1->reg = NHMEX_S0_MSR_MM_CFG;
        else
                reg1->reg = NHMEX_S1_MSR_MM_CFG;
        reg1->idx = 0;
+        reg1->config = event->attr.config1;
+        reg2->config = event->attr.config2;
        return 0;
 }
@@ -1059,8 +1061,8 @@ static void nhmex_sbox_msr_enable_event(struct intel_uncore_box *box, struct per
        struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
        struct hw_perf_event_extra *reg2 = &hwc->branch_reg;
-        wrmsrl(reg1->reg, 0);
+        if (reg1->idx != EXTRA_REG_NONE) {
-        if (reg1->config != ~0ULL || reg2->config != ~0ULL) {
+                wrmsrl(reg1->reg, 0);
                wrmsrl(reg1->reg + 1, reg1->config);
                wrmsrl(reg1->reg + 2, reg2->config);
                wrmsrl(reg1->reg, NHMEX_S_PMON_MM_CFG_EN);
@@ -1074,7 +1076,6 @@ static struct attribute *nhmex_uncore_sbox_formats_attr[] = {
        &format_attr_edge.attr,
        &format_attr_inv.attr,
        &format_attr_thresh8.attr,
-        &format_attr_mm_cfg.attr,
        &format_attr_match.attr,
        &format_attr_mask.attr,
        NULL,
@@ -1142,6 +1143,9 @@ static struct extra_reg nhmex_uncore_mbox_extra_regs[] = {
        EVENT_EXTRA_END
 };
+/* Nehalem-EX or Westmere-EX ? */
+bool uncore_nhmex;
 static bool nhmex_mbox_get_shared_reg(struct intel_uncore_box *box, int idx, u64 config)
 {
        struct intel_uncore_extra_reg *er;
@@ -1171,18 +1175,29 @@ static bool nhmex_mbox_get_shared_reg(struct intel_uncore_box *box, int idx, u64
                return false;
        /* mask of the shared fields */
-        mask = NHMEX_M_PMON_ZDP_CTL_FVC_MASK;
+        if (uncore_nhmex)
+                mask = NHMEX_M_PMON_ZDP_CTL_FVC_MASK;
+        else
+                mask = WSMEX_M_PMON_ZDP_CTL_FVC_MASK;
        er = &box->shared_regs[EXTRA_REG_NHMEX_M_ZDP_CTL_FVC];
        raw_spin_lock_irqsave(&er->lock, flags);
        /* add mask of the non-shared field if it's in use */
-        if (__BITS_VALUE(atomic_read(&er->ref), idx, 8))
+        if (__BITS_VALUE(atomic_read(&er->ref), idx, 8)) {
-                mask |= NHMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
+                if (uncore_nhmex)
+                        mask |= NHMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
+                else
+                        mask |= WSMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
+        }
        if (!atomic_read(&er->ref) || !((er->config ^ config) & mask)) {
                atomic_add(1 << (idx * 8), &er->ref);
-                mask = NHMEX_M_PMON_ZDP_CTL_FVC_MASK |
+                if (uncore_nhmex)
-                        NHMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
+                        mask = NHMEX_M_PMON_ZDP_CTL_FVC_MASK |
+                                NHMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
+                else
+                        mask = WSMEX_M_PMON_ZDP_CTL_FVC_MASK |
+                                WSMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
                er->config &= ~mask;
                er->config |= (config & mask);
                ret = true;
@@ -1216,7 +1231,10 @@ u64 nhmex_mbox_alter_er(struct perf_event *event, int new_idx, bool modify)
        /* get the non-shared control bits and shift them */
        idx = orig_idx - EXTRA_REG_NHMEX_M_ZDP_CTL_FVC;
-        config &= NHMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
+        if (uncore_nhmex)
+                config &= NHMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
+        else
+                config &= WSMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(idx);
        if (new_idx > orig_idx) {
                idx = new_idx - orig_idx;
                config <<= 3 * idx;
@@ -1226,6 +1244,10 @@ u64 nhmex_mbox_alter_er(struct perf_event *event, int new_idx, bool modify)
        }
        /* add the shared control bits back */
+        if (uncore_nhmex)
+                config |= NHMEX_M_PMON_ZDP_CTL_FVC_MASK & reg1->config;
+        else
+                config |= WSMEX_M_PMON_ZDP_CTL_FVC_MASK & reg1->config;
        config |= NHMEX_M_PMON_ZDP_CTL_FVC_MASK & reg1->config;
        if (modify) {
                /* adjust the main event selector */
@@ -1264,7 +1286,8 @@ again:
        }
        /* for the match/mask registers */
-        if ((uncore_box_is_fake(box) || !reg2->alloc) &&
+        if (reg2->idx != EXTRA_REG_NONE &&
+            (uncore_box_is_fake(box) || !reg2->alloc) &&
            !nhmex_mbox_get_shared_reg(box, reg2->idx, reg2->config))
                goto fail;
@@ -1278,7 +1301,8 @@ again:
                if (idx[0] != 0xff && idx[0] != __BITS_VALUE(reg1->idx, 0, 8))
                        nhmex_mbox_alter_er(event, idx[0], true);
                reg1->alloc |= alloc;
-                reg2->alloc = 1;
+                if (reg2->idx != EXTRA_REG_NONE)
+                        reg2->alloc = 1;
        }
        return NULL;
 fail:
@@ -1342,9 +1366,6 @@ static int nhmex_mbox_hw_config(struct intel_uncore_box *box, struct perf_event
        struct extra_reg *er;
        unsigned msr;
        int reg_idx = 0;
-        if (WARN_ON_ONCE(reg1->idx != -1))
-                return -EINVAL;
        /*
         * The mbox events may require 2 extra MSRs at the most. But only
         * the lower 32 bits in these MSRs are significant, so we can use
@@ -1355,11 +1376,6 @@ static int nhmex_mbox_hw_config(struct intel_uncore_box *box, struct perf_event
                        continue;
                if (event->attr.config1 & ~er->valid_mask)
                        return -EINVAL;
-                if (er->idx == __BITS_VALUE(reg1->idx, 0, 8) ||
-                    er->idx == __BITS_VALUE(reg1->idx, 1, 8))
-                        continue;
-                if (WARN_ON_ONCE(reg_idx >= 2))
-                        return -EINVAL;
                msr = er->msr + type->msr_offset * box->pmu->pmu_idx;
                if (WARN_ON_ONCE(msr >= 0xffff || er->idx >= 0xff))
@@ -1368,6 +1384,8 @@ static int nhmex_mbox_hw_config(struct intel_uncore_box *box, struct perf_event
                /* always use the 32~63 bits to pass the PLD config */
                if (er->idx == EXTRA_REG_NHMEX_M_PLD)
                        reg_idx = 1;
+                else if (WARN_ON_ONCE(reg_idx > 0))
+                        return -EINVAL;
                reg1->idx &= ~(0xff << (reg_idx * 8));
                reg1->reg &= ~(0xffff << (reg_idx * 16));
@@ -1376,17 +1394,21 @@ static int nhmex_mbox_hw_config(struct intel_uncore_box *box, struct perf_event
                reg1->config = event->attr.config1;
                reg_idx++;
        }
-        /* use config2 to pass the filter config */
+        /*
-        reg2->idx = EXTRA_REG_NHMEX_M_FILTER;
+         * The mbox only provides ability to perform address matching
-        if (event->attr.config2 & NHMEX_M_PMON_MM_CFG_EN)
+         * for the PLD events.
-                reg2->config = event->attr.config2;
+         */
-        else
+        if (reg_idx == 2) {
-                reg2->config = ~0ULL;
+                reg2->idx = EXTRA_REG_NHMEX_M_FILTER;
-        if (box->pmu->pmu_idx == 0)
+                if (event->attr.config2 & NHMEX_M_PMON_MM_CFG_EN)
-                reg2->reg = NHMEX_M0_MSR_PMU_MM_CFG;
+                        reg2->config = event->attr.config2;
-        else
+                else
-                reg2->reg = NHMEX_M1_MSR_PMU_MM_CFG;
+                        reg2->config = ~0ULL;
+                if (box->pmu->pmu_idx == 0)
+                        reg2->reg = NHMEX_M0_MSR_PMU_MM_CFG;
+                else
+                        reg2->reg = NHMEX_M1_MSR_PMU_MM_CFG;
+        }
        return 0;
 }
@@ -1422,34 +1444,36 @@ static void nhmex_mbox_msr_enable_event(struct intel_uncore_box *box, struct per
                wrmsrl(__BITS_VALUE(reg1->reg, 1, 16),
                        nhmex_mbox_shared_reg_config(box, idx));
-        wrmsrl(reg2->reg, 0);
+        if (reg2->idx != EXTRA_REG_NONE) {
-        if (reg2->config != ~0ULL) {
+                wrmsrl(reg2->reg, 0);
-                wrmsrl(reg2->reg + 1,
+                if (reg2->config != ~0ULL) {
-                        reg2->config & NHMEX_M_PMON_ADDR_MATCH_MASK);
+                        wrmsrl(reg2->reg + 1,
-                wrmsrl(reg2->reg + 2, NHMEX_M_PMON_ADDR_MASK_MASK &
+                                reg2->config & NHMEX_M_PMON_ADDR_MATCH_MASK);
-                        (reg2->config >> NHMEX_M_PMON_ADDR_MASK_SHIFT));
+                        wrmsrl(reg2->reg + 2, NHMEX_M_PMON_ADDR_MASK_MASK &
-                wrmsrl(reg2->reg, NHMEX_M_PMON_MM_CFG_EN);
+                                (reg2->config >> NHMEX_M_PMON_ADDR_MASK_SHIFT));
+                        wrmsrl(reg2->reg, NHMEX_M_PMON_MM_CFG_EN);
+                }
        }
        wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT0);
 }
-DEFINE_UNCORE_FORMAT_ATTR(count_mode,   count_mode,     "config:2-3");
+DEFINE_UNCORE_FORMAT_ATTR(count_mode,           count_mode,     "config:2-3");
-DEFINE_UNCORE_FORMAT_ATTR(storage_mode, storage_mode,   "config:4-5");
+DEFINE_UNCORE_FORMAT_ATTR(storage_mode,         storage_mode,   "config:4-5");
-DEFINE_UNCORE_FORMAT_ATTR(wrap_mode,    wrap_mode,      "config:6");
+DEFINE_UNCORE_FORMAT_ATTR(wrap_mode,            wrap_mode,      "config:6");
-DEFINE_UNCORE_FORMAT_ATTR(flag_mode,    flag_mode,      "config:7");
+DEFINE_UNCORE_FORMAT_ATTR(flag_mode,            flag_mode,      "config:7");
-DEFINE_UNCORE_FORMAT_ATTR(inc_sel,      inc_sel,        "config:9-13");
+DEFINE_UNCORE_FORMAT_ATTR(inc_sel,              inc_sel,        "config:9-13");
-DEFINE_UNCORE_FORMAT_ATTR(set_flag_sel, set_flag_sel,   "config:19-21");
+DEFINE_UNCORE_FORMAT_ATTR(set_flag_sel,         set_flag_sel,   "config:19-21");
-DEFINE_UNCORE_FORMAT_ATTR(filter_cfg,   filter_cfg,     "config2:63");
+DEFINE_UNCORE_FORMAT_ATTR(filter_cfg_en,        filter_cfg_en,  "config2:63");
-DEFINE_UNCORE_FORMAT_ATTR(filter_match, filter_match,   "config2:0-33");
+DEFINE_UNCORE_FORMAT_ATTR(filter_match,         filter_match,   "config2:0-33");
-DEFINE_UNCORE_FORMAT_ATTR(filter_mask,  filter_mask,    "config2:34-61");
+DEFINE_UNCORE_FORMAT_ATTR(filter_mask,          filter_mask,    "config2:34-61");
-DEFINE_UNCORE_FORMAT_ATTR(dsp,          dsp,            "config1:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(dsp,                  dsp,            "config1:0-31");
-DEFINE_UNCORE_FORMAT_ATTR(thr,          thr,            "config1:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(thr,                  thr,            "config1:0-31");
-DEFINE_UNCORE_FORMAT_ATTR(fvc,          fvc,            "config1:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(fvc,                  fvc,            "config1:0-31");
-DEFINE_UNCORE_FORMAT_ATTR(pgt,          pgt,            "config1:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(pgt,                  pgt,            "config1:0-31");
-DEFINE_UNCORE_FORMAT_ATTR(map,          map,            "config1:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(map,                  map,            "config1:0-31");
-DEFINE_UNCORE_FORMAT_ATTR(iss,          iss,            "config1:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(iss,                  iss,            "config1:0-31");
-DEFINE_UNCORE_FORMAT_ATTR(pld,          pld,            "config1:32-63");
+DEFINE_UNCORE_FORMAT_ATTR(pld,                  pld,            "config1:32-63");
 static struct attribute *nhmex_uncore_mbox_formats_attr[] = {
        &format_attr_count_mode.attr,
@@ -1458,7 +1482,7 @@ static struct attribute *nhmex_uncore_mbox_formats_attr[] = {
        &format_attr_flag_mode.attr,
        &format_attr_inc_sel.attr,
        &format_attr_set_flag_sel.attr,
-        &format_attr_filter_cfg.attr,
+        &format_attr_filter_cfg_en.attr,
        &format_attr_filter_match.attr,
        &format_attr_filter_mask.attr,
        &format_attr_dsp.attr,
@@ -1482,6 +1506,12 @@ static struct uncore_event_desc nhmex_uncore_mbox_events[] = {
        { /* end: all zeroes */ },
 };
+static struct uncore_event_desc wsmex_uncore_mbox_events[] = {
+        INTEL_UNCORE_EVENT_DESC(bbox_cmds_read, "inc_sel=0xd,fvc=0x5000"),
+        INTEL_UNCORE_EVENT_DESC(bbox_cmds_write, "inc_sel=0xd,fvc=0x5040"),
+        { /* end: all zeroes */ },
+};
 static struct intel_uncore_ops nhmex_uncore_mbox_ops = {
        NHMEX_UNCORE_OPS_COMMON_INIT(),
        .enable_event   = nhmex_mbox_msr_enable_event,
@@ -1513,7 +1543,7 @@ void nhmex_rbox_alter_er(struct intel_uncore_box *box, struct perf_event *event)
        struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
        int port;
-        /* adjust the main event selector */
+        /* adjust the main event selector and extra register index */
        if (reg1->idx % 2) {
                reg1->idx--;
                hwc->config -= 1 << NHMEX_R_PMON_CTL_EV_SEL_SHIFT;
@@ -1522,29 +1552,17 @@ void nhmex_rbox_alter_er(struct intel_uncore_box *box, struct perf_event *event)
                hwc->config += 1 << NHMEX_R_PMON_CTL_EV_SEL_SHIFT;
        }
-        /* adjust address or config of extra register */
+        /* adjust extra register config */
        port = reg1->idx / 6 + box->pmu->pmu_idx * 4;
        switch (reg1->idx % 6) {
-        case 0:
-                reg1->reg = NHMEX_R_MSR_PORTN_IPERF_CFG0(port);
-                break;
-        case 1:
-                reg1->reg = NHMEX_R_MSR_PORTN_IPERF_CFG1(port);
-                break;
        case 2:
-                /* the 8~15 bits to the 0~7 bits */
+                /* shift the 8~15 bits to the 0~7 bits */
                reg1->config >>= 8;
                break;
        case 3:
-                /* the 0~7 bits to the 8~15 bits */
+                /* shift the 0~7 bits to the 8~15 bits */
                reg1->config <<= 8;
                break;
-        case 4:
-                reg1->reg = NHMEX_R_MSR_PORTN_XBR_SET1_MM_CFG(port);
-                break;
-        case 5:
-                reg1->reg = NHMEX_R_MSR_PORTN_XBR_SET2_MM_CFG(port);
-                break;
        };
 }
@@ -1671,7 +1689,7 @@ static int nhmex_rbox_hw_config(struct intel_uncore_box *box, struct perf_event
        struct hw_perf_event *hwc = &event->hw;
        struct hw_perf_event_extra *reg1 = &event->hw.extra_reg;
        struct hw_perf_event_extra *reg2 = &event->hw.branch_reg;
-        int port, idx;
+        int idx;
        idx = (event->hw.config & NHMEX_R_PMON_CTL_EV_SEL_MASK) >>
                NHMEX_R_PMON_CTL_EV_SEL_SHIFT;
@@ -1681,27 +1699,11 @@ static int nhmex_rbox_hw_config(struct intel_uncore_box *box, struct perf_event
        reg1->idx = idx;
        reg1->config = event->attr.config1;
-        port = idx / 6 + box->pmu->pmu_idx * 4;
+        switch (idx % 6) {
-        idx %= 6;
-        switch (idx) {
-        case 0:
-                reg1->reg = NHMEX_R_MSR_PORTN_IPERF_CFG0(port);
-                break;
-        case 1:
-                reg1->reg = NHMEX_R_MSR_PORTN_IPERF_CFG1(port);
-                break;
-        case 2:
-        case 3:
-                reg1->reg = NHMEX_R_MSR_PORTN_QLX_CFG(port);
-                break;
        case 4:
        case 5:
-                if (idx == 4)
-                        reg1->reg = NHMEX_R_MSR_PORTN_XBR_SET1_MM_CFG(port);
-                else
-                        reg1->reg = NHMEX_R_MSR_PORTN_XBR_SET2_MM_CFG(port);
-                reg2->config = event->attr.config2;
                hwc->config |= event->attr.config & (~0ULL << 32);
+                reg2->config = event->attr.config2;
                break;
        };
        return 0;
@@ -1727,28 +1729,34 @@ static void nhmex_rbox_msr_enable_event(struct intel_uncore_box *box, struct per
        struct hw_perf_event *hwc = &event->hw;
        struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
        struct hw_perf_event_extra *reg2 = &hwc->branch_reg;
-        int idx, er_idx;
+        int idx, port;
-        idx = reg1->idx % 6;
+        idx = reg1->idx;
-        er_idx = idx;
+        port = idx / 6 + box->pmu->pmu_idx * 4;
-        if (er_idx > 2)
-                er_idx--;
-        er_idx += (reg1->idx / 6) * 5;
-        switch (idx) {
+        switch (idx % 6) {
        case 0:
+                wrmsrl(NHMEX_R_MSR_PORTN_IPERF_CFG0(port), reg1->config);
+                break;
        case 1:
-                wrmsrl(reg1->reg, reg1->config);
+                wrmsrl(NHMEX_R_MSR_PORTN_IPERF_CFG1(port), reg1->config);
                break;
        case 2:
        case 3:
-                wrmsrl(reg1->reg, nhmex_rbox_shared_reg_config(box, er_idx));
+                wrmsrl(NHMEX_R_MSR_PORTN_QLX_CFG(port),
+                        nhmex_rbox_shared_reg_config(box, 2 + (idx / 6) * 5));
                break;
        case 4:
+                wrmsrl(NHMEX_R_MSR_PORTN_XBR_SET1_MM_CFG(port),
+                        hwc->config >> 32);
+                wrmsrl(NHMEX_R_MSR_PORTN_XBR_SET1_MATCH(port), reg1->config);
+                wrmsrl(NHMEX_R_MSR_PORTN_XBR_SET1_MASK(port), reg2->config);
+                break;
        case 5:
-                wrmsrl(reg1->reg, reg1->config);
+                wrmsrl(NHMEX_R_MSR_PORTN_XBR_SET2_MM_CFG(port),
-                wrmsrl(reg1->reg + 1, hwc->config >> 32);
+                        hwc->config >> 32);
-                wrmsrl(reg1->reg + 2, reg2->config);
+                wrmsrl(NHMEX_R_MSR_PORTN_XBR_SET2_MATCH(port), reg1->config);
+                wrmsrl(NHMEX_R_MSR_PORTN_XBR_SET2_MASK(port), reg2->config);
                break;
        };
@@ -1756,8 +1764,8 @@ static void nhmex_rbox_msr_enable_event(struct intel_uncore_box *box, struct per
                (hwc->config & NHMEX_R_PMON_CTL_EV_SEL_MASK));
 }
-DEFINE_UNCORE_FORMAT_ATTR(xbr_match, xbr_match, "config:32-63");
+DEFINE_UNCORE_FORMAT_ATTR(xbr_mm_cfg, xbr_mm_cfg, "config:32-63");
-DEFINE_UNCORE_FORMAT_ATTR(xbr_mm_cfg, xbr_mm_cfg, "config1:0-63");
+DEFINE_UNCORE_FORMAT_ATTR(xbr_match, xbr_match, "config1:0-63");
 DEFINE_UNCORE_FORMAT_ATTR(xbr_mask, xbr_mask, "config2:0-63");
 DEFINE_UNCORE_FORMAT_ATTR(qlx_cfg, qlx_cfg, "config1:0-15");
 DEFINE_UNCORE_FORMAT_ATTR(iperf_cfg, iperf_cfg, "config1:0-31");
@@ -2303,6 +2311,7 @@ int uncore_pmu_event_init(struct perf_event *event)
        event->hw.idx = -1;
        event->hw.last_tag = ~0ULL;
        event->hw.extra_reg.idx = EXTRA_REG_NONE;
+        event->hw.branch_reg.idx = EXTRA_REG_NONE;
        if (event->attr.config == UNCORE_FIXED_EVENT) {
                /* no fixed counter */
@@ -2373,7 +2382,7 @@ static void __init uncore_type_exit(struct intel_uncore_type *type)
        type->attr_groups[1] = NULL;
 }
-static void uncore_types_exit(struct intel_uncore_type **types)
+static void __init uncore_types_exit(struct intel_uncore_type **types)
 {
        int i;
        for (i = 0; types[i]; i++)
@@ -2814,7 +2823,13 @@ static int __init uncore_cpu_init(void)
                        snbep_uncore_cbox.num_boxes = max_cores;
                msr_uncores = snbep_msr_uncores;
                break;
-        case 46:
+        case 46: /* Nehalem-EX */
+                uncore_nhmex = true;
+        case 47: /* Westmere-EX aka. Xeon E7 */
+                if (!uncore_nhmex)
+                        nhmex_uncore_mbox.event_descs = wsmex_uncore_mbox_events;
+                if (nhmex_uncore_cbox.num_boxes > max_cores)
+                        nhmex_uncore_cbox.num_boxes = max_cores;
                msr_uncores = nhmex_msr_uncores;
                break;
        default:
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
index c9e5dc56630a..5b81c1856aac 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
@@ -230,6 +230,7 @@
 #define NHMEX_S1_MSR_MASK                       0xe5a
 #define NHMEX_S_PMON_MM_CFG_EN                  (0x1ULL << 63)
+#define NHMEX_S_EVENT_TO_R_PROG_EV              0
 /* NHM-EX Mbox */
 #define NHMEX_M0_MSR_GLOBAL_CTL                 0xca0
@@ -275,18 +276,12 @@
                 NHMEX_M_PMON_CTL_INC_SEL_MASK |        \
                 NHMEX_M_PMON_CTL_SET_FLAG_SEL_MASK)
+#define NHMEX_M_PMON_ZDP_CTL_FVC_MASK           (((1 << 11) - 1) | (1 << 23))
-#define NHMEX_M_PMON_ZDP_CTL_FVC_FVID_MASK      0x1f
-#define NHMEX_M_PMON_ZDP_CTL_FVC_BCMD_MASK      (0x7 << 5)
-#define NHMEX_M_PMON_ZDP_CTL_FVC_RSP_MASK       (0x7 << 8)
-#define NHMEX_M_PMON_ZDP_CTL_FVC_PBOX_INIT_ERR  (1 << 23)
-#define NHMEX_M_PMON_ZDP_CTL_FVC_MASK                   \
-                (NHMEX_M_PMON_ZDP_CTL_FVC_FVID_MASK |   \
-                 NHMEX_M_PMON_ZDP_CTL_FVC_BCMD_MASK |   \
-                 NHMEX_M_PMON_ZDP_CTL_FVC_RSP_MASK  |   \
-                 NHMEX_M_PMON_ZDP_CTL_FVC_PBOX_INIT_ERR)
 #define NHMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(n)  (0x7 << (11 + 3 * (n)))
+#define WSMEX_M_PMON_ZDP_CTL_FVC_MASK           (((1 << 12) - 1) | (1 << 24))
+#define WSMEX_M_PMON_ZDP_CTL_FVC_EVENT_MASK(n)  (0x7 << (12 + 3 * (n)))
 /*
 * use the 9~13 bits to select event If the 7th bit is not set,
 * otherwise use the 19~21 bits to select event.
@@ -368,6 +363,7 @@ struct intel_uncore_type {
        unsigned num_shared_regs:8;
        unsigned single_fixed:1;
        unsigned pair_ctr_ctl:1;
+        unsigned *msr_offsets;
        struct event_constraint unconstrainted;
        struct event_constraint *constraints;
        struct intel_uncore_pmu *pmus;
@@ -485,29 +481,31 @@ unsigned uncore_pci_perf_ctr(struct intel_uncore_box *box, int idx)
        return idx * 8 + box->pmu->type->perf_ctr;
 }
-static inline
+static inline unsigned uncore_msr_box_offset(struct intel_uncore_box *box)
-unsigned uncore_msr_box_ctl(struct intel_uncore_box *box)
+{
+        struct intel_uncore_pmu *pmu = box->pmu;
+        return pmu->type->msr_offsets ?
+                pmu->type->msr_offsets[pmu->pmu_idx] :
+                pmu->type->msr_offset * pmu->pmu_idx;
+}
+static inline unsigned uncore_msr_box_ctl(struct intel_uncore_box *box)
 {
        if (!box->pmu->type->box_ctl)
                return 0;
-        return box->pmu->type->box_ctl +
+        return box->pmu->type->box_ctl + uncore_msr_box_offset(box);
-                box->pmu->type->msr_offset * box->pmu->pmu_idx;
 }
-static inline
+static inline unsigned uncore_msr_fixed_ctl(struct intel_uncore_box *box)
-unsigned uncore_msr_fixed_ctl(struct intel_uncore_box *box)
 {
        if (!box->pmu->type->fixed_ctl)
                return 0;
-        return box->pmu->type->fixed_ctl +
+        return box->pmu->type->fixed_ctl + uncore_msr_box_offset(box);
-                box->pmu->type->msr_offset * box->pmu->pmu_idx;
 }
-static inline
+static inline unsigned uncore_msr_fixed_ctr(struct intel_uncore_box *box)
-unsigned uncore_msr_fixed_ctr(struct intel_uncore_box *box)
 {
-        return box->pmu->type->fixed_ctr +
+        return box->pmu->type->fixed_ctr + uncore_msr_box_offset(box);
-                box->pmu->type->msr_offset * box->pmu->pmu_idx;
 }
 static inline
@@ -515,7 +513,7 @@ unsigned uncore_msr_event_ctl(struct intel_uncore_box *box, int idx)
 {
        return box->pmu->type->event_ctl +
                (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx) +
-                box->pmu->type->msr_offset * box->pmu->pmu_idx;
+                uncore_msr_box_offset(box);
 }
 static inline
@@ -523,7 +521,7 @@ unsigned uncore_msr_perf_ctr(struct intel_uncore_box *box, int idx)
 {
        return box->pmu->type->perf_ctr +
                (box->pmu->type->pair_ctr_ctl ? 2 * idx : idx) +
-                box->pmu->type->msr_offset * box->pmu->pmu_idx;
+                uncore_msr_box_offset(box);
 }
 static inline
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 7ad683d78645..d44f7829968e 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -270,7 +270,7 @@ void fixup_irqs(void)
                if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) {
                        break_affinity = 1;
-                        affinity = cpu_all_mask;
+                        affinity = cpu_online_mask;
                }
                chip = irq_data_get_irq_chip(data);
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 8a2ce8fd41c0..82746f942cd8 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -143,11 +143,12 @@ static int get_matching_microcode(int cpu, const u8 *ucode_ptr,
                                  unsigned int *current_size)
 {
        struct microcode_header_amd *mc_hdr;
-        unsigned int actual_size;
+        unsigned int actual_size, patch_size;
        u16 equiv_cpu_id;
        /* size of the current patch we're staring at */
-        *current_size = *(u32 *)(ucode_ptr + 4) + SECTION_HDR_SIZE;
+        patch_size = *(u32 *)(ucode_ptr + 4);
+        *current_size = patch_size + SECTION_HDR_SIZE;
        equiv_cpu_id = find_equiv_id();
        if (!equiv_cpu_id)
@@ -174,7 +175,7 @@ static int get_matching_microcode(int cpu, const u8 *ucode_ptr,
        /*
         * now that the header looks sane, verify its size
         */
-        actual_size = verify_ucode_size(cpu, *current_size, leftover_size);
+        actual_size = verify_ucode_size(cpu, patch_size, leftover_size);
        if (!actual_size)
                return 0;
diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
index 4873e62db6a1..9e5bcf1e2376 100644
--- a/arch/x86/kernel/microcode_core.c
+++ b/arch/x86/kernel/microcode_core.c
@@ -225,6 +225,9 @@ static ssize_t microcode_write(struct file *file, const char __user *buf,
        if (do_microcode_update(buf, len) == 0)
                ret = (ssize_t)len;
+        if (ret > 0)
+                perf_check_microcode();
        mutex_unlock(&microcode_mutex);
        put_online_cpus();
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 97d9a9914ba8..a3b57a27be88 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -475,13 +475,26 @@ register_address(struct x86_emulate_ctxt *ctxt, unsigned long reg)
        return address_mask(ctxt, reg);
 }
+static void masked_increment(ulong *reg, ulong mask, int inc)
+{
+        assign_masked(reg, *reg + inc, mask);
+}
 static inline void
 register_address_increment(struct x86_emulate_ctxt *ctxt, unsigned long *reg, int inc)
 {
+        ulong mask;
        if (ctxt->ad_bytes == sizeof(unsigned long))
-                *reg += inc;
+                mask = ~0UL;
        else
-                *reg = (*reg & ~ad_mask(ctxt)) | ((*reg + inc) & ad_mask(ctxt));
+                mask = ad_mask(ctxt);
+        masked_increment(reg, mask, inc);
+}
+static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)
+{
+        masked_increment(&ctxt->regs[VCPU_REGS_RSP], stack_mask(ctxt), inc);
 }
 static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
@@ -1522,8 +1535,8 @@ static int push(struct x86_emulate_ctxt *ctxt, void *data, int bytes)
 {
        struct segmented_address addr;
-        register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP], -bytes);
+        rsp_increment(ctxt, -bytes);
-        addr.ea = register_address(ctxt, ctxt->regs[VCPU_REGS_RSP]);
+        addr.ea = ctxt->regs[VCPU_REGS_RSP] & stack_mask(ctxt);
        addr.seg = VCPU_SREG_SS;
        return segmented_write(ctxt, addr, data, bytes);
@@ -1542,13 +1555,13 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt,
        int rc;
        struct segmented_address addr;
-        addr.ea = register_address(ctxt, ctxt->regs[VCPU_REGS_RSP]);
+        addr.ea = ctxt->regs[VCPU_REGS_RSP] & stack_mask(ctxt);
        addr.seg = VCPU_SREG_SS;
        rc = segmented_read(ctxt, addr, dest, len);
        if (rc != X86EMUL_CONTINUE)
                return rc;
-        register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP], len);
+        rsp_increment(ctxt, len);
        return rc;
 }
@@ -1688,8 +1701,7 @@ static int em_popa(struct x86_emulate_ctxt *ctxt)
        while (reg >= VCPU_REGS_RAX) {
                if (reg == VCPU_REGS_RSP) {
-                        register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP],
+                        rsp_increment(ctxt, ctxt->op_bytes);
-                                                        ctxt->op_bytes);
                        --reg;
                }
@@ -2825,7 +2837,7 @@ static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
        rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes);
        if (rc != X86EMUL_CONTINUE)
                return rc;
-        register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP], ctxt->src.val);
+        rsp_increment(ctxt, ctxt->src.val);
        return X86EMUL_CONTINUE;
 }
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index e498b18f010c..9fc9aa7ac703 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -318,7 +318,7 @@ static void pic_ioport_write(void *opaque, u32 addr, u32 val)
                if (val & 0x10) {
                        u8 edge_irr = s->irr & ~s->elcr;
                        int i;
-                        bool found;
+                        bool found = false;
                        struct kvm_vcpu *vcpu;
                        s->init4 = val & 1;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 01ca00423938..7fbd0d273ea8 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4113,16 +4113,21 @@ static int mmu_shrink(struct shrinker *shrink, struct shrink_control *sc)
                LIST_HEAD(invalid_list);
                /*
+                 * Never scan more than sc->nr_to_scan VM instances.
+                 * Will not hit this condition practically since we do not try
+                 * to shrink more than one VM and it is very unlikely to see
+                 * !n_used_mmu_pages so many times.
+                 */
+                if (!nr_to_scan--)
+                        break;
+                /*
                 * n_used_mmu_pages is accessed without holding kvm->mmu_lock
                 * here. We may skip a VM instance errorneosly, but we do not
                 * want to shrink a VM that only started to populate its MMU
                 * anyway.
                 */
-                if (kvm->arch.n_used_mmu_pages > 0) {
+                if (!kvm->arch.n_used_mmu_pages)
-                        if (!nr_to_scan--)
-                                break;
                        continue;
-                }
                idx = srcu_read_lock(&kvm->srcu);
                spin_lock(&kvm->mmu_lock);
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c00f03de1b79..b1eb202ee76a 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3619,6 +3619,7 @@ static void seg_setup(int seg)
 static int alloc_apic_access_page(struct kvm *kvm)
 {
+        struct page *page;
        struct kvm_userspace_memory_region kvm_userspace_mem;
        int r = 0;
@@ -3633,7 +3634,13 @@ static int alloc_apic_access_page(struct kvm *kvm)
        if (r)
                goto out;
-        kvm->arch.apic_access_page = gfn_to_page(kvm, 0xfee00);
+        page = gfn_to_page(kvm, 0xfee00);
+        if (is_error_page(page)) {
+                r = -EFAULT;
+                goto out;
+        }
+        kvm->arch.apic_access_page = page;
 out:
        mutex_unlock(&kvm->slots_lock);
        return r;
@@ -3641,6 +3648,7 @@ out:
 static int alloc_identity_pagetable(struct kvm *kvm)
 {
+        struct page *page;
        struct kvm_userspace_memory_region kvm_userspace_mem;
        int r = 0;
@@ -3656,8 +3664,13 @@ static int alloc_identity_pagetable(struct kvm *kvm)
        if (r)
                goto out;
-        kvm->arch.ept_identity_pagetable = gfn_to_page(kvm,
+        page = gfn_to_page(kvm, kvm->arch.ept_identity_map_addr >> PAGE_SHIFT);
-                        kvm->arch.ept_identity_map_addr >> PAGE_SHIFT);
+        if (is_error_page(page)) {
+                r = -EFAULT;
+                goto out;
+        }
+        kvm->arch.ept_identity_pagetable = page;
 out:
        mutex_unlock(&kvm->slots_lock);
        return r;
@@ -6575,7 +6588,7 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
        /* Exposing INVPCID only when PCID is exposed */
        best = kvm_find_cpuid_entry(vcpu, 0x7, 0);
        if (vmx_invpcid_supported() &&
-            best && (best->ecx & bit(X86_FEATURE_INVPCID)) &&
+            best && (best->ebx & bit(X86_FEATURE_INVPCID)) &&
            guest_cpuid_has_pcid(vcpu)) {
                exec_control |= SECONDARY_EXEC_ENABLE_INVPCID;
                vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
@@ -6585,7 +6598,7 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
                vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
                             exec_control);
                if (best)
-                        best->ecx &= ~bit(X86_FEATURE_INVPCID);
+                        best->ebx &= ~bit(X86_FEATURE_INVPCID);
        }
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 42bce48f6928..2966c847d489 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -806,7 +806,7 @@ EXPORT_SYMBOL_GPL(kvm_rdpmc);
 * kvm-specific. Those are put in the beginning of the list.
 */
-#define KVM_SAVE_MSRS_BEGIN     9
+#define KVM_SAVE_MSRS_BEGIN     10
 static u32 msrs_to_save[] = {
        MSR_KVM_SYSTEM_TIME, MSR_KVM_WALL_CLOCK,
        MSR_KVM_SYSTEM_TIME_NEW, MSR_KVM_WALL_CLOCK_NEW,
@@ -2000,6 +2000,9 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
        case MSR_KVM_STEAL_TIME:
                data = vcpu->arch.st.msr_val;
                break;
+        case MSR_KVM_PV_EOI_EN:
+                data = vcpu->arch.pv_eoi.msr_val;
+                break;
        case MSR_IA32_P5_MC_ADDR:
        case MSR_IA32_P5_MC_TYPE:
        case MSR_IA32_MCG_CAP:
@@ -5110,17 +5113,20 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu)
                        !kvm_event_needs_reinjection(vcpu);
 }
-static void vapic_enter(struct kvm_vcpu *vcpu)
+static int vapic_enter(struct kvm_vcpu *vcpu)
 {
        struct kvm_lapic *apic = vcpu->arch.apic;
        struct page *page;
        if (!apic || !apic->vapic_addr)
-                return;
+                return 0;
        page = gfn_to_page(vcpu->kvm, apic->vapic_addr >> PAGE_SHIFT);
+        if (is_error_page(page))
+                return -EFAULT;
        vcpu->arch.apic->vapic_page = page;
+        return 0;
 }
 static void vapic_exit(struct kvm_vcpu *vcpu)
@@ -5427,7 +5433,11 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
        }
        vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
-        vapic_enter(vcpu);
+        r = vapic_enter(vcpu);
+        if (r) {
+                srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
+                return r;
+        }
        r = 1;
        while (r > 0) {
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index f6679a7fb8ca..b91e48512425 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -56,9 +56,16 @@ static int vma_shareable(struct vm_area_struct *vma, unsigned long addr)
 }
 /*
- * search for a shareable pmd page for hugetlb.
+ * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc()
+ * and returns the corresponding pte. While this is not necessary for the
+ * !shared pmd case because we can allocate the pmd later as well, it makes the
+ * code much cleaner. pmd allocation is essential for the shared case because
+ * pud has to be populated inside the same i_mmap_mutex section - otherwise
+ * racing tasks could either miss the sharing (see huge_pte_offset) or select a
+ * bad pmd for sharing.
 */
-static void huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
+static pte_t *
+huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
 {
        struct vm_area_struct *vma = find_vma(mm, addr);
        struct address_space *mapping = vma->vm_file->f_mapping;
@@ -68,9 +75,10 @@ static void huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
        struct vm_area_struct *svma;
        unsigned long saddr;
        pte_t *spte = NULL;
+        pte_t *pte;
        if (!vma_shareable(vma, addr))
-                return;
+                return (pte_t *)pmd_alloc(mm, pud, addr);
        mutex_lock(&mapping->i_mmap_mutex);
        vma_prio_tree_foreach(svma, &iter, &mapping->i_mmap, idx, idx) {
@@ -97,7 +105,9 @@ static void huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
                put_page(virt_to_page(spte));
        spin_unlock(&mm->page_table_lock);
 out:
+        pte = (pte_t *)pmd_alloc(mm, pud, addr);
        mutex_unlock(&mapping->i_mmap_mutex);
+        return pte;
 }
 /*
@@ -142,8 +152,9 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                } else {
                        BUG_ON(sz != PMD_SIZE);
                        if (pud_none(*pud))
-                                huge_pmd_share(mm, addr, pud);
+                                pte = huge_pmd_share(mm, addr, pud);
-                        pte = (pte_t *) pmd_alloc(mm, pud, addr);
+                        else
+                                pte = (pte_t *)pmd_alloc(mm, pud, addr);
                }
        }
        BUG_ON(pte && !pte_none(*pte) && !pte_huge(*pte));
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 931930a96160..a718e0d23503 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -919,13 +919,11 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
        /*
         * On success we use clflush, when the CPU supports it to
-         * avoid the wbindv. If the CPU does not support it, in the
+         * avoid the wbindv. If the CPU does not support it and in the
-         * error case, and during early boot (for EFI) we fall back
+         * error case we fall back to cpa_flush_all (which uses
-         * to cpa_flush_all (which uses wbinvd):
+         * wbindv):
         */
-        if (early_boot_irqs_disabled)
+        if (!ret && cpu_has_clflush) {
-                __cpa_flush_all((void *)(long)cache);
-        else if (!ret && cpu_has_clflush) {
                if (cpa.flags & (CPA_PAGES_ARRAY | CPA_ARRAY)) {
                        cpa_flush_array(addr, numpages, cache,
                                        cpa.flags, pages);
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 2dc29f51e75a..92660edaa1e7 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -234,7 +234,22 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
        return status;
 }
-static int efi_set_rtc_mmss(unsigned long nowtime)
+static efi_status_t __init phys_efi_get_time(efi_time_t *tm,
+                                             efi_time_cap_t *tc)
+{
+        unsigned long flags;
+        efi_status_t status;
+        spin_lock_irqsave(&rtc_lock, flags);
+        efi_call_phys_prelog();
+        status = efi_call_phys2(efi_phys.get_time, virt_to_phys(tm),
+                                virt_to_phys(tc));
+        efi_call_phys_epilog();
+        spin_unlock_irqrestore(&rtc_lock, flags);
+        return status;
+}
+int efi_set_rtc_mmss(unsigned long nowtime)
 {
        int real_seconds, real_minutes;
        efi_status_t    status;
@@ -263,7 +278,7 @@ static int efi_set_rtc_mmss(unsigned long nowtime)
        return 0;
 }
-static unsigned long efi_get_time(void)
+unsigned long efi_get_time(void)
 {
        efi_status_t status;
        efi_time_t eft;
@@ -606,13 +621,18 @@ static int __init efi_runtime_init(void)
        }
        /*
         * We will only need *early* access to the following
-         * EFI runtime service before set_virtual_address_map
+         * two EFI runtime services before set_virtual_address_map
         * is invoked.
         */
+        efi_phys.get_time = (efi_get_time_t *)runtime->get_time;
        efi_phys.set_virtual_address_map =
                (efi_set_virtual_address_map_t *)
                runtime->set_virtual_address_map;
+        /*
+         * Make efi_get_time can be called before entering
+         * virtual mode.
+         */
+        efi.get_time = phys_efi_get_time;
        early_iounmap(runtime, sizeof(efi_runtime_services_t));
        return 0;
@@ -700,10 +720,12 @@ void __init efi_init(void)
                efi_enabled = 0;
                return;
        }
+#ifdef CONFIG_X86_32
        if (efi_native) {
                x86_platform.get_wallclock = efi_get_time;
                x86_platform.set_wallclock = efi_set_rtc_mmss;
        }
+#endif
 #if EFI_DEBUG
        print_efi_memmap();
diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
index b2d534cab25f..88692871823f 100644
--- a/arch/x86/realmode/rm/Makefile
+++ b/arch/x86/realmode/rm/Makefile
@@ -72,7 +72,7 @@ KBUILD_CFLAGS	:= $(LINUXINCLUDE) -m32 -g -Os -D_SETUP -D__KERNEL__ -D_WAKEUP \
                   -Wall -Wstrict-prototypes \
                   -march=i386 -mregparm=3 \
                   -include $(srctree)/$(src)/../../boot/code16gcc.h \
-                   -fno-strict-aliasing -fomit-frame-pointer \
+                   -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
                   $(call cc-option, -ffreestanding) \
                   $(call cc-option, -fno-toplevel-reorder,\
                        $(call cc-option, -fno-unit-at-a-time)) \
diff --git a/arch/x86/syscalls/syscall_64.tbl b/arch/x86/syscalls/syscall_64.tbl
index 29aed7ac2c02..a582bfed95bb 100644
--- a/arch/x86/syscalls/syscall_64.tbl
+++ b/arch/x86/syscalls/syscall_64.tbl
@@ -60,8 +60,8 @@
 51      common  getsockname             sys_getsockname
 52      common  getpeername             sys_getpeername
 53      common  socketpair              sys_socketpair
-54      common  setsockopt              sys_setsockopt
+54      64      setsockopt              sys_setsockopt
-55      common  getsockopt              sys_getsockopt
+55      64      getsockopt              sys_getsockopt
 56      common  clone                   stub_clone
 57      common  fork                    stub_fork
 58      common  vfork                   stub_vfork
@@ -353,3 +353,5 @@
 538     x32     sendmmsg                compat_sys_sendmmsg
 539     x32     process_vm_readv        compat_sys_process_vm_readv
 540     x32     process_vm_writev       compat_sys_process_vm_writev
+541     x32     setsockopt              compat_sys_setsockopt
+542     x32     getsockopt              compat_sys_getsockopt
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index bf4bda6d3e9a..9642d4a38602 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -31,7 +31,6 @@
 #include <linux/pci.h>
 #include <linux/gfp.h>
 #include <linux/memblock.h>
-#include <linux/syscore_ops.h>
 #include <xen/xen.h>
 #include <xen/interface/xen.h>
@@ -1470,130 +1469,38 @@ asmlinkage void __init xen_start_kernel(void)
 #endif
 }
-#ifdef CONFIG_XEN_PVHVM
+void __ref xen_hvm_init_shared_info(void)
-/*
- * The pfn containing the shared_info is located somewhere in RAM. This
- * will cause trouble if the current kernel is doing a kexec boot into a
- * new kernel. The new kernel (and its startup code) can not know where
- * the pfn is, so it can not reserve the page. The hypervisor will
- * continue to update the pfn, and as a result memory corruption occours
- * in the new kernel.
- *
- * One way to work around this issue is to allocate a page in the
- * xen-platform pci device's BAR memory range. But pci init is done very
- * late and the shared_info page is already in use very early to read
- * the pvclock. So moving the pfn from RAM to MMIO is racy because some
- * code paths on other vcpus could access the pfn during the small
- * window when the old pfn is moved to the new pfn. There is even a
- * small window were the old pfn is not backed by a mfn, and during that
- * time all reads return -1.
- *
- * Because it is not known upfront where the MMIO region is located it
- * can not be used right from the start in xen_hvm_init_shared_info.
- *
- * To minimise trouble the move of the pfn is done shortly before kexec.
- * This does not eliminate the race because all vcpus are still online
- * when the syscore_ops will be called. But hopefully there is no work
- * pending at this point in time. Also the syscore_op is run last which
- * reduces the risk further.
- */
-static struct shared_info *xen_hvm_shared_info;
-static void xen_hvm_connect_shared_info(unsigned long pfn)
 {
+        int cpu;
        struct xen_add_to_physmap xatp;
+        static struct shared_info *shared_info_page = 0;
+        if (!shared_info_page)
+                shared_info_page = (struct shared_info *)
+                        extend_brk(PAGE_SIZE, PAGE_SIZE);
        xatp.domid = DOMID_SELF;
        xatp.idx = 0;
        xatp.space = XENMAPSPACE_shared_info;
-        xatp.gpfn = pfn;
+        xatp.gpfn = __pa(shared_info_page) >> PAGE_SHIFT;
        if (HYPERVISOR_memory_op(XENMEM_add_to_physmap, &xatp))
                BUG();
-}
+        HYPERVISOR_shared_info = (struct shared_info *)shared_info_page;
-static void xen_hvm_set_shared_info(struct shared_info *sip)
-{
-        int cpu;
-        HYPERVISOR_shared_info = sip;
        /* xen_vcpu is a pointer to the vcpu_info struct in the shared_info
         * page, we use it in the event channel upcall and in some pvclock
         * related functions. We don't need the vcpu_info placement
         * optimizations because we don't use any pv_mmu or pv_irq op on
         * HVM.
-         * When xen_hvm_set_shared_info is run at boot time only vcpu 0 is
+         * When xen_hvm_init_shared_info is run at boot time only vcpu 0 is
-         * online but xen_hvm_set_shared_info is run at resume time too and
+         * online but xen_hvm_init_shared_info is run at resume time too and
         * in that case multiple vcpus might be online. */
        for_each_online_cpu(cpu) {
                per_cpu(xen_vcpu, cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
        }
 }
-/* Reconnect the shared_info pfn to a mfn */
+#ifdef CONFIG_XEN_PVHVM
-void xen_hvm_resume_shared_info(void)
-{
-        xen_hvm_connect_shared_info(__pa(xen_hvm_shared_info) >> PAGE_SHIFT);
-}
-#ifdef CONFIG_KEXEC
-static struct shared_info *xen_hvm_shared_info_kexec;
-static unsigned long xen_hvm_shared_info_pfn_kexec;
-/* Remember a pfn in MMIO space for kexec reboot */
-void __devinit xen_hvm_prepare_kexec(struct shared_info *sip, unsigned long pfn)
-{
-        xen_hvm_shared_info_kexec = sip;
-        xen_hvm_shared_info_pfn_kexec = pfn;
-}
-static void xen_hvm_syscore_shutdown(void)
-{
-        struct xen_memory_reservation reservation = {
-                .domid = DOMID_SELF,
-                .nr_extents = 1,
-        };
-        unsigned long prev_pfn;
-        int rc;
-        if (!xen_hvm_shared_info_kexec)
-                return;
-        prev_pfn = __pa(xen_hvm_shared_info) >> PAGE_SHIFT;
-        set_xen_guest_handle(reservation.extent_start, &prev_pfn);
-        /* Move pfn to MMIO, disconnects previous pfn from mfn */
-        xen_hvm_connect_shared_info(xen_hvm_shared_info_pfn_kexec);
-        /* Update pointers, following hypercall is also a memory barrier */
-        xen_hvm_set_shared_info(xen_hvm_shared_info_kexec);
-        /* Allocate new mfn for previous pfn */
-        do {
-                rc = HYPERVISOR_memory_op(XENMEM_populate_physmap, &reservation);
-                if (rc == 0)
-                        msleep(123);
-        } while (rc == 0);
-        /* Make sure the previous pfn is really connected to a (new) mfn */
-        BUG_ON(rc != 1);
-}
-static struct syscore_ops xen_hvm_syscore_ops = {
-        .shutdown = xen_hvm_syscore_shutdown,
-};
-#endif
-/* Use a pfn in RAM, may move to MMIO before kexec. */
-static void __init xen_hvm_init_shared_info(void)
-{
-        /* Remember pointer for resume */
-        xen_hvm_shared_info = extend_brk(PAGE_SIZE, PAGE_SIZE);
-        xen_hvm_connect_shared_info(__pa(xen_hvm_shared_info) >> PAGE_SHIFT);
-        xen_hvm_set_shared_info(xen_hvm_shared_info);
-}
 static void __init init_hvm_pv_info(void)
 {
        int major, minor;
@@ -1644,9 +1551,6 @@ static void __init xen_hvm_guest_init(void)
        init_hvm_pv_info();
        xen_hvm_init_shared_info();
-#ifdef CONFIG_KEXEC
-        register_syscore_ops(&xen_hvm_syscore_ops);
-#endif
        if (xen_feature(XENFEAT_hvm_callback_vector))
                xen_have_vector_callback = 1;
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index b65a76133f4f..5141d808e751 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1283,7 +1283,7 @@ static void xen_flush_tlb_others(const struct cpumask *cpus,
        cpumask_clear_cpu(smp_processor_id(), to_cpumask(args->mask));
        args->op.cmd = MMUEXT_TLB_FLUSH_MULTI;
-        if (start != TLB_FLUSH_ALL && (end - start) <= PAGE_SIZE) {
+        if (end != TLB_FLUSH_ALL && (end - start) <= PAGE_SIZE) {
                args->op.cmd = MMUEXT_INVLPG_MULTI;
                args->op.arg1.linear_addr = start;
        }
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index b2e91d40a4cb..76ba0e97e530 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -196,9 +196,11 @@ RESERVE_BRK(p2m_mid_identity, PAGE_SIZE * 2 * 3);
 /* When we populate back during bootup, the amount of pages can vary. The
 * max we have is seen is 395979, but that does not mean it can't be more.
- * But some machines can have 3GB I/O holes even. So lets reserve enough
+ * Some machines can have 3GB I/O holes even. With early_can_reuse_p2m_middle
- * for 4GB of I/O and E820 holes. */
+ * it can re-use Xen provided mfn_list array, so we only need to allocate at
-RESERVE_BRK(p2m_populated, PMD_SIZE * 4);
+ * most three P2M top nodes. */
+RESERVE_BRK(p2m_populated, PAGE_SIZE * 3);
 static inline unsigned p2m_top_index(unsigned long pfn)
 {
        BUG_ON(pfn >= MAX_P2M_PFN);
@@ -575,12 +577,99 @@ static bool __init early_alloc_p2m(unsigned long pfn)
        }
        return true;
 }
+/*
+ * Skim over the P2M tree looking at pages that are either filled with
+ * INVALID_P2M_ENTRY or with 1:1 PFNs. If found, re-use that page and
+ * replace the P2M leaf with a p2m_missing or p2m_identity.
+ * Stick the old page in the new P2M tree location.
+ */
+bool __init early_can_reuse_p2m_middle(unsigned long set_pfn, unsigned long set_mfn)
+{
+        unsigned topidx;
+        unsigned mididx;
+        unsigned ident_pfns;
+        unsigned inv_pfns;
+        unsigned long *p2m;
+        unsigned long *mid_mfn_p;
+        unsigned idx;
+        unsigned long pfn;
+        /* We only look when this entails a P2M middle layer */
+        if (p2m_index(set_pfn))
+                return false;
+        for (pfn = 0; pfn < MAX_DOMAIN_PAGES; pfn += P2M_PER_PAGE) {
+                topidx = p2m_top_index(pfn);
+                if (!p2m_top[topidx])
+                        continue;
+                if (p2m_top[topidx] == p2m_mid_missing)
+                        continue;
+                mididx = p2m_mid_index(pfn);
+                p2m = p2m_top[topidx][mididx];
+                if (!p2m)
+                        continue;
+                if ((p2m == p2m_missing) || (p2m == p2m_identity))
+                        continue;
+                if ((unsigned long)p2m == INVALID_P2M_ENTRY)
+                        continue;
+                ident_pfns = 0;
+                inv_pfns = 0;
+                for (idx = 0; idx < P2M_PER_PAGE; idx++) {
+                        /* IDENTITY_PFNs are 1:1 */
+                        if (p2m[idx] == IDENTITY_FRAME(pfn + idx))
+                                ident_pfns++;
+                        else if (p2m[idx] == INVALID_P2M_ENTRY)
+                                inv_pfns++;
+                        else
+                                break;
+                }
+                if ((ident_pfns == P2M_PER_PAGE) || (inv_pfns == P2M_PER_PAGE))
+                        goto found;
+        }
+        return false;
+found:
+        /* Found one, replace old with p2m_identity or p2m_missing */
+        p2m_top[topidx][mididx] = (ident_pfns ? p2m_identity : p2m_missing);
+        /* And the other for save/restore.. */
+        mid_mfn_p = p2m_top_mfn_p[topidx];
+        /* NOTE: Even if it is a p2m_identity it should still be point to
+         * a page filled with INVALID_P2M_ENTRY entries. */
+        mid_mfn_p[mididx] = virt_to_mfn(p2m_missing);
+        /* Reset where we want to stick the old page in. */
+        topidx = p2m_top_index(set_pfn);
+        mididx = p2m_mid_index(set_pfn);
+        /* This shouldn't happen */
+        if (WARN_ON(p2m_top[topidx] == p2m_mid_missing))
+                early_alloc_p2m(set_pfn);
+        if (WARN_ON(p2m_top[topidx][mididx] != p2m_missing))
+                return false;
+        p2m_init(p2m);
+        p2m_top[topidx][mididx] = p2m;
+        mid_mfn_p = p2m_top_mfn_p[topidx];
+        mid_mfn_p[mididx] = virt_to_mfn(p2m);
+        return true;
+}
 bool __init early_set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 {
        if (unlikely(!__set_phys_to_machine(pfn, mfn)))  {
                if (!early_alloc_p2m(pfn))
                        return false;
+                if (early_can_reuse_p2m_middle(pfn, mfn))
+                        return __set_phys_to_machine(pfn, mfn);
                if (!early_alloc_p2m_middle(pfn, false /* boundary crossover OK!*/))
                        return false;
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index ead85576d54a..d11ca11d14fc 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -78,9 +78,16 @@ static void __init xen_add_extra_mem(u64 start, u64 size)
        memblock_reserve(start, size);
        xen_max_p2m_pfn = PFN_DOWN(start + size);
+        for (pfn = PFN_DOWN(start); pfn < xen_max_p2m_pfn; pfn++) {
+                unsigned long mfn = pfn_to_mfn(pfn);
+                if (WARN(mfn == pfn, "Trying to over-write 1-1 mapping (pfn: %lx)\n", pfn))
+                        continue;
+                WARN(mfn != INVALID_P2M_ENTRY, "Trying to remove %lx which has %lx mfn!\n",
+                        pfn, mfn);
-        for (pfn = PFN_DOWN(start); pfn <= xen_max_p2m_pfn; pfn++)
                __set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
+        }
 }
 static unsigned long __init xen_do_chunk(unsigned long start,
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
index ae8a00c39de4..45329c8c226e 100644
--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -30,7 +30,7 @@ void xen_arch_hvm_post_suspend(int suspend_cancelled)
 {
 #ifdef CONFIG_XEN_PVHVM
        int cpu;
-        xen_hvm_resume_shared_info();
+        xen_hvm_init_shared_info();
        xen_callback_vector();
        xen_unplug_emulated_devices();
        if (xen_feature(XENFEAT_hvm_safe_pvclock)) {
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index 1e4329e04e0f..202d4c150154 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -41,7 +41,7 @@ void xen_enable_syscall(void);
 void xen_vcpu_restore(void);
 void xen_callback_vector(void);
-void xen_hvm_resume_shared_info(void);
+void xen_hvm_init_shared_info(void);
 void xen_unplug_emulated_devices(void);
 void __init xen_build_dynamic_phys_to_machine(void);
diff --git a/block/blk-lib.c b/block/blk-lib.c
index 2b461b496a78..19cc761cacb2 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -44,6 +44,7 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
        struct request_queue *q = bdev_get_queue(bdev);
        int type = REQ_WRITE | REQ_DISCARD;
        unsigned int max_discard_sectors;
+        unsigned int granularity, alignment, mask;
        struct bio_batch bb;
        struct bio *bio;
        int ret = 0;
@@ -54,18 +55,20 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
        if (!blk_queue_discard(q))
                return -EOPNOTSUPP;
+        /* Zero-sector (unknown) and one-sector granularities are the same.  */
+        granularity = max(q->limits.discard_granularity >> 9, 1U);
+        mask = granularity - 1;
+        alignment = (bdev_discard_alignment(bdev) >> 9) & mask;
        /*
         * Ensure that max_discard_sectors is of the proper
-         * granularity
+         * granularity, so that requests stay aligned after a split.
         */
        max_discard_sectors = min(q->limits.max_discard_sectors, UINT_MAX >> 9);
+        max_discard_sectors = round_down(max_discard_sectors, granularity);
        if (unlikely(!max_discard_sectors)) {
                /* Avoid infinite loop below. Being cautious never hurts. */
                return -EOPNOTSUPP;
-        } else if (q->limits.discard_granularity) {
-                unsigned int disc_sects = q->limits.discard_granularity >> 9;
-                max_discard_sectors &= ~(disc_sects - 1);
        }
        if (flags & BLKDEV_DISCARD_SECURE) {
@@ -79,25 +82,37 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
        bb.wait = &wait;
        while (nr_sects) {
+                unsigned int req_sects;
+                sector_t end_sect;
                bio = bio_alloc(gfp_mask, 1);
                if (!bio) {
                        ret = -ENOMEM;
                        break;
                }
+                req_sects = min_t(sector_t, nr_sects, max_discard_sectors);
+                /*
+                 * If splitting a request, and the next starting sector would be
+                 * misaligned, stop the discard at the previous aligned sector.
+                 */
+                end_sect = sector + req_sects;
+                if (req_sects < nr_sects && (end_sect & mask) != alignment) {
+                        end_sect =
+                                round_down(end_sect - alignment, granularity)
+                                + alignment;
+                        req_sects = end_sect - sector;
+                }
                bio->bi_sector = sector;
                bio->bi_end_io = bio_batch_end_io;
                bio->bi_bdev = bdev;
                bio->bi_private = &bb;
-                if (nr_sects > max_discard_sectors) {
+                bio->bi_size = req_sects << 9;
-                        bio->bi_size = max_discard_sectors << 9;
+                nr_sects -= req_sects;
-                        nr_sects -= max_discard_sectors;
+                sector = end_sect;
-                        sector += max_discard_sectors;
-                } else {
-                        bio->bi_size = nr_sects << 9;
-                        nr_sects = 0;
-                }
                atomic_inc(&bb.done);
                submit_bio(type, bio);
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 160035f54882..e76279e41162 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -110,6 +110,49 @@ static int blk_phys_contig_segment(struct request_queue *q, struct bio *bio,
        return 0;
 }
+static void
+__blk_segment_map_sg(struct request_queue *q, struct bio_vec *bvec,
+                     struct scatterlist *sglist, struct bio_vec **bvprv,
+                     struct scatterlist **sg, int *nsegs, int *cluster)
+{
+        int nbytes = bvec->bv_len;
+        if (*bvprv && *cluster) {
+                if ((*sg)->length + nbytes > queue_max_segment_size(q))
+                        goto new_segment;
+                if (!BIOVEC_PHYS_MERGEABLE(*bvprv, bvec))
+                        goto new_segment;
+                if (!BIOVEC_SEG_BOUNDARY(q, *bvprv, bvec))
+                        goto new_segment;
+                (*sg)->length += nbytes;
+        } else {
+new_segment:
+                if (!*sg)
+                        *sg = sglist;
+                else {
+                        /*
+                         * If the driver previously mapped a shorter
+                         * list, we could see a termination bit
+                         * prematurely unless it fully inits the sg
+                         * table on each mapping. We KNOW that there
+                         * must be more entries here or the driver
+                         * would be buggy, so force clear the
+                         * termination bit to avoid doing a full
+                         * sg_init_table() in drivers for each command.
+                         */
+                        (*sg)->page_link &= ~0x02;
+                        *sg = sg_next(*sg);
+                }
+                sg_set_page(*sg, bvec->bv_page, nbytes, bvec->bv_offset);
+                (*nsegs)++;
+        }
+        *bvprv = bvec;
+}
 /*
 * map a request to scatterlist, return number of sg entries setup. Caller
 * must make sure sg can hold rq->nr_phys_segments entries
@@ -131,41 +174,8 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq,
        bvprv = NULL;
        sg = NULL;
        rq_for_each_segment(bvec, rq, iter) {
-                int nbytes = bvec->bv_len;
+                __blk_segment_map_sg(q, bvec, sglist, &bvprv, &sg,
+                                     &nsegs, &cluster);
-                if (bvprv && cluster) {
-                        if (sg->length + nbytes > queue_max_segment_size(q))
-                                goto new_segment;
-                        if (!BIOVEC_PHYS_MERGEABLE(bvprv, bvec))
-                                goto new_segment;
-                        if (!BIOVEC_SEG_BOUNDARY(q, bvprv, bvec))
-                                goto new_segment;
-                        sg->length += nbytes;
-                } else {
-new_segment:
-                        if (!sg)
-                                sg = sglist;
-                        else {
-                                /*
-                                 * If the driver previously mapped a shorter
-                                 * list, we could see a termination bit
-                                 * prematurely unless it fully inits the sg
-                                 * table on each mapping. We KNOW that there
-                                 * must be more entries here or the driver
-                                 * would be buggy, so force clear the
-                                 * termination bit to avoid doing a full
-                                 * sg_init_table() in drivers for each command.
-                                 */
-                                sg->page_link &= ~0x02;
-                                sg = sg_next(sg);
-                        }
-                        sg_set_page(sg, bvec->bv_page, nbytes, bvec->bv_offset);
-                        nsegs++;
-                }
-                bvprv = bvec;
        } /* segments in rq */
@@ -199,6 +209,43 @@ new_segment:
 }
 EXPORT_SYMBOL(blk_rq_map_sg);
+/**
+ * blk_bio_map_sg - map a bio to a scatterlist
+ * @q: request_queue in question
+ * @bio: bio being mapped
+ * @sglist: scatterlist being mapped
+ *
+ * Note:
+ *    Caller must make sure sg can hold bio->bi_phys_segments entries
+ *
+ * Will return the number of sg entries setup
+ */
+int blk_bio_map_sg(struct request_queue *q, struct bio *bio,
+                   struct scatterlist *sglist)
+{
+        struct bio_vec *bvec, *bvprv;
+        struct scatterlist *sg;
+        int nsegs, cluster;
+        unsigned long i;
+        nsegs = 0;
+        cluster = blk_queue_cluster(q);
+        bvprv = NULL;
+        sg = NULL;
+        bio_for_each_segment(bvec, bio, i) {
+                __blk_segment_map_sg(q, bvec, sglist, &bvprv, &sg,
+                                     &nsegs, &cluster);
+        } /* segments in bio */
+        if (sg)
+                sg_mark_end(sg);
+        BUG_ON(bio->bi_phys_segments && nsegs > bio->bi_phys_segments);
+        return nsegs;
+}
+EXPORT_SYMBOL(blk_bio_map_sg);
 static inline int ll_new_hw_segment(struct request_queue *q,
                                    struct request *req,
                                    struct bio *bio)
diff --git a/block/genhd.c b/block/genhd.c
index cac7366957c3..d839723303c8 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -835,7 +835,7 @@ static void disk_seqf_stop(struct seq_file *seqf, void *v)
 static void *show_partition_start(struct seq_file *seqf, loff_t *pos)
 {
-        static void *p;
+        void *p;
        p = disk_seqf_start(seqf, pos);
        if (!IS_ERR_OR_NULL(p) && !*pos)
diff --git a/crypto/authenc.c b/crypto/authenc.c
index 5ef7ba6b6a76..d0583a4489e6 100644
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -336,7 +336,7 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv,
                cryptlen += ivsize;
        }
-        if (sg_is_last(assoc)) {
+        if (req->assoclen && sg_is_last(assoc)) {
                authenc_ahash_fn = crypto_authenc_ahash;
                sg_init_table(asg, 2);
                sg_set_page(asg, sg_page(assoc), assoc->length, assoc->offset);
@@ -490,7 +490,7 @@ static int crypto_authenc_iverify(struct aead_request *req, u8 *iv,
                cryptlen += ivsize;
        }
-        if (sg_is_last(assoc)) {
+        if (req->assoclen && sg_is_last(assoc)) {
                authenc_ahash_fn = crypto_authenc_ahash;
                sg_init_table(asg, 2);
                sg_set_page(asg, sg_page(assoc), assoc->length, assoc->offset);
diff --git a/drivers/acpi/acpica/tbxface.c b/drivers/acpi/acpica/tbxface.c
index ea4c6d52605a..29e51bc01383 100644
--- a/drivers/acpi/acpica/tbxface.c
+++ b/drivers/acpi/acpica/tbxface.c
@@ -387,6 +387,7 @@ acpi_get_table_with_size(char *signature,
        return (AE_NOT_FOUND);
 }
+ACPI_EXPORT_SYMBOL(acpi_get_table_with_size)
 acpi_status
 acpi_get_table(char *signature,
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 2be8ef1d3093..27cecd313e75 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -115,7 +115,7 @@ config SATA_SIL24
          If unsure, say N.
 config ATA_SFF
-        bool "ATA SFF support"
+        bool "ATA SFF support (for legacy IDE and PATA)"
        default y
        help
          This option adds support for ATA controllers with SFF
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 062e6a1a248f..7862d17976b7 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -256,10 +256,21 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x8c07), board_ahci }, /* Lynx Point RAID */
        { PCI_VDEVICE(INTEL, 0x8c0e), board_ahci }, /* Lynx Point RAID */
        { PCI_VDEVICE(INTEL, 0x8c0f), board_ahci }, /* Lynx Point RAID */
+        { PCI_VDEVICE(INTEL, 0x9c02), board_ahci }, /* Lynx Point-LP AHCI */
+        { PCI_VDEVICE(INTEL, 0x9c03), board_ahci }, /* Lynx Point-LP AHCI */
+        { PCI_VDEVICE(INTEL, 0x9c04), board_ahci }, /* Lynx Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9c05), board_ahci }, /* Lynx Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9c06), board_ahci }, /* Lynx Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9c07), board_ahci }, /* Lynx Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9c0e), board_ahci }, /* Lynx Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9c0f), board_ahci }, /* Lynx Point-LP RAID */
        /* JMicron 360/1/3/5/6, match class to avoid IDE function */
        { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
          PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci_ign_iferr },
+        /* JMicron 362B and 362C have an AHCI function with IDE class code */
+        { PCI_VDEVICE(JMICRON, 0x2362), board_ahci_ign_iferr },
+        { PCI_VDEVICE(JMICRON, 0x236f), board_ahci_ign_iferr },
        /* ATI */
        { PCI_VDEVICE(ATI, 0x4380), board_ahci_sb600 }, /* ATI SB600 */
@@ -385,6 +396,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
          .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
        { PCI_DEVICE(0x1b4b, 0x917a),
          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
+        { PCI_DEVICE(0x1b4b, 0x9192),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 on some Gigabyte */
        { PCI_DEVICE(0x1b4b, 0x91a3),
          .driver_data = board_ahci_yes_fbs },
@@ -392,7 +405,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
        /* Asmedia */
-        { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1061 */
+        { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },   /* ASM1060 */
+        { PCI_VDEVICE(ASMEDIA, 0x0602), board_ahci },   /* ASM1060 */
+        { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },   /* ASM1061 */
+        { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
        /* Generic, PCI class code for AHCI */
        { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index c2594ddf25b0..57eb1c212a4c 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -320,6 +320,7 @@ extern struct device_attribute *ahci_sdev_attrs[];
 extern struct ata_port_operations ahci_ops;
 extern struct ata_port_operations ahci_pmp_retry_srst_ops;
+unsigned int ahci_dev_classify(struct ata_port *ap);
 void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
                        u32 opts);
 void ahci_save_initial_config(struct device *dev,
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 3c809bfbccf5..ef773e12af79 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -329,6 +329,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
        { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
        /* SATA Controller IDE (Lynx Point) */
        { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (Lynx Point-LP) */
+        { 0x8086, 0x9c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+        /* SATA Controller IDE (Lynx Point-LP) */
+        { 0x8086, 0x9c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+        /* SATA Controller IDE (Lynx Point-LP) */
+        { 0x8086, 0x9c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (Lynx Point-LP) */
+        { 0x8086, 0x9c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
        /* SATA Controller IDE (DH89xxCC) */
        { 0x8086, 0x2326, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
        { }     /* terminate list */
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index f9eaa82311a9..555c07afa05b 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1139,7 +1139,7 @@ static void ahci_dev_config(struct ata_device *dev)
        }
 }
-static unsigned int ahci_dev_classify(struct ata_port *ap)
+unsigned int ahci_dev_classify(struct ata_port *ap)
 {
        void __iomem *port_mmio = ahci_port_base(ap);
        struct ata_taskfile tf;
@@ -1153,6 +1153,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap)
        return ata_dev_classify(&tf);
 }
+EXPORT_SYMBOL_GPL(ahci_dev_classify);
 void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
                        u32 opts)
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 902b5a457170..fd9ecf74e631 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -60,17 +60,7 @@ acpi_handle ata_ap_acpi_handle(struct ata_port *ap)
        if (ap->flags & ATA_FLAG_ACPI_SATA)
                return NULL;
-        /*
+        return acpi_get_child(DEVICE_ACPI_HANDLE(ap->host->dev), ap->port_no);
-         * If acpi bind operation has already happened, we can get the handle
-         * for the port by checking the corresponding scsi_host device's
-         * firmware node, otherwise we will need to find out the handle from
-         * its parent's acpi node.
-         */
-        if (ap->scsi_host)
-                return DEVICE_ACPI_HANDLE(&ap->scsi_host->shost_gendev);
-        else
-                return acpi_get_child(DEVICE_ACPI_HANDLE(ap->host->dev),
-                                ap->port_no);
 }
 EXPORT_SYMBOL(ata_ap_acpi_handle);
@@ -1101,6 +1091,9 @@ static int ata_acpi_bind_host(struct ata_port *ap, acpi_handle *handle)
        if (!*handle)
                return -ENODEV;
+        if (ata_acpi_gtm(ap, &ap->__acpi_init_gtm) == 0)
+                ap->pflags |= ATA_PFLAG_INIT_GTM_VALID;
        return 0;
 }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index fadd5866d40f..8e1039c8e159 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4062,7 +4062,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "_NEC DV5800A",       NULL,           ATA_HORKAGE_NODMA },
        { "SAMSUNG CD-ROM SN-124", "N001",      ATA_HORKAGE_NODMA },
        { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
-        { "2GB ATA Flash Disk", "ADMA428M",     ATA_HORKAGE_NODMA },
+        { " 2GB ATA Flash Disk", "ADMA428M",    ATA_HORKAGE_NODMA },
        /* Odd clown on sil3726/4726 PMPs */
        { "Config  Disk",       NULL,           ATA_HORKAGE_DISABLE },
@@ -4128,6 +4128,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        /* Devices that do not need bridging limits applied */
        { "MTRON MSP-SATA*",            NULL,   ATA_HORKAGE_BRIDGE_OK, },
+        { "BUFFALO HD-QSU2/R5",         NULL,   ATA_HORKAGE_BRIDGE_OK, },
        /* Devices which aren't very happy with higher link speeds */
        { "WD My Book",                 NULL,   ATA_HORKAGE_1_5_GBPS, },
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index 361c75cea57b..24e51056ac26 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -20,6 +20,7 @@
 #include <linux/delay.h>
 #include <scsi/scsi_host.h>
 #include <linux/libata.h>
+#include <linux/dmi.h>
 #define DRV_NAME "pata_atiixp"
 #define DRV_VERSION "0.4.6"
@@ -33,11 +34,26 @@ enum {
        ATIIXP_IDE_UDMA_MODE    = 0x56
 };
+static const struct dmi_system_id attixp_cable_override_dmi_table[] = {
+        {
+                /* Board has onboard PATA<->SATA converters */
+                .ident = "MSI E350DM-E33",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "MSI"),
+                        DMI_MATCH(DMI_BOARD_NAME, "E350DM-E33(MS-7720)"),
+                },
+        },
+        { }
+};
 static int atiixp_cable_detect(struct ata_port *ap)
 {
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
        u8 udma;
+        if (dmi_check_system(attixp_cable_override_dmi_table))
+                return ATA_CBL_PATA40_SHORT;
        /* Hack from drivers/ide/pci. Really we want to know how to do the
           raw detection not play follow the bios mode guess */
        pci_read_config_byte(pdev, ATIIXP_IDE_UDMA_MODE + ap->port_no, &udma);
diff --git a/drivers/base/core.c b/drivers/base/core.c
index f338037a4f3d..5e6e00bc1652 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1865,6 +1865,7 @@ int __dev_printk(const char *level, const struct device *dev,
                 struct va_format *vaf)
 {
        char dict[128];
+        const char *level_extra = "";
        size_t dictlen = 0;
        const char *subsys;
@@ -1911,10 +1912,14 @@ int __dev_printk(const char *level, const struct device *dev,
                                    "DEVICE=+%s:%s", subsys, dev_name(dev));
        }
 skip:
+        if (level[2])
+                level_extra = &level[2]; /* skip past KERN_SOH "L" */
        return printk_emit(0, level[1] - '0',
                           dictlen ? dict : NULL, dictlen,
-                           "%s %s: %pV",
+                           "%s %s: %s%pV",
-                           dev_driver_string(dev), dev_name(dev), vaf);
+                           dev_driver_string(dev), dev_name(dev),
+                           level_extra, vaf);
 }
 EXPORT_SYMBOL(__dev_printk);
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 78efb0306a44..34d94c762a1e 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -250,7 +250,7 @@ int __init dma_declare_contiguous(struct device *dev, unsigned long size,
                return -EINVAL;
        /* Sanitise input arguments */
-        alignment = PAGE_SIZE << max(MAX_ORDER, pageblock_order);
+        alignment = PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order);
        base = ALIGN(base, alignment);
        size = ALIGN(size, alignment);
        limit &= ~(alignment - 1);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 59894873a3b3..7d9c1cb1c39a 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -147,6 +147,8 @@ static int rpm_check_suspend_allowed(struct device *dev)
            || (dev->power.request_pending
                        && dev->power.request == RPM_REQ_RESUME))
                retval = -EAGAIN;
+        else if (__dev_pm_qos_read_value(dev) < 0)
+                retval = -EPERM;
        else if (dev->power.runtime_status == RPM_SUSPENDED)
                retval = 1;
@@ -388,7 +390,6 @@ static int rpm_suspend(struct device *dev, int rpmflags)
                goto repeat;
        }
-        dev->power.deferred_resume = false;
        if (dev->power.no_callbacks)
                goto no_callback;       /* Assume success. */
@@ -403,12 +404,6 @@ static int rpm_suspend(struct device *dev, int rpmflags)
                goto out;
        }
-        if (__dev_pm_qos_read_value(dev) < 0) {
-                /* Negative PM QoS constraint means "never suspend". */
-                retval = -EPERM;
-                goto out;
-        }
        __update_runtime_status(dev, RPM_SUSPENDING);
        if (dev->pm_domain)
@@ -440,6 +435,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
        wake_up_all(&dev->power.wait_queue);
        if (dev->power.deferred_resume) {
+                dev->power.deferred_resume = false;
                rpm_resume(dev, 0);
                retval = -EAGAIN;
                goto out;
@@ -584,6 +580,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
                    || dev->parent->power.runtime_status == RPM_ACTIVE) {
                        atomic_inc(&dev->parent->power.child_count);
                        spin_unlock(&dev->parent->power.lock);
+                        retval = 1;
                        goto no_callback;       /* Assume success. */
                }
                spin_unlock(&dev->parent->power.lock);
@@ -664,7 +661,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
        }
        wake_up_all(&dev->power.wait_queue);
-        if (!retval)
+        if (retval >= 0)
                rpm_idle(dev, RPM_ASYNC);
 out:
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index acda773b3720..38aa6dda6b81 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -763,16 +763,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout,
                {
                        case CMD_TARGET_STATUS:
                                /* Pass it up to the upper layers... */
-                                if( ei->ScsiStatus)
+                                if (!ei->ScsiStatus) {
-                                {
-#if 0
-                                        printk(KERN_WARNING "cciss: cmd %p "
-                                                "has SCSI Status = %x\n",
-                                                c, ei->ScsiStatus);
-#endif
-                                        cmd->result |= (ei->ScsiStatus << 1);
-                                }
-                                else {  /* scsi status is zero??? How??? */
                                        
        /* Ordinarily, this case should never happen, but there is a bug
           in some released firmware revisions that allows it to happen
diff --git a/drivers/block/drbd/drbd_bitmap.c b/drivers/block/drbd/drbd_bitmap.c
index ba91b408abad..d84566496746 100644
--- a/drivers/block/drbd/drbd_bitmap.c
+++ b/drivers/block/drbd/drbd_bitmap.c
@@ -889,6 +889,7 @@ struct bm_aio_ctx {
        unsigned int done;
        unsigned flags;
 #define BM_AIO_COPY_PAGES       1
+#define BM_WRITE_ALL_PAGES      2
        int error;
        struct kref kref;
 };
@@ -1059,7 +1060,8 @@ static int bm_rw(struct drbd_conf *mdev, int rw, unsigned flags, unsigned lazy_w
                if (lazy_writeout_upper_idx && i == lazy_writeout_upper_idx)
                        break;
                if (rw & WRITE) {
-                        if (bm_test_page_unchanged(b->bm_pages[i])) {
+                        if (!(flags & BM_WRITE_ALL_PAGES) &&
+                            bm_test_page_unchanged(b->bm_pages[i])) {
                                dynamic_dev_dbg(DEV, "skipped bm write for idx %u\n", i);
                                continue;
                        }
@@ -1141,6 +1143,17 @@ int drbd_bm_write(struct drbd_conf *mdev) __must_hold(local)
 }
 /**
+ * drbd_bm_write_all() - Write the whole bitmap to its on disk location.
+ * @mdev:       DRBD device.
+ *
+ * Will write all pages.
+ */
+int drbd_bm_write_all(struct drbd_conf *mdev) __must_hold(local)
+{
+        return bm_rw(mdev, WRITE, BM_WRITE_ALL_PAGES, 0);
+}
+/**
 * drbd_bm_lazy_write_out() - Write bitmap pages 0 to @upper_idx-1, if they have changed.
 * @mdev:       DRBD device.
 * @upper_idx:  0: write all changed pages; +ve: page index to stop scanning for changed pages
diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
index b2ca143d0053..b953cc7c9c00 100644
--- a/drivers/block/drbd/drbd_int.h
+++ b/drivers/block/drbd/drbd_int.h
@@ -1469,6 +1469,7 @@ extern int  drbd_bm_e_weight(struct drbd_conf *mdev, unsigned long enr);
 extern int  drbd_bm_write_page(struct drbd_conf *mdev, unsigned int idx) __must_hold(local);
 extern int  drbd_bm_read(struct drbd_conf *mdev) __must_hold(local);
 extern int  drbd_bm_write(struct drbd_conf *mdev) __must_hold(local);
+extern int drbd_bm_write_all(struct drbd_conf *mdev) __must_hold(local);
 extern int  drbd_bm_write_copy_pages(struct drbd_conf *mdev) __must_hold(local);
 extern unsigned long drbd_bm_ALe_set_all(struct drbd_conf *mdev,
                unsigned long al_enr);
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index dbe6135a2abe..f93a0320e952 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -79,6 +79,7 @@ static int w_md_sync(struct drbd_conf *mdev, struct drbd_work *w, int unused);
 static void md_sync_timer_fn(unsigned long data);
 static int w_bitmap_io(struct drbd_conf *mdev, struct drbd_work *w, int unused);
 static int w_go_diskless(struct drbd_conf *mdev, struct drbd_work *w, int unused);
+static void _tl_clear(struct drbd_conf *mdev);
 MODULE_AUTHOR("Philipp Reisner <phil@linbit.com>, "
              "Lars Ellenberg <lars@linbit.com>");
@@ -432,19 +433,10 @@ static void _tl_restart(struct drbd_conf *mdev, enum drbd_req_event what)
        /* Actions operating on the disk state, also want to work on
           requests that got barrier acked. */
-        switch (what) {
-        case fail_frozen_disk_io:
-        case restart_frozen_disk_io:
-                list_for_each_safe(le, tle, &mdev->barrier_acked_requests) {
-                        req = list_entry(le, struct drbd_request, tl_requests);
-                        _req_mod(req, what);
-                }
-        case connection_lost_while_pending:
+        list_for_each_safe(le, tle, &mdev->barrier_acked_requests) {
-        case resend:
+                req = list_entry(le, struct drbd_request, tl_requests);
-                break;
+                _req_mod(req, what);
-        default:
-                dev_err(DEV, "what = %d in _tl_restart()\n", what);
        }
 }
@@ -459,11 +451,16 @@ static void _tl_restart(struct drbd_conf *mdev, enum drbd_req_event what)
 */
 void tl_clear(struct drbd_conf *mdev)
 {
+        spin_lock_irq(&mdev->req_lock);
+        _tl_clear(mdev);
+        spin_unlock_irq(&mdev->req_lock);
+}
+static void _tl_clear(struct drbd_conf *mdev)
+{
        struct list_head *le, *tle;
        struct drbd_request *r;
-        spin_lock_irq(&mdev->req_lock);
        _tl_restart(mdev, connection_lost_while_pending);
        /* we expect this list to be empty. */
@@ -482,7 +479,6 @@ void tl_clear(struct drbd_conf *mdev)
        memset(mdev->app_reads_hash, 0, APP_R_HSIZE*sizeof(void *));
-        spin_unlock_irq(&mdev->req_lock);
 }
 void tl_restart(struct drbd_conf *mdev, enum drbd_req_event what)
@@ -1476,12 +1472,12 @@ static void after_state_ch(struct drbd_conf *mdev, union drbd_state os,
        if (ns.susp_fen) {
                /* case1: The outdate peer handler is successful: */
                if (os.pdsk > D_OUTDATED  && ns.pdsk <= D_OUTDATED) {
-                        tl_clear(mdev);
                        if (test_bit(NEW_CUR_UUID, &mdev->flags)) {
                                drbd_uuid_new_current(mdev);
                                clear_bit(NEW_CUR_UUID, &mdev->flags);
                        }
                        spin_lock_irq(&mdev->req_lock);
+                        _tl_clear(mdev);
                        _drbd_set_state(_NS(mdev, susp_fen, 0), CS_VERBOSE, NULL);
                        spin_unlock_irq(&mdev->req_lock);
                }
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index fb9dce8daa24..edb490aad8b4 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -674,8 +674,8 @@ enum determine_dev_size drbd_determine_dev_size(struct drbd_conf *mdev, enum dds
                         la_size_changed && md_moved ? "size changed and md moved" :
                         la_size_changed ? "size changed" : "md moved");
                /* next line implicitly does drbd_suspend_io()+drbd_resume_io() */
-                err = drbd_bitmap_io(mdev, &drbd_bm_write,
+                err = drbd_bitmap_io(mdev, md_moved ? &drbd_bm_write_all : &drbd_bm_write,
-                                "size changed", BM_LOCKED_MASK);
+                                     "size changed", BM_LOCKED_MASK);
                if (err) {
                        rv = dev_size_error;
                        goto out;
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index 910335c30927..01b2ac641c7b 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -695,6 +695,12 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                break;
        case resend:
+                /* Simply complete (local only) READs. */
+                if (!(req->rq_state & RQ_WRITE) && !req->w.cb) {
+                        _req_may_be_done(req, m);
+                        break;
+                }
                /* If RQ_NET_OK is already set, we got a P_WRITE_ACK or P_RECV_ACK
                   before the connection loss (B&C only); only P_BARRIER_ACK was missing.
                   Trowing them out of the TL here by pretending we got a BARRIER_ACK
@@ -834,7 +840,15 @@ static int drbd_make_request_common(struct drbd_conf *mdev, struct bio *bio, uns
                req->private_bio = NULL;
        }
        if (rw == WRITE) {
-                remote = 1;
+                /* Need to replicate writes.  Unless it is an empty flush,
+                 * which is better mapped to a DRBD P_BARRIER packet,
+                 * also for drbd wire protocol compatibility reasons. */
+                if (unlikely(size == 0)) {
+                        /* The only size==0 bios we expect are empty flushes. */
+                        D_ASSERT(bio->bi_rw & REQ_FLUSH);
+                        remote = 0;
+                } else
+                        remote = 1;
        } else {
                /* READ || READA */
                if (local) {
@@ -870,8 +884,11 @@ static int drbd_make_request_common(struct drbd_conf *mdev, struct bio *bio, uns
         * extent.  This waits for any resync activity in the corresponding
         * resync extent to finish, and, if necessary, pulls in the target
         * extent into the activity log, which involves further disk io because
-         * of transactional on-disk meta data updates. */
+         * of transactional on-disk meta data updates.
-        if (rw == WRITE && local && !test_bit(AL_SUSPENDED, &mdev->flags)) {
+         * Empty flushes don't need to go into the activity log, they can only
+         * flush data for pending writes which are already in there. */
+        if (rw == WRITE && local && size
+        && !test_bit(AL_SUSPENDED, &mdev->flags)) {
                req->rq_state |= RQ_IN_ACT_LOG;
                drbd_al_begin_io(mdev, sector);
        }
@@ -994,7 +1011,10 @@ allocate_barrier:
        if (rw == WRITE && _req_conflicts(req))
                goto fail_conflicting;
-        list_add_tail(&req->tl_requests, &mdev->newest_tle->requests);
+        /* no point in adding empty flushes to the transfer log,
+         * they are mapped to drbd barriers already. */
+        if (likely(size!=0))
+                list_add_tail(&req->tl_requests, &mdev->newest_tle->requests);
        /* NOTE remote first: to get the concurrent write detection right,
         * we must register the request before start of local IO.  */
@@ -1014,6 +1034,14 @@ allocate_barrier:
            mdev->net_conf->on_congestion != OC_BLOCK && mdev->agreed_pro_version >= 96)
                maybe_pull_ahead(mdev);
+        /* If this was a flush, queue a drbd barrier/start a new epoch.
+         * Unless the current epoch was empty anyways, or we are not currently
+         * replicating, in which case there is no point. */
+        if (unlikely(bio->bi_rw & REQ_FLUSH)
+                && mdev->newest_tle->n_writes
+                && drbd_should_do_remote(mdev->state))
+                queue_barrier(mdev);
        spin_unlock_irq(&mdev->req_lock);
        kfree(b); /* if someone else has beaten us to it... */
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 10308cd8a7ed..fc2de5528dcc 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -79,12 +79,14 @@ static struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x13d3, 0x3362) },
        { USB_DEVICE(0x0CF3, 0xE004) },
        { USB_DEVICE(0x0930, 0x0219) },
+        { USB_DEVICE(0x0489, 0xe057) },
        /* Atheros AR5BBU12 with sflash firmware */
        { USB_DEVICE(0x0489, 0xE02C) },
        /* Atheros AR5BBU22 with sflash firmware */
        { USB_DEVICE(0x0489, 0xE03C) },
+        { USB_DEVICE(0x0489, 0xE036) },
        { }     /* Terminating entry */
 };
@@ -104,9 +106,11 @@ static struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        /* Atheros AR5BBU22 with sflash firmware */
        { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
        { }     /* Terminating entry */
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index e27221411036..654e248763ef 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -52,6 +52,9 @@ static struct usb_device_id btusb_table[] = {
        /* Generic Bluetooth USB device */
        { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
+        /* Apple-specific (Broadcom) devices */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
        /* Broadcom SoftSailing reporting vendor specific */
        { USB_DEVICE(0x0a5c, 0x21e1) },
@@ -94,15 +97,14 @@ static struct usb_device_id btusb_table[] = {
        /* Broadcom BCM20702A0 */
        { USB_DEVICE(0x0489, 0xe042) },
-        { USB_DEVICE(0x0a5c, 0x21e3) },
-        { USB_DEVICE(0x0a5c, 0x21e6) },
-        { USB_DEVICE(0x0a5c, 0x21e8) },
-        { USB_DEVICE(0x0a5c, 0x21f3) },
        { USB_DEVICE(0x413c, 0x8197) },
        /* Foxconn - Hon Hai */
        { USB_DEVICE(0x0489, 0xe033) },
+        /*Broadcom devices with vendor specific id */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
        { }     /* Terminating entry */
 };
@@ -133,12 +135,14 @@ static struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        /* Atheros AR5BBU12 with sflash firmware */
        { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
        /* Atheros AR5BBU12 with sflash firmware */
        { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
        /* Broadcom BCM2035 */
        { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index 6f007b6c240d..6ec0fff79bc2 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -64,6 +64,7 @@
 #define I830_PTE_SYSTEM_CACHED  0x00000006
 /* GT PTE cache control fields */
 #define GEN6_PTE_UNCACHED       0x00000002
+#define HSW_PTE_UNCACHED        0x00000000
 #define GEN6_PTE_LLC            0x00000004
 #define GEN6_PTE_LLC_MLC        0x00000006
 #define GEN6_PTE_GFDT           0x00000008
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 08fc5cbb13cd..58e32f7c3229 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -1156,6 +1156,30 @@ static bool gen6_check_flags(unsigned int flags)
        return true;
 }
+static void haswell_write_entry(dma_addr_t addr, unsigned int entry,
+                                unsigned int flags)
+{
+        unsigned int type_mask = flags & ~AGP_USER_CACHED_MEMORY_GFDT;
+        unsigned int gfdt = flags & AGP_USER_CACHED_MEMORY_GFDT;
+        u32 pte_flags;
+        if (type_mask == AGP_USER_MEMORY)
+                pte_flags = HSW_PTE_UNCACHED | I810_PTE_VALID;
+        else if (type_mask == AGP_USER_CACHED_MEMORY_LLC_MLC) {
+                pte_flags = GEN6_PTE_LLC_MLC | I810_PTE_VALID;
+                if (gfdt)
+                        pte_flags |= GEN6_PTE_GFDT;
+        } else { /* set 'normal'/'cached' to LLC by default */
+                pte_flags = GEN6_PTE_LLC | I810_PTE_VALID;
+                if (gfdt)
+                        pte_flags |= GEN6_PTE_GFDT;
+        }
+        /* gen6 has bit11-4 for physical addr bit39-32 */
+        addr |= (addr >> 28) & 0xff0;
+        writel(addr | pte_flags, intel_private.gtt + entry);
+}
 static void gen6_write_entry(dma_addr_t addr, unsigned int entry,
                             unsigned int flags)
 {
@@ -1382,6 +1406,15 @@ static const struct intel_gtt_driver sandybridge_gtt_driver = {
        .check_flags = gen6_check_flags,
        .chipset_flush = i9xx_chipset_flush,
 };
+static const struct intel_gtt_driver haswell_gtt_driver = {
+        .gen = 6,
+        .setup = i9xx_setup,
+        .cleanup = gen6_cleanup,
+        .write_entry = haswell_write_entry,
+        .dma_mask_size = 40,
+        .check_flags = gen6_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
+};
 static const struct intel_gtt_driver valleyview_gtt_driver = {
        .gen = 7,
        .setup = i9xx_setup,
@@ -1499,77 +1532,77 @@ static const struct intel_gtt_driver_description {
        { PCI_DEVICE_ID_INTEL_VALLEYVIEW_IG,
            "ValleyView", &valleyview_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_D_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_D_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_D_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_M_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_M_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_M_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_S_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_S_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_S_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_D_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_D_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_D_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_M_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_M_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_M_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_S_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_S_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_SDV_S_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_D_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_D_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_D_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_M_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_M_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_M_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_S_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_S_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_ULT_S_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_D_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_D_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_D_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_M_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_M_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_M_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_S_GT1_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_S_GT2_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { PCI_DEVICE_ID_INTEL_HASWELL_CRW_S_GT2_PLUS_IG,
-            "Haswell", &sandybridge_gtt_driver },
+            "Haswell", &haswell_gtt_driver },
        { 0, NULL, NULL }
 };
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index 540795cd0760..d9279385304d 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -53,7 +53,7 @@ static struct cs5535_mfgpt_timer *cs5535_event_clock;
 #define MFGPT_PERIODIC (MFGPT_HZ / HZ)
 /*
- * The MFPGT timers on the CS5536 provide us with suitable timers to use
+ * The MFGPT timers on the CS5536 provide us with suitable timers to use
 * as clock event sources - not as good as a HPET or APIC, but certainly
 * better than the PIT.  This isn't a general purpose MFGPT driver, but
 * a simplified one designed specifically to act as a clock event source.
@@ -144,7 +144,7 @@ static int __init cs5535_mfgpt_init(void)
        timer = cs5535_mfgpt_alloc_timer(MFGPT_TIMER_ANY, MFGPT_DOMAIN_WORKING);
        if (!timer) {
-                printk(KERN_ERR DRV_NAME ": Could not allocate MFPGT timer\n");
+                printk(KERN_ERR DRV_NAME ": Could not allocate MFGPT timer\n");
                return -ENODEV;
        }
        cs5535_event_clock = timer;
diff --git a/drivers/cpufreq/omap-cpufreq.c b/drivers/cpufreq/omap-cpufreq.c
index 17fa04d08be9..b47034e650a5 100644
--- a/drivers/cpufreq/omap-cpufreq.c
+++ b/drivers/cpufreq/omap-cpufreq.c
@@ -218,7 +218,7 @@ static int __cpuinit omap_cpu_init(struct cpufreq_policy *policy)
        policy->cur = policy->min = policy->max = omap_getspeed(policy->cpu);
-        if (atomic_inc_return(&freq_table_users) == 1)
+        if (!freq_table)
                result = opp_init_cpufreq_table(mpu_dev, &freq_table);
        if (result) {
@@ -227,6 +227,8 @@ static int __cpuinit omap_cpu_init(struct cpufreq_policy *policy)
                goto fail_ck;
        }
+        atomic_inc_return(&freq_table_users);
        result = cpufreq_frequency_table_cpuinfo(policy, freq_table);
        if (result)
                goto fail_table;
diff --git a/drivers/cpuidle/coupled.c b/drivers/cpuidle/coupled.c
index 2c9bf2692232..3265844839bf 100644
--- a/drivers/cpuidle/coupled.c
+++ b/drivers/cpuidle/coupled.c
@@ -678,10 +678,22 @@ static int cpuidle_coupled_cpu_notify(struct notifier_block *nb,
        int cpu = (unsigned long)hcpu;
        struct cpuidle_device *dev;
+        switch (action & ~CPU_TASKS_FROZEN) {
+        case CPU_UP_PREPARE:
+        case CPU_DOWN_PREPARE:
+        case CPU_ONLINE:
+        case CPU_DEAD:
+        case CPU_UP_CANCELED:
+        case CPU_DOWN_FAILED:
+                break;
+        default:
+                return NOTIFY_OK;
+        }
        mutex_lock(&cpuidle_lock);
        dev = per_cpu(cpuidle_devices, cpu);
-        if (!dev->coupled)
+        if (!dev || !dev->coupled)
                goto out;
        switch (action & ~CPU_TASKS_FROZEN) {
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index 53c8c51d5881..93d14070141a 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -63,7 +63,7 @@ static void caam_jr_dequeue(unsigned long devarg)
                head = ACCESS_ONCE(jrp->head);
-                spin_lock_bh(&jrp->outlock);
+                spin_lock(&jrp->outlock);
                sw_idx = tail = jrp->tail;
                hw_idx = jrp->out_ring_read_index;
@@ -115,7 +115,7 @@ static void caam_jr_dequeue(unsigned long devarg)
                        jrp->tail = tail;
                }
-                spin_unlock_bh(&jrp->outlock);
+                spin_unlock(&jrp->outlock);
                /* Finally, execute user's callback */
                usercall(dev, userdesc, userstatus, userarg);
@@ -236,14 +236,14 @@ int caam_jr_enqueue(struct device *dev, u32 *desc,
                return -EIO;
        }
-        spin_lock(&jrp->inplock);
+        spin_lock_bh(&jrp->inplock);
        head = jrp->head;
        tail = ACCESS_ONCE(jrp->tail);
        if (!rd_reg32(&jrp->rregs->inpring_avail) ||
            CIRC_SPACE(head, tail, JOBR_DEPTH) <= 0) {
-                spin_unlock(&jrp->inplock);
+                spin_unlock_bh(&jrp->inplock);
                dma_unmap_single(dev, desc_dma, desc_size, DMA_TO_DEVICE);
                return -EBUSY;
        }
@@ -265,7 +265,7 @@ int caam_jr_enqueue(struct device *dev, u32 *desc,
        wr_reg32(&jrp->rregs->inpring_jobadd, 1);
-        spin_unlock(&jrp->inplock);
+        spin_unlock_bh(&jrp->inplock);
        return 0;
 }
diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c
index 002888185f17..d216cd3cc569 100644
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -120,3 +120,4 @@ u32 gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
        return ret;
 }
+EXPORT_SYMBOL(gen_split_key);
diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
index c9c4befb5a8d..df14358d7fa1 100644
--- a/drivers/crypto/hifn_795x.c
+++ b/drivers/crypto/hifn_795x.c
@@ -821,8 +821,8 @@ static int hifn_register_rng(struct hifn_device *dev)
        /*
         * We must wait at least 256 Pk_clk cycles between two reads of the rng.
         */
-        dev->rng_wait_time      = DIV_ROUND_UP(NSEC_PER_SEC, dev->pk_clk_freq) *
+        dev->rng_wait_time      = DIV_ROUND_UP_ULL(NSEC_PER_SEC,
-                                  256;
+                                                   dev->pk_clk_freq) * 256;
        dev->rng.name           = dev->name;
        dev->rng.data_present   = hifn_rng_data_present,
diff --git a/drivers/extcon/extcon_gpio.c b/drivers/extcon/extcon_gpio.c
index fe3db45fa83c..3cc152e690b0 100644
--- a/drivers/extcon/extcon_gpio.c
+++ b/drivers/extcon/extcon_gpio.c
@@ -107,7 +107,8 @@ static int __devinit gpio_extcon_probe(struct platform_device *pdev)
        if (ret < 0)
                return ret;
-        ret = gpio_request_one(extcon_data->gpio, GPIOF_DIR_IN, pdev->name);
+        ret = devm_gpio_request_one(&pdev->dev, extcon_data->gpio, GPIOF_DIR_IN,
+                                    pdev->name);
        if (ret < 0)
                goto err;
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index b16c8a72a2e2..ba7926f5c099 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -294,7 +294,7 @@ config GPIO_MAX732X_IRQ
 config GPIO_MC9S08DZ60
        bool "MX35 3DS BOARD MC9S08DZ60 GPIO functions"
-        depends on I2C && MACH_MX35_3DS
+        depends on I2C=y && MACH_MX35_3DS
        help
          Select this to enable the MC9S08DZ60 GPIO driver
diff --git a/drivers/gpio/gpio-em.c b/drivers/gpio/gpio-em.c
index ae37181798b3..ec48ed512628 100644
--- a/drivers/gpio/gpio-em.c
+++ b/drivers/gpio/gpio-em.c
@@ -247,9 +247,9 @@ static int __devinit em_gio_irq_domain_init(struct em_gio_priv *p)
        p->irq_base = irq_alloc_descs(pdata->irq_base, 0,
                                      pdata->number_of_pins, numa_node_id());
-        if (IS_ERR_VALUE(p->irq_base)) {
+        if (p->irq_base < 0) {
                dev_err(&pdev->dev, "cannot get irq_desc\n");
-                return -ENXIO;
+                return p->irq_base;
        }
        pr_debug("gio: hw base = %d, nr = %d, sw base = %d\n",
                 pdata->gpio_base, pdata->number_of_pins, p->irq_base);
diff --git a/drivers/gpio/gpio-rdc321x.c b/drivers/gpio/gpio-rdc321x.c
index e97016af6443..b62d443e9a59 100644
--- a/drivers/gpio/gpio-rdc321x.c
+++ b/drivers/gpio/gpio-rdc321x.c
@@ -170,6 +170,7 @@ static int __devinit rdc321x_gpio_probe(struct platform_device *pdev)
        rdc321x_gpio_dev->reg2_data_base = r->start + 0x4;
        rdc321x_gpio_dev->chip.label = "rdc321x-gpio";
+        rdc321x_gpio_dev->chip.owner = THIS_MODULE;
        rdc321x_gpio_dev->chip.direction_input = rdc_gpio_direction_input;
        rdc321x_gpio_dev->chip.direction_output = rdc_gpio_config;
        rdc321x_gpio_dev->chip.get = rdc_gpio_get_value;
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index a18c4aa68b1e..f1a45997aea8 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -82,7 +82,7 @@ int of_get_named_gpio_flags(struct device_node *np, const char *propname,
        gpiochip_find(&gg_data, of_gpiochip_find_and_xlate);
        of_node_put(gg_data.gpiospec.np);
-        pr_debug("%s exited with status %d\n", __func__, ret);
+        pr_debug("%s exited with status %d\n", __func__, gg_data.out_gpio);
        return gg_data.out_gpio;
 }
 EXPORT_SYMBOL(of_get_named_gpio_flags);
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 23120c00a881..90e28081712d 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -22,6 +22,7 @@ menuconfig DRM
 config DRM_USB
        tristate
        depends on DRM
+        depends on USB_ARCH_HAS_HCD
        select USB
 config DRM_KMS_HELPER
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index d0c4574ef49c..36164806b9d4 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -193,6 +193,9 @@ static const struct file_operations ast_fops = {
        .mmap = ast_mmap,
        .poll = drm_poll,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .read = drm_read,
 };
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 7282c081fb53..a712cafcfa1d 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -841,7 +841,7 @@ int ast_cursor_init(struct drm_device *dev)
        ast->cursor_cache = obj;
        ast->cursor_cache_gpu_addr = gpu_addr;
-        DRM_ERROR("pinned cursor cache at %llx\n", ast->cursor_cache_gpu_addr);
+        DRM_DEBUG_KMS("pinned cursor cache at %llx\n", ast->cursor_cache_gpu_addr);
        return 0;
 fail:
        return ret;
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
index 7053140c6596..b83a2d7ddd1a 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
@@ -74,6 +74,9 @@ static const struct file_operations cirrus_driver_fops = {
        .unlocked_ioctl = drm_ioctl,
        .mmap = cirrus_mmap,
        .poll = drm_poll,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .fasync = drm_fasync,
 };
 static struct drm_driver driver = {
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 08a7aa722d6b..6fbfc244748f 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1981,7 +1981,7 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
        if (!drm_core_check_feature(dev, DRIVER_MODESET))
                return -EINVAL;
-        if (!req->flags)
+        if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
                return -EINVAL;
        mutex_lock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index a8743c399e83..b7ee230572b7 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -87,6 +87,9 @@ static struct edid_quirk {
        int product_id;
        u32 quirks;
 } edid_quirk_list[] = {
+        /* ASUS VW222S */
+        { "ACI", 0x22a2, EDID_QUIRK_FORCE_REDUCED_BLANKING },
        /* Acer AL1706 */
        { "ACR", 44358, EDID_QUIRK_PREFER_LARGE_60 },
        /* Acer F51 */
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index b7adb4a967fd..28637c181b15 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -706,9 +706,6 @@ void drm_mode_set_crtcinfo(struct drm_display_mode *p, int adjust_flags)
        p->crtc_vblank_end = max(p->crtc_vsync_end, p->crtc_vtotal);
        p->crtc_hblank_start = min(p->crtc_hsync_start, p->crtc_hdisplay);
        p->crtc_hblank_end = max(p->crtc_hsync_end, p->crtc_htotal);
-        p->crtc_hadjusted = false;
-        p->crtc_vadjusted = false;
 }
 EXPORT_SYMBOL(drm_mode_set_crtcinfo);
diff --git a/drivers/gpu/drm/drm_proc.c b/drivers/gpu/drm/drm_proc.c
index 371c695322d9..da457b18eaaf 100644
--- a/drivers/gpu/drm/drm_proc.c
+++ b/drivers/gpu/drm/drm_proc.c
@@ -89,7 +89,7 @@ static const struct file_operations drm_proc_fops = {
 * Create a given set of proc files represented by an array of
 * gdm_proc_lists in the given root directory.
 */
-int drm_proc_create_files(struct drm_info_list *files, int count,
+static int drm_proc_create_files(struct drm_info_list *files, int count,
                          struct proc_dir_entry *root, struct drm_minor *minor)
 {
        struct drm_device *dev = minor->dev;
@@ -172,7 +172,7 @@ int drm_proc_init(struct drm_minor *minor, int minor_id,
        return 0;
 }
-int drm_proc_remove_files(struct drm_info_list *files, int count,
+static int drm_proc_remove_files(struct drm_info_list *files, int count,
                          struct drm_minor *minor)
 {
        struct list_head *pos, *q;
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 7f5096763b7d..59a26e577b57 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -36,6 +36,6 @@ config DRM_EXYNOS_VIDI
 config DRM_EXYNOS_G2D
        bool "Exynos DRM G2D"
-        depends on DRM_EXYNOS
+        depends on DRM_EXYNOS && !VIDEO_SAMSUNG_S5P_G2D
        help
          Choose this option if you want to use Exynos G2D for DRM.
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index 613bf8a5d9b2..ae13febe0eaa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -163,6 +163,12 @@ static void exynos_gem_dmabuf_kunmap(struct dma_buf *dma_buf,
        /* TODO */
 }
+static int exynos_gem_dmabuf_mmap(struct dma_buf *dma_buf,
+        struct vm_area_struct *vma)
+{
+        return -ENOTTY;
+}
 static struct dma_buf_ops exynos_dmabuf_ops = {
        .map_dma_buf            = exynos_gem_map_dma_buf,
        .unmap_dma_buf          = exynos_gem_unmap_dma_buf,
@@ -170,6 +176,7 @@ static struct dma_buf_ops exynos_dmabuf_ops = {
        .kmap_atomic            = exynos_gem_dmabuf_kmap_atomic,
        .kunmap                 = exynos_gem_dmabuf_kunmap,
        .kunmap_atomic          = exynos_gem_dmabuf_kunmap_atomic,
+        .mmap                   = exynos_gem_dmabuf_mmap,
        .release                = exynos_dmabuf_release,
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index ebacec6f1e48..d07071937453 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -160,7 +160,6 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
        if (!file_priv)
                return -ENOMEM;
-        drm_prime_init_file_private(&file->prime);
        file->driver_priv = file_priv;
        return exynos_drm_subdrv_open(dev, file);
@@ -184,7 +183,6 @@ static void exynos_drm_preclose(struct drm_device *dev,
                        e->base.destroy(&e->base);
                }
        }
-        drm_prime_destroy_file_private(&file->prime);
        spin_unlock_irqrestore(&dev->event_lock, flags);
        exynos_drm_subdrv_close(dev, file);
@@ -241,6 +239,9 @@ static const struct file_operations exynos_drm_driver_fops = {
        .poll           = drm_poll,
        .read           = drm_read,
        .unlocked_ioctl = drm_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .release        = drm_release,
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index a68d2b313f03..b19cd93e7047 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -831,11 +831,6 @@ static int __devinit fimd_probe(struct platform_device *pdev)
        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(dev, "failed to find registers\n");
-                ret = -ENOENT;
-                goto err_clk;
-        }
        ctx->regs = devm_request_and_ioremap(&pdev->dev, res);
        if (!ctx->regs) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index d2d88f22a037..1065e90d0919 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -129,7 +129,6 @@ struct g2d_runqueue_node {
 struct g2d_data {
        struct device                   *dev;
        struct clk                      *gate_clk;
-        struct resource                 *regs_res;
        void __iomem                    *regs;
        int                             irq;
        struct workqueue_struct         *g2d_workq;
@@ -751,7 +750,7 @@ static int __devinit g2d_probe(struct platform_device *pdev)
        struct exynos_drm_subdrv *subdrv;
        int ret;
-        g2d = kzalloc(sizeof(*g2d), GFP_KERNEL);
+        g2d = devm_kzalloc(&pdev->dev, sizeof(*g2d), GFP_KERNEL);
        if (!g2d) {
                dev_err(dev, "failed to allocate driver data\n");
                return -ENOMEM;
@@ -759,10 +758,8 @@ static int __devinit g2d_probe(struct platform_device *pdev)
        g2d->runqueue_slab = kmem_cache_create("g2d_runqueue_slab",
                        sizeof(struct g2d_runqueue_node), 0, 0, NULL);
-        if (!g2d->runqueue_slab) {
+        if (!g2d->runqueue_slab)
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto err_free_mem;
-        }
        g2d->dev = dev;
@@ -794,38 +791,26 @@ static int __devinit g2d_probe(struct platform_device *pdev)
        pm_runtime_enable(dev);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(dev, "failed to get I/O memory\n");
-                ret = -ENOENT;
-                goto err_put_clk;
-        }
-        g2d->regs_res = request_mem_region(res->start, resource_size(res),
+        g2d->regs = devm_request_and_ioremap(&pdev->dev, res);
-                                           dev_name(dev));
-        if (!g2d->regs_res) {
-                dev_err(dev, "failed to request I/O memory\n");
-                ret = -ENOENT;
-                goto err_put_clk;
-        }
-        g2d->regs = ioremap(res->start, resource_size(res));
        if (!g2d->regs) {
                dev_err(dev, "failed to remap I/O memory\n");
                ret = -ENXIO;
-                goto err_release_res;
+                goto err_put_clk;
        }
        g2d->irq = platform_get_irq(pdev, 0);
        if (g2d->irq < 0) {
                dev_err(dev, "failed to get irq\n");
                ret = g2d->irq;
-                goto err_unmap_base;
+                goto err_put_clk;
        }
-        ret = request_irq(g2d->irq, g2d_irq_handler, 0, "drm_g2d", g2d);
+        ret = devm_request_irq(&pdev->dev, g2d->irq, g2d_irq_handler, 0,
+                                                                "drm_g2d", g2d);
        if (ret < 0) {
                dev_err(dev, "irq request failed\n");
-                goto err_unmap_base;
+                goto err_put_clk;
        }
        platform_set_drvdata(pdev, g2d);
@@ -838,7 +823,7 @@ static int __devinit g2d_probe(struct platform_device *pdev)
        ret = exynos_drm_subdrv_register(subdrv);
        if (ret < 0) {
                dev_err(dev, "failed to register drm g2d device\n");
-                goto err_free_irq;
+                goto err_put_clk;
        }
        dev_info(dev, "The exynos g2d(ver %d.%d) successfully probed\n",
@@ -846,13 +831,6 @@ static int __devinit g2d_probe(struct platform_device *pdev)
        return 0;
-err_free_irq:
-        free_irq(g2d->irq, g2d);
-err_unmap_base:
-        iounmap(g2d->regs);
-err_release_res:
-        release_resource(g2d->regs_res);
-        kfree(g2d->regs_res);
 err_put_clk:
        pm_runtime_disable(dev);
        clk_put(g2d->gate_clk);
@@ -862,8 +840,6 @@ err_destroy_workqueue:
        destroy_workqueue(g2d->g2d_workq);
 err_destroy_slab:
        kmem_cache_destroy(g2d->runqueue_slab);
-err_free_mem:
-        kfree(g2d);
        return ret;
 }
@@ -873,24 +849,18 @@ static int __devexit g2d_remove(struct platform_device *pdev)
        cancel_work_sync(&g2d->runqueue_work);
        exynos_drm_subdrv_unregister(&g2d->subdrv);
-        free_irq(g2d->irq, g2d);
        while (g2d->runqueue_node) {
                g2d_free_runqueue_node(g2d, g2d->runqueue_node);
                g2d->runqueue_node = g2d_get_runqueue_node(g2d);
        }
-        iounmap(g2d->regs);
-        release_resource(g2d->regs_res);
-        kfree(g2d->regs_res);
        pm_runtime_disable(&pdev->dev);
        clk_put(g2d->gate_clk);
        g2d_fini_cmdlist(g2d);
        destroy_workqueue(g2d->g2d_workq);
        kmem_cache_destroy(g2d->runqueue_slab);
-        kfree(g2d);
        return 0;
 }
@@ -924,7 +894,7 @@ static int g2d_resume(struct device *dev)
 }
 #endif
-SIMPLE_DEV_PM_OPS(g2d_pm_ops, g2d_suspend, g2d_resume);
+static SIMPLE_DEV_PM_OPS(g2d_pm_ops, g2d_suspend, g2d_resume);
 struct platform_driver g2d_driver = {
        .probe          = g2d_probe,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index f9efde40c097..a38051c95ec4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -122,7 +122,7 @@ fail:
                __free_page(pages[i]);
        drm_free_large(pages);
-        return ERR_PTR(PTR_ERR(p));
+        return ERR_CAST(p);
 }
 static void exynos_gem_put_pages(struct drm_gem_object *obj,
@@ -662,7 +662,7 @@ int exynos_drm_gem_dumb_create(struct drm_file *file_priv,
         */
        args->pitch = args->width * ((args->bpp + 7) / 8);
-        args->size = PAGE_ALIGN(args->pitch * args->height);
+        args->size = args->pitch * args->height;
        exynos_gem_obj = exynos_drm_gem_create(dev, args->flags, args->size);
        if (IS_ERR(exynos_gem_obj))
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 8ffcdf8b9e22..3fdf0b65f47e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -345,7 +345,7 @@ static int __devinit exynos_drm_hdmi_probe(struct platform_device *pdev)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
        if (!ctx) {
                DRM_LOG_KMS("failed to alloc common hdmi context.\n");
                return -ENOMEM;
@@ -371,7 +371,6 @@ static int __devexit exynos_drm_hdmi_remove(struct platform_device *pdev)
        DRM_DEBUG_KMS("%s\n", __FILE__);
        exynos_drm_subdrv_unregister(&ctx->subdrv);
-        kfree(ctx);
        return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index b89829e5043a..e1f94b746bd7 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -29,7 +29,6 @@ static const uint32_t formats[] = {
        DRM_FORMAT_XRGB8888,
        DRM_FORMAT_ARGB8888,
        DRM_FORMAT_NV12,
-        DRM_FORMAT_NV12M,
        DRM_FORMAT_NV12MT,
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index bb1550c4dd57..537027a74fd5 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -633,7 +633,7 @@ static int __devinit vidi_probe(struct platform_device *pdev)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
        if (!ctx)
                return -ENOMEM;
@@ -673,8 +673,6 @@ static int __devexit vidi_remove(struct platform_device *pdev)
                ctx->raw_edid = NULL;
        }
-        kfree(ctx);
        return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 409e2ec1207c..a6aea6f3ea1a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2172,7 +2172,7 @@ static int __devinit hdmi_resources_init(struct hdmi_context *hdata)
        DRM_DEBUG_KMS("HDMI resource init\n");
-        memset(res, 0, sizeof *res);
+        memset(res, 0, sizeof(*res));
        /* get clocks, power */
        res->hdmi = clk_get(dev, "hdmi");
@@ -2204,7 +2204,7 @@ static int __devinit hdmi_resources_init(struct hdmi_context *hdata)
        clk_set_parent(res->sclk_hdmi, res->sclk_pixel);
        res->regul_bulk = kzalloc(ARRAY_SIZE(supply) *
-                sizeof res->regul_bulk[0], GFP_KERNEL);
+                sizeof(res->regul_bulk[0]), GFP_KERNEL);
        if (!res->regul_bulk) {
                DRM_ERROR("failed to get memory for regulators\n");
                goto fail;
@@ -2243,7 +2243,7 @@ static int hdmi_resources_cleanup(struct hdmi_context *hdata)
                clk_put(res->sclk_hdmi);
        if (!IS_ERR_OR_NULL(res->hdmi))
                clk_put(res->hdmi);
-        memset(res, 0, sizeof *res);
+        memset(res, 0, sizeof(*res));
        return 0;
 }
@@ -2312,11 +2312,6 @@ static int __devinit hdmi_probe(struct platform_device *pdev)
        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                DRM_ERROR("failed to find registers\n");
-                ret = -ENOENT;
-                goto err_resource;
-        }
        hdata->regs = devm_request_and_ioremap(&pdev->dev, res);
        if (!hdata->regs) {
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 30fcc12f81dd..25b97d5e5fcb 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -236,11 +236,11 @@ static inline void vp_filter_set(struct mixer_resources *res,
 static void vp_default_filter(struct mixer_resources *res)
 {
        vp_filter_set(res, VP_POLY8_Y0_LL,
-                filter_y_horiz_tap8, sizeof filter_y_horiz_tap8);
+                filter_y_horiz_tap8, sizeof(filter_y_horiz_tap8));
        vp_filter_set(res, VP_POLY4_Y0_LL,
-                filter_y_vert_tap4, sizeof filter_y_vert_tap4);
+                filter_y_vert_tap4, sizeof(filter_y_vert_tap4));
        vp_filter_set(res, VP_POLY4_C0_LL,
-                filter_cr_horiz_tap4, sizeof filter_cr_horiz_tap4);
+                filter_cr_horiz_tap4, sizeof(filter_cr_horiz_tap4));
 }
 static void mixer_vsync_set_update(struct mixer_context *ctx, bool enable)
diff --git a/drivers/gpu/drm/gma500/oaktrail_device.c b/drivers/gpu/drm/gma500/oaktrail_device.c
index 0f9b7db80f6b..cf49ba5a54bf 100644
--- a/drivers/gpu/drm/gma500/oaktrail_device.c
+++ b/drivers/gpu/drm/gma500/oaktrail_device.c
@@ -476,6 +476,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
                .pos = DSPAPOS,
                .surf = DSPASURF,
                .addr = MRST_DSPABASE,
+                .base = MRST_DSPABASE,
                .status = PIPEASTAT,
                .linoff = DSPALINOFF,
                .tileoff = DSPATILEOFF,
@@ -499,6 +500,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
                .pos = DSPBPOS,
                .surf = DSPBSURF,
                .addr = DSPBBASE,
+                .base = DSPBBASE,
                .status = PIPEBSTAT,
                .linoff = DSPBLINOFF,
                .tileoff = DSPBTILEOFF,
diff --git a/drivers/gpu/drm/gma500/psb_intel_display.c b/drivers/gpu/drm/gma500/psb_intel_display.c
index 30dc22a7156c..8033526bb53b 100644
--- a/drivers/gpu/drm/gma500/psb_intel_display.c
+++ b/drivers/gpu/drm/gma500/psb_intel_display.c
@@ -1362,6 +1362,9 @@ void psb_intel_crtc_init(struct drm_device *dev, int pipe,
            (struct drm_connector **) (psb_intel_crtc + 1);
        psb_intel_crtc->mode_set.num_connectors = 0;
        psb_intel_cursor_init(dev, psb_intel_crtc);
+        /* Set to true so that the pipe is forced off on initial config. */
+        psb_intel_crtc->active = true;
 }
 int psb_intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 57d892eaaa6e..463ec6871fe9 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -115,6 +115,9 @@ static const struct file_operations i810_buffer_fops = {
        .unlocked_ioctl = drm_ioctl,
        .mmap = i810_mmap_buffers,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .llseek = noop_llseek,
 };
diff --git a/drivers/gpu/drm/i810/i810_drv.c b/drivers/gpu/drm/i810/i810_drv.c
index f9924ad04d09..48cfcca2b350 100644
--- a/drivers/gpu/drm/i810/i810_drv.c
+++ b/drivers/gpu/drm/i810/i810_drv.c
@@ -51,6 +51,9 @@ static const struct file_operations i810_driver_fops = {
        .mmap = drm_mmap,
        .poll = drm_poll,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .llseek = noop_llseek,
 };
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9cf7dfe022b9..914c0dfabe60 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1587,6 +1587,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        spin_lock_init(&dev_priv->irq_lock);
        spin_lock_init(&dev_priv->error_lock);
        spin_lock_init(&dev_priv->rps_lock);
+        spin_lock_init(&dev_priv->dpio_lock);
        if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
                dev_priv->num_pipe = 3;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 5c4657a54f97..489e2b162b27 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2365,6 +2365,10 @@ int i915_gpu_idle(struct drm_device *dev)
        /* Flush everything onto the inactive list. */
        for_each_ring(ring, dev_priv, i) {
+                ret = i915_switch_context(ring, NULL, DEFAULT_CONTEXT_ID);
+                if (ret)
+                        return ret;
                ret = i915_ring_idle(ring);
                if (ret)
                        return ret;
@@ -2372,10 +2376,6 @@ int i915_gpu_idle(struct drm_device *dev)
                /* Is the device fubar? */
                if (WARN_ON(!list_empty(&ring->gpu_write_list)))
                        return -EBUSY;
-                ret = i915_switch_context(ring, NULL, DEFAULT_CONTEXT_ID);
-                if (ret)
-                        return ret;
        }
        return 0;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index ee9b68f6bc36..60815b861ec2 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -72,7 +72,7 @@ int i915_gem_init_aliasing_ppgtt(struct drm_device *dev)
        /* ppgtt PDEs reside in the global gtt pagetable, which has 512*1024
         * entries. For aliasing ppgtt support we just steal them at the end for
         * now. */
-        first_pd_entry_in_global_pt = 512*1024 - I915_PPGTT_PD_ENTRIES;
+        first_pd_entry_in_global_pt = dev_priv->mm.gtt->gtt_total_entries - I915_PPGTT_PD_ENTRIES;
        ppgtt = kzalloc(sizeof(*ppgtt), GFP_KERNEL);
        if (!ppgtt)
@@ -261,7 +261,10 @@ void i915_ppgtt_bind_object(struct i915_hw_ppgtt *ppgtt,
                pte_flags |= GEN6_PTE_CACHE_LLC;
                break;
        case I915_CACHE_NONE:
-                pte_flags |= GEN6_PTE_UNCACHED;
+                if (IS_HASWELL(dev))
+                        pte_flags |= HSW_PTE_UNCACHED;
+                else
+                        pte_flags |= GEN6_PTE_UNCACHED;
                break;
        default:
                BUG();
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 8a3828528b9d..5249640cce13 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2700,9 +2700,6 @@ void intel_irq_init(struct drm_device *dev)
                        dev->driver->irq_handler = i8xx_irq_handler;
                        dev->driver->irq_uninstall = i8xx_irq_uninstall;
                } else if (INTEL_INFO(dev)->gen == 3) {
-                        /* IIR "flip pending" means done if this bit is set */
-                        I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
                        dev->driver->irq_preinstall = i915_irq_preinstall;
                        dev->driver->irq_postinstall = i915_irq_postinstall;
                        dev->driver->irq_uninstall = i915_irq_uninstall;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index acc99b21e0b6..28725ce5b82c 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -115,6 +115,7 @@
 #define GEN6_PTE_VALID                  (1 << 0)
 #define GEN6_PTE_UNCACHED               (1 << 1)
+#define HSW_PTE_UNCACHED                (0)
 #define GEN6_PTE_CACHE_LLC              (2 << 1)
 #define GEN6_PTE_CACHE_LLC_MLC          (3 << 1)
 #define GEN6_PTE_CACHE_BITS             (3 << 1)
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 7ed4a41c3965..23bdc8cd1458 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -326,6 +326,36 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
        return ret;
 }
+static struct edid *intel_crt_get_edid(struct drm_connector *connector,
+                                struct i2c_adapter *i2c)
+{
+        struct edid *edid;
+        edid = drm_get_edid(connector, i2c);
+        if (!edid && !intel_gmbus_is_forced_bit(i2c)) {
+                DRM_DEBUG_KMS("CRT GMBUS EDID read failed, retry using GPIO bit-banging\n");
+                intel_gmbus_force_bit(i2c, true);
+                edid = drm_get_edid(connector, i2c);
+                intel_gmbus_force_bit(i2c, false);
+        }
+        return edid;
+}
+/* local version of intel_ddc_get_modes() to use intel_crt_get_edid() */
+static int intel_crt_ddc_get_modes(struct drm_connector *connector,
+                                struct i2c_adapter *adapter)
+{
+        struct edid *edid;
+        edid = intel_crt_get_edid(connector, adapter);
+        if (!edid)
+                return 0;
+        return intel_connector_update_modes(connector, edid);
+}
 static bool intel_crt_detect_ddc(struct drm_connector *connector)
 {
        struct intel_crt *crt = intel_attached_crt(connector);
@@ -336,7 +366,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
        BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
        i2c = intel_gmbus_get_adapter(dev_priv, dev_priv->crt_ddc_pin);
-        edid = drm_get_edid(connector, i2c);
+        edid = intel_crt_get_edid(connector, i2c);
        if (edid) {
                bool is_digital = edid->input & DRM_EDID_INPUT_DIGITAL;
@@ -544,13 +574,13 @@ static int intel_crt_get_modes(struct drm_connector *connector)
        struct i2c_adapter *i2c;
        i2c = intel_gmbus_get_adapter(dev_priv, dev_priv->crt_ddc_pin);
-        ret = intel_ddc_get_modes(connector, i2c);
+        ret = intel_crt_ddc_get_modes(connector, i2c);
        if (ret || !IS_G4X(dev))
                return ret;
        /* Try to probe digital port for output in DVI-I -> VGA mode. */
        i2c = intel_gmbus_get_adapter(dev_priv, GMBUS_PORT_DPB);
-        return intel_ddc_get_modes(connector, i2c);
+        return intel_crt_ddc_get_modes(connector, i2c);
 }
 static int intel_crt_set_property(struct drm_connector *connector,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a69a3d0d3acf..bc2ad348e5d8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1376,7 +1376,8 @@ static void assert_pch_dp_disabled(struct drm_i915_private *dev_priv,
             "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
             reg, pipe_name(pipe));
-        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & SDVO_PIPE_B_SELECT),
+        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & DP_PORT_EN) == 0
+             && (val & DP_PIPEB_SELECT),
             "IBX PCH dp port still using transcoder B\n");
 }
@@ -1384,11 +1385,12 @@ static void assert_pch_hdmi_disabled(struct drm_i915_private *dev_priv,
                                     enum pipe pipe, int reg)
 {
        u32 val = I915_READ(reg);
-        WARN(hdmi_pipe_enabled(dev_priv, val, pipe),
+        WARN(hdmi_pipe_enabled(dev_priv, pipe, val),
             "PCH HDMI (0x%08x) enabled on transcoder %c, should be disabled\n",
             reg, pipe_name(pipe));
-        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & SDVO_PIPE_B_SELECT),
+        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & PORT_ENABLE) == 0
+             && (val & SDVO_PIPE_B_SELECT),
             "IBX PCH hdmi port still using transcoder B\n");
 }
@@ -1404,13 +1406,13 @@ static void assert_pch_ports_disabled(struct drm_i915_private *dev_priv,
        reg = PCH_ADPA;
        val = I915_READ(reg);
-        WARN(adpa_pipe_enabled(dev_priv, val, pipe),
+        WARN(adpa_pipe_enabled(dev_priv, pipe, val),
             "PCH VGA enabled on transcoder %c, should be disabled\n",
             pipe_name(pipe));
        reg = PCH_LVDS;
        val = I915_READ(reg);
-        WARN(lvds_pipe_enabled(dev_priv, val, pipe),
+        WARN(lvds_pipe_enabled(dev_priv, pipe, val),
             "PCH LVDS enabled on transcoder %c, should be disabled\n",
             pipe_name(pipe));
@@ -1872,7 +1874,7 @@ static void disable_pch_hdmi(struct drm_i915_private *dev_priv,
                             enum pipe pipe, int reg)
 {
        u32 val = I915_READ(reg);
-        if (hdmi_pipe_enabled(dev_priv, val, pipe)) {
+        if (hdmi_pipe_enabled(dev_priv, pipe, val)) {
                DRM_DEBUG_KMS("Disabling pch HDMI %x on pipe %d\n",
                              reg, pipe);
                I915_WRITE(reg, val & ~PORT_ENABLE);
@@ -1894,12 +1896,12 @@ static void intel_disable_pch_ports(struct drm_i915_private *dev_priv,
        reg = PCH_ADPA;
        val = I915_READ(reg);
-        if (adpa_pipe_enabled(dev_priv, val, pipe))
+        if (adpa_pipe_enabled(dev_priv, pipe, val))
                I915_WRITE(reg, val & ~ADPA_DAC_ENABLE);
        reg = PCH_LVDS;
        val = I915_READ(reg);
-        if (lvds_pipe_enabled(dev_priv, val, pipe)) {
+        if (lvds_pipe_enabled(dev_priv, pipe, val)) {
                DRM_DEBUG_KMS("disable lvds on pipe %d val 0x%08x\n", pipe, val);
                I915_WRITE(reg, val & ~LVDS_PORT_EN);
                POSTING_READ(reg);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index a6c426afaa7a..ace757af9133 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2533,14 +2533,10 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                        break;
        }
-        intel_dp_i2c_init(intel_dp, intel_connector, name);
        /* Cache some DPCD data in the eDP case */
        if (is_edp(intel_dp)) {
-                bool ret;
                struct edp_power_seq    cur, vbt;
                u32 pp_on, pp_off, pp_div;
-                struct edid *edid;
                pp_on = I915_READ(PCH_PP_ON_DELAYS);
                pp_off = I915_READ(PCH_PP_OFF_DELAYS);
@@ -2591,6 +2587,13 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                DRM_DEBUG_KMS("backlight on delay %d, off delay %d\n",
                              intel_dp->backlight_on_delay, intel_dp->backlight_off_delay);
+        }
+        intel_dp_i2c_init(intel_dp, intel_connector, name);
+        if (is_edp(intel_dp)) {
+                bool ret;
+                struct edid *edid;
                ironlake_edp_panel_vdd_on(intel_dp);
                ret = intel_dp_get_dpcd(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 132ab511b90c..cd54cf88a28f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -342,6 +342,8 @@ struct intel_fbc_work {
        int interval;
 };
+int intel_connector_update_modes(struct drm_connector *connector,
+                                struct edid *edid);
 int intel_ddc_get_modes(struct drm_connector *c, struct i2c_adapter *adapter);
 extern void intel_attach_force_audio_property(struct drm_connector *connector);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index e05c0d3e3440..e9a6f6aaed85 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -780,6 +780,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
                        DMI_MATCH(DMI_BOARD_NAME, "ZBOXSD-ID12/ID13"),
                },
        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Gigabyte GA-D525TUD",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
+                        DMI_MATCH(DMI_BOARD_NAME, "D525TUD"),
+                },
+        },
        { }     /* terminating entry */
 };
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 45848b9b670b..29b72593fbb2 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -33,6 +33,25 @@
 #include "i915_drv.h"
 /**
+ * intel_connector_update_modes - update connector from edid
+ * @connector: DRM connector device to use
+ * @edid: previously read EDID information
+ */
+int intel_connector_update_modes(struct drm_connector *connector,
+                                struct edid *edid)
+{
+        int ret;
+        drm_mode_connector_update_edid_property(connector, edid);
+        ret = drm_add_edid_modes(connector, edid);
+        drm_edid_to_eld(connector, edid);
+        connector->display_info.raw_edid = NULL;
+        kfree(edid);
+        return ret;
+}
+/**
 * intel_ddc_get_modes - get modelist from monitor
 * @connector: DRM connector device to use
 * @adapter: i2c adapter
@@ -43,18 +62,12 @@ int intel_ddc_get_modes(struct drm_connector *connector,
                        struct i2c_adapter *adapter)
 {
        struct edid *edid;
-        int ret = 0;
        edid = drm_get_edid(connector, adapter);
-        if (edid) {
+        if (!edid)
-                drm_mode_connector_update_edid_property(connector, edid);
+                return 0;
-                ret = drm_add_edid_modes(connector, edid);
-                drm_edid_to_eld(connector, edid);
-                connector->display_info.raw_edid = NULL;
-                kfree(edid);
-        }
-        return ret;
+        return intel_connector_update_modes(connector, edid);
 }
 static const struct drm_prop_enum_list force_audio_names[] = {
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 3df4f5fa892a..e019b2369861 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -162,19 +162,12 @@ static u32 i915_read_blc_pwm_ctl(struct drm_i915_private *dev_priv)
        return val;
 }
-u32 intel_panel_get_max_backlight(struct drm_device *dev)
+static u32 _intel_panel_get_max_backlight(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 max;
        max = i915_read_blc_pwm_ctl(dev_priv);
-        if (max == 0) {
-                /* XXX add code here to query mode clock or hardware clock
-                 * and program max PWM appropriately.
-                 */
-                pr_warn_once("fixme: max PWM is zero\n");
-                return 1;
-        }
        if (HAS_PCH_SPLIT(dev)) {
                max >>= 16;
@@ -188,6 +181,22 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
                        max *= 0xff;
        }
+        return max;
+}
+u32 intel_panel_get_max_backlight(struct drm_device *dev)
+{
+        u32 max;
+        max = _intel_panel_get_max_backlight(dev);
+        if (max == 0) {
+                /* XXX add code here to query mode clock or hardware clock
+                 * and program max PWM appropriately.
+                 */
+                pr_warn_once("fixme: max PWM is zero\n");
+                return 1;
+        }
        DRM_DEBUG_DRIVER("max backlight PWM = %d\n", max);
        return max;
 }
@@ -424,7 +433,11 @@ int intel_panel_setup_backlight(struct drm_device *dev)
        memset(&props, 0, sizeof(props));
        props.type = BACKLIGHT_RAW;
-        props.max_brightness = intel_panel_get_max_backlight(dev);
+        props.max_brightness = _intel_panel_get_max_backlight(dev);
+        if (props.max_brightness == 0) {
+                DRM_ERROR("Failed to get maximum backlight value\n");
+                return -ENODEV;
+        }
        dev_priv->backlight =
                backlight_device_register("intel_backlight",
                                          &connector->kdev, dev,
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 58c07cdafb7e..ba8a27b1757a 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2441,17 +2441,10 @@ static void gen6_enable_rps(struct drm_device *dev)
                   dev_priv->max_delay << 24 |
                   dev_priv->min_delay << 16);
-        if (IS_HASWELL(dev)) {
+        I915_WRITE(GEN6_RP_UP_THRESHOLD, 59400);
-                I915_WRITE(GEN6_RP_UP_THRESHOLD, 59400);
+        I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 245000);
-                I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 245000);
+        I915_WRITE(GEN6_RP_UP_EI, 66000);
-                I915_WRITE(GEN6_RP_UP_EI, 66000);
+        I915_WRITE(GEN6_RP_DOWN_EI, 350000);
-                I915_WRITE(GEN6_RP_DOWN_EI, 350000);
-        } else {
-                I915_WRITE(GEN6_RP_UP_THRESHOLD, 10000);
-                I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 1000000);
-                I915_WRITE(GEN6_RP_UP_EI, 100000);
-                I915_WRITE(GEN6_RP_DOWN_EI, 5000000);
-        }
        I915_WRITE(GEN6_RP_IDLE_HYSTERSIS, 10);
        I915_WRITE(GEN6_RP_CONTROL,
@@ -3679,6 +3672,9 @@ static void gen3_init_clock_gating(struct drm_device *dev)
        if (IS_PINEVIEW(dev))
                I915_WRITE(ECOSKPD, _MASKED_BIT_ENABLE(ECO_GATING_CX_ONLY));
+        /* IIR "flip pending" means done if this bit is set */
+        I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
 }
 static void i85x_init_clock_gating(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index d172e9873131..123afd357611 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1692,6 +1692,7 @@ static bool intel_sdvo_detect_hdmi_audio(struct drm_connector *connector)
        edid = intel_sdvo_get_edid(connector);
        if (edid != NULL && edid->input & DRM_EDID_INPUT_DIGITAL)
                has_audio = drm_detect_monitor_audio(edid);
+        kfree(edid);
        return has_audio;
 }
@@ -2572,7 +2573,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                hotplug_mask = intel_sdvo->is_sdvob ?
                        SDVOB_HOTPLUG_INT_STATUS_I915 : SDVOC_HOTPLUG_INT_STATUS_I915;
        }
-        dev_priv->hotplug_supported_mask |= hotplug_mask;
        drm_encoder_helper_add(&intel_encoder->base, &intel_sdvo_helper_funcs);
@@ -2580,14 +2580,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
        if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
                goto err;
-        /* Set up hotplug command - note paranoia about contents of reply.
-         * We assume that the hardware is in a sane state, and only touch
-         * the bits we think we understand.
-         */
-        intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
-                             &intel_sdvo->hotplug_active, 2);
-        intel_sdvo->hotplug_active[0] &= ~0x3;
        if (intel_sdvo_output_setup(intel_sdvo,
                                    intel_sdvo->caps.output_flags) != true) {
                DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
@@ -2595,6 +2587,12 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                goto err;
        }
+        /* Only enable the hotplug irq if we need it, to work around noisy
+         * hotplug lines.
+         */
+        if (intel_sdvo->hotplug_active[0])
+                dev_priv->hotplug_supported_mask |= hotplug_mask;
        intel_sdvo_select_ddc_bus(dev_priv, intel_sdvo, sdvo_reg);
        /* Set the input timing to the screen. Assume always input 0. */
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index cc8df4de2d92..7644f31a3778 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -60,11 +60,11 @@ ivb_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
        switch (fb->pixel_format) {
        case DRM_FORMAT_XBGR8888:
-                sprctl |= SPRITE_FORMAT_RGBX888;
+                sprctl |= SPRITE_FORMAT_RGBX888 | SPRITE_RGB_ORDER_RGBX;
                pixel_size = 4;
                break;
        case DRM_FORMAT_XRGB8888:
-                sprctl |= SPRITE_FORMAT_RGBX888 | SPRITE_RGB_ORDER_RGBX;
+                sprctl |= SPRITE_FORMAT_RGBX888;
                pixel_size = 4;
                break;
        case DRM_FORMAT_YUYV:
diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.c b/drivers/gpu/drm/mgag200/mgag200_drv.c
index ea1024d79974..e5f145d2cb3b 100644
--- a/drivers/gpu/drm/mgag200/mgag200_drv.c
+++ b/drivers/gpu/drm/mgag200/mgag200_drv.c
@@ -84,6 +84,9 @@ static const struct file_operations mgag200_driver_fops = {
        .mmap = mgag200_mmap,
        .poll = drm_poll,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .read = drm_read,
 };
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index fc841e87b343..26ebffebe710 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -211,11 +211,6 @@ static int nouveau_dsm_power_state(enum vga_switcheroo_client_id id,
        return nouveau_dsm_set_discrete_state(nouveau_dsm_priv.dhandle, state);
 }
-static int nouveau_dsm_init(void)
-{
-        return 0;
-}
 static int nouveau_dsm_get_client_id(struct pci_dev *pdev)
 {
        /* easy option one - intel vendor ID means Integrated */
@@ -232,7 +227,6 @@ static int nouveau_dsm_get_client_id(struct pci_dev *pdev)
 static struct vga_switcheroo_handler nouveau_dsm_handler = {
        .switchto = nouveau_dsm_switchto,
        .power_state = nouveau_dsm_power_state,
-        .init = nouveau_dsm_init,
        .get_client_id = nouveau_dsm_get_client_id,
 };
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 69688ef5cf46..7e16dc5e6467 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -598,7 +598,7 @@ nouveau_display_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
        args->size = args->pitch * args->height;
        args->size = roundup(args->size, PAGE_SIZE);
-        ret = nouveau_gem_new(dev, args->size, 0, TTM_PL_FLAG_VRAM, 0, 0, &bo);
+        ret = nouveau_gem_new(dev, args->size, 0, NOUVEAU_GEM_DOMAIN_VRAM, 0, 0, &bo);
        if (ret)
                return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 1866dbb49979..c61014442aa9 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -736,9 +736,11 @@ nouveau_card_init(struct drm_device *dev)
                        }
                        break;
                case NV_C0:
-                        nvc0_copy_create(dev, 1);
+                        if (!(nv_rd32(dev, 0x022500) & 0x00000200))
+                                nvc0_copy_create(dev, 1);
                case NV_D0:
-                        nvc0_copy_create(dev, 0);
+                        if (!(nv_rd32(dev, 0x022500) & 0x00000100))
+                                nvc0_copy_create(dev, 0);
                        break;
                default:
                        break;
diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
index f429e6a8ca7a..f03490534893 100644
--- a/drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
@@ -115,6 +115,9 @@ nv50_gpio_init(struct drm_device *dev)
 {
        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        /* initialise gpios and routing to vbios defaults */
+        nouveau_gpio_reset(dev);
        /* disable, and ack any pending gpio interrupts */
        nv_wr32(dev, 0xe050, 0x00000000);
        nv_wr32(dev, 0xe054, 0xffffffff);
diff --git a/drivers/gpu/drm/nouveau/nvd0_display.c b/drivers/gpu/drm/nouveau/nvd0_display.c
index dac525b2994e..8a2fc89b7763 100644
--- a/drivers/gpu/drm/nouveau/nvd0_display.c
+++ b/drivers/gpu/drm/nouveau/nvd0_display.c
@@ -1510,10 +1510,10 @@ nvd0_sor_mode_set(struct drm_encoder *encoder, struct drm_display_mode *umode,
        case OUTPUT_DP:
                if (nv_connector->base.display_info.bpc == 6) {
                        nv_encoder->dp.datarate = mode->clock * 18 / 8;
-                        syncs |= 0x00000140;
+                        syncs |= 0x00000002 << 6;
                } else {
                        nv_encoder->dp.datarate = mode->clock * 24 / 8;
-                        syncs |= 0x00000180;
+                        syncs |= 0x00000005 << 6;
                }
                if (nv_encoder->dcb->sorconf.link & 1)
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c6fcb5b86a45..e721e3087b99 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -258,7 +258,6 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
                radeon_crtc->enabled = true;
                /* adjust pm to dpms changes BEFORE enabling crtcs */
                radeon_pm_compute_clocks(rdev);
-                /* disable crtc pair power gating before programming */
                if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set)
                        atombios_powergate_crtc(crtc, ATOM_DISABLE);
                atombios_enable_crtc(crtc, ATOM_ENABLE);
@@ -278,25 +277,8 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
                        atombios_enable_crtc_memreq(crtc, ATOM_DISABLE);
                atombios_enable_crtc(crtc, ATOM_DISABLE);
                radeon_crtc->enabled = false;
-                /* power gating is per-pair */
+                if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set)
-                if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set) {
+                        atombios_powergate_crtc(crtc, ATOM_ENABLE);
-                        struct drm_crtc *other_crtc;
-                        struct radeon_crtc *other_radeon_crtc;
-                        list_for_each_entry(other_crtc, &rdev->ddev->mode_config.crtc_list, head) {
-                                other_radeon_crtc = to_radeon_crtc(other_crtc);
-                                if (((radeon_crtc->crtc_id == 0) && (other_radeon_crtc->crtc_id == 1)) ||
-                                    ((radeon_crtc->crtc_id == 1) && (other_radeon_crtc->crtc_id == 0)) ||
-                                    ((radeon_crtc->crtc_id == 2) && (other_radeon_crtc->crtc_id == 3)) ||
-                                    ((radeon_crtc->crtc_id == 3) && (other_radeon_crtc->crtc_id == 2)) ||
-                                    ((radeon_crtc->crtc_id == 4) && (other_radeon_crtc->crtc_id == 5)) ||
-                                    ((radeon_crtc->crtc_id == 5) && (other_radeon_crtc->crtc_id == 4))) {
-                                        /* if both crtcs in the pair are off, enable power gating */
-                                        if (other_radeon_crtc->enabled == false)
-                                                atombios_powergate_crtc(crtc, ATOM_ENABLE);
-                                        break;
-                                }
-                        }
-                }
                /* adjust pm to dpms changes AFTER disabling crtcs */
                radeon_pm_compute_clocks(rdev);
                break;
@@ -444,11 +426,28 @@ union atom_enable_ss {
 static void atombios_crtc_program_ss(struct radeon_device *rdev,
                                     int enable,
                                     int pll_id,
+                                     int crtc_id,
                                     struct radeon_atom_ss *ss)
 {
+        unsigned i;
        int index = GetIndexIntoMasterTable(COMMAND, EnableSpreadSpectrumOnPPLL);
        union atom_enable_ss args;
+        if (!enable) {
+                for (i = 0; i < rdev->num_crtc; i++) {
+                        if (rdev->mode_info.crtcs[i] &&
+                            rdev->mode_info.crtcs[i]->enabled &&
+                            i != crtc_id &&
+                            pll_id == rdev->mode_info.crtcs[i]->pll_id) {
+                                /* one other crtc is using this pll don't turn
+                                 * off spread spectrum as it might turn off
+                                 * display on active crtc
+                                 */
+                                return;
+                        }
+                }
+        }
        memset(&args, 0, sizeof(args));
        if (ASIC_IS_DCE5(rdev)) {
@@ -1028,7 +1027,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
                radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
                                          &ref_div, &post_div);
-        atombios_crtc_program_ss(rdev, ATOM_DISABLE, radeon_crtc->pll_id, &ss);
+        atombios_crtc_program_ss(rdev, ATOM_DISABLE, radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss);
        atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
                                  encoder_mode, radeon_encoder->encoder_id, mode->clock,
@@ -1051,7 +1050,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
                        ss.step = step_size;
                }
-                atombios_crtc_program_ss(rdev, ATOM_ENABLE, radeon_crtc->pll_id, &ss);
+                atombios_crtc_program_ss(rdev, ATOM_ENABLE, radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss);
        }
 }
@@ -1480,14 +1479,98 @@ static void radeon_legacy_atom_fixup(struct drm_crtc *crtc)
        }
 }
+/**
+ * radeon_get_pll_use_mask - look up a mask of which pplls are in use
+ *
+ * @crtc: drm crtc
+ *
+ * Returns the mask of which PPLLs (Pixel PLLs) are in use.
+ */
+static u32 radeon_get_pll_use_mask(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_crtc *test_crtc;
+        struct radeon_crtc *radeon_test_crtc;
+        u32 pll_in_use = 0;
+        list_for_each_entry(test_crtc, &dev->mode_config.crtc_list, head) {
+                if (crtc == test_crtc)
+                        continue;
+                radeon_test_crtc = to_radeon_crtc(test_crtc);
+                if (radeon_test_crtc->pll_id != ATOM_PPLL_INVALID)
+                        pll_in_use |= (1 << radeon_test_crtc->pll_id);
+        }
+        return pll_in_use;
+}
+/**
+ * radeon_get_shared_dp_ppll - return the PPLL used by another crtc for DP
+ *
+ * @crtc: drm crtc
+ *
+ * Returns the PPLL (Pixel PLL) used by another crtc/encoder which is
+ * also in DP mode.  For DP, a single PPLL can be used for all DP
+ * crtcs/encoders.
+ */
+static int radeon_get_shared_dp_ppll(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_encoder *test_encoder;
+        struct radeon_crtc *radeon_test_crtc;
+        list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
+                if (test_encoder->crtc && (test_encoder->crtc != crtc)) {
+                        if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_encoder))) {
+                                /* for DP use the same PLL for all */
+                                radeon_test_crtc = to_radeon_crtc(test_encoder->crtc);
+                                if (radeon_test_crtc->pll_id != ATOM_PPLL_INVALID)
+                                        return radeon_test_crtc->pll_id;
+                        }
+                }
+        }
+        return ATOM_PPLL_INVALID;
+}
+/**
+ * radeon_atom_pick_pll - Allocate a PPLL for use by the crtc.
+ *
+ * @crtc: drm crtc
+ *
+ * Returns the PPLL (Pixel PLL) to be used by the crtc.  For DP monitors
+ * a single PPLL can be used for all DP crtcs/encoders.  For non-DP
+ * monitors a dedicated PPLL must be used.  If a particular board has
+ * an external DP PLL, return ATOM_PPLL_INVALID to skip PLL programming
+ * as there is no need to program the PLL itself.  If we are not able to
+ * allocate a PLL, return ATOM_PPLL_INVALID to skip PLL programming to
+ * avoid messing up an existing monitor.
+ *
+ * Asic specific PLL information
+ *
+ * DCE 6.1
+ * - PPLL2 is only available to UNIPHYA (both DP and non-DP)
+ * - PPLL0, PPLL1 are available for UNIPHYB/C/D/E/F (both DP and non-DP)
+ *
+ * DCE 6.0
+ * - PPLL0 is available to all UNIPHY (DP only)
+ * - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC
+ *
+ * DCE 5.0
+ * - DCPLL is available to all UNIPHY (DP only)
+ * - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC
+ *
+ * DCE 3.0/4.0/4.1
+ * - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC
+ *
+ */
 static int radeon_atom_pick_pll(struct drm_crtc *crtc)
 {
        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
        struct drm_device *dev = crtc->dev;
        struct radeon_device *rdev = dev->dev_private;
        struct drm_encoder *test_encoder;
-        struct drm_crtc *test_crtc;
+        u32 pll_in_use;
-        uint32_t pll_in_use = 0;
+        int pll;
        if (ASIC_IS_DCE61(rdev)) {
                list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
@@ -1499,32 +1582,40 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                if ((test_radeon_encoder->encoder_id ==
                                     ENCODER_OBJECT_ID_INTERNAL_UNIPHY) &&
-                                    (dig->linkb == false)) /* UNIPHY A uses PPLL2 */
+                                    (dig->linkb == false))
+                                        /* UNIPHY A uses PPLL2 */
                                        return ATOM_PPLL2;
+                                else if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_encoder))) {
+                                        /* UNIPHY B/C/D/E/F */
+                                        if (rdev->clock.dp_extclk)
+                                                /* skip PPLL programming if using ext clock */
+                                                return ATOM_PPLL_INVALID;
+                                        else {
+                                                /* use the same PPLL for all DP monitors */
+                                                pll = radeon_get_shared_dp_ppll(crtc);
+                                                if (pll != ATOM_PPLL_INVALID)
+                                                        return pll;
+                                        }
+                                }
+                                break;
                        }
                }
                /* UNIPHY B/C/D/E/F */
-                list_for_each_entry(test_crtc, &dev->mode_config.crtc_list, head) {
+                pll_in_use = radeon_get_pll_use_mask(crtc);
-                        struct radeon_crtc *radeon_test_crtc;
+                if (!(pll_in_use & (1 << ATOM_PPLL0)))
-                        if (crtc == test_crtc)
-                                continue;
-                        radeon_test_crtc = to_radeon_crtc(test_crtc);
-                        if ((radeon_test_crtc->pll_id == ATOM_PPLL0) ||
-                            (radeon_test_crtc->pll_id == ATOM_PPLL1))
-                                pll_in_use |= (1 << radeon_test_crtc->pll_id);
-                }
-                if (!(pll_in_use & 4))
                        return ATOM_PPLL0;
-                return ATOM_PPLL1;
+                if (!(pll_in_use & (1 << ATOM_PPLL1)))
+                        return ATOM_PPLL1;
+                DRM_ERROR("unable to allocate a PPLL\n");
+                return ATOM_PPLL_INVALID;
        } else if (ASIC_IS_DCE4(rdev)) {
                list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
                        if (test_encoder->crtc && (test_encoder->crtc == crtc)) {
                                /* in DP mode, the DP ref clock can come from PPLL, DCPLL, or ext clock,
                                 * depending on the asic:
                                 * DCE4: PPLL or ext clock
-                                 * DCE5: DCPLL or ext clock
+                                 * DCE5: PPLL, DCPLL, or ext clock
+                                 * DCE6: PPLL, PPLL0, or ext clock
                                 *
                                 * Setting ATOM_PPLL_INVALID will cause SetPixelClock to skip
                                 * PPLL/DCPLL programming and only program the DP DTO for the
@@ -1532,31 +1623,34 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                 */
                                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_encoder))) {
                                        if (rdev->clock.dp_extclk)
+                                                /* skip PPLL programming if using ext clock */
                                                return ATOM_PPLL_INVALID;
                                        else if (ASIC_IS_DCE6(rdev))
+                                                /* use PPLL0 for all DP */
                                                return ATOM_PPLL0;
                                        else if (ASIC_IS_DCE5(rdev))
+                                                /* use DCPLL for all DP */
                                                return ATOM_DCPLL;
+                                        else {
+                                                /* use the same PPLL for all DP monitors */
+                                                pll = radeon_get_shared_dp_ppll(crtc);
+                                                if (pll != ATOM_PPLL_INVALID)
+                                                        return pll;
+                                        }
                                }
+                                break;
                        }
                }
+                /* all other cases */
-                /* otherwise, pick one of the plls */
+                pll_in_use = radeon_get_pll_use_mask(crtc);
-                list_for_each_entry(test_crtc, &dev->mode_config.crtc_list, head) {
+                if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                        struct radeon_crtc *radeon_test_crtc;
+                        return ATOM_PPLL2;
+                if (!(pll_in_use & (1 << ATOM_PPLL1)))
-                        if (crtc == test_crtc)
-                                continue;
-                        radeon_test_crtc = to_radeon_crtc(test_crtc);
-                        if ((radeon_test_crtc->pll_id >= ATOM_PPLL1) &&
-                            (radeon_test_crtc->pll_id <= ATOM_PPLL2))
-                                pll_in_use |= (1 << radeon_test_crtc->pll_id);
-                }
-                if (!(pll_in_use & 1))
                        return ATOM_PPLL1;
-                return ATOM_PPLL2;
+                DRM_ERROR("unable to allocate a PPLL\n");
+                return ATOM_PPLL_INVALID;
        } else
+                /* use PPLL1 or PPLL2 */
                return radeon_crtc->crtc_id;
 }
@@ -1572,11 +1666,11 @@ void radeon_atom_disp_eng_pll_init(struct radeon_device *rdev)
                                                                   ASIC_INTERNAL_SS_ON_DCPLL,
                                                                   rdev->clock.default_dispclk);
                if (ss_enabled)
-                        atombios_crtc_program_ss(rdev, ATOM_DISABLE, ATOM_DCPLL, &ss);
+                        atombios_crtc_program_ss(rdev, ATOM_DISABLE, ATOM_DCPLL, -1, &ss);
                /* XXX: DCE5, make sure voltage, dispclk is high enough */
                atombios_crtc_set_disp_eng_pll(rdev, rdev->clock.default_dispclk);
                if (ss_enabled)
-                        atombios_crtc_program_ss(rdev, ATOM_ENABLE, ATOM_DCPLL, &ss);
+                        atombios_crtc_program_ss(rdev, ATOM_ENABLE, ATOM_DCPLL, -1, &ss);
        }
 }
@@ -1665,9 +1759,22 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
        struct drm_device *dev = crtc->dev;
        struct radeon_device *rdev = dev->dev_private;
        struct radeon_atom_ss ss;
+        int i;
        atombios_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+        for (i = 0; i < rdev->num_crtc; i++) {
+                if (rdev->mode_info.crtcs[i] &&
+                    rdev->mode_info.crtcs[i]->enabled &&
+                    i != radeon_crtc->crtc_id &&
+                    radeon_crtc->pll_id == rdev->mode_info.crtcs[i]->pll_id) {
+                        /* one other crtc is using this pll don't turn
+                         * off the pll
+                         */
+                        goto done;
+                }
+        }
        switch (radeon_crtc->pll_id) {
        case ATOM_PPLL1:
        case ATOM_PPLL2:
@@ -1684,7 +1791,8 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
        default:
                break;
        }
-        radeon_crtc->pll_id = -1;
+done:
+        radeon_crtc->pll_id = ATOM_PPLL_INVALID;
 }
 static const struct drm_crtc_helper_funcs atombios_helper_funcs = {
@@ -1733,6 +1841,6 @@ void radeon_atombios_init_crtc(struct drm_device *dev,
                else
                        radeon_crtc->crtc_offset = 0;
        }
-        radeon_crtc->pll_id = -1;
+        radeon_crtc->pll_id = ATOM_PPLL_INVALID;
        drm_crtc_helper_add(&radeon_crtc->base, &atombios_helper_funcs);
 }
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 7712cf5ab33b..3623b98ed3fe 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -577,30 +577,25 @@ int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
        struct radeon_device *rdev = dev->dev_private;
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
        int panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+        u16 dp_bridge = radeon_connector_encoder_get_dp_bridge_encoder_id(connector);
+        u8 tmp;
        if (!ASIC_IS_DCE4(rdev))
                return panel_mode;
-        if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+        if (dp_bridge != ENCODER_OBJECT_ID_NONE) {
-            ENCODER_OBJECT_ID_NUTMEG)
+                /* DP bridge chips */
-                panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
+                tmp = radeon_read_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_CAP);
-        else if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+                if (tmp & 1)
-                 ENCODER_OBJECT_ID_TRAVIS) {
+                        panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
-                u8 id[6];
+                else if ((dp_bridge == ENCODER_OBJECT_ID_NUTMEG) ||
-                int i;
+                         (dp_bridge == ENCODER_OBJECT_ID_TRAVIS))
-                for (i = 0; i < 6; i++)
-                        id[i] = radeon_read_dpcd_reg(radeon_connector, 0x503 + i);
-                if (id[0] == 0x73 &&
-                    id[1] == 0x69 &&
-                    id[2] == 0x76 &&
-                    id[3] == 0x61 &&
-                    id[4] == 0x72 &&
-                    id[5] == 0x54)
                        panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
                else
-                        panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+                        panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
        } else if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
-                u8 tmp = radeon_read_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_CAP);
+                /* eDP */
+                tmp = radeon_read_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_CAP);
                if (tmp & 1)
                        panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
        }
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index f9bc27fe269a..6e8803a1170c 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1379,6 +1379,8 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
        struct drm_device *dev = encoder->dev;
        struct radeon_device *rdev = dev->dev_private;
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_encoder *ext_encoder = radeon_get_external_encoder(encoder);
+        struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
        struct radeon_connector *radeon_connector = NULL;
        struct radeon_connector_atom_dig *radeon_dig_connector = NULL;
@@ -1390,19 +1392,37 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
        switch (mode) {
        case DRM_MODE_DPMS_ON:
-                /* some early dce3.2 boards have a bug in their transmitter control table */
+                if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
-                if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730) ||
+                        if (!connector)
-                    ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
+                                dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
-                        if (ASIC_IS_DCE6(rdev)) {
+                        else
-                                /* It seems we need to call ATOM_ENCODER_CMD_SETUP again
+                                dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
-                                 * before reenabling encoder on DPMS ON, otherwise we never
-                                 * get picture
+                        /* setup and enable the encoder */
-                                 */
+                        atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-                                atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+                        atombios_dig_encoder_setup(encoder,
+                                                   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
+                                                   dig->panel_mode);
+                        if (ext_encoder) {
+                                if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
+                                        atombios_external_encoder_setup(encoder, ext_encoder,
+                                                                        EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP);
                        }
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-                } else {
+                } else if (ASIC_IS_DCE4(rdev)) {
+                        /* setup and enable the encoder */
+                        atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+                        /* enable the transmitter */
+                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+                } else {
+                        /* setup and enable the encoder and transmitter */
+                        atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
+                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
+                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+                        /* some early dce3.2 boards have a bug in their transmitter control table */
+                        if ((rdev->family != CHIP_RV710) || (rdev->family != CHIP_RV730))
+                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                }
                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
                        if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
@@ -1420,10 +1440,19 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
        case DRM_MODE_DPMS_STANDBY:
        case DRM_MODE_DPMS_SUSPEND:
        case DRM_MODE_DPMS_OFF:
-                if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
+                if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
+                        /* disable the transmitter */
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-                else
+                } else if (ASIC_IS_DCE4(rdev)) {
+                        /* disable the transmitter */
+                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
+                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+                } else {
+                        /* disable the encoder and transmitter */
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
+                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+                        atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
+                }
                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
                        if (ASIC_IS_DCE4(rdev))
                                atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
@@ -1740,13 +1769,34 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
        struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        struct drm_encoder *test_encoder;
-        struct radeon_encoder_atom_dig *dig;
+        struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
        uint32_t dig_enc_in_use = 0;
-        /* DCE4/5 */
+        if (ASIC_IS_DCE6(rdev)) {
-        if (ASIC_IS_DCE4(rdev)) {
+                /* DCE6 */
-                dig = radeon_encoder->enc_priv;
+                switch (radeon_encoder->encoder_id) {
-                if (ASIC_IS_DCE41(rdev)) {
+                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+                        if (dig->linkb)
+                                return 1;
+                        else
+                                return 0;
+                        break;
+                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+                        if (dig->linkb)
+                                return 3;
+                        else
+                                return 2;
+                        break;
+                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+                        if (dig->linkb)
+                                return 5;
+                        else
+                                return 4;
+                        break;
+                }
+        } else if (ASIC_IS_DCE4(rdev)) {
+                /* DCE4/5 */
+                if (ASIC_IS_DCE41(rdev) && !ASIC_IS_DCE61(rdev)) {
                        /* ontario follows DCE4 */
                        if (rdev->family == CHIP_PALM) {
                                if (dig->linkb)
@@ -1848,10 +1898,12 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
        struct drm_device *dev = encoder->dev;
        struct radeon_device *rdev = dev->dev_private;
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-        struct drm_encoder *ext_encoder = radeon_get_external_encoder(encoder);
        radeon_encoder->pixel_clock = adjusted_mode->clock;
+        /* need to call this here rather than in prepare() since we need some crtc info */
+        radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
        if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE4(rdev)) {
                if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT))
                        atombios_yuv_setup(encoder, true);
@@ -1870,38 +1922,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
        case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-                if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
+                /* handled in dpms */
-                        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
-                        struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-                        if (!connector)
-                                dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
-                        else
-                                dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
-                        /* setup and enable the encoder */
-                        atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-                        atombios_dig_encoder_setup(encoder,
-                                                   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
-                                                   dig->panel_mode);
-                } else if (ASIC_IS_DCE4(rdev)) {
-                        /* disable the transmitter */
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-                        /* setup and enable the encoder */
-                        atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-                        /* enable the transmitter */
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-                } else {
-                        /* disable the encoder and transmitter */
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-                        atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
-                        /* setup and enable the encoder and transmitter */
-                        atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-                }
                break;
        case ENCODER_OBJECT_ID_INTERNAL_DDI:
        case ENCODER_OBJECT_ID_INTERNAL_DVO1:
@@ -1922,14 +1943,6 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
                break;
        }
-        if (ext_encoder) {
-                if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
-                        atombios_external_encoder_setup(encoder, ext_encoder,
-                                                        EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP);
-                else
-                        atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE);
-        }
        atombios_apply_encoder_quirks(encoder, adjusted_mode);
        if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_HDMI) {
@@ -2116,7 +2129,6 @@ static void radeon_atom_encoder_prepare(struct drm_encoder *encoder)
        }
        radeon_atom_output_lock(encoder, true);
-        radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
        if (connector) {
                struct radeon_connector *radeon_connector = to_radeon_connector(connector);
@@ -2137,6 +2149,7 @@ static void radeon_atom_encoder_prepare(struct drm_encoder *encoder)
 static void radeon_atom_encoder_commit(struct drm_encoder *encoder)
 {
+        /* need to call this here as we need the crtc set up */
        radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_ON);
        radeon_atom_output_lock(encoder, false);
 }
@@ -2177,14 +2190,7 @@ static void radeon_atom_encoder_disable(struct drm_encoder *encoder)
        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
        case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-                if (ASIC_IS_DCE4(rdev))
+                /* handled in dpms */
-                        /* disable the transmitter */
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-                else {
-                        /* disable the encoder and transmitter */
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-                        atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
-                }
                break;
        case ENCODER_OBJECT_ID_INTERNAL_DDI:
        case ENCODER_OBJECT_ID_INTERNAL_DVO1:
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 3dab49cb1d4a..f37676d7f217 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -47,18 +47,23 @@ struct r600_cs_track {
        u32                     npipes;
        /* value we track */
        u32                     sq_config;
+        u32                     log_nsamples;
        u32                     nsamples;
        u32                     cb_color_base_last[8];
        struct radeon_bo        *cb_color_bo[8];
        u64                     cb_color_bo_mc[8];
-        u32                     cb_color_bo_offset[8];
+        u64                     cb_color_bo_offset[8];
-        struct radeon_bo        *cb_color_frag_bo[8]; /* unused */
+        struct radeon_bo        *cb_color_frag_bo[8];
-        struct radeon_bo        *cb_color_tile_bo[8]; /* unused */
+        u64                     cb_color_frag_offset[8];
+        struct radeon_bo        *cb_color_tile_bo[8];
+        u64                     cb_color_tile_offset[8];
+        u32                     cb_color_mask[8];
        u32                     cb_color_info[8];
        u32                     cb_color_view[8];
        u32                     cb_color_size_idx[8]; /* unused */
        u32                     cb_target_mask;
        u32                     cb_shader_mask;  /* unused */
+        bool                    is_resolve;
        u32                     cb_color_size[8];
        u32                     vgt_strmout_en;
        u32                     vgt_strmout_buffer_en;
@@ -311,7 +316,15 @@ static void r600_cs_track_init(struct r600_cs_track *track)
                track->cb_color_bo[i] = NULL;
                track->cb_color_bo_offset[i] = 0xFFFFFFFF;
                track->cb_color_bo_mc[i] = 0xFFFFFFFF;
-        }
+                track->cb_color_frag_bo[i] = NULL;
+                track->cb_color_frag_offset[i] = 0xFFFFFFFF;
+                track->cb_color_tile_bo[i] = NULL;
+                track->cb_color_tile_offset[i] = 0xFFFFFFFF;
+                track->cb_color_mask[i] = 0xFFFFFFFF;
+        }
+        track->is_resolve = false;
+        track->nsamples = 16;
+        track->log_nsamples = 4;
        track->cb_target_mask = 0xFFFFFFFF;
        track->cb_shader_mask = 0xFFFFFFFF;
        track->cb_dirty = true;
@@ -348,11 +361,9 @@ static int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
        volatile u32 *ib = p->ib.ptr;
        unsigned array_mode;
        u32 format;
+        /* When resolve is used, the second colorbuffer has always 1 sample. */
+        unsigned nsamples = track->is_resolve && i == 1 ? 1 : track->nsamples;
-        if (G_0280A0_TILE_MODE(track->cb_color_info[i])) {
-                dev_warn(p->dev, "FMASK or CMASK buffer are not supported by this kernel\n");
-                return -EINVAL;
-        }
        size = radeon_bo_size(track->cb_color_bo[i]) - track->cb_color_bo_offset[i];
        format = G_0280A0_FORMAT(track->cb_color_info[i]);
        if (!r600_fmt_is_valid_color(format)) {
@@ -375,7 +386,7 @@ static int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
        array_check.group_size = track->group_size;
        array_check.nbanks = track->nbanks;
        array_check.npipes = track->npipes;
-        array_check.nsamples = track->nsamples;
+        array_check.nsamples = nsamples;
        array_check.blocksize = r600_fmt_get_blocksize(format);
        if (r600_get_array_mode_alignment(&array_check,
                                          &pitch_align, &height_align, &depth_align, &base_align)) {
@@ -420,7 +431,8 @@ static int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
        }
        /* check offset */
-        tmp = r600_fmt_get_nblocksy(format, height) * r600_fmt_get_nblocksx(format, pitch) * r600_fmt_get_blocksize(format);
+        tmp = r600_fmt_get_nblocksy(format, height) * r600_fmt_get_nblocksx(format, pitch) *
+              r600_fmt_get_blocksize(format) * nsamples;
        switch (array_mode) {
        default:
        case V_0280A0_ARRAY_LINEAR_GENERAL:
@@ -441,7 +453,7 @@ static int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
                         * broken userspace.
                         */
                } else {
-                        dev_warn(p->dev, "%s offset[%d] %d %d %d %lu too big (%d %d) (%d %d %d)\n",
+                        dev_warn(p->dev, "%s offset[%d] %d %llu %d %lu too big (%d %d) (%d %d %d)\n",
                                 __func__, i, array_mode,
                                 track->cb_color_bo_offset[i], tmp,
                                 radeon_bo_size(track->cb_color_bo[i]),
@@ -458,6 +470,51 @@ static int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
        tmp = S_028060_PITCH_TILE_MAX((pitch / 8) - 1) |
                S_028060_SLICE_TILE_MAX(slice_tile_max - 1);
        ib[track->cb_color_size_idx[i]] = tmp;
+        /* FMASK/CMASK */
+        switch (G_0280A0_TILE_MODE(track->cb_color_info[i])) {
+        case V_0280A0_TILE_DISABLE:
+                break;
+        case V_0280A0_FRAG_ENABLE:
+                if (track->nsamples > 1) {
+                        uint32_t tile_max = G_028100_FMASK_TILE_MAX(track->cb_color_mask[i]);
+                        /* the tile size is 8x8, but the size is in units of bits.
+                         * for bytes, do just * 8. */
+                        uint32_t bytes = track->nsamples * track->log_nsamples * 8 * (tile_max + 1);
+                        if (bytes + track->cb_color_frag_offset[i] >
+                            radeon_bo_size(track->cb_color_frag_bo[i])) {
+                                dev_warn(p->dev, "%s FMASK_TILE_MAX too large "
+                                         "(tile_max=%u, bytes=%u, offset=%llu, bo_size=%lu)\n",
+                                         __func__, tile_max, bytes,
+                                         track->cb_color_frag_offset[i],
+                                         radeon_bo_size(track->cb_color_frag_bo[i]));
+                                return -EINVAL;
+                        }
+                }
+                /* fall through */
+        case V_0280A0_CLEAR_ENABLE:
+        {
+                uint32_t block_max = G_028100_CMASK_BLOCK_MAX(track->cb_color_mask[i]);
+                /* One block = 128x128 pixels, one 8x8 tile has 4 bits..
+                 * (128*128) / (8*8) / 2 = 128 bytes per block. */
+                uint32_t bytes = (block_max + 1) * 128;
+                if (bytes + track->cb_color_tile_offset[i] >
+                    radeon_bo_size(track->cb_color_tile_bo[i])) {
+                        dev_warn(p->dev, "%s CMASK_BLOCK_MAX too large "
+                                 "(block_max=%u, bytes=%u, offset=%llu, bo_size=%lu)\n",
+                                 __func__, block_max, bytes,
+                                 track->cb_color_tile_offset[i],
+                                 radeon_bo_size(track->cb_color_tile_bo[i]));
+                        return -EINVAL;
+                }
+                break;
+        }
+        default:
+                dev_warn(p->dev, "%s invalid tile mode\n", __func__);
+                return -EINVAL;
+        }
        return 0;
 }
@@ -566,7 +623,7 @@ static int r600_cs_track_validate_db(struct radeon_cs_parser *p)
                ntiles = G_028000_SLICE_TILE_MAX(track->db_depth_size) + 1;
                nviews = G_028004_SLICE_MAX(track->db_depth_view) + 1;
-                tmp = ntiles * bpe * 64 * nviews;
+                tmp = ntiles * bpe * 64 * nviews * track->nsamples;
                if ((tmp + track->db_offset) > radeon_bo_size(track->db_bo)) {
                        dev_warn(p->dev, "z/stencil buffer (%d) too small (0x%08X %d %d %d -> %u have %lu)\n",
                                        array_mode,
@@ -746,6 +803,12 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
         */
        if (track->cb_dirty) {
                tmp = track->cb_target_mask;
+                /* We must check both colorbuffers for RESOLVE. */
+                if (track->is_resolve) {
+                        tmp |= 0xff;
+                }
                for (i = 0; i < 8; i++) {
                        if ((tmp >> (i * 4)) & 0xF) {
                                /* at least one component is enabled */
@@ -1231,9 +1294,15 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                break;
        case R_028C04_PA_SC_AA_CONFIG:
                tmp = G_028C04_MSAA_NUM_SAMPLES(radeon_get_ib_value(p, idx));
+                track->log_nsamples = tmp;
                track->nsamples = 1 << tmp;
                track->cb_dirty = true;
                break;
+        case R_028808_CB_COLOR_CONTROL:
+                tmp = G_028808_SPECIAL_OP(radeon_get_ib_value(p, idx));
+                track->is_resolve = tmp == V_028808_SPECIAL_RESOLVE_BOX;
+                track->cb_dirty = true;
+                break;
        case R_0280A0_CB_COLOR0_INFO:
        case R_0280A4_CB_COLOR1_INFO:
        case R_0280A8_CB_COLOR2_INFO:
@@ -1312,16 +1381,21 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                dev_err(p->dev, "Broken old userspace ? no cb_color0_base supplied before trying to write 0x%08X\n", reg);
                                return -EINVAL;
                        }
-                        ib[idx] = track->cb_color_base_last[tmp];
                        track->cb_color_frag_bo[tmp] = track->cb_color_bo[tmp];
+                        track->cb_color_frag_offset[tmp] = track->cb_color_bo_offset[tmp];
+                        ib[idx] = track->cb_color_base_last[tmp];
                } else {
                        r = r600_cs_packet_next_reloc(p, &reloc);
                        if (r) {
                                dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
                                return -EINVAL;
                        }
-                        ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                        track->cb_color_frag_bo[tmp] = reloc->robj;
+                        track->cb_color_frag_offset[tmp] = (u64)ib[idx] << 8;
+                        ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                }
+                if (G_0280A0_TILE_MODE(track->cb_color_info[tmp])) {
+                        track->cb_dirty = true;
                }
                break;
        case R_0280C0_CB_COLOR0_TILE:
@@ -1338,16 +1412,35 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                dev_err(p->dev, "Broken old userspace ? no cb_color0_base supplied before trying to write 0x%08X\n", reg);
                                return -EINVAL;
                        }
-                        ib[idx] = track->cb_color_base_last[tmp];
                        track->cb_color_tile_bo[tmp] = track->cb_color_bo[tmp];
+                        track->cb_color_tile_offset[tmp] = track->cb_color_bo_offset[tmp];
+                        ib[idx] = track->cb_color_base_last[tmp];
                } else {
                        r = r600_cs_packet_next_reloc(p, &reloc);
                        if (r) {
                                dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
                                return -EINVAL;
                        }
-                        ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                        track->cb_color_tile_bo[tmp] = reloc->robj;
+                        track->cb_color_tile_offset[tmp] = (u64)ib[idx] << 8;
+                        ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                }
+                if (G_0280A0_TILE_MODE(track->cb_color_info[tmp])) {
+                        track->cb_dirty = true;
+                }
+                break;
+        case R_028100_CB_COLOR0_MASK:
+        case R_028104_CB_COLOR1_MASK:
+        case R_028108_CB_COLOR2_MASK:
+        case R_02810C_CB_COLOR3_MASK:
+        case R_028110_CB_COLOR4_MASK:
+        case R_028114_CB_COLOR5_MASK:
+        case R_028118_CB_COLOR6_MASK:
+        case R_02811C_CB_COLOR7_MASK:
+                tmp = (reg - R_028100_CB_COLOR0_MASK) / 4;
+                track->cb_color_mask[tmp] = radeon_get_ib_value(p, idx);
+                if (G_0280A0_TILE_MODE(track->cb_color_info[tmp])) {
+                        track->cb_dirty = true;
                }
                break;
        case CB_COLOR0_BASE:
@@ -1492,7 +1585,7 @@ unsigned r600_mip_minify(unsigned size, unsigned level)
 }
 static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
-                              unsigned w0, unsigned h0, unsigned d0, unsigned format,
+                              unsigned w0, unsigned h0, unsigned d0, unsigned nsamples, unsigned format,
                              unsigned block_align, unsigned height_align, unsigned base_align,
                              unsigned *l0_size, unsigned *mipmap_size)
 {
@@ -1520,7 +1613,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
                depth = r600_mip_minify(d0, i);
-                size = nbx * nby * blocksize;
+                size = nbx * nby * blocksize * nsamples;
                if (nfaces)
                        size *= nfaces;
                else
@@ -1672,7 +1765,7 @@ static int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 idx,
                nfaces = larray - barray + 1;
        }
-        r600_texture_size(nfaces, blevel, llevel, w0, h0, d0, format,
+        r600_texture_size(nfaces, blevel, llevel, w0, h0, d0, array_check.nsamples, format,
                          pitch_align, height_align, base_align,
                          &l0_size, &mipmap_size);
        /* using get ib will give us the offset into the texture bo */
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index fd328f4c3ea8..fa6f37099ba9 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -66,6 +66,14 @@
 #define CC_RB_BACKEND_DISABLE                           0x98F4
 #define         BACKEND_DISABLE(x)                              ((x) << 16)
+#define R_028808_CB_COLOR_CONTROL                       0x28808
+#define   S_028808_SPECIAL_OP(x)                       (((x) & 0x7) << 4)
+#define   G_028808_SPECIAL_OP(x)                       (((x) >> 4) & 0x7)
+#define   C_028808_SPECIAL_OP                          0xFFFFFF8F
+#define     V_028808_SPECIAL_NORMAL                     0x00
+#define     V_028808_SPECIAL_DISABLE                    0x01
+#define     V_028808_SPECIAL_RESOLVE_BOX                0x07
 #define CB_COLOR0_BASE                                  0x28040
 #define CB_COLOR1_BASE                                  0x28044
 #define CB_COLOR2_BASE                                  0x28048
@@ -92,6 +100,20 @@
 #define R_028094_CB_COLOR5_VIEW                      0x028094
 #define R_028098_CB_COLOR6_VIEW                      0x028098
 #define R_02809C_CB_COLOR7_VIEW                      0x02809C
+#define R_028100_CB_COLOR0_MASK                      0x028100
+#define   S_028100_CMASK_BLOCK_MAX(x)                  (((x) & 0xFFF) << 0)
+#define   G_028100_CMASK_BLOCK_MAX(x)                  (((x) >> 0) & 0xFFF)
+#define   C_028100_CMASK_BLOCK_MAX                     0xFFFFF000
+#define   S_028100_FMASK_TILE_MAX(x)                   (((x) & 0xFFFFF) << 12)
+#define   G_028100_FMASK_TILE_MAX(x)                   (((x) >> 12) & 0xFFFFF)
+#define   C_028100_FMASK_TILE_MAX                      0x00000FFF
+#define R_028104_CB_COLOR1_MASK                      0x028104
+#define R_028108_CB_COLOR2_MASK                      0x028108
+#define R_02810C_CB_COLOR3_MASK                      0x02810C
+#define R_028110_CB_COLOR4_MASK                      0x028110
+#define R_028114_CB_COLOR5_MASK                      0x028114
+#define R_028118_CB_COLOR6_MASK                      0x028118
+#define R_02811C_CB_COLOR7_MASK                      0x02811C
 #define CB_COLOR0_INFO                                  0x280a0
 #       define CB_FORMAT(x)                             ((x) << 2)
 #       define CB_ARRAY_MODE(x)                         ((x) << 8)
@@ -1400,6 +1422,9 @@
 #define   S_0280A0_TILE_MODE(x)                        (((x) & 0x3) << 18)
 #define   G_0280A0_TILE_MODE(x)                        (((x) >> 18) & 0x3)
 #define   C_0280A0_TILE_MODE                           0xFFF3FFFF
+#define     V_0280A0_TILE_DISABLE                       0
+#define     V_0280A0_CLEAR_ENABLE                       1
+#define     V_0280A0_FRAG_ENABLE                        2
 #define   S_0280A0_BLEND_CLAMP(x)                      (((x) & 0x1) << 20)
 #define   G_0280A0_BLEND_CLAMP(x)                      (((x) >> 20) & 0x1)
 #define   C_0280A0_BLEND_CLAMP                         0xFFEFFFFF
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 99304194a65c..59a15315ae9f 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -142,21 +142,6 @@ struct radeon_device;
 /*
 * BIOS.
 */
-#define ATRM_BIOS_PAGE 4096
-#if defined(CONFIG_VGA_SWITCHEROO)
-bool radeon_atrm_supported(struct pci_dev *pdev);
-int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len);
-#else
-static inline bool radeon_atrm_supported(struct pci_dev *pdev)
-{
-        return false;
-}
-static inline int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len){
-        return -EINVAL;
-}
-#endif
 bool radeon_get_bios(struct radeon_device *rdev);
 /*
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index f9c21f9d16bc..d67d4f3eb6f4 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -452,7 +452,7 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
        }
        /* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */
-        if ((dev->pdev->device == 0x9802) &&
+        if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) &&
            (dev->pdev->subsystem_vendor == 0x1734) &&
            (dev->pdev->subsystem_device == 0x11bd)) {
                if (*connector_type == DRM_MODE_CONNECTOR_VGA) {
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 98724fcb0088..2a2cf0b88a28 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -30,57 +30,8 @@ static struct radeon_atpx_priv {
        /* handle for device - and atpx */
        acpi_handle dhandle;
        acpi_handle atpx_handle;
-        acpi_handle atrm_handle;
 } radeon_atpx_priv;
-/* retrieve the ROM in 4k blocks */
-static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
-                            int offset, int len)
-{
-        acpi_status status;
-        union acpi_object atrm_arg_elements[2], *obj;
-        struct acpi_object_list atrm_arg;
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
-        atrm_arg.count = 2;
-        atrm_arg.pointer = &atrm_arg_elements[0];
-        atrm_arg_elements[0].type = ACPI_TYPE_INTEGER;
-        atrm_arg_elements[0].integer.value = offset;
-        atrm_arg_elements[1].type = ACPI_TYPE_INTEGER;
-        atrm_arg_elements[1].integer.value = len;
-        status = acpi_evaluate_object(atrm_handle, NULL, &atrm_arg, &buffer);
-        if (ACPI_FAILURE(status)) {
-                printk("failed to evaluate ATRM got %s\n", acpi_format_exception(status));
-                return -ENODEV;
-        }
-        obj = (union acpi_object *)buffer.pointer;
-        memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
-        len = obj->buffer.length;
-        kfree(buffer.pointer);
-        return len;
-}
-bool radeon_atrm_supported(struct pci_dev *pdev)
-{
-        /* get the discrete ROM only via ATRM */
-        if (!radeon_atpx_priv.atpx_detected)
-                return false;
-        if (radeon_atpx_priv.dhandle == DEVICE_ACPI_HANDLE(&pdev->dev))
-                return false;
-        return true;
-}
-int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len)
-{
-        return radeon_atrm_call(radeon_atpx_priv.atrm_handle, bios, offset, len);
-}
 static int radeon_atpx_get_version(acpi_handle handle)
 {
        acpi_status status;
@@ -198,7 +149,7 @@ static int radeon_atpx_power_state(enum vga_switcheroo_client_id id,
 static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
 {
-        acpi_handle dhandle, atpx_handle, atrm_handle;
+        acpi_handle dhandle, atpx_handle;
        acpi_status status;
        dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
@@ -209,13 +160,8 @@ static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
        if (ACPI_FAILURE(status))
                return false;
-        status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
-        if (ACPI_FAILURE(status))
-                return false;
        radeon_atpx_priv.dhandle = dhandle;
        radeon_atpx_priv.atpx_handle = atpx_handle;
-        radeon_atpx_priv.atrm_handle = atrm_handle;
        return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 501f4881e5aa..d306cc8fdeaa 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -32,6 +32,7 @@
 #include <linux/vga_switcheroo.h>
 #include <linux/slab.h>
+#include <linux/acpi.h>
 /*
 * BIOS.
 */
@@ -98,16 +99,81 @@ static bool radeon_read_bios(struct radeon_device *rdev)
        return true;
 }
+#ifdef CONFIG_ACPI
 /* ATRM is used to get the BIOS on the discrete cards in
 * dual-gpu systems.
 */
+/* retrieve the ROM in 4k blocks */
+#define ATRM_BIOS_PAGE 4096
+/**
+ * radeon_atrm_call - fetch a chunk of the vbios
+ *
+ * @atrm_handle: acpi ATRM handle
+ * @bios: vbios image pointer
+ * @offset: offset of vbios image data to fetch
+ * @len: length of vbios image data to fetch
+ *
+ * Executes ATRM to fetch a chunk of the discrete
+ * vbios image on PX systems (all asics).
+ * Returns the length of the buffer fetched.
+ */
+static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
+                            int offset, int len)
+{
+        acpi_status status;
+        union acpi_object atrm_arg_elements[2], *obj;
+        struct acpi_object_list atrm_arg;
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
+        atrm_arg.count = 2;
+        atrm_arg.pointer = &atrm_arg_elements[0];
+        atrm_arg_elements[0].type = ACPI_TYPE_INTEGER;
+        atrm_arg_elements[0].integer.value = offset;
+        atrm_arg_elements[1].type = ACPI_TYPE_INTEGER;
+        atrm_arg_elements[1].integer.value = len;
+        status = acpi_evaluate_object(atrm_handle, NULL, &atrm_arg, &buffer);
+        if (ACPI_FAILURE(status)) {
+                printk("failed to evaluate ATRM got %s\n", acpi_format_exception(status));
+                return -ENODEV;
+        }
+        obj = (union acpi_object *)buffer.pointer;
+        memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
+        len = obj->buffer.length;
+        kfree(buffer.pointer);
+        return len;
+}
 static bool radeon_atrm_get_bios(struct radeon_device *rdev)
 {
        int ret;
        int size = 256 * 1024;
        int i;
+        struct pci_dev *pdev = NULL;
+        acpi_handle dhandle, atrm_handle;
+        acpi_status status;
+        bool found = false;
+        /* ATRM is for the discrete card only */
+        if (rdev->flags & RADEON_IS_IGP)
+                return false;
+        while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
+                dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+                if (!dhandle)
+                        continue;
+                status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
+                if (!ACPI_FAILURE(status)) {
+                        found = true;
+                        break;
+                }
+        }
-        if (!radeon_atrm_supported(rdev->pdev))
+        if (!found)
                return false;
        rdev->bios = kmalloc(size, GFP_KERNEL);
@@ -117,9 +183,10 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
        }
        for (i = 0; i < size / ATRM_BIOS_PAGE; i++) {
-                ret = radeon_atrm_get_bios_chunk(rdev->bios,
+                ret = radeon_atrm_call(atrm_handle,
-                                                 (i * ATRM_BIOS_PAGE),
+                                       rdev->bios,
-                                                 ATRM_BIOS_PAGE);
+                                       (i * ATRM_BIOS_PAGE),
+                                       ATRM_BIOS_PAGE);
                if (ret < ATRM_BIOS_PAGE)
                        break;
        }
@@ -130,6 +197,12 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
        }
        return true;
 }
+#else
+static inline bool radeon_atrm_get_bios(struct radeon_device *rdev)
+{
+        return false;
+}
+#endif
 static bool ni_read_disabled_bios(struct radeon_device *rdev)
 {
@@ -476,6 +549,61 @@ static bool radeon_read_disabled_bios(struct radeon_device *rdev)
                return legacy_read_disabled_bios(rdev);
 }
+#ifdef CONFIG_ACPI
+static bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+{
+        bool ret = false;
+        struct acpi_table_header *hdr;
+        acpi_size tbl_size;
+        UEFI_ACPI_VFCT *vfct;
+        GOP_VBIOS_CONTENT *vbios;
+        VFCT_IMAGE_HEADER *vhdr;
+        if (!ACPI_SUCCESS(acpi_get_table_with_size("VFCT", 1, &hdr, &tbl_size)))
+                return false;
+        if (tbl_size < sizeof(UEFI_ACPI_VFCT)) {
+                DRM_ERROR("ACPI VFCT table present but broken (too short #1)\n");
+                goto out_unmap;
+        }
+        vfct = (UEFI_ACPI_VFCT *)hdr;
+        if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) > tbl_size) {
+                DRM_ERROR("ACPI VFCT table present but broken (too short #2)\n");
+                goto out_unmap;
+        }
+        vbios = (GOP_VBIOS_CONTENT *)((char *)hdr + vfct->VBIOSImageOffset);
+        vhdr = &vbios->VbiosHeader;
+        DRM_INFO("ACPI VFCT contains a BIOS for %02x:%02x.%d %04x:%04x, size %d\n",
+                        vhdr->PCIBus, vhdr->PCIDevice, vhdr->PCIFunction,
+                        vhdr->VendorID, vhdr->DeviceID, vhdr->ImageLength);
+        if (vhdr->PCIBus != rdev->pdev->bus->number ||
+            vhdr->PCIDevice != PCI_SLOT(rdev->pdev->devfn) ||
+            vhdr->PCIFunction != PCI_FUNC(rdev->pdev->devfn) ||
+            vhdr->VendorID != rdev->pdev->vendor ||
+            vhdr->DeviceID != rdev->pdev->device) {
+                DRM_INFO("ACPI VFCT table is not for this card\n");
+                goto out_unmap;
+        };
+        if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) + vhdr->ImageLength > tbl_size) {
+                DRM_ERROR("ACPI VFCT image truncated\n");
+                goto out_unmap;
+        }
+        rdev->bios = kmemdup(&vbios->VbiosContent, vhdr->ImageLength, GFP_KERNEL);
+        ret = !!rdev->bios;
+out_unmap:
+        return ret;
+}
+#else
+static inline bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+{
+        return false;
+}
+#endif
 bool radeon_get_bios(struct radeon_device *rdev)
 {
@@ -484,6 +612,8 @@ bool radeon_get_bios(struct radeon_device *rdev)
        r = radeon_atrm_get_bios(rdev);
        if (r == false)
+                r = radeon_acpi_vfct_bios(rdev);
+        if (r == false)
                r = igp_read_bios_from_vram(rdev);
        if (r == false)
                r = radeon_read_bios(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index d2e243867ac6..7a3daebd732d 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1051,7 +1051,7 @@ int radeon_device_init(struct radeon_device *rdev,
        if (rdev->flags & RADEON_IS_AGP)
                rdev->need_dma32 = true;
        if ((rdev->flags & RADEON_IS_PCI) &&
-            (rdev->family < CHIP_RS400))
+            (rdev->family <= CHIP_RS740))
                rdev->need_dma32 = true;
        dma_bits = rdev->need_dma32 ? 32 : 40;
@@ -1346,12 +1346,15 @@ retry:
                for (i = 0; i < RADEON_NUM_RINGS; ++i) {
                        radeon_ring_restore(rdev, &rdev->ring[i],
                                            ring_sizes[i], ring_data[i]);
+                        ring_sizes[i] = 0;
+                        ring_data[i] = NULL;
                }
                r = radeon_ib_ring_tests(rdev);
                if (r) {
                        dev_err(rdev->dev, "ib ring test failed (%d).\n", r);
                        if (saved) {
+                                saved = false;
                                radeon_suspend(rdev);
                                goto retry;
                        }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index d7269f48d37c..8c593ea82c41 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -62,9 +62,11 @@
 *   2.18.0 - r600-eg: allow "invalid" DB formats
 *   2.19.0 - r600-eg: MSAA textures
 *   2.20.0 - r600-si: RADEON_INFO_TIMESTAMP query
+ *   2.21.0 - r600-r700: FMASK and CMASK
+ *   2.22.0 - r600 only: RESOLVE_BOX allowed
 */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        20
+#define KMS_DRIVER_MINOR        22
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 7b737b9339ad..2a59375dbe52 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -131,7 +131,7 @@ int radeon_fence_emit(struct radeon_device *rdev,
 */
 void radeon_fence_process(struct radeon_device *rdev, int ring)
 {
-        uint64_t seq, last_seq;
+        uint64_t seq, last_seq, last_emitted;
        unsigned count_loop = 0;
        bool wake = false;
@@ -158,13 +158,15 @@ void radeon_fence_process(struct radeon_device *rdev, int ring)
         */
        last_seq = atomic64_read(&rdev->fence_drv[ring].last_seq);
        do {
+                last_emitted = rdev->fence_drv[ring].sync_seq[ring];
                seq = radeon_fence_read(rdev, ring);
                seq |= last_seq & 0xffffffff00000000LL;
                if (seq < last_seq) {
-                        seq += 0x100000000LL;
+                        seq &= 0xffffffff;
+                        seq |= last_emitted & 0xffffffff00000000LL;
                }
-                if (seq == last_seq) {
+                if (seq <= last_seq || seq > last_emitted) {
                        break;
                }
                /* If we loop over we don't want to return without
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 1cb014b571ab..9024e7222839 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -132,6 +132,7 @@ int radeon_bo_create(struct radeon_device *rdev,
        acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
                                       sizeof(struct radeon_bo));
+retry:
        bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
        if (bo == NULL)
                return -ENOMEM;
@@ -145,8 +146,6 @@ int radeon_bo_create(struct radeon_device *rdev,
        bo->surface_reg = -1;
        INIT_LIST_HEAD(&bo->list);
        INIT_LIST_HEAD(&bo->va);
-retry:
        radeon_ttm_placement_from_domain(bo, domain);
        /* Kernel allocation are uninterruptible */
        down_read(&rdev->pm.mclk_lock);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index ec79b3750430..43c431a2686d 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -706,6 +706,7 @@ int radeon_ring_init(struct radeon_device *rdev, struct radeon_ring *ring, unsig
        if (radeon_debugfs_ring_init(rdev, ring)) {
                DRM_ERROR("Failed to register debugfs file for rings !\n");
        }
+        radeon_ring_lockup_update(ring);
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r600 b/drivers/gpu/drm/radeon/reg_srcs/r600
index 5e659b034d9a..20bfbda7b3f1 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r600
+++ b/drivers/gpu/drm/radeon/reg_srcs/r600
@@ -744,15 +744,6 @@ r600 0x9400
 0x00028C38 CB_CLRCMP_DST
 0x00028C3C CB_CLRCMP_MSK
 0x00028C34 CB_CLRCMP_SRC
-0x00028100 CB_COLOR0_MASK
-0x00028104 CB_COLOR1_MASK
-0x00028108 CB_COLOR2_MASK
-0x0002810C CB_COLOR3_MASK
-0x00028110 CB_COLOR4_MASK
-0x00028114 CB_COLOR5_MASK
-0x00028118 CB_COLOR6_MASK
-0x0002811C CB_COLOR7_MASK
-0x00028808 CB_COLOR_CONTROL
 0x0002842C CB_FOG_BLUE
 0x00028428 CB_FOG_GREEN
 0x00028424 CB_FOG_RED
diff --git a/drivers/gpu/drm/savage/savage_drv.c b/drivers/gpu/drm/savage/savage_drv.c
index d31d4cca9a4c..c5a164337bd5 100644
--- a/drivers/gpu/drm/savage/savage_drv.c
+++ b/drivers/gpu/drm/savage/savage_drv.c
@@ -43,6 +43,9 @@ static const struct file_operations savage_driver_fops = {
        .mmap = drm_mmap,
        .poll = drm_poll,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .llseek = noop_llseek,
 };
diff --git a/drivers/gpu/drm/sis/sis_drv.c b/drivers/gpu/drm/sis/sis_drv.c
index 7f119870147c..867dc03000e6 100644
--- a/drivers/gpu/drm/sis/sis_drv.c
+++ b/drivers/gpu/drm/sis/sis_drv.c
@@ -74,6 +74,9 @@ static const struct file_operations sis_driver_fops = {
        .mmap = drm_mmap,
        .poll = drm_poll,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .llseek = noop_llseek,
 };
diff --git a/drivers/gpu/drm/tdfx/tdfx_drv.c b/drivers/gpu/drm/tdfx/tdfx_drv.c
index 90f6b13acfac..a7f4d6bd1330 100644
--- a/drivers/gpu/drm/tdfx/tdfx_drv.c
+++ b/drivers/gpu/drm/tdfx/tdfx_drv.c
@@ -49,6 +49,9 @@ static const struct file_operations tdfx_driver_fops = {
        .mmap = drm_mmap,
        .poll = drm_poll,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .llseek = noop_llseek,
 };
diff --git a/drivers/gpu/drm/udl/Kconfig b/drivers/gpu/drm/udl/Kconfig
index 0b5e096d39a6..56e0bf31d425 100644
--- a/drivers/gpu/drm/udl/Kconfig
+++ b/drivers/gpu/drm/udl/Kconfig
@@ -1,6 +1,7 @@
 config DRM_UDL
        tristate "DisplayLink"
        depends on DRM && EXPERIMENTAL
+        depends on USB_ARCH_HAS_HCD
        select DRM_USB
        select FB_SYS_FILLRECT
        select FB_SYS_COPYAREA
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 6e52069894b3..9f84128505bb 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -66,6 +66,9 @@ static const struct file_operations udl_driver_fops = {
        .unlocked_ioctl = drm_ioctl,
        .release = drm_release,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .llseek = noop_llseek,
 };
diff --git a/drivers/gpu/drm/udl/udl_modeset.c b/drivers/gpu/drm/udl/udl_modeset.c
index f5dd89e891de..9159d48d1dfd 100644
--- a/drivers/gpu/drm/udl/udl_modeset.c
+++ b/drivers/gpu/drm/udl/udl_modeset.c
@@ -354,8 +354,7 @@ static int udl_crtc_mode_set(struct drm_crtc *crtc,
 static void udl_crtc_disable(struct drm_crtc *crtc)
 {
+        udl_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
 }
 static void udl_crtc_destroy(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/via/via_drv.c b/drivers/gpu/drm/via/via_drv.c
index e927b4c052f5..af1b914b17e3 100644
--- a/drivers/gpu/drm/via/via_drv.c
+++ b/drivers/gpu/drm/via/via_drv.c
@@ -65,6 +65,9 @@ static const struct file_operations via_driver_fops = {
        .mmap = drm_mmap,
        .poll = drm_poll,
        .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
        .llseek = noop_llseek,
 };
diff --git a/drivers/gpu/drm/vmwgfx/Kconfig b/drivers/gpu/drm/vmwgfx/Kconfig
index 794ff67c5701..b71bcd0bfbbf 100644
--- a/drivers/gpu/drm/vmwgfx/Kconfig
+++ b/drivers/gpu/drm/vmwgfx/Kconfig
@@ -12,3 +12,11 @@ config DRM_VMWGFX
          This is a KMS enabled DRM driver for the VMware SVGA2
          virtual hardware.
          The compiled module will be called "vmwgfx.ko".
+config DRM_VMWGFX_FBCON
+        depends on DRM_VMWGFX
+        bool "Enable framebuffer console under vmwgfx by default"
+        help
+           Choose this option if you are shipping a new vmwgfx
+           userspace driver that supports using the kernel driver.
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 4d9edead01ac..ba2c35dbf10e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -182,8 +182,9 @@ static struct pci_device_id vmw_pci_id_list[] = {
        {0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII},
        {0, 0, 0}
 };
+MODULE_DEVICE_TABLE(pci, vmw_pci_id_list);
-static int enable_fbdev;
+static int enable_fbdev = IS_ENABLED(CONFIG_DRM_VMWGFX_FBCON);
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
@@ -1154,6 +1155,11 @@ static struct drm_driver driver = {
        .open = vmw_driver_open,
        .preclose = vmw_preclose,
        .postclose = vmw_postclose,
+        .dumb_create = vmw_dumb_create,
+        .dumb_map_offset = vmw_dumb_map_offset,
+        .dumb_destroy = vmw_dumb_destroy,
        .fops = &vmwgfx_driver_fops,
        .name = VMWGFX_DRIVER_NAME,
        .desc = VMWGFX_DRIVER_DESC,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index d0f2c079ee27..29c984ff7f23 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_private *dev_priv,
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
+int vmw_dumb_create(struct drm_file *file_priv,
+                    struct drm_device *dev,
+                    struct drm_mode_create_dumb *args);
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+                        struct drm_device *dev, uint32_t handle,
+                        uint64_t *offset);
+int vmw_dumb_destroy(struct drm_file *file_priv,
+                     struct drm_device *dev,
+                     uint32_t handle);
 /**
 * Overlay control - vmwgfx_overlay.c
 */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 6b0078ffa763..c50724bd30f6 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1688,15 +1688,19 @@ int vmw_du_page_flip(struct drm_crtc *crtc,
        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
        struct drm_framebuffer *old_fb = crtc->fb;
        struct vmw_framebuffer *vfb = vmw_framebuffer_to_vfb(fb);
-        struct drm_file *file_priv = event->base.file_priv;
+        struct drm_file *file_priv ;
        struct vmw_fence_obj *fence = NULL;
        struct drm_clip_rect clips;
        int ret;
+        if (event == NULL)
+                return -EINVAL;
        /* require ScreenObject support for page flipping */
        if (!dev_priv->sou_priv)
                return -ENOSYS;
+        file_priv = event->base.file_priv;
        if (!vmw_kms_screen_object_flippable(dev_priv, crtc))
                return -EINVAL;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 22bf9a21ec71..2c6ffe0e2c07 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -1917,3 +1917,76 @@ err_ref:
        vmw_resource_unreference(&res);
        return ret;
 }
+int vmw_dumb_create(struct drm_file *file_priv,
+                    struct drm_device *dev,
+                    struct drm_mode_create_dumb *args)
+{
+        struct vmw_private *dev_priv = vmw_priv(dev);
+        struct vmw_master *vmaster = vmw_master(file_priv->master);
+        struct vmw_user_dma_buffer *vmw_user_bo;
+        struct ttm_buffer_object *tmp;
+        int ret;
+        args->pitch = args->width * ((args->bpp + 7) / 8);
+        args->size = args->pitch * args->height;
+        vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
+        if (vmw_user_bo == NULL)
+                return -ENOMEM;
+        ret = ttm_read_lock(&vmaster->lock, true);
+        if (ret != 0) {
+                kfree(vmw_user_bo);
+                return ret;
+        }
+        ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
+                              &vmw_vram_sys_placement, true,
+                              &vmw_user_dmabuf_destroy);
+        if (ret != 0)
+                goto out_no_dmabuf;
+        tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
+        ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
+                                   &vmw_user_bo->base,
+                                   false,
+                                   ttm_buffer_type,
+                                   &vmw_user_dmabuf_release, NULL);
+        if (unlikely(ret != 0))
+                goto out_no_base_object;
+        args->handle = vmw_user_bo->base.hash.key;
+out_no_base_object:
+        ttm_bo_unref(&tmp);
+out_no_dmabuf:
+        ttm_read_unlock(&vmaster->lock);
+        return ret;
+}
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+                        struct drm_device *dev, uint32_t handle,
+                        uint64_t *offset)
+{
+        struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+        struct vmw_dma_buffer *out_buf;
+        int ret;
+        ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
+        if (ret != 0)
+                return -EINVAL;
+        *offset = out_buf->base.addr_space_offset;
+        vmw_dmabuf_unreference(&out_buf);
+        return 0;
+}
+int vmw_dumb_destroy(struct drm_file *file_priv,
+                     struct drm_device *dev,
+                     uint32_t handle)
+{
+        return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
+                                         handle, TTM_REF_USAGE);
+}
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index 5b3c7d135dc9..e25cf31faab2 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -70,27 +70,12 @@ static struct vgasr_priv vgasr_priv = {
        .clients = LIST_HEAD_INIT(vgasr_priv.clients),
 };
-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler)
+static bool vga_switcheroo_ready(void)
-{
-        mutex_lock(&vgasr_mutex);
-        if (vgasr_priv.handler) {
-                mutex_unlock(&vgasr_mutex);
-                return -EINVAL;
-        }
-        vgasr_priv.handler = handler;
-        mutex_unlock(&vgasr_mutex);
-        return 0;
-}
-EXPORT_SYMBOL(vga_switcheroo_register_handler);
-void vga_switcheroo_unregister_handler(void)
 {
-        mutex_lock(&vgasr_mutex);
+        /* we're ready if we get two clients + handler */
-        vgasr_priv.handler = NULL;
+        return !vgasr_priv.active &&
-        mutex_unlock(&vgasr_mutex);
+               vgasr_priv.registered_clients == 2 && vgasr_priv.handler;
 }
-EXPORT_SYMBOL(vga_switcheroo_unregister_handler);
 static void vga_switcheroo_enable(void)
 {
@@ -98,7 +83,8 @@ static void vga_switcheroo_enable(void)
        struct vga_switcheroo_client *client;
        /* call the handler to init */
-        vgasr_priv.handler->init();
+        if (vgasr_priv.handler->init)
+                vgasr_priv.handler->init();
        list_for_each_entry(client, &vgasr_priv.clients, list) {
                if (client->id != -1)
@@ -113,6 +99,37 @@ static void vga_switcheroo_enable(void)
        vgasr_priv.active = true;
 }
+int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler)
+{
+        mutex_lock(&vgasr_mutex);
+        if (vgasr_priv.handler) {
+                mutex_unlock(&vgasr_mutex);
+                return -EINVAL;
+        }
+        vgasr_priv.handler = handler;
+        if (vga_switcheroo_ready()) {
+                printk(KERN_INFO "vga_switcheroo: enabled\n");
+                vga_switcheroo_enable();
+        }
+        mutex_unlock(&vgasr_mutex);
+        return 0;
+}
+EXPORT_SYMBOL(vga_switcheroo_register_handler);
+void vga_switcheroo_unregister_handler(void)
+{
+        mutex_lock(&vgasr_mutex);
+        vgasr_priv.handler = NULL;
+        if (vgasr_priv.active) {
+                pr_info("vga_switcheroo: disabled\n");
+                vga_switcheroo_debugfs_fini(&vgasr_priv);
+                vgasr_priv.active = false;
+        }
+        mutex_unlock(&vgasr_mutex);
+}
+EXPORT_SYMBOL(vga_switcheroo_unregister_handler);
 static int register_client(struct pci_dev *pdev,
                           const struct vga_switcheroo_client_ops *ops,
                           int id, bool active)
@@ -134,9 +151,7 @@ static int register_client(struct pci_dev *pdev,
        if (client_is_vga(client))
                vgasr_priv.registered_clients++;
-        /* if we get two clients + handler */
+        if (vga_switcheroo_ready()) {
-        if (!vgasr_priv.active &&
-            vgasr_priv.registered_clients == 2 && vgasr_priv.handler) {
                printk(KERN_INFO "vga_switcheroo: enabled\n");
                vga_switcheroo_enable();
        }
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 60ea284407ce..8bcd168fffae 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -996,7 +996,8 @@ static void hid_process_event(struct hid_device *hid, struct hid_field *field,
        struct hid_driver *hdrv = hid->driver;
        int ret;
-        hid_dump_input(hid, usage, value);
+        if (!list_empty(&hid->debug_list))
+                hid_dump_input(hid, usage, value);
        if (hdrv && hdrv->event && hid_match_usage(hid, usage)) {
                ret = hdrv->event(hid, field, usage, value);
@@ -1558,7 +1559,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPKBD) },
+#if IS_ENABLED(CONFIG_HID_LENOVO_TPKBD)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPKBD) },
+#endif
        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
@@ -1624,7 +1627,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
        { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
        { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN) },
        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONE) },
        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 0f9c146fc00d..4d524b5f52f5 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -439,7 +439,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
        struct dj_report *dj_report;
        int retval;
-        dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
+        dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
        if (!dj_report)
                return -ENOMEM;
        dj_report->report_id = REPORT_ID_DJ_SHORT;
@@ -456,7 +456,7 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
        struct dj_report *dj_report;
        int retval;
-        dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
+        dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
        if (!dj_report)
                return -ENOMEM;
        dj_report->report_id = REPORT_ID_DJ_SHORT;
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 903eef3d3e10..991e85c7325c 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -70,6 +70,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 351d1f4593e7..4ee578948723 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -34,6 +34,12 @@ static const struct dmi_system_id __initconst atk_force_new_if[] = {
                .matches = {
                        DMI_MATCH(DMI_BOARD_NAME, "SABERTOOTH X58")
                }
+        }, {
+                /* Old interface reads the same sensor for fan0 and fan1 */
+                .ident = "Asus M5A78L",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_NAME, "M5A78L")
+                }
        },
        { }
 };
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index faa16f80db9c..0fa356fe82cc 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -196,7 +196,7 @@ struct tjmax {
        int tjmax;
 };
-static struct tjmax __cpuinitconst tjmax_table[] = {
+static const struct tjmax __cpuinitconst tjmax_table[] = {
        { "CPU D410", 100000 },
        { "CPU D425", 100000 },
        { "CPU D510", 100000 },
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index 7f3f4a385729..602148299f68 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -69,22 +69,6 @@ struct ina2xx_data {
        u16 regs[INA2XX_MAX_REGISTERS];
 };
-int ina2xx_read_word(struct i2c_client *client, int reg)
-{
-        int val = i2c_smbus_read_word_data(client, reg);
-        if (unlikely(val < 0)) {
-                dev_dbg(&client->dev,
-                        "Failed to read register: %d\n", reg);
-                return val;
-        }
-        return be16_to_cpu(val);
-}
-void ina2xx_write_word(struct i2c_client *client, int reg, int data)
-{
-        i2c_smbus_write_word_data(client, reg, cpu_to_be16(data));
-}
 static struct ina2xx_data *ina2xx_update_device(struct device *dev)
 {
        struct i2c_client *client = to_i2c_client(dev);
@@ -102,7 +86,7 @@ static struct ina2xx_data *ina2xx_update_device(struct device *dev)
                /* Read all registers */
                for (i = 0; i < data->registers; i++) {
-                        int rv = ina2xx_read_word(client, i);
+                        int rv = i2c_smbus_read_word_swapped(client, i);
                        if (rv < 0) {
                                ret = ERR_PTR(rv);
                                goto abort;
@@ -279,22 +263,26 @@ static int ina2xx_probe(struct i2c_client *client,
        switch (data->kind) {
        case ina219:
                /* device configuration */
-                ina2xx_write_word(client, INA2XX_CONFIG, INA219_CONFIG_DEFAULT);
+                i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+                                             INA219_CONFIG_DEFAULT);
                /* set current LSB to 1mA, shunt is in uOhms */
                /* (equation 13 in datasheet) */
-                ina2xx_write_word(client, INA2XX_CALIBRATION, 40960000 / shunt);
+                i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+                                             40960000 / shunt);
                dev_info(&client->dev,
                         "power monitor INA219 (Rshunt = %li uOhm)\n", shunt);
                data->registers = INA219_REGISTERS;
                break;
        case ina226:
                /* device configuration */
-                ina2xx_write_word(client, INA2XX_CONFIG, INA226_CONFIG_DEFAULT);
+                i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+                                             INA226_CONFIG_DEFAULT);
                /* set current LSB to 1mA, shunt is in uOhms */
                /* (equation 1 in datasheet)*/
-                ina2xx_write_word(client, INA2XX_CALIBRATION, 5120000 / shunt);
+                i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+                                             5120000 / shunt);
                dev_info(&client->dev,
                         "power monitor INA226 (Rshunt = %li uOhm)\n", shunt);
                data->registers = INA226_REGISTERS;
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index 0018c7dd0097..1a174f0a3cde 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -44,12 +44,13 @@ static ssize_t madc_read(struct device *dev,
                         struct device_attribute *devattr, char *buf)
 {
        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct twl4030_madc_request req;
+        struct twl4030_madc_request req = {
+                .channels = 1 << attr->index,
+                .method = TWL4030_MADC_SW2,
+                .type = TWL4030_MADC_WAIT,
+        };
        long val;
-        req.channels = (1 << attr->index);
-        req.method = TWL4030_MADC_SW2;
-        req.func_cb = NULL;
        val = twl4030_madc_conversion(&req);
        if (val < 0)
                return val;
diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index ab4825205a9d..5b1a6a666441 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -1206,7 +1206,7 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
        int err = -ENODEV;
        u16 val;
-        static const __initdata char *names[] = {
+        static __initconst char *const names[] = {
                "W83627HF",
                "W83627THF",
                "W83697HF",
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 73133b1063f0..6f5f98d69af7 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -476,17 +476,17 @@ static int pca_init(struct i2c_adapter *adap)
                /* To avoid integer overflow, use clock/100 for calculations */
                clock = pca_clock(pca_data) / 100;
-                if (pca_data->i2c_clock > 10000) {
+                if (pca_data->i2c_clock > 1000000) {
                        mode = I2C_PCA_MODE_TURBO;
                        min_tlow = 14;
                        min_thi  = 5;
                        raise_fall_time = 22; /* Raise 11e-8s, Fall 11e-8s */
-                } else if (pca_data->i2c_clock > 4000) {
+                } else if (pca_data->i2c_clock > 400000) {
                        mode = I2C_PCA_MODE_FASTP;
                        min_tlow = 17;
                        min_thi  = 9;
                        raise_fall_time = 22; /* Raise 11e-8s, Fall 11e-8s */
-                } else if (pca_data->i2c_clock > 1000) {
+                } else if (pca_data->i2c_clock > 100000) {
                        mode = I2C_PCA_MODE_FAST;
                        min_tlow = 44;
                        min_thi  = 20;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index b4aaa1bd6728..970a1612e795 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -104,6 +104,7 @@ config I2C_I801
            DH89xxCC (PCH)
            Panther Point (PCH)
            Lynx Point (PCH)
+            Lynx Point-LP (PCH)
          This driver can also be built as a module.  If so, the module
          will be called i2c-i801.
@@ -354,9 +355,13 @@ config I2C_DAVINCI
          devices such as DaVinci NIC.
          For details please see http://www.ti.com/davinci
+config I2C_DESIGNWARE_CORE
+        tristate
 config I2C_DESIGNWARE_PLATFORM
        tristate "Synopsys DesignWare Platform"
        depends on HAVE_CLK
+        select I2C_DESIGNWARE_CORE
        help
          If you say yes to this option, support will be included for the
          Synopsys DesignWare I2C adapter. Only master mode is supported.
@@ -367,6 +372,7 @@ config I2C_DESIGNWARE_PLATFORM
 config I2C_DESIGNWARE_PCI
        tristate "Synopsys DesignWare PCI"
        depends on PCI
+        select I2C_DESIGNWARE_CORE
        help
          If you say yes to this option, support will be included for the
          Synopsys DesignWare I2C adapter. Only master mode is supported.
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index ce3c2be7fb40..37c4182cc98b 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -33,10 +33,11 @@ obj-$(CONFIG_I2C_AU1550)	+= i2c-au1550.o
 obj-$(CONFIG_I2C_BLACKFIN_TWI)  += i2c-bfin-twi.o
 obj-$(CONFIG_I2C_CPM)           += i2c-cpm.o
 obj-$(CONFIG_I2C_DAVINCI)       += i2c-davinci.o
+obj-$(CONFIG_I2C_DESIGNWARE_CORE)       += i2c-designware-core.o
 obj-$(CONFIG_I2C_DESIGNWARE_PLATFORM)   += i2c-designware-platform.o
-i2c-designware-platform-objs := i2c-designware-platdrv.o i2c-designware-core.o
+i2c-designware-platform-objs := i2c-designware-platdrv.o
 obj-$(CONFIG_I2C_DESIGNWARE_PCI)        += i2c-designware-pci.o
-i2c-designware-pci-objs := i2c-designware-pcidrv.o i2c-designware-core.o
+i2c-designware-pci-objs := i2c-designware-pcidrv.o
 obj-$(CONFIG_I2C_EG20T)         += i2c-eg20t.o
 obj-$(CONFIG_I2C_GPIO)          += i2c-gpio.o
 obj-$(CONFIG_I2C_HIGHLANDER)    += i2c-highlander.o
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 1e48bec80edf..7b8ebbefb581 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -25,6 +25,7 @@
 * ----------------------------------------------------------------------------
 *
 */
+#include <linux/export.h>
 #include <linux/clk.h>
 #include <linux/errno.h>
 #include <linux/err.h>
@@ -316,6 +317,7 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
        dw_writel(dev, dev->master_cfg , DW_IC_CON);
        return 0;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_init);
 /*
 * Waiting for bus not busy
@@ -568,12 +570,14 @@ done:
        return ret;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_xfer);
 u32 i2c_dw_func(struct i2c_adapter *adap)
 {
        struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
        return dev->functionality;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_func);
 static u32 i2c_dw_read_clear_intrbits(struct dw_i2c_dev *dev)
 {
@@ -678,17 +682,20 @@ tx_aborted:
        return IRQ_HANDLED;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_isr);
 void i2c_dw_enable(struct dw_i2c_dev *dev)
 {
       /* Enable the adapter */
        dw_writel(dev, 1, DW_IC_ENABLE);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_enable);
 u32 i2c_dw_is_enabled(struct dw_i2c_dev *dev)
 {
        return dw_readl(dev, DW_IC_ENABLE);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_is_enabled);
 void i2c_dw_disable(struct dw_i2c_dev *dev)
 {
@@ -699,18 +706,22 @@ void i2c_dw_disable(struct dw_i2c_dev *dev)
        dw_writel(dev, 0, DW_IC_INTR_MASK);
        dw_readl(dev, DW_IC_CLR_INTR);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_disable);
 void i2c_dw_clear_int(struct dw_i2c_dev *dev)
 {
        dw_readl(dev, DW_IC_CLR_INTR);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_clear_int);
 void i2c_dw_disable_int(struct dw_i2c_dev *dev)
 {
        dw_writel(dev, 0, DW_IC_INTR_MASK);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_disable_int);
 u32 i2c_dw_read_comp_param(struct dw_i2c_dev *dev)
 {
        return dw_readl(dev, DW_IC_COMP_PARAM_1);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_read_comp_param);
diff --git a/drivers/i2c/busses/i2c-diolan-u2c.c b/drivers/i2c/busses/i2c-diolan-u2c.c
index aedb94f34bf7..dae3ddfe7619 100644
--- a/drivers/i2c/busses/i2c-diolan-u2c.c
+++ b/drivers/i2c/busses/i2c-diolan-u2c.c
@@ -405,6 +405,7 @@ static int diolan_usb_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
                        }
                }
        }
+        ret = num;
 abort:
        sret = diolan_i2c_stop(dev);
        if (sret < 0 && ret >= 0)
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 898dcf9c7ade..33e9b0c09af2 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -52,6 +52,7 @@
  DH89xxCC (PCH)        0x2330     32     hard     yes     yes     yes
  Panther Point (PCH)   0x1e22     32     hard     yes     yes     yes
  Lynx Point (PCH)      0x8c22     32     hard     yes     yes     yes
+  Lynx Point-LP (PCH)   0x9c22     32     hard     yes     yes     yes
  Features supported by this driver:
  Software PEC                     no
@@ -155,6 +156,7 @@
 #define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
 #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_SMBUS     0x8c22
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS  0x9c22
 struct i801_priv {
        struct i2c_adapter adapter;
@@ -771,6 +773,7 @@ static DEFINE_PCI_DEVICE_TABLE(i801_ids) = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PANTHERPOINT_SMBUS) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNXPOINT_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS) },
        { 0, }
 };
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 088c5c1ed17d..51f05b8520ed 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -365,10 +365,6 @@ static int mxs_i2c_get_ofdata(struct mxs_i2c_dev *i2c)
        struct device_node *node = dev->of_node;
        int ret;
-        if (!node)
-                return -EINVAL;
-        i2c->speed = &mxs_i2c_95kHz_config;
        ret = of_property_read_u32(node, "clock-frequency", &speed);
        if (ret)
                dev_warn(dev, "No I2C speed selected, using 100kHz\n");
@@ -419,10 +415,13 @@ static int __devinit mxs_i2c_probe(struct platform_device *pdev)
                return err;
        i2c->dev = dev;
+        i2c->speed = &mxs_i2c_95kHz_config;
-        err = mxs_i2c_get_ofdata(i2c);
+        if (dev->of_node) {
-        if (err)
+                err = mxs_i2c_get_ofdata(i2c);
-                return err;
+                if (err)
+                        return err;
+        }
        platform_set_drvdata(pdev, i2c);
diff --git a/drivers/i2c/busses/i2c-nomadik.c b/drivers/i2c/busses/i2c-nomadik.c
index 5e6f1eed4f83..61b00edacb08 100644
--- a/drivers/i2c/busses/i2c-nomadik.c
+++ b/drivers/i2c/busses/i2c-nomadik.c
@@ -350,10 +350,6 @@ static void setup_i2c_controller(struct nmk_i2c_dev *dev)
        i2c_clk = clk_get_rate(dev->clk);
-        /* fallback to std. mode if machine has not provided it */
-        if (dev->cfg.clk_freq == 0)
-                dev->cfg.clk_freq = 100000;
        /*
         * The spec says, in case of std. mode the divider is
         * 2 whereas it is 3 for fast and fastplus mode of
@@ -911,20 +907,32 @@ static const struct i2c_algorithm nmk_i2c_algo = {
        .functionality  = nmk_i2c_functionality
 };
+static struct nmk_i2c_controller u8500_i2c = {
+        /*
+         * Slave data setup time; 250ns, 100ns, and 10ns, which
+         * is 14, 6 and 2 respectively for a 48Mhz i2c clock.
+         */
+        .slsu           = 0xe,
+        .tft            = 1,      /* Tx FIFO threshold */
+        .rft            = 8,      /* Rx FIFO threshold */
+        .clk_freq       = 400000, /* fast mode operation */
+        .timeout        = 200,    /* Slave response timeout(ms) */
+        .sm             = I2C_FREQ_MODE_FAST,
+};
 static atomic_t adapter_id = ATOMIC_INIT(0);
 static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id)
 {
        int ret = 0;
-        struct nmk_i2c_controller *pdata =
+        struct nmk_i2c_controller *pdata = adev->dev.platform_data;
-                        adev->dev.platform_data;
        struct nmk_i2c_dev      *dev;
        struct i2c_adapter *adap;
-        if (!pdata) {
+        if (!pdata)
-                dev_warn(&adev->dev, "no platform data\n");
+                /* No i2c configuration found, using the default. */
-                return -ENODEV;
+                pdata = &u8500_i2c;
-        }
        dev = kzalloc(sizeof(struct nmk_i2c_dev), GFP_KERNEL);
        if (!dev) {
                dev_err(&adev->dev, "cannot allocate memory\n");
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 6849635b268a..5d19a49803c1 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -584,7 +584,7 @@ omap_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
        r = pm_runtime_get_sync(dev->dev);
        if (IS_ERR_VALUE(r))
-                return r;
+                goto out;
        r = omap_i2c_wait_for_bb(dev);
        if (r < 0)
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 5d54416770b0..8488bddfe465 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -48,8 +48,9 @@ enum {
        mcntrl_afie = 0x00000002,
        mcntrl_naie = 0x00000004,
        mcntrl_drmie = 0x00000008,
-        mcntrl_daie = 0x00000020,
+        mcntrl_drsie = 0x00000010,
-        mcntrl_rffie = 0x00000040,
+        mcntrl_rffie = 0x00000020,
+        mcntrl_daie = 0x00000040,
        mcntrl_tffie = 0x00000080,
        mcntrl_reset = 0x00000100,
        mcntrl_cdbmode = 0x00000400,
@@ -290,31 +291,37 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data)
         * or we didn't 'ask' for it yet.
         */
        if (ioread32(I2C_REG_STS(alg_data)) & mstatus_rfe) {
-                dev_dbg(&alg_data->adapter.dev,
+                /* 'Asking' is done asynchronously, e.g. dummy TX of several
-                        "%s(): Write dummy data to fill Rx-fifo...\n",
+                 * bytes is done before the first actual RX arrives in FIFO.
-                        __func__);
+                 * Therefore, ordered bytes (via TX) are counted separately.
+                 */
+                if (alg_data->mif.order) {
+                        dev_dbg(&alg_data->adapter.dev,
+                                "%s(): Write dummy data to fill Rx-fifo...\n",
+                                __func__);
-                if (alg_data->mif.len == 1) {
+                        if (alg_data->mif.order == 1) {
-                        /* Last byte, do not acknowledge next rcv. */
+                                /* Last byte, do not acknowledge next rcv. */
-                        val |= stop_bit;
+                                val |= stop_bit;
+                                /*
+                                 * Enable interrupt RFDAIE (data in Rx fifo),
+                                 * and disable DRMIE (need data for Tx)
+                                 */
+                                ctl = ioread32(I2C_REG_CTL(alg_data));
+                                ctl |= mcntrl_rffie | mcntrl_daie;
+                                ctl &= ~mcntrl_drmie;
+                                iowrite32(ctl, I2C_REG_CTL(alg_data));
+                        }
                        /*
-                         * Enable interrupt RFDAIE (data in Rx fifo),
+                         * Now we'll 'ask' for data:
-                         * and disable DRMIE (need data for Tx)
+                         * For each byte we want to receive, we must
+                         * write a (dummy) byte to the Tx-FIFO.
                         */
-                        ctl = ioread32(I2C_REG_CTL(alg_data));
+                        iowrite32(val, I2C_REG_TX(alg_data));
-                        ctl |= mcntrl_rffie | mcntrl_daie;
+                        alg_data->mif.order--;
-                        ctl &= ~mcntrl_drmie;
-                        iowrite32(ctl, I2C_REG_CTL(alg_data));
                }
-                /*
-                 * Now we'll 'ask' for data:
-                 * For each byte we want to receive, we must
-                 * write a (dummy) byte to the Tx-FIFO.
-                 */
-                iowrite32(val, I2C_REG_TX(alg_data));
                return 0;
        }
@@ -514,6 +521,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
                alg_data->mif.buf = pmsg->buf;
                alg_data->mif.len = pmsg->len;
+                alg_data->mif.order = pmsg->len;
                alg_data->mif.mode = (pmsg->flags & I2C_M_RD) ?
                        I2C_SMBUS_READ : I2C_SMBUS_WRITE;
                alg_data->mif.ret = 0;
@@ -566,6 +574,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
        /* Cleanup to be sure... */
        alg_data->mif.buf = NULL;
        alg_data->mif.len = 0;
+        alg_data->mif.order = 0;
        dev_dbg(&alg_data->adapter.dev, "%s(): exiting, stat = %x\n",
                __func__, ioread32(I2C_REG_STS(alg_data)));
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index 66eb53fac202..9a08c57bc936 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -712,7 +712,7 @@ static int __devexit tegra_i2c_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int tegra_i2c_suspend(struct device *dev)
 {
        struct tegra_i2c_dev *i2c_dev = dev_get_drvdata(dev);
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 2efa56c5ff2c..2091ae8f539a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -637,6 +637,22 @@ static void i2c_adapter_dev_release(struct device *dev)
 }
 /*
+ * This function is only needed for mutex_lock_nested, so it is never
+ * called unless locking correctness checking is enabled. Thus we
+ * make it inline to avoid a compiler warning. That's what gcc ends up
+ * doing anyway.
+ */
+static inline unsigned int i2c_adapter_depth(struct i2c_adapter *adapter)
+{
+        unsigned int depth = 0;
+        while ((adapter = i2c_parent_is_i2c_adapter(adapter)))
+                depth++;
+        return depth;
+}
+/*
 * Let users instantiate I2C devices through sysfs. This can be used when
 * platform initialization code doesn't contain the proper data for
 * whatever reason. Also useful for drivers that do device detection and
@@ -726,7 +742,8 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
        /* Make sure the device was added through sysfs */
        res = -ENOENT;
-        mutex_lock(&adap->userspace_clients_lock);
+        mutex_lock_nested(&adap->userspace_clients_lock,
+                          i2c_adapter_depth(adap));
        list_for_each_entry_safe(client, next, &adap->userspace_clients,
                                 detected) {
                if (client->addr == addr) {
@@ -1073,7 +1090,8 @@ int i2c_del_adapter(struct i2c_adapter *adap)
                return res;
        /* Remove devices instantiated from sysfs */
-        mutex_lock(&adap->userspace_clients_lock);
+        mutex_lock_nested(&adap->userspace_clients_lock,
+                          i2c_adapter_depth(adap));
        list_for_each_entry_safe(client, next, &adap->userspace_clients,
                                 detected) {
                dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
diff --git a/drivers/ide/ide-pm.c b/drivers/ide/ide-pm.c
index 92406097efeb..8d1e32d7cd97 100644
--- a/drivers/ide/ide-pm.c
+++ b/drivers/ide/ide-pm.c
@@ -4,7 +4,7 @@
 int generic_ide_suspend(struct device *dev, pm_message_t mesg)
 {
-        ide_drive_t *drive = dev_get_drvdata(dev);
+        ide_drive_t *drive = to_ide_device(dev);
        ide_drive_t *pair = ide_get_pair_dev(drive);
        ide_hwif_t *hwif = drive->hwif;
        struct request *rq;
@@ -40,7 +40,7 @@ int generic_ide_suspend(struct device *dev, pm_message_t mesg)
 int generic_ide_resume(struct device *dev)
 {
-        ide_drive_t *drive = dev_get_drvdata(dev);
+        ide_drive_t *drive = to_ide_device(dev);
        ide_drive_t *pair = ide_get_pair_dev(drive);
        ide_hwif_t *hwif = drive->hwif;
        struct request *rq;
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index f559088869f6..e8726177d103 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -606,8 +606,9 @@ static int __init intel_idle_init(void)
        intel_idle_cpuidle_driver_init();
        retval = cpuidle_register_driver(&intel_idle_driver);
        if (retval) {
+                struct cpuidle_driver *drv = cpuidle_get_driver();
                printk(KERN_DEBUG PREFIX "intel_idle yielding to %s",
-                        cpuidle_get_driver()->name);
+                        drv ? drv->name : "none");
                return retval;
        }
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index f61780a02374..3bd5540238a7 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -617,7 +617,7 @@ static int __devinit at91_adc_probe(struct platform_device *pdev)
        st->adc_clk = clk_get(&pdev->dev, "adc_op_clk");
        if (IS_ERR(st->adc_clk)) {
                dev_err(&pdev->dev, "Failed to get the ADC clock.\n");
-                ret = PTR_ERR(st->clk);
+                ret = PTR_ERR(st->adc_clk);
                goto error_disable_clk;
        }
diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c
index 59fbb3ae40e7..e35bb8f6fe75 100644
--- a/drivers/iio/frequency/adf4350.c
+++ b/drivers/iio/frequency/adf4350.c
@@ -129,7 +129,7 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq)
 {
        struct adf4350_platform_data *pdata = st->pdata;
        u64 tmp;
-        u32 div_gcd, prescaler;
+        u32 div_gcd, prescaler, chspc;
        u16 mdiv, r_cnt = 0;
        u8 band_sel_div;
@@ -158,14 +158,20 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq)
        if (pdata->ref_div_factor)
                r_cnt = pdata->ref_div_factor - 1;
-        do  {
+        chspc = st->chspc;
-                r_cnt = adf4350_tune_r_cnt(st, r_cnt);
-                st->r1_mod = st->fpfd / st->chspc;
+        do  {
-                while (st->r1_mod > ADF4350_MAX_MODULUS) {
+                do {
-                        r_cnt = adf4350_tune_r_cnt(st, r_cnt);
+                        do {
-                        st->r1_mod = st->fpfd / st->chspc;
+                                r_cnt = adf4350_tune_r_cnt(st, r_cnt);
-                }
+                                st->r1_mod = st->fpfd / chspc;
+                                if (r_cnt > ADF4350_MAX_R_CNT) {
+                                        /* try higher spacing values */
+                                        chspc++;
+                                        r_cnt = 0;
+                                }
+                        } while ((st->r1_mod > ADF4350_MAX_MODULUS) && r_cnt);
+                } while (r_cnt == 0);
                tmp = freq * (u64)st->r1_mod + (st->fpfd > 1);
                do_div(tmp, st->fpfd); /* Div round closest (n + d/2)/d */
@@ -194,7 +200,7 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq)
        st->regs[ADF4350_REG0] = ADF4350_REG0_INT(st->r0_int) |
                                 ADF4350_REG0_FRACT(st->r0_fract);
-        st->regs[ADF4350_REG1] = ADF4350_REG1_PHASE(0) |
+        st->regs[ADF4350_REG1] = ADF4350_REG1_PHASE(1) |
                                 ADF4350_REG1_MOD(st->r1_mod) |
                                 prescaler;
diff --git a/drivers/iio/light/adjd_s311.c b/drivers/iio/light/adjd_s311.c
index 1cbb449b319a..9a99f43094f0 100644
--- a/drivers/iio/light/adjd_s311.c
+++ b/drivers/iio/light/adjd_s311.c
@@ -271,9 +271,10 @@ static int adjd_s311_update_scan_mode(struct iio_dev *indio_dev,
        const unsigned long *scan_mask)
 {
        struct adjd_s311_data *data = iio_priv(indio_dev);
-        data->buffer = krealloc(data->buffer, indio_dev->scan_bytes,
-                                GFP_KERNEL);
+        kfree(data->buffer);
-        if (!data->buffer)
+        data->buffer = kmalloc(indio_dev->scan_bytes, GFP_KERNEL);
+        if (data->buffer == NULL)
                return -ENOMEM;
        return 0;
diff --git a/drivers/iio/light/lm3533-als.c b/drivers/iio/light/lm3533-als.c
index c3e7bac13123..e45712a921ce 100644
--- a/drivers/iio/light/lm3533-als.c
+++ b/drivers/iio/light/lm3533-als.c
@@ -404,7 +404,7 @@ out:
        return ret;
 }
-static int show_thresh_either_en(struct device *dev,
+static ssize_t show_thresh_either_en(struct device *dev,
                                        struct device_attribute *attr,
                                        char *buf)
 {
@@ -424,7 +424,7 @@ static int show_thresh_either_en(struct device *dev,
        return scnprintf(buf, PAGE_SIZE, "%u\n", enable);
 }
-static int store_thresh_either_en(struct device *dev,
+static ssize_t store_thresh_either_en(struct device *dev,
                                        struct device_attribute *attr,
                                        const char *buf, size_t len)
 {
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 6bf850422895..055ed59838dc 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -267,6 +267,7 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
        if (!uevent)
                return event->event == RDMA_CM_EVENT_CONNECT_REQUEST;
+        mutex_lock(&ctx->file->mut);
        uevent->cm_id = cm_id;
        ucma_set_event_context(ctx, event, uevent);
        uevent->resp.event = event->event;
@@ -277,7 +278,6 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
                ucma_copy_conn_event(&uevent->resp.param.conn,
                                     &event->param.conn);
-        mutex_lock(&ctx->file->mut);
        if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
                if (!ctx->backlog) {
                        ret = -ENOMEM;
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 8c81992fa6db..e4a73158fc7f 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -439,7 +439,7 @@ static int c2_rnic_close(struct c2_dev *c2dev)
 /*
 * Called by c2_probe to initialize the RNIC. This principally
- * involves initalizing the various limits and resouce pools that
+ * involves initializing the various limits and resource pools that
 * comprise the RNIC instance.
 */
 int __devinit c2_rnic_init(struct c2_dev *c2dev)
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 77b6b182778a..aaf88ef9409c 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -1680,7 +1680,7 @@ static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
 * T3A does 3 things when a TERM is received:
 * 1) send up a CPL_RDMA_TERMINATE message with the TERM packet
 * 2) generate an async event on the QP with the TERMINATE opcode
- * 3) post a TERMINATE opcde cqe into the associated CQ.
+ * 3) post a TERMINATE opcode cqe into the associated CQ.
 *
 * For (1), we save the message in the qp for later consumer consumption.
 * For (2), we move the QP into TERMINATE, post a QP event and disconnect.
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c27141fef1ab..9c2ae7efd00f 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -125,6 +125,7 @@ static void update_sm_ah(struct mlx4_ib_dev *dev, u8 port_num, u16 lid, u8 sl)
 {
        struct ib_ah *new_ah;
        struct ib_ah_attr ah_attr;
+        unsigned long flags;
        if (!dev->send_agent[port_num - 1][0])
                return;
@@ -139,11 +140,11 @@ static void update_sm_ah(struct mlx4_ib_dev *dev, u8 port_num, u16 lid, u8 sl)
        if (IS_ERR(new_ah))
                return;
-        spin_lock(&dev->sm_lock);
+        spin_lock_irqsave(&dev->sm_lock, flags);
        if (dev->sm_ah[port_num - 1])
                ib_destroy_ah(dev->sm_ah[port_num - 1]);
        dev->sm_ah[port_num - 1] = new_ah;
-        spin_unlock(&dev->sm_lock);
+        spin_unlock_irqrestore(&dev->sm_lock, flags);
 }
 /*
@@ -197,13 +198,15 @@ static void smp_snoop(struct ib_device *ibdev, u8 port_num, struct ib_mad *mad,
 static void node_desc_override(struct ib_device *dev,
                               struct ib_mad *mad)
 {
+        unsigned long flags;
        if ((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED ||
             mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) &&
            mad->mad_hdr.method == IB_MGMT_METHOD_GET_RESP &&
            mad->mad_hdr.attr_id == IB_SMP_ATTR_NODE_DESC) {
-                spin_lock(&to_mdev(dev)->sm_lock);
+                spin_lock_irqsave(&to_mdev(dev)->sm_lock, flags);
                memcpy(((struct ib_smp *) mad)->data, dev->node_desc, 64);
-                spin_unlock(&to_mdev(dev)->sm_lock);
+                spin_unlock_irqrestore(&to_mdev(dev)->sm_lock, flags);
        }
 }
@@ -213,6 +216,7 @@ static void forward_trap(struct mlx4_ib_dev *dev, u8 port_num, struct ib_mad *ma
        struct ib_mad_send_buf *send_buf;
        struct ib_mad_agent *agent = dev->send_agent[port_num - 1][qpn];
        int ret;
+        unsigned long flags;
        if (agent) {
                send_buf = ib_create_send_mad(agent, qpn, 0, 0, IB_MGMT_MAD_HDR,
@@ -225,13 +229,13 @@ static void forward_trap(struct mlx4_ib_dev *dev, u8 port_num, struct ib_mad *ma
                 * wrong following the IB spec strictly, but we know
                 * it's OK for our devices).
                 */
-                spin_lock(&dev->sm_lock);
+                spin_lock_irqsave(&dev->sm_lock, flags);
                memcpy(send_buf->mad, mad, sizeof *mad);
                if ((send_buf->ah = dev->sm_ah[port_num - 1]))
                        ret = ib_post_send_mad(send_buf, NULL);
                else
                        ret = -EINVAL;
-                spin_unlock(&dev->sm_lock);
+                spin_unlock_irqrestore(&dev->sm_lock, flags);
                if (ret)
                        ib_free_send_mad(send_buf);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index fe2088cfa6ee..cc05579ebce7 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -423,6 +423,7 @@ static int mlx4_ib_modify_device(struct ib_device *ibdev, int mask,
                                 struct ib_device_modify *props)
 {
        struct mlx4_cmd_mailbox *mailbox;
+        unsigned long flags;
        if (mask & ~IB_DEVICE_MODIFY_NODE_DESC)
                return -EOPNOTSUPP;
@@ -430,9 +431,9 @@ static int mlx4_ib_modify_device(struct ib_device *ibdev, int mask,
        if (!(mask & IB_DEVICE_MODIFY_NODE_DESC))
                return 0;
-        spin_lock(&to_mdev(ibdev)->sm_lock);
+        spin_lock_irqsave(&to_mdev(ibdev)->sm_lock, flags);
        memcpy(ibdev->node_desc, props->node_desc, 64);
-        spin_unlock(&to_mdev(ibdev)->sm_lock);
+        spin_unlock_irqrestore(&to_mdev(ibdev)->sm_lock, flags);
        /*
         * If possible, pass node desc to FW, so it can generate
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index a6d8ea060ea8..f585eddef4b7 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1407,6 +1407,7 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
        struct mlx4_wqe_mlx_seg *mlx = wqe;
        struct mlx4_wqe_inline_seg *inl = wqe + sizeof *mlx;
        struct mlx4_ib_ah *ah = to_mah(wr->wr.ud.ah);
+        struct net_device *ndev;
        union ib_gid sgid;
        u16 pkey;
        int send_size;
@@ -1483,7 +1484,10 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
                memcpy(sqp->ud_header.eth.dmac_h, ah->av.eth.mac, 6);
                /* FIXME: cache smac value? */
-                smac = to_mdev(sqp->qp.ibqp.device)->iboe.netdevs[sqp->qp.port - 1]->dev_addr;
+                ndev = to_mdev(sqp->qp.ibqp.device)->iboe.netdevs[sqp->qp.port - 1];
+                if (!ndev)
+                        return -ENODEV;
+                smac = ndev->dev_addr;
                memcpy(sqp->ud_header.eth.smac_h, smac, 6);
                if (!memcmp(sqp->ud_header.eth.smac_h, sqp->ud_header.eth.dmac_h, 6))
                        mlx->flags |= cpu_to_be32(MLX4_WQE_CTRL_FORCE_LOOPBACK);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 5a044526e4f4..c4e0131f1b57 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -161,7 +161,7 @@ static void ocrdma_add_default_sgid(struct ocrdma_dev *dev)
        ocrdma_get_guid(dev, &sgid->raw[8]);
 }
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+#if IS_ENABLED(CONFIG_VLAN_8021Q)
 static void ocrdma_add_vlan_sgids(struct ocrdma_dev *dev)
 {
        struct net_device *netdev, *tmp;
@@ -202,14 +202,13 @@ static int ocrdma_build_sgid_tbl(struct ocrdma_dev *dev)
        return 0;
 }
-#if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_VLAN_8021Q)
+#if IS_ENABLED(CONFIG_IPV6)
 static int ocrdma_inet6addr_event(struct notifier_block *notifier,
                                  unsigned long event, void *ptr)
 {
        struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
-        struct net_device *event_netdev = ifa->idev->dev;
+        struct net_device *netdev = ifa->idev->dev;
-        struct net_device *netdev = NULL;
        struct ib_event gid_event;
        struct ocrdma_dev *dev;
        bool found = false;
@@ -217,11 +216,12 @@ static int ocrdma_inet6addr_event(struct notifier_block *notifier,
        bool is_vlan = false;
        u16 vid = 0;
-        netdev = vlan_dev_real_dev(event_netdev);
+        is_vlan = netdev->priv_flags & IFF_802_1Q_VLAN;
-        if (netdev != event_netdev) {
+        if (is_vlan) {
-                is_vlan = true;
+                vid = vlan_dev_vlan_id(netdev);
-                vid = vlan_dev_vlan_id(event_netdev);
+                netdev = vlan_dev_real_dev(netdev);
        }
        rcu_read_lock();
        list_for_each_entry_rcu(dev, &ocrdma_dev_list, entry) {
                if (dev->nic_info.netdev == netdev) {
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 0d7280af99bc..3f6b21e9dc11 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -6346,8 +6346,10 @@ static int qib_init_7322_variables(struct qib_devdata *dd)
                        dd->piobcnt4k * dd->align4k;
                dd->piovl15base = ioremap_nocache(vl15off,
                                                  NUM_VL15_BUFS * dd->align4k);
-                if (!dd->piovl15base)
+                if (!dd->piovl15base) {
+                        ret = -ENOMEM;
                        goto bail;
+                }
        }
        qib_7322_set_baseaddrs(dd); /* set chip access pointers now */
diff --git a/drivers/infiniband/hw/qib/qib_sd7220.c b/drivers/infiniband/hw/qib/qib_sd7220.c
index a322d5171a2c..50a8a0d4fe67 100644
--- a/drivers/infiniband/hw/qib/qib_sd7220.c
+++ b/drivers/infiniband/hw/qib/qib_sd7220.c
@@ -372,7 +372,7 @@ static void qib_sd_trimdone_monitor(struct qib_devdata *dd,
                /* Read CTRL reg for each channel to check TRIMDONE */
                if (baduns & (1 << chn)) {
                        qib_dev_err(dd,
-                                "Reseting TRIMDONE on chn %d (%s)\n",
+                                "Resetting TRIMDONE on chn %d (%s)\n",
                                chn, where);
                        ret = qib_sd7220_reg_mod(dd, IB_7220_SERDES,
                                IB_CTRL2(chn), 0x10, 0x10);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 95ecf4eadf5f..24683fda8e21 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1271,12 +1271,15 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
 void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
 {
        struct ipoib_dev_priv *priv = netdev_priv(tx->dev);
+        unsigned long flags;
        if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
+                spin_lock_irqsave(&priv->lock, flags);
                list_move(&tx->list, &priv->cm.reap_list);
                queue_work(ipoib_workqueue, &priv->cm.reap_task);
                ipoib_dbg(priv, "Reap connection for gid %pI6\n",
                          tx->neigh->daddr + 4);
                tx->neigh = NULL;
+                spin_unlock_irqrestore(&priv->lock, flags);
        }
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 97920b77a5d0..3e2085a3ee47 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1052,7 +1052,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
        for (n = rcu_dereference_protected(*np,
                                            lockdep_is_held(&ntbl->rwlock));
             n != NULL;
-             n = rcu_dereference_protected(neigh->hnext,
+             n = rcu_dereference_protected(*np,
                                        lockdep_is_held(&ntbl->rwlock))) {
                if (n == neigh) {
                        /* found */
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index bcbf22ee0aa7..1b5b0c730054 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -586,24 +586,62 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd,
                        scmnd->sc_data_direction);
 }
-static void srp_remove_req(struct srp_target_port *target,
+/**
-                           struct srp_request *req, s32 req_lim_delta)
+ * srp_claim_req - Take ownership of the scmnd associated with a request.
+ * @target: SRP target port.
+ * @req: SRP request.
+ * @scmnd: If NULL, take ownership of @req->scmnd. If not NULL, only take
+ *         ownership of @req->scmnd if it equals @scmnd.
+ *
+ * Return value:
+ * Either NULL or a pointer to the SCSI command the caller became owner of.
+ */
+static struct scsi_cmnd *srp_claim_req(struct srp_target_port *target,
+                                       struct srp_request *req,
+                                       struct scsi_cmnd *scmnd)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&target->lock, flags);
+        if (!scmnd) {
+                scmnd = req->scmnd;
+                req->scmnd = NULL;
+        } else if (req->scmnd == scmnd) {
+                req->scmnd = NULL;
+        } else {
+                scmnd = NULL;
+        }
+        spin_unlock_irqrestore(&target->lock, flags);
+        return scmnd;
+}
+/**
+ * srp_free_req() - Unmap data and add request to the free request list.
+ */
+static void srp_free_req(struct srp_target_port *target,
+                         struct srp_request *req, struct scsi_cmnd *scmnd,
+                         s32 req_lim_delta)
 {
        unsigned long flags;
-        srp_unmap_data(req->scmnd, target, req);
+        srp_unmap_data(scmnd, target, req);
        spin_lock_irqsave(&target->lock, flags);
        target->req_lim += req_lim_delta;
-        req->scmnd = NULL;
        list_add_tail(&req->list, &target->free_reqs);
        spin_unlock_irqrestore(&target->lock, flags);
 }
 static void srp_reset_req(struct srp_target_port *target, struct srp_request *req)
 {
-        req->scmnd->result = DID_RESET << 16;
+        struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
-        req->scmnd->scsi_done(req->scmnd);
-        srp_remove_req(target, req, 0);
+        if (scmnd) {
+                scmnd->result = DID_RESET << 16;
+                scmnd->scsi_done(scmnd);
+                srp_free_req(target, req, scmnd, 0);
+        }
 }
 static int srp_reconnect_target(struct srp_target_port *target)
@@ -1073,11 +1111,18 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                complete(&target->tsk_mgmt_done);
        } else {
                req = &target->req_ring[rsp->tag];
-                scmnd = req->scmnd;
+                scmnd = srp_claim_req(target, req, NULL);
-                if (!scmnd)
+                if (!scmnd) {
                        shost_printk(KERN_ERR, target->scsi_host,
                                     "Null scmnd for RSP w/tag %016llx\n",
                                     (unsigned long long) rsp->tag);
+                        spin_lock_irqsave(&target->lock, flags);
+                        target->req_lim += be32_to_cpu(rsp->req_lim_delta);
+                        spin_unlock_irqrestore(&target->lock, flags);
+                        return;
+                }
                scmnd->result = rsp->status;
                if (rsp->flags & SRP_RSP_FLAG_SNSVALID) {
@@ -1092,7 +1137,9 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                else if (rsp->flags & (SRP_RSP_FLAG_DIOVER | SRP_RSP_FLAG_DIUNDER))
                        scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
-                srp_remove_req(target, req, be32_to_cpu(rsp->req_lim_delta));
+                srp_free_req(target, req, scmnd,
+                             be32_to_cpu(rsp->req_lim_delta));
                scmnd->host_scribble = NULL;
                scmnd->scsi_done(scmnd);
        }
@@ -1631,25 +1678,17 @@ static int srp_abort(struct scsi_cmnd *scmnd)
 {
        struct srp_target_port *target = host_to_target(scmnd->device->host);
        struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
-        int ret = SUCCESS;
        shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
-        if (!req || target->qp_in_error)
+        if (!req || target->qp_in_error || !srp_claim_req(target, req, scmnd))
                return FAILED;
-        if (srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
+        srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
-                              SRP_TSK_ABORT_TASK))
+                          SRP_TSK_ABORT_TASK);
-                return FAILED;
+        srp_free_req(target, req, scmnd, 0);
+        scmnd->result = DID_ABORT << 16;
-        if (req->scmnd) {
-                if (!target->tsk_mgmt_status) {
-                        srp_remove_req(target, req, 0);
-                        scmnd->result = DID_ABORT << 16;
-                } else
-                        ret = FAILED;
-        }
-        return ret;
+        return SUCCESS;
 }
 static int srp_reset_device(struct scsi_cmnd *scmnd)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 7a0ce8d42887..9e1449f8c6a2 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1469,7 +1469,7 @@ static void srpt_handle_send_comp(struct srpt_rdma_ch *ch,
 *
 * XXX: what is now target_execute_cmd used to be asynchronous, and unmapping
 * the data that has been transferred via IB RDMA had to be postponed until the
- * check_stop_free() callback.  None of this is nessecary anymore and needs to
+ * check_stop_free() callback.  None of this is necessary anymore and needs to
 * be cleaned up.
 */
 static void srpt_handle_rdma_comp(struct srpt_rdma_ch *ch,
diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index ff4c0a87a25f..ce68e361558c 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -358,6 +358,7 @@ static void imx_keypad_inhibit(struct imx_keypad *keypad)
        /* Inhibit KDI and KRI interrupts. */
        reg_val = readw(keypad->mmio_base + KPSR);
        reg_val &= ~(KBD_STAT_KRIE | KBD_STAT_KDIE);
+        reg_val |= KBD_STAT_KPKR | KBD_STAT_KPKD;
        writew(reg_val, keypad->mmio_base + KPSR);
        /* Colums as open drain and disable all rows */
@@ -515,7 +516,9 @@ static int __devinit imx_keypad_probe(struct platform_device *pdev)
        input_set_drvdata(input_dev, keypad);
        /* Ensure that the keypad will stay dormant until opened */
+        clk_enable(keypad->clk);
        imx_keypad_inhibit(keypad);
+        clk_disable(keypad->clk);
        error = request_irq(irq, imx_keypad_irq_handler, 0,
                            pdev->name, keypad);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 5ec774d6c82b..6918773ce024 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -177,6 +177,20 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
                },
        },
        {
+                /* Gigabyte T1005 - defines wrong chassis type ("Other") */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "T1005"),
+                },
+        },
+        {
+                /* Gigabyte T1005M/P - defines wrong chassis type ("Other") */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "T1005M/P"),
+                },
+        },
+        {
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 002041975de9..532d067a9e07 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1848,7 +1848,10 @@ static const struct wacom_features wacom_features_0x2A =
        { "Wacom Intuos5 M", WACOM_PKGLEN_INTUOS,  44704, 27940, 2047,
          63, INTUOS5, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0xF4 =
-        { "Wacom Cintiq 24HD",    WACOM_PKGLEN_INTUOS,   104480, 65600, 2047,
+        { "Wacom Cintiq 24HD",       WACOM_PKGLEN_INTUOS,   104480, 65600, 2047,
+          63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
+static const struct wacom_features wacom_features_0xF8 =
+        { "Wacom Cintiq 24HD touch", WACOM_PKGLEN_INTUOS,   104480, 65600, 2047,
          63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0x3F =
        { "Wacom Cintiq 21UX",    WACOM_PKGLEN_INTUOS,    87200, 65600, 1023,
@@ -2091,6 +2094,7 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0xEF) },
        { USB_DEVICE_WACOM(0x47) },
        { USB_DEVICE_WACOM(0xF4) },
+        { USB_DEVICE_WACOM(0xF8) },
        { USB_DEVICE_WACOM(0xFA) },
        { USB_DEVICE_LENOVO(0x6004) },
        { }
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 9afc777a40a7..b06a5e3a665e 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -602,6 +602,7 @@ edt_ft5x06_ts_teardown_debugfs(struct edt_ft5x06_ts_data *tsdata)
 {
        if (tsdata->debug_dir)
                debugfs_remove_recursive(tsdata->debug_dir);
+        kfree(tsdata->raw_buffer);
 }
 #else
@@ -843,7 +844,6 @@ static int __devexit edt_ft5x06_ts_remove(struct i2c_client *client)
        if (gpio_is_valid(pdata->reset_pin))
                gpio_free(pdata->reset_pin);
-        kfree(tsdata->raw_buffer);
        kfree(tsdata);
        return 0;
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 0a2ea317120a..18a89b760aaa 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1111,7 +1111,7 @@ static void print_iommu_info(void)
                if (iommu->cap & (1 << IOMMU_CAP_EFR)) {
                        pr_info("AMD-Vi:  Extended features: ");
-                        for (i = 0; ARRAY_SIZE(feat_str); ++i) {
+                        for (i = 0; i < ARRAY_SIZE(feat_str); ++i) {
                                if (iommu_feature(iommu, (1ULL << i)))
                                        pr_cont(" %s", feat_str[i]);
                        }
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index e0b18f3ae9a8..af8904de1d44 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -736,6 +736,7 @@ int __init parse_ioapics_under_ir(void)
 {
        struct dmar_drhd_unit *drhd;
        int ir_supported = 0;
+        int ioapic_idx;
        for_each_drhd_unit(drhd) {
                struct intel_iommu *iommu = drhd->iommu;
@@ -748,13 +749,20 @@ int __init parse_ioapics_under_ir(void)
                }
        }
-        if (ir_supported && ir_ioapic_num != nr_ioapics) {
+        if (!ir_supported)
-                printk(KERN_WARNING
+                return 0;
-                       "Not all IO-APIC's listed under remapping hardware\n");
-                return -1;
+        for (ioapic_idx = 0; ioapic_idx < nr_ioapics; ioapic_idx++) {
+                int ioapic_id = mpc_ioapic_id(ioapic_idx);
+                if (!map_ioapic_to_ir(ioapic_id)) {
+                        pr_err(FW_BUG "ioapic %d has no mapping iommu, "
+                               "interrupt remapping will be disabled\n",
+                               ioapic_id);
+                        return -1;
+                }
        }
-        return ir_supported;
+        return 1;
 }
 int __init ir_dev_scope_init(void)
diff --git a/drivers/isdn/hardware/mISDN/avmfritz.c b/drivers/isdn/hardware/mISDN/avmfritz.c
index fa6ca4733725..dceaec821b0e 100644
--- a/drivers/isdn/hardware/mISDN/avmfritz.c
+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
@@ -857,8 +857,9 @@ avm_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
        switch (cmd) {
        case CLOSE_CHANNEL:
                test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                spin_lock_irqsave(&fc->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                modehdlc(bch, ISDN_P_NONE);
                spin_unlock_irqrestore(&fc->lock, flags);
                ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 5e402cf2e795..f02794203bb1 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -5059,6 +5059,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
                                printk(KERN_INFO
                                       "HFC-E1 #%d has overlapping B-channels on fragment #%d\n",
                                       E1_cnt + 1, pt);
+                                kfree(hc);
                                return -EINVAL;
                        }
                        maskcheck |= hc->bmask[pt];
@@ -5086,6 +5087,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
        if ((poll >> 1) > sizeof(hc->silence_data)) {
                printk(KERN_ERR "HFCMULTI error: silence_data too small, "
                       "please fix\n");
+                kfree(hc);
                return -EINVAL;
        }
        for (i = 0; i < (poll >> 1); i++)
diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index 752e0825591f..ccd7d851be26 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1406,8 +1406,9 @@ hscx_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
        switch (cmd) {
        case CLOSE_CHANNEL:
                test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                spin_lock_irqsave(hx->ip->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                hscx_mode(hx, ISDN_P_NONE);
                spin_unlock_irqrestore(hx->ip->hwlock, flags);
                ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/mISDNisar.c b/drivers/isdn/hardware/mISDN/mISDNisar.c
index be5973ded6d6..182ecf0626c2 100644
--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
@@ -1588,8 +1588,9 @@ isar_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
        switch (cmd) {
        case CLOSE_CHANNEL:
                test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                spin_lock_irqsave(ich->is->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                modeisar(ich, ISDN_P_NONE);
                spin_unlock_irqrestore(ich->is->hwlock, flags);
                ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index c3e3e7686273..9bcade59eb73 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -812,8 +812,9 @@ nj_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
        switch (cmd) {
        case CLOSE_CHANNEL:
                test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                mode_tiger(bc, ISDN_P_NONE);
                spin_unlock_irqrestore(&card->lock, flags);
                ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c
index 26a86b846099..335fe6455002 100644
--- a/drivers/isdn/hardware/mISDN/w6692.c
+++ b/drivers/isdn/hardware/mISDN/w6692.c
@@ -1054,8 +1054,9 @@ w6692_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
        switch (cmd) {
        case CLOSE_CHANNEL:
                test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                w6692_mode(bc, ISDN_P_NONE);
                spin_unlock_irqrestore(&card->lock, flags);
                ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/mISDN/hwchannel.c b/drivers/isdn/mISDN/hwchannel.c
index ef34fd40867c..2602be23f341 100644
--- a/drivers/isdn/mISDN/hwchannel.c
+++ b/drivers/isdn/mISDN/hwchannel.c
@@ -148,17 +148,16 @@ mISDN_clear_bchannel(struct bchannel *ch)
        ch->next_minlen = ch->init_minlen;
        ch->maxlen = ch->init_maxlen;
        ch->next_maxlen = ch->init_maxlen;
+        skb_queue_purge(&ch->rqueue);
+        ch->rcount = 0;
 }
 EXPORT_SYMBOL(mISDN_clear_bchannel);
-int
+void
 mISDN_freebchannel(struct bchannel *ch)
 {
+        cancel_work_sync(&ch->workq);
        mISDN_clear_bchannel(ch);
-        skb_queue_purge(&ch->rqueue);
-        ch->rcount = 0;
-        flush_work_sync(&ch->workq);
-        return 0;
 }
 EXPORT_SYMBOL(mISDN_freebchannel);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index fcd098794d37..3f6203a4c7ea 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1108,8 +1108,11 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
                        ret = 0;
        }
        rdev->sectors = rdev->sb_start;
-        /* Limit to 4TB as metadata cannot record more than that */
+        /* Limit to 4TB as metadata cannot record more than that.
-        if (rdev->sectors >= (2ULL << 32))
+         * (not needed for Linear and RAID0 as metadata doesn't
+         * record this size)
+         */
+        if (rdev->sectors >= (2ULL << 32) && sb->level >= 1)
                rdev->sectors = (2ULL << 32) - 2;
        if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
@@ -1400,7 +1403,7 @@ super_90_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors)
        /* Limit to 4TB as metadata cannot record more than that.
         * 4TB == 2^32 KB, or 2*2^32 sectors.
         */
-        if (num_sectors >= (2ULL << 32))
+        if (num_sectors >= (2ULL << 32) && rdev->mddev->level >= 1)
                num_sectors = (2ULL << 32) - 2;
        md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
                       rdev->sb_page);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index de5ed6fd8806..1c2eb38f3c51 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -659,7 +659,11 @@ static int raid10_mergeable_bvec(struct request_queue *q,
                max = biovec->bv_len;
        if (mddev->merge_check_needed) {
-                struct r10bio r10_bio;
+                struct {
+                        struct r10bio r10_bio;
+                        struct r10dev devs[conf->copies];
+                } on_stack;
+                struct r10bio *r10_bio = &on_stack.r10_bio;
                int s;
                if (conf->reshape_progress != MaxSector) {
                        /* Cannot give any guidance during reshape */
@@ -667,18 +671,18 @@ static int raid10_mergeable_bvec(struct request_queue *q,
                                return biovec->bv_len;
                        return 0;
                }
-                r10_bio.sector = sector;
+                r10_bio->sector = sector;
-                raid10_find_phys(conf, &r10_bio);
+                raid10_find_phys(conf, r10_bio);
                rcu_read_lock();
                for (s = 0; s < conf->copies; s++) {
-                        int disk = r10_bio.devs[s].devnum;
+                        int disk = r10_bio->devs[s].devnum;
                        struct md_rdev *rdev = rcu_dereference(
                                conf->mirrors[disk].rdev);
                        if (rdev && !test_bit(Faulty, &rdev->flags)) {
                                struct request_queue *q =
                                        bdev_get_queue(rdev->bdev);
                                if (q->merge_bvec_fn) {
-                                        bvm->bi_sector = r10_bio.devs[s].addr
+                                        bvm->bi_sector = r10_bio->devs[s].addr
                                                + rdev->data_offset;
                                        bvm->bi_bdev = rdev->bdev;
                                        max = min(max, q->merge_bvec_fn(
@@ -690,7 +694,7 @@ static int raid10_mergeable_bvec(struct request_queue *q,
                                struct request_queue *q =
                                        bdev_get_queue(rdev->bdev);
                                if (q->merge_bvec_fn) {
-                                        bvm->bi_sector = r10_bio.devs[s].addr
+                                        bvm->bi_sector = r10_bio->devs[s].addr
                                                + rdev->data_offset;
                                        bvm->bi_bdev = rdev->bdev;
                                        max = min(max, q->merge_bvec_fn(
@@ -4414,14 +4418,18 @@ static int handle_reshape_read_error(struct mddev *mddev,
 {
        /* Use sync reads to get the blocks from somewhere else */
        int sectors = r10_bio->sectors;
-        struct r10bio r10b;
        struct r10conf *conf = mddev->private;
+        struct {
+                struct r10bio r10_bio;
+                struct r10dev devs[conf->copies];
+        } on_stack;
+        struct r10bio *r10b = &on_stack.r10_bio;
        int slot = 0;
        int idx = 0;
        struct bio_vec *bvec = r10_bio->master_bio->bi_io_vec;
-        r10b.sector = r10_bio->sector;
+        r10b->sector = r10_bio->sector;
-        __raid10_find_phys(&conf->prev, &r10b);
+        __raid10_find_phys(&conf->prev, r10b);
        while (sectors) {
                int s = sectors;
@@ -4432,7 +4440,7 @@ static int handle_reshape_read_error(struct mddev *mddev,
                        s = PAGE_SIZE >> 9;
                while (!success) {
-                        int d = r10b.devs[slot].devnum;
+                        int d = r10b->devs[slot].devnum;
                        struct md_rdev *rdev = conf->mirrors[d].rdev;
                        sector_t addr;
                        if (rdev == NULL ||
@@ -4440,7 +4448,7 @@ static int handle_reshape_read_error(struct mddev *mddev,
                            !test_bit(In_sync, &rdev->flags))
                                goto failed;
-                        addr = r10b.devs[slot].addr + idx * PAGE_SIZE;
+                        addr = r10b->devs[slot].addr + idx * PAGE_SIZE;
                        success = sync_page_io(rdev,
                                               addr,
                                               s << 9,
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 007c2c68dd83..1054cf602345 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -110,7 +110,7 @@ struct r10bio {
         * We choose the number when they are allocated.
         * We sometimes need an extra bio to write to the replacement.
         */
-        struct {
+        struct r10dev {
                struct bio      *bio;
                union {
                        struct bio      *repl_bio; /* used for resync and
diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c
index 664e460f247b..aac622200e99 100644
--- a/drivers/media/dvb/siano/smsusb.c
+++ b/drivers/media/dvb/siano/smsusb.c
@@ -481,7 +481,7 @@ static int smsusb_resume(struct usb_interface *intf)
        return 0;
 }
-static const struct usb_device_id smsusb_id_table[] __devinitconst = {
+static const struct usb_device_id smsusb_id_table[] = {
        { USB_DEVICE(0x187f, 0x0010),
                .driver_info = SMS1XXX_BOARD_SIANO_STELLAR },
        { USB_DEVICE(0x187f, 0x0100),
diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
index d0b6bb507634..72ded29728bb 100644
--- a/drivers/media/radio/radio-shark.c
+++ b/drivers/media/radio/radio-shark.c
@@ -35,6 +35,11 @@
 #include <media/v4l2-device.h>
 #include <sound/tea575x-tuner.h>
+#if defined(CONFIG_LEDS_CLASS) || \
+    (defined(CONFIG_LEDS_CLASS_MODULE) && defined(CONFIG_RADIO_SHARK_MODULE))
+#define SHARK_USE_LEDS 1
+#endif
 /*
 * Version Information
 */
@@ -56,44 +61,18 @@ MODULE_LICENSE("GPL");
 enum { BLUE_LED, BLUE_PULSE_LED, RED_LED, NO_LEDS };
-static void shark_led_set_blue(struct led_classdev *led_cdev,
-                               enum led_brightness value);
-static void shark_led_set_blue_pulse(struct led_classdev *led_cdev,
-                                     enum led_brightness value);
-static void shark_led_set_red(struct led_classdev *led_cdev,
-                              enum led_brightness value);
-static const struct led_classdev shark_led_templates[NO_LEDS] = {
-        [BLUE_LED] = {
-                .name           = "%s:blue:",
-                .brightness     = LED_OFF,
-                .max_brightness = 127,
-                .brightness_set = shark_led_set_blue,
-        },
-        [BLUE_PULSE_LED] = {
-                .name           = "%s:blue-pulse:",
-                .brightness     = LED_OFF,
-                .max_brightness = 255,
-                .brightness_set = shark_led_set_blue_pulse,
-        },
-        [RED_LED] = {
-                .name           = "%s:red:",
-                .brightness     = LED_OFF,
-                .max_brightness = 1,
-                .brightness_set = shark_led_set_red,
-        },
-};
 struct shark_device {
        struct usb_device *usbdev;
        struct v4l2_device v4l2_dev;
        struct snd_tea575x tea;
+#ifdef SHARK_USE_LEDS
        struct work_struct led_work;
        struct led_classdev leds[NO_LEDS];
        char led_names[NO_LEDS][32];
        atomic_t brightness[NO_LEDS];
        unsigned long brightness_new;
+#endif
        u8 *transfer_buffer;
        u32 last_val;
@@ -175,20 +154,13 @@ static struct snd_tea575x_ops shark_tea_ops = {
        .read_val  = shark_read_val,
 };
+#ifdef SHARK_USE_LEDS
 static void shark_led_work(struct work_struct *work)
 {
        struct shark_device *shark =
                container_of(work, struct shark_device, led_work);
        int i, res, brightness, actual_len;
-        /*
-         * We use the v4l2_dev lock and registered bit to ensure the device
-         * does not get unplugged and unreffed while we're running.
-         */
-        mutex_lock(&shark->tea.mutex);
-        if (!video_is_registered(&shark->tea.vd))
-                goto leave;
        for (i = 0; i < 3; i++) {
                if (!test_and_clear_bit(i, &shark->brightness_new))
                        continue;
@@ -208,8 +180,6 @@ static void shark_led_work(struct work_struct *work)
                        v4l2_err(&shark->v4l2_dev, "set LED %s error: %d\n",
                                 shark->led_names[i], res);
        }
-leave:
-        mutex_unlock(&shark->tea.mutex);
 }
 static void shark_led_set_blue(struct led_classdev *led_cdev,
@@ -245,19 +215,78 @@ static void shark_led_set_red(struct led_classdev *led_cdev,
        schedule_work(&shark->led_work);
 }
+static const struct led_classdev shark_led_templates[NO_LEDS] = {
+        [BLUE_LED] = {
+                .name           = "%s:blue:",
+                .brightness     = LED_OFF,
+                .max_brightness = 127,
+                .brightness_set = shark_led_set_blue,
+        },
+        [BLUE_PULSE_LED] = {
+                .name           = "%s:blue-pulse:",
+                .brightness     = LED_OFF,
+                .max_brightness = 255,
+                .brightness_set = shark_led_set_blue_pulse,
+        },
+        [RED_LED] = {
+                .name           = "%s:red:",
+                .brightness     = LED_OFF,
+                .max_brightness = 1,
+                .brightness_set = shark_led_set_red,
+        },
+};
+static int shark_register_leds(struct shark_device *shark, struct device *dev)
+{
+        int i, retval;
+        INIT_WORK(&shark->led_work, shark_led_work);
+        for (i = 0; i < NO_LEDS; i++) {
+                shark->leds[i] = shark_led_templates[i];
+                snprintf(shark->led_names[i], sizeof(shark->led_names[0]),
+                         shark->leds[i].name, shark->v4l2_dev.name);
+                shark->leds[i].name = shark->led_names[i];
+                retval = led_classdev_register(dev, &shark->leds[i]);
+                if (retval) {
+                        v4l2_err(&shark->v4l2_dev,
+                                 "couldn't register led: %s\n",
+                                 shark->led_names[i]);
+                        return retval;
+                }
+        }
+        return 0;
+}
+static void shark_unregister_leds(struct shark_device *shark)
+{
+        int i;
+        for (i = 0; i < NO_LEDS; i++)
+                led_classdev_unregister(&shark->leds[i]);
+        cancel_work_sync(&shark->led_work);
+}
+#else
+static int shark_register_leds(struct shark_device *shark, struct device *dev)
+{
+        v4l2_warn(&shark->v4l2_dev,
+                  "CONFIG_LED_CLASS not enabled, LED support disabled\n");
+        return 0;
+}
+static inline void shark_unregister_leds(struct shark_device *shark) { }
+#endif
 static void usb_shark_disconnect(struct usb_interface *intf)
 {
        struct v4l2_device *v4l2_dev = usb_get_intfdata(intf);
        struct shark_device *shark = v4l2_dev_to_shark(v4l2_dev);
-        int i;
        mutex_lock(&shark->tea.mutex);
        v4l2_device_disconnect(&shark->v4l2_dev);
        snd_tea575x_exit(&shark->tea);
        mutex_unlock(&shark->tea.mutex);
-        for (i = 0; i < NO_LEDS; i++)
+        shark_unregister_leds(shark);
-                led_classdev_unregister(&shark->leds[i]);
        v4l2_device_put(&shark->v4l2_dev);
 }
@@ -266,7 +295,6 @@ static void usb_shark_release(struct v4l2_device *v4l2_dev)
 {
        struct shark_device *shark = v4l2_dev_to_shark(v4l2_dev);
-        cancel_work_sync(&shark->led_work);
        v4l2_device_unregister(&shark->v4l2_dev);
        kfree(shark->transfer_buffer);
        kfree(shark);
@@ -276,7 +304,7 @@ static int usb_shark_probe(struct usb_interface *intf,
                           const struct usb_device_id *id)
 {
        struct shark_device *shark;
-        int i, retval = -ENOMEM;
+        int retval = -ENOMEM;
        shark = kzalloc(sizeof(struct shark_device), GFP_KERNEL);
        if (!shark)
@@ -286,17 +314,13 @@ static int usb_shark_probe(struct usb_interface *intf,
        if (!shark->transfer_buffer)
                goto err_alloc_buffer;
-        /*
+        v4l2_device_set_name(&shark->v4l2_dev, DRV_NAME, &shark_instance);
-         * Work around a bug in usbhid/hid-core.c, where it leaves a dangling
-         * pointer in intfdata causing v4l2-device.c to not set it. Which
+        retval = shark_register_leds(shark, &intf->dev);
-         * results in usb_shark_disconnect() referencing the dangling pointer
+        if (retval)
-         *
+                goto err_reg_leds;
-         * REMOVE (as soon as the above bug is fixed, patch submitted)
-         */
-        usb_set_intfdata(intf, NULL);
        shark->v4l2_dev.release = usb_shark_release;
-        v4l2_device_set_name(&shark->v4l2_dev, DRV_NAME, &shark_instance);
        retval = v4l2_device_register(&intf->dev, &shark->v4l2_dev);
        if (retval) {
                v4l2_err(&shark->v4l2_dev, "couldn't register v4l2_device\n");
@@ -320,32 +344,13 @@ static int usb_shark_probe(struct usb_interface *intf,
                goto err_init_tea;
        }
-        INIT_WORK(&shark->led_work, shark_led_work);
-        for (i = 0; i < NO_LEDS; i++) {
-                shark->leds[i] = shark_led_templates[i];
-                snprintf(shark->led_names[i], sizeof(shark->led_names[0]),
-                         shark->leds[i].name, shark->v4l2_dev.name);
-                shark->leds[i].name = shark->led_names[i];
-                /*
-                 * We don't fail the probe if we fail to register the leds,
-                 * because once we've called snd_tea575x_init, the /dev/radio0
-                 * node may be opened from userspace holding a reference to us!
-                 *
-                 * Note we cannot register the leds first instead as
-                 * shark_led_work depends on the v4l2 mutex and registered bit.
-                 */
-                retval = led_classdev_register(&intf->dev, &shark->leds[i]);
-                if (retval)
-                        v4l2_err(&shark->v4l2_dev,
-                                 "couldn't register led: %s\n",
-                                 shark->led_names[i]);
-        }
        return 0;
 err_init_tea:
        v4l2_device_unregister(&shark->v4l2_dev);
 err_reg_dev:
+        shark_unregister_leds(shark);
+err_reg_leds:
        kfree(shark->transfer_buffer);
 err_alloc_buffer:
        kfree(shark);
diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
index b9575de3e7e8..7b4efdfaae28 100644
--- a/drivers/media/radio/radio-shark2.c
+++ b/drivers/media/radio/radio-shark2.c
@@ -35,6 +35,11 @@
 #include <media/v4l2-device.h>
 #include "radio-tea5777.h"
+#if defined(CONFIG_LEDS_CLASS) || \
+    (defined(CONFIG_LEDS_CLASS_MODULE) && defined(CONFIG_RADIO_SHARK2_MODULE))
+#define SHARK_USE_LEDS 1
+#endif
 MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
 MODULE_DESCRIPTION("Griffin radioSHARK2, USB radio receiver driver");
 MODULE_LICENSE("GPL");
@@ -43,7 +48,6 @@ static int debug;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0-1)");
 #define SHARK_IN_EP             0x83
 #define SHARK_OUT_EP            0x05
@@ -54,36 +58,18 @@ MODULE_PARM_DESC(debug, "Debug level (0-1)");
 enum { BLUE_LED, RED_LED, NO_LEDS };
-static void shark_led_set_blue(struct led_classdev *led_cdev,
-                               enum led_brightness value);
-static void shark_led_set_red(struct led_classdev *led_cdev,
-                              enum led_brightness value);
-static const struct led_classdev shark_led_templates[NO_LEDS] = {
-        [BLUE_LED] = {
-                .name           = "%s:blue:",
-                .brightness     = LED_OFF,
-                .max_brightness = 127,
-                .brightness_set = shark_led_set_blue,
-        },
-        [RED_LED] = {
-                .name           = "%s:red:",
-                .brightness     = LED_OFF,
-                .max_brightness = 1,
-                .brightness_set = shark_led_set_red,
-        },
-};
 struct shark_device {
        struct usb_device *usbdev;
        struct v4l2_device v4l2_dev;
        struct radio_tea5777 tea;
+#ifdef SHARK_USE_LEDS
        struct work_struct led_work;
        struct led_classdev leds[NO_LEDS];
        char led_names[NO_LEDS][32];
        atomic_t brightness[NO_LEDS];
        unsigned long brightness_new;
+#endif
        u8 *transfer_buffer;
 };
@@ -161,18 +147,12 @@ static struct radio_tea5777_ops shark_tea_ops = {
        .read_reg  = shark_read_reg,
 };
+#ifdef SHARK_USE_LEDS
 static void shark_led_work(struct work_struct *work)
 {
        struct shark_device *shark =
                container_of(work, struct shark_device, led_work);
        int i, res, brightness, actual_len;
-        /*
-         * We use the v4l2_dev lock and registered bit to ensure the device
-         * does not get unplugged and unreffed while we're running.
-         */
-        mutex_lock(&shark->tea.mutex);
-        if (!video_is_registered(&shark->tea.vd))
-                goto leave;
        for (i = 0; i < 2; i++) {
                if (!test_and_clear_bit(i, &shark->brightness_new))
@@ -191,8 +171,6 @@ static void shark_led_work(struct work_struct *work)
                        v4l2_err(&shark->v4l2_dev, "set LED %s error: %d\n",
                                 shark->led_names[i], res);
        }
-leave:
-        mutex_unlock(&shark->tea.mutex);
 }
 static void shark_led_set_blue(struct led_classdev *led_cdev,
@@ -217,19 +195,72 @@ static void shark_led_set_red(struct led_classdev *led_cdev,
        schedule_work(&shark->led_work);
 }
+static const struct led_classdev shark_led_templates[NO_LEDS] = {
+        [BLUE_LED] = {
+                .name           = "%s:blue:",
+                .brightness     = LED_OFF,
+                .max_brightness = 127,
+                .brightness_set = shark_led_set_blue,
+        },
+        [RED_LED] = {
+                .name           = "%s:red:",
+                .brightness     = LED_OFF,
+                .max_brightness = 1,
+                .brightness_set = shark_led_set_red,
+        },
+};
+static int shark_register_leds(struct shark_device *shark, struct device *dev)
+{
+        int i, retval;
+        INIT_WORK(&shark->led_work, shark_led_work);
+        for (i = 0; i < NO_LEDS; i++) {
+                shark->leds[i] = shark_led_templates[i];
+                snprintf(shark->led_names[i], sizeof(shark->led_names[0]),
+                         shark->leds[i].name, shark->v4l2_dev.name);
+                shark->leds[i].name = shark->led_names[i];
+                retval = led_classdev_register(dev, &shark->leds[i]);
+                if (retval) {
+                        v4l2_err(&shark->v4l2_dev,
+                                 "couldn't register led: %s\n",
+                                 shark->led_names[i]);
+                        return retval;
+                }
+        }
+        return 0;
+}
+static void shark_unregister_leds(struct shark_device *shark)
+{
+        int i;
+        for (i = 0; i < NO_LEDS; i++)
+                led_classdev_unregister(&shark->leds[i]);
+        cancel_work_sync(&shark->led_work);
+}
+#else
+static int shark_register_leds(struct shark_device *shark, struct device *dev)
+{
+        v4l2_warn(&shark->v4l2_dev,
+                  "CONFIG_LED_CLASS not enabled, LED support disabled\n");
+        return 0;
+}
+static inline void shark_unregister_leds(struct shark_device *shark) { }
+#endif
 static void usb_shark_disconnect(struct usb_interface *intf)
 {
        struct v4l2_device *v4l2_dev = usb_get_intfdata(intf);
        struct shark_device *shark = v4l2_dev_to_shark(v4l2_dev);
-        int i;
        mutex_lock(&shark->tea.mutex);
        v4l2_device_disconnect(&shark->v4l2_dev);
        radio_tea5777_exit(&shark->tea);
        mutex_unlock(&shark->tea.mutex);
-        for (i = 0; i < NO_LEDS; i++)
+        shark_unregister_leds(shark);
-                led_classdev_unregister(&shark->leds[i]);
        v4l2_device_put(&shark->v4l2_dev);
 }
@@ -238,7 +269,6 @@ static void usb_shark_release(struct v4l2_device *v4l2_dev)
 {
        struct shark_device *shark = v4l2_dev_to_shark(v4l2_dev);
-        cancel_work_sync(&shark->led_work);
        v4l2_device_unregister(&shark->v4l2_dev);
        kfree(shark->transfer_buffer);
        kfree(shark);
@@ -248,7 +278,7 @@ static int usb_shark_probe(struct usb_interface *intf,
                           const struct usb_device_id *id)
 {
        struct shark_device *shark;
-        int i, retval = -ENOMEM;
+        int retval = -ENOMEM;
        shark = kzalloc(sizeof(struct shark_device), GFP_KERNEL);
        if (!shark)
@@ -258,17 +288,13 @@ static int usb_shark_probe(struct usb_interface *intf,
        if (!shark->transfer_buffer)
                goto err_alloc_buffer;
-        /*
+        v4l2_device_set_name(&shark->v4l2_dev, DRV_NAME, &shark_instance);
-         * Work around a bug in usbhid/hid-core.c, where it leaves a dangling
-         * pointer in intfdata causing v4l2-device.c to not set it. Which
+        retval = shark_register_leds(shark, &intf->dev);
-         * results in usb_shark_disconnect() referencing the dangling pointer
+        if (retval)
-         *
+                goto err_reg_leds;
-         * REMOVE (as soon as the above bug is fixed, patch submitted)
-         */
-        usb_set_intfdata(intf, NULL);
        shark->v4l2_dev.release = usb_shark_release;
-        v4l2_device_set_name(&shark->v4l2_dev, DRV_NAME, &shark_instance);
        retval = v4l2_device_register(&intf->dev, &shark->v4l2_dev);
        if (retval) {
                v4l2_err(&shark->v4l2_dev, "couldn't register v4l2_device\n");
@@ -292,32 +318,13 @@ static int usb_shark_probe(struct usb_interface *intf,
                goto err_init_tea;
        }
-        INIT_WORK(&shark->led_work, shark_led_work);
-        for (i = 0; i < NO_LEDS; i++) {
-                shark->leds[i] = shark_led_templates[i];
-                snprintf(shark->led_names[i], sizeof(shark->led_names[0]),
-                         shark->leds[i].name, shark->v4l2_dev.name);
-                shark->leds[i].name = shark->led_names[i];
-                /*
-                 * We don't fail the probe if we fail to register the leds,
-                 * because once we've called radio_tea5777_init, the /dev/radio0
-                 * node may be opened from userspace holding a reference to us!
-                 *
-                 * Note we cannot register the leds first instead as
-                 * shark_led_work depends on the v4l2 mutex and registered bit.
-                 */
-                retval = led_classdev_register(&intf->dev, &shark->leds[i]);
-                if (retval)
-                        v4l2_err(&shark->v4l2_dev,
-                                 "couldn't register led: %s\n",
-                                 shark->led_names[i]);
-        }
        return 0;
 err_init_tea:
        v4l2_device_unregister(&shark->v4l2_dev);
 err_reg_dev:
+        shark_unregister_leds(shark);
+err_reg_leds:
        kfree(shark->transfer_buffer);
 err_alloc_buffer:
        kfree(shark);
diff --git a/drivers/media/radio/si470x/radio-si470x-common.c b/drivers/media/radio/si470x/radio-si470x-common.c
index 9e38132afec6..9bb65e170d99 100644
--- a/drivers/media/radio/si470x/radio-si470x-common.c
+++ b/drivers/media/radio/si470x/radio-si470x-common.c
@@ -151,6 +151,7 @@ static const struct v4l2_frequency_band bands[] = {
                .index = 0,
                .capability = V4L2_TUNER_CAP_LOW | V4L2_TUNER_CAP_STEREO |
                            V4L2_TUNER_CAP_RDS | V4L2_TUNER_CAP_RDS_BLOCK_IO |
+                            V4L2_TUNER_CAP_FREQ_BANDS |
                            V4L2_TUNER_CAP_HWSEEK_BOUNDED |
                            V4L2_TUNER_CAP_HWSEEK_WRAP,
                .rangelow   =  87500 * 16,
@@ -162,6 +163,7 @@ static const struct v4l2_frequency_band bands[] = {
                .index = 1,
                .capability = V4L2_TUNER_CAP_LOW | V4L2_TUNER_CAP_STEREO |
                            V4L2_TUNER_CAP_RDS | V4L2_TUNER_CAP_RDS_BLOCK_IO |
+                            V4L2_TUNER_CAP_FREQ_BANDS |
                            V4L2_TUNER_CAP_HWSEEK_BOUNDED |
                            V4L2_TUNER_CAP_HWSEEK_WRAP,
                .rangelow   =  76000 * 16,
@@ -173,6 +175,7 @@ static const struct v4l2_frequency_band bands[] = {
                .index = 2,
                .capability = V4L2_TUNER_CAP_LOW | V4L2_TUNER_CAP_STEREO |
                            V4L2_TUNER_CAP_RDS | V4L2_TUNER_CAP_RDS_BLOCK_IO |
+                            V4L2_TUNER_CAP_FREQ_BANDS |
                            V4L2_TUNER_CAP_HWSEEK_BOUNDED |
                            V4L2_TUNER_CAP_HWSEEK_WRAP,
                .rangelow   =  76000 * 16,
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index 643a6ff7c5d0..f867f04cccc9 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -225,8 +225,9 @@ int si470x_vidioc_querycap(struct file *file, void *priv,
 {
        strlcpy(capability->driver, DRIVER_NAME, sizeof(capability->driver));
        strlcpy(capability->card, DRIVER_CARD, sizeof(capability->card));
-        capability->capabilities = V4L2_CAP_HW_FREQ_SEEK |
+        capability->device_caps = V4L2_CAP_HW_FREQ_SEEK | V4L2_CAP_READWRITE |
-                V4L2_CAP_TUNER | V4L2_CAP_RADIO;
+                V4L2_CAP_TUNER | V4L2_CAP_RADIO | V4L2_CAP_RDS_CAPTURE;
+        capability->capabilities = capability->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
index 146be4263ea1..be076f7181e7 100644
--- a/drivers/media/radio/si470x/radio-si470x-usb.c
+++ b/drivers/media/radio/si470x/radio-si470x-usb.c
@@ -531,7 +531,7 @@ int si470x_vidioc_querycap(struct file *file, void *priv,
        strlcpy(capability->card, DRIVER_CARD, sizeof(capability->card));
        usb_make_path(radio->usbdev, capability->bus_info,
                        sizeof(capability->bus_info));
-        capability->device_caps = V4L2_CAP_HW_FREQ_SEEK |
+        capability->device_caps = V4L2_CAP_HW_FREQ_SEEK | V4L2_CAP_READWRITE |
                V4L2_CAP_TUNER | V4L2_CAP_RADIO | V4L2_CAP_RDS_CAPTURE;
        capability->capabilities = capability->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
diff --git a/drivers/media/rc/Kconfig b/drivers/media/rc/Kconfig
index 5180390be7ab..8be57634ba60 100644
--- a/drivers/media/rc/Kconfig
+++ b/drivers/media/rc/Kconfig
@@ -261,6 +261,7 @@ config IR_WINBOND_CIR
 config IR_IGUANA
        tristate "IguanaWorks USB IR Transceiver"
+        depends on USB_ARCH_HAS_HCD
        depends on RC_CORE
        select USB
        ---help---
diff --git a/drivers/media/video/gspca/jl2005bcd.c b/drivers/media/video/gspca/jl2005bcd.c
index cf9d9fca5b84..234777116e5f 100644
--- a/drivers/media/video/gspca/jl2005bcd.c
+++ b/drivers/media/video/gspca/jl2005bcd.c
@@ -512,7 +512,7 @@ static const struct sd_desc sd_desc = {
 };
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x0979, 0x0227)},
        {}
 };
diff --git a/drivers/media/video/gspca/spca506.c b/drivers/media/video/gspca/spca506.c
index 969bb5a4cd93..bab01c86c315 100644
--- a/drivers/media/video/gspca/spca506.c
+++ b/drivers/media/video/gspca/spca506.c
@@ -579,7 +579,7 @@ static const struct sd_desc sd_desc = {
 };
 /* -- module initialisation -- */
-static const struct usb_device_id device_table[] __devinitconst = {
+static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x06e1, 0xa190)},
 /*fixme: may be IntelPCCameraPro BRIDGE_SPCA505
        {USB_DEVICE(0x0733, 0x0430)}, */
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index 7efe9ad7acc7..0b91a5cd38eb 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -431,7 +431,7 @@ static int vidioc_querycap(struct file *file, void *priv,
        strncpy(cap->driver, MEM2MEM_NAME, sizeof(cap->driver) - 1);
        strncpy(cap->card, MEM2MEM_NAME, sizeof(cap->card) - 1);
        strlcpy(cap->bus_info, MEM2MEM_NAME, sizeof(cap->bus_info));
-        cap->capabilities = V4L2_CAP_VIDEO_M2M | V4L2_CAP_STREAMING;
+        cap->device_caps = V4L2_CAP_VIDEO_M2M | V4L2_CAP_STREAMING;
        cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
        return 0;
 }
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index d2e6f82ecfac..560a65aa7038 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -403,7 +403,7 @@ static void mx1_camera_activate(struct mx1_camera_dev *pcdev)
        dev_dbg(pcdev->icd->parent, "Activate device\n");
-        clk_enable(pcdev->clk);
+        clk_prepare_enable(pcdev->clk);
        /* enable CSI before doing anything else */
        __raw_writel(csicr1, pcdev->base + CSICR1);
@@ -422,7 +422,7 @@ static void mx1_camera_deactivate(struct mx1_camera_dev *pcdev)
        /* Disable all CSI interface */
        __raw_writel(0x00, pcdev->base + CSICR1);
-        clk_disable(pcdev->clk);
+        clk_disable_unprepare(pcdev->clk);
 }
 /*
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index 637bde8aca28..ac175406e582 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -272,7 +272,7 @@ struct mx2_camera_dev {
        struct device           *dev;
        struct soc_camera_host  soc_host;
        struct soc_camera_device *icd;
-        struct clk              *clk_csi, *clk_emma;
+        struct clk              *clk_csi, *clk_emma_ahb, *clk_emma_ipg;
        unsigned int            irq_csi, irq_emma;
        void __iomem            *base_csi, *base_emma;
@@ -407,7 +407,7 @@ static void mx2_camera_deactivate(struct mx2_camera_dev *pcdev)
 {
        unsigned long flags;
-        clk_disable(pcdev->clk_csi);
+        clk_disable_unprepare(pcdev->clk_csi);
        writel(0, pcdev->base_csi + CSICR1);
        if (cpu_is_mx27()) {
                writel(0, pcdev->base_emma + PRP_CNTL);
@@ -435,7 +435,7 @@ static int mx2_camera_add_device(struct soc_camera_device *icd)
        if (pcdev->icd)
                return -EBUSY;
-        ret = clk_enable(pcdev->clk_csi);
+        ret = clk_prepare_enable(pcdev->clk_csi);
        if (ret < 0)
                return ret;
@@ -1633,23 +1633,34 @@ static int __devinit mx27_camera_emma_init(struct mx2_camera_dev *pcdev)
                goto exit_iounmap;
        }
-        pcdev->clk_emma = clk_get(NULL, "emma");
+        pcdev->clk_emma_ipg = clk_get(pcdev->dev, "emma-ipg");
-        if (IS_ERR(pcdev->clk_emma)) {
+        if (IS_ERR(pcdev->clk_emma_ipg)) {
-                err = PTR_ERR(pcdev->clk_emma);
+                err = PTR_ERR(pcdev->clk_emma_ipg);
                goto exit_free_irq;
        }
-        clk_enable(pcdev->clk_emma);
+        clk_prepare_enable(pcdev->clk_emma_ipg);
+        pcdev->clk_emma_ahb = clk_get(pcdev->dev, "emma-ahb");
+        if (IS_ERR(pcdev->clk_emma_ahb)) {
+                err = PTR_ERR(pcdev->clk_emma_ahb);
+                goto exit_clk_emma_ipg_put;
+        }
+        clk_prepare_enable(pcdev->clk_emma_ahb);
        err = mx27_camera_emma_prp_reset(pcdev);
        if (err)
-                goto exit_clk_emma_put;
+                goto exit_clk_emma_ahb_put;
        return err;
-exit_clk_emma_put:
+exit_clk_emma_ahb_put:
-        clk_disable(pcdev->clk_emma);
+        clk_disable_unprepare(pcdev->clk_emma_ahb);
-        clk_put(pcdev->clk_emma);
+        clk_put(pcdev->clk_emma_ahb);
+exit_clk_emma_ipg_put:
+        clk_disable_unprepare(pcdev->clk_emma_ipg);
+        clk_put(pcdev->clk_emma_ipg);
 exit_free_irq:
        free_irq(pcdev->irq_emma, pcdev);
 exit_iounmap:
@@ -1685,7 +1696,7 @@ static int __devinit mx2_camera_probe(struct platform_device *pdev)
                goto exit;
        }
-        pcdev->clk_csi = clk_get(&pdev->dev, NULL);
+        pcdev->clk_csi = clk_get(&pdev->dev, "ahb");
        if (IS_ERR(pcdev->clk_csi)) {
                dev_err(&pdev->dev, "Could not get csi clock\n");
                err = PTR_ERR(pcdev->clk_csi);
@@ -1785,8 +1796,10 @@ exit_free_emma:
 eallocctx:
        if (cpu_is_mx27()) {
                free_irq(pcdev->irq_emma, pcdev);
-                clk_disable(pcdev->clk_emma);
+                clk_disable_unprepare(pcdev->clk_emma_ipg);
-                clk_put(pcdev->clk_emma);
+                clk_put(pcdev->clk_emma_ipg);
+                clk_disable_unprepare(pcdev->clk_emma_ahb);
+                clk_put(pcdev->clk_emma_ahb);
                iounmap(pcdev->base_emma);
                release_mem_region(pcdev->res_emma->start, resource_size(pcdev->res_emma));
        }
@@ -1825,8 +1838,10 @@ static int __devexit mx2_camera_remove(struct platform_device *pdev)
        iounmap(pcdev->base_csi);
        if (cpu_is_mx27()) {
-                clk_disable(pcdev->clk_emma);
+                clk_disable_unprepare(pcdev->clk_emma_ipg);
-                clk_put(pcdev->clk_emma);
+                clk_put(pcdev->clk_emma_ipg);
+                clk_disable_unprepare(pcdev->clk_emma_ahb);
+                clk_put(pcdev->clk_emma_ahb);
                iounmap(pcdev->base_emma);
                res = pcdev->res_emma;
                release_mem_region(res->start, resource_size(res));
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index f13643d31353..af2297dd49c8 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -61,15 +61,9 @@
 #define MAX_VIDEO_MEM 16
-enum csi_buffer_state {
-        CSI_BUF_NEEDS_INIT,
-        CSI_BUF_PREPARED,
-};
 struct mx3_camera_buffer {
        /* common v4l buffer stuff -- must be first */
        struct vb2_buffer                       vb;
-        enum csi_buffer_state                   state;
        struct list_head                        queue;
        /* One descriptot per scatterlist (per frame) */
@@ -285,7 +279,7 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
                goto error;
        }
-        if (buf->state == CSI_BUF_NEEDS_INIT) {
+        if (!buf->txd) {
                sg_dma_address(sg)      = vb2_dma_contig_plane_dma_addr(vb, 0);
                sg_dma_len(sg)          = new_size;
@@ -298,7 +292,6 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
                txd->callback_param     = txd;
                txd->callback           = mx3_cam_dma_done;
-                buf->state              = CSI_BUF_PREPARED;
                buf->txd                = txd;
        } else {
                txd = buf->txd;
@@ -385,7 +378,6 @@ static void mx3_videobuf_release(struct vb2_buffer *vb)
        /* Doesn't hurt also if the list is empty */
        list_del_init(&buf->queue);
-        buf->state = CSI_BUF_NEEDS_INIT;
        if (txd) {
                buf->txd = NULL;
@@ -405,13 +397,13 @@ static int mx3_videobuf_init(struct vb2_buffer *vb)
        struct mx3_camera_dev *mx3_cam = ici->priv;
        struct mx3_camera_buffer *buf = to_mx3_vb(vb);
-        /* This is for locking debugging only */
+        if (!buf->txd) {
-        INIT_LIST_HEAD(&buf->queue);
+                /* This is for locking debugging only */
-        sg_init_table(&buf->sg, 1);
+                INIT_LIST_HEAD(&buf->queue);
+                sg_init_table(&buf->sg, 1);
-        buf->state = CSI_BUF_NEEDS_INIT;
+                mx3_cam->buf_total += vb2_plane_size(vb, 0);
+        }
-        mx3_cam->buf_total += vb2_plane_size(vb, 0);
        return 0;
 }
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index b03ffecb7438..1bde255e45df 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -171,7 +171,8 @@ static int soc_camera_try_fmt(struct soc_camera_device *icd,
        dev_dbg(icd->pdev, "TRY_FMT(%c%c%c%c, %ux%u)\n",
                pixfmtstr(pix->pixelformat), pix->width, pix->height);
-        if (!(ici->capabilities & SOCAM_HOST_CAP_STRIDE)) {
+        if (pix->pixelformat != V4L2_PIX_FMT_JPEG &&
+            !(ici->capabilities & SOCAM_HOST_CAP_STRIDE)) {
                pix->bytesperline = 0;
                pix->sizeimage = 0;
        }
diff --git a/drivers/media/video/soc_mediabus.c b/drivers/media/video/soc_mediabus.c
index 89dce097a827..a397812635d6 100644
--- a/drivers/media/video/soc_mediabus.c
+++ b/drivers/media/video/soc_mediabus.c
@@ -378,6 +378,9 @@ EXPORT_SYMBOL(soc_mbus_samples_per_pixel);
 s32 soc_mbus_bytes_per_line(u32 width, const struct soc_mbus_pixelfmt *mf)
 {
+        if (mf->fourcc == V4L2_PIX_FMT_JPEG)
+                return 0;
        if (mf->layout != SOC_MBUS_LAYOUT_PACKED)
                return width * mf->bits_per_sample / 8;
@@ -400,6 +403,9 @@ EXPORT_SYMBOL(soc_mbus_bytes_per_line);
 s32 soc_mbus_image_size(const struct soc_mbus_pixelfmt *mf,
                        u32 bytes_per_line, u32 height)
 {
+        if (mf->fourcc == V4L2_PIX_FMT_JPEG)
+                return 0;
        if (mf->layout == SOC_MBUS_LAYOUT_PACKED)
                return bytes_per_line * height;
diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index 9288fbd5001b..5577381b5bf0 100644
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -338,6 +338,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
        if ((queue->flags & UVC_QUEUE_DROP_CORRUPTED) && buf->error) {
                buf->error = 0;
                buf->state = UVC_BUF_STATE_QUEUED;
+                buf->bytesused = 0;
                vb2_set_plane_payload(&buf->buf, 0, 0);
                return buf;
        }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index c3b7b5f59b32..6bc47fc82fe2 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -402,8 +402,10 @@ static void v4l_print_hw_freq_seek(const void *arg, bool write_only)
 {
        const struct v4l2_hw_freq_seek *p = arg;
-        pr_cont("tuner=%u, type=%u, seek_upward=%u, wrap_around=%u, spacing=%u\n",
+        pr_cont("tuner=%u, type=%u, seek_upward=%u, wrap_around=%u, spacing=%u, "
-                p->tuner, p->type, p->seek_upward, p->wrap_around, p->spacing);
+                "rangelow=%u, rangehigh=%u\n",
+                p->tuner, p->type, p->seek_upward, p->wrap_around, p->spacing,
+                p->rangelow, p->rangehigh);
 }
 static void v4l_print_requestbuffers(const void *arg, bool write_only)
@@ -1853,6 +1855,8 @@ static int v4l_enum_freq_bands(const struct v4l2_ioctl_ops *ops,
                        .type = type,
                };
+                if (p->index)
+                        return -EINVAL;
                err = ops->vidioc_g_tuner(file, fh, &t);
                if (err)
                        return err;
@@ -1870,6 +1874,8 @@ static int v4l_enum_freq_bands(const struct v4l2_ioctl_ops *ops,
                if (type != V4L2_TUNER_RADIO)
                        return -EINVAL;
+                if (p->index)
+                        return -EINVAL;
                err = ops->vidioc_g_modulator(file, fh, &m);
                if (err)
                        return err;
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index d1facef28a60..b1a146205c08 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -395,7 +395,8 @@ config MFD_TC6387XB
 config MFD_TC6393XB
        bool "Support Toshiba TC6393XB"
-        depends on GPIOLIB && ARM && HAVE_CLK
+        depends on ARM && HAVE_CLK
+        select GPIOLIB
        select MFD_CORE
        select MFD_TMIO
        help
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index c6ffbbe5a6c0..d78c05e693f7 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -1253,7 +1253,7 @@ static int mei_irq_thread_write_handler(struct mei_io_list *cmpl_list,
                        if (dev->wd_timeout)
                                *slots -= mei_data2slots(MEI_START_WD_DATA_SIZE);
                        else
-                                *slots -= mei_data2slots(MEI_START_WD_DATA_SIZE);
+                                *slots -= mei_data2slots(MEI_WD_PARAMS_SIZE);
                }
        }
        if (dev->stop)
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 092330208869..7422c7652845 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -925,6 +925,27 @@ static struct miscdevice  mei_misc_device = {
 };
 /**
+ * mei_quirk_probe - probe for devices that doesn't valid ME interface
+ * @pdev: PCI device structure
+ * @ent: entry into pci_device_table
+ *
+ * returns true if ME Interface is valid, false otherwise
+ */
+static bool __devinit mei_quirk_probe(struct pci_dev *pdev,
+                                const struct pci_device_id *ent)
+{
+        u32 reg;
+        if (ent->device == MEI_DEV_ID_PBG_1) {
+                pci_read_config_dword(pdev, 0x48, &reg);
+                /* make sure that bit 9 is up and bit 10 is down */
+                if ((reg & 0x600) == 0x200) {
+                        dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
+                        return false;
+                }
+        }
+        return true;
+}
+/**
 * mei_probe - Device Initialization Routine
 *
 * @pdev: PCI device structure
@@ -939,6 +960,12 @@ static int __devinit mei_probe(struct pci_dev *pdev,
        int err;
        mutex_lock(&mei_mutex);
+        if (!mei_quirk_probe(pdev, ent)) {
+                err = -ENODEV;
+                goto end;
+        }
        if (mei_device) {
                err = -EEXIST;
                goto end;
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index 87b251ab6ec5..b9e2000969f0 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -18,6 +18,8 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <linux/cpu.h>
+#include <linux/module.h>
 #include <linux/err.h>
 #include <linux/slab.h>
 #include <asm/uv/uv_hub.h>
@@ -59,6 +61,8 @@ static struct xpc_heartbeat_uv *xpc_heartbeat_uv;
                                         XPC_NOTIFY_MSG_SIZE_UV)
 #define XPC_NOTIFY_IRQ_NAME             "xpc_notify"
+static int xpc_mq_node = -1;
 static struct xpc_gru_mq_uv *xpc_activate_mq_uv;
 static struct xpc_gru_mq_uv *xpc_notify_mq_uv;
@@ -109,11 +113,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_uv *mq, int cpu, char *irq_name)
 #if defined CONFIG_X86_64
        mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset,
                        UV_AFFINITY_CPU);
-        if (mq->irq < 0) {
+        if (mq->irq < 0)
-                dev_err(xpc_part, "uv_setup_irq() returned error=%d\n",
-                        -mq->irq);
                return mq->irq;
-        }
        mq->mmr_value = uv_read_global_mmr64(mmr_pnode, mq->mmr_offset);
@@ -238,8 +239,9 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
        mq->mmr_blade = uv_cpu_to_blade_id(cpu);
        nid = cpu_to_node(cpu);
-        page = alloc_pages_exact_node(nid, GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+        page = alloc_pages_exact_node(nid,
-                                pg_order);
+                                      GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                      pg_order);
        if (page == NULL) {
                dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
                        "bytes of memory on nid=%d for GRU mq\n", mq_size, nid);
@@ -1731,9 +1733,50 @@ static struct xpc_arch_operations xpc_arch_ops_uv = {
        .notify_senders_of_disconnect = xpc_notify_senders_of_disconnect_uv,
 };
+static int
+xpc_init_mq_node(int nid)
+{
+        int cpu;
+        get_online_cpus();
+        for_each_cpu(cpu, cpumask_of_node(nid)) {
+                xpc_activate_mq_uv =
+                        xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, nid,
+                                             XPC_ACTIVATE_IRQ_NAME,
+                                             xpc_handle_activate_IRQ_uv);
+                if (!IS_ERR(xpc_activate_mq_uv))
+                        break;
+        }
+        if (IS_ERR(xpc_activate_mq_uv)) {
+                put_online_cpus();
+                return PTR_ERR(xpc_activate_mq_uv);
+        }
+        for_each_cpu(cpu, cpumask_of_node(nid)) {
+                xpc_notify_mq_uv =
+                        xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, nid,
+                                             XPC_NOTIFY_IRQ_NAME,
+                                             xpc_handle_notify_IRQ_uv);
+                if (!IS_ERR(xpc_notify_mq_uv))
+                        break;
+        }
+        if (IS_ERR(xpc_notify_mq_uv)) {
+                xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
+                put_online_cpus();
+                return PTR_ERR(xpc_notify_mq_uv);
+        }
+        put_online_cpus();
+        return 0;
+}
 int
 xpc_init_uv(void)
 {
+        int nid;
+        int ret = 0;
        xpc_arch_ops = xpc_arch_ops_uv;
        if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
@@ -1742,21 +1785,21 @@ xpc_init_uv(void)
                return -E2BIG;
        }
-        xpc_activate_mq_uv = xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, 0,
+        if (xpc_mq_node < 0)
-                                                  XPC_ACTIVATE_IRQ_NAME,
+                for_each_online_node(nid) {
-                                                  xpc_handle_activate_IRQ_uv);
+                        ret = xpc_init_mq_node(nid);
-        if (IS_ERR(xpc_activate_mq_uv))
-                return PTR_ERR(xpc_activate_mq_uv);
-        xpc_notify_mq_uv = xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, 0,
+                        if (!ret)
-                                                XPC_NOTIFY_IRQ_NAME,
+                                break;
-                                                xpc_handle_notify_IRQ_uv);
+                }
-        if (IS_ERR(xpc_notify_mq_uv)) {
+        else
-                xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
+                ret = xpc_init_mq_node(xpc_mq_node);
-                return PTR_ERR(xpc_notify_mq_uv);
-        }
-        return 0;
+        if (ret < 0)
+                dev_err(xpc_part, "xpc_init_mq_node() returned error=%d\n",
+                        -ret);
+        return ret;
 }
 void
@@ -1765,3 +1808,6 @@ xpc_exit_uv(void)
        xpc_destroy_gru_mq_uv(xpc_notify_mq_uv);
        xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
 }
+module_param(xpc_mq_node, int, 0);
+MODULE_PARM_DESC(xpc_mq_node, "Node number on which to allocate message queues.");
diff --git a/drivers/misc/ti-st/st_ll.c b/drivers/misc/ti-st/st_ll.c
index 1ff460a8e9c7..93b4d67cc4a3 100644
--- a/drivers/misc/ti-st/st_ll.c
+++ b/drivers/misc/ti-st/st_ll.c
@@ -87,7 +87,7 @@ static void ll_device_want_to_wakeup(struct st_data_s *st_data)
        /* communicate to platform about chip wakeup */
        kim_data = st_data->kim_data;
        pdata = kim_data->kim_pdev->dev.platform_data;
-        if (pdata->chip_asleep)
+        if (pdata->chip_awake)
                pdata->chip_awake(NULL);
 }
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index f1c84decb192..172a768036d8 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1411,7 +1411,8 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                /* complete ongoing async transfer before issuing discard */
                if (card->host->areq)
                        mmc_blk_issue_rw_rq(mq, NULL);
-                if (req->cmd_flags & REQ_SECURE)
+                if (req->cmd_flags & REQ_SECURE &&
+                        !(card->quirks & MMC_QUIRK_SEC_ERASE_TRIM_BROKEN))
                        ret = mmc_blk_issue_secdiscard_rq(mq, req);
                else
                        ret = mmc_blk_issue_discard_rq(mq, req);
@@ -1716,6 +1717,7 @@ force_ro_fail:
 #define CID_MANFID_SANDISK      0x2
 #define CID_MANFID_TOSHIBA      0x11
 #define CID_MANFID_MICRON       0x13
+#define CID_MANFID_SAMSUNG      0x15
 static const struct mmc_fixup blk_fixups[] =
 {
@@ -1752,6 +1754,28 @@ static const struct mmc_fixup blk_fixups[] =
        MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
                  MMC_QUIRK_LONG_READ_TIME),
+        /*
+         * On these Samsung MoviNAND parts, performing secure erase or
+         * secure trim can result in unrecoverable corruption due to a
+         * firmware bug.
+         */
+        MMC_FIXUP("M8G2FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+        MMC_FIXUP("MAG4FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+        MMC_FIXUP("MBG8FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+        MMC_FIXUP("MCGAFA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+        MMC_FIXUP("VAL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+        MMC_FIXUP("VYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+        MMC_FIXUP("KYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+        MMC_FIXUP("VZL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+                  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
        END_FIXUP
 };
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 322412cec4ee..a53c7c478e05 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -81,6 +81,7 @@ struct atmel_mci_caps {
        bool    has_bad_data_ordering;
        bool    need_reset_after_xfer;
        bool    need_blksz_mul_4;
+        bool    need_notbusy_for_read_ops;
 };
 struct atmel_mci_dma {
@@ -1625,7 +1626,8 @@ static void atmci_tasklet_func(unsigned long priv)
                                __func__);
                        atmci_set_completed(host, EVENT_XFER_COMPLETE);
-                        if (host->data->flags & MMC_DATA_WRITE) {
+                        if (host->caps.need_notbusy_for_read_ops ||
+                           (host->data->flags & MMC_DATA_WRITE)) {
                                atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY);
                                state = STATE_WAITING_NOTBUSY;
                        } else if (host->mrq->stop) {
@@ -2218,6 +2220,7 @@ static void __init atmci_get_cap(struct atmel_mci *host)
        host->caps.has_bad_data_ordering = 1;
        host->caps.need_reset_after_xfer = 1;
        host->caps.need_blksz_mul_4 = 1;
+        host->caps.need_notbusy_for_read_ops = 0;
        /* keep only major version number */
        switch (version & 0xf00) {
@@ -2238,6 +2241,7 @@ static void __init atmci_get_cap(struct atmel_mci *host)
        case 0x200:
                host->caps.has_rwproof = 1;
                host->caps.need_blksz_mul_4 = 0;
+                host->caps.need_notbusy_for_read_ops = 1;
        case 0x100:
                host->caps.has_bad_data_ordering = 0;
                host->caps.need_reset_after_xfer = 0;
diff --git a/drivers/mmc/host/bfin_sdh.c b/drivers/mmc/host/bfin_sdh.c
index 03666174ca48..a17dd7363ceb 100644
--- a/drivers/mmc/host/bfin_sdh.c
+++ b/drivers/mmc/host/bfin_sdh.c
@@ -49,13 +49,6 @@
 #define bfin_write_SDH_CFG              bfin_write_RSI_CFG
 #endif
-struct dma_desc_array {
-        unsigned long   start_addr;
-        unsigned short  cfg;
-        unsigned short  x_count;
-        short           x_modify;
-} __packed;
 struct sdh_host {
        struct mmc_host         *mmc;
        spinlock_t              lock;
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 72dc3cde646d..af40d227bece 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -627,6 +627,7 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot)
 {
        struct dw_mci *host = slot->host;
        u32 div;
+        u32 clk_en_a;
        if (slot->clock != host->current_speed) {
                div = host->bus_hz / slot->clock;
@@ -659,9 +660,11 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot)
                mci_send_cmd(slot,
                             SDMMC_CMD_UPD_CLK | SDMMC_CMD_PRV_DAT_WAIT, 0);
-                /* enable clock */
+                /* enable clock; only low power if no SDIO */
-                mci_writel(host, CLKENA, ((SDMMC_CLKEN_ENABLE |
+                clk_en_a = SDMMC_CLKEN_ENABLE << slot->id;
-                           SDMMC_CLKEN_LOW_PWR) << slot->id));
+                if (!(mci_readl(host, INTMASK) & SDMMC_INT_SDIO(slot->id)))
+                        clk_en_a |= SDMMC_CLKEN_LOW_PWR << slot->id;
+                mci_writel(host, CLKENA, clk_en_a);
                /* inform CIU */
                mci_send_cmd(slot,
@@ -862,6 +865,30 @@ static int dw_mci_get_cd(struct mmc_host *mmc)
        return present;
 }
+/*
+ * Disable lower power mode.
+ *
+ * Low power mode will stop the card clock when idle.  According to the
+ * description of the CLKENA register we should disable low power mode
+ * for SDIO cards if we need SDIO interrupts to work.
+ *
+ * This function is fast if low power mode is already disabled.
+ */
+static void dw_mci_disable_low_power(struct dw_mci_slot *slot)
+{
+        struct dw_mci *host = slot->host;
+        u32 clk_en_a;
+        const u32 clken_low_pwr = SDMMC_CLKEN_LOW_PWR << slot->id;
+        clk_en_a = mci_readl(host, CLKENA);
+        if (clk_en_a & clken_low_pwr) {
+                mci_writel(host, CLKENA, clk_en_a & ~clken_low_pwr);
+                mci_send_cmd(slot, SDMMC_CMD_UPD_CLK |
+                             SDMMC_CMD_PRV_DAT_WAIT, 0);
+        }
+}
 static void dw_mci_enable_sdio_irq(struct mmc_host *mmc, int enb)
 {
        struct dw_mci_slot *slot = mmc_priv(mmc);
@@ -871,6 +898,14 @@ static void dw_mci_enable_sdio_irq(struct mmc_host *mmc, int enb)
        /* Enable/disable Slot Specific SDIO interrupt */
        int_mask = mci_readl(host, INTMASK);
        if (enb) {
+                /*
+                 * Turn off low power mode if it was enabled.  This is a bit of
+                 * a heavy operation and we disable / enable IRQs a lot, so
+                 * we'll leave low power mode disabled and it will get
+                 * re-enabled again in dw_mci_setup_bus().
+                 */
+                dw_mci_disable_low_power(slot);
                mci_writel(host, INTMASK,
                           (int_mask | SDMMC_INT_SDIO(slot->id)));
        } else {
@@ -1429,22 +1464,10 @@ static void dw_mci_read_data_pio(struct dw_mci *host)
                        nbytes += len;
                        remain -= len;
                } while (remain);
-                sg_miter->consumed = offset;
+                sg_miter->consumed = offset;
                status = mci_readl(host, MINTSTS);
                mci_writel(host, RINTSTS, SDMMC_INT_RXDR);
-                if (status & DW_MCI_DATA_ERROR_FLAGS) {
-                        host->data_status = status;
-                        data->bytes_xfered += nbytes;
-                        sg_miter_stop(sg_miter);
-                        host->sg = NULL;
-                        smp_wmb();
-                        set_bit(EVENT_DATA_ERROR, &host->pending_events);
-                        tasklet_schedule(&host->tasklet);
-                        return;
-                }
        } while (status & SDMMC_INT_RXDR); /*if the RXDR is ready read again*/
        data->bytes_xfered += nbytes;
@@ -1497,23 +1520,10 @@ static void dw_mci_write_data_pio(struct dw_mci *host)
                        nbytes += len;
                        remain -= len;
                } while (remain);
-                sg_miter->consumed = offset;
+                sg_miter->consumed = offset;
                status = mci_readl(host, MINTSTS);
                mci_writel(host, RINTSTS, SDMMC_INT_TXDR);
-                if (status & DW_MCI_DATA_ERROR_FLAGS) {
-                        host->data_status = status;
-                        data->bytes_xfered += nbytes;
-                        sg_miter_stop(sg_miter);
-                        host->sg = NULL;
-                        smp_wmb();
-                        set_bit(EVENT_DATA_ERROR, &host->pending_events);
-                        tasklet_schedule(&host->tasklet);
-                        return;
-                }
        } while (status & SDMMC_INT_TXDR); /* if TXDR write again */
        data->bytes_xfered += nbytes;
@@ -1547,12 +1557,11 @@ static void dw_mci_cmd_interrupt(struct dw_mci *host, u32 status)
 static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
 {
        struct dw_mci *host = dev_id;
-        u32 status, pending;
+        u32 pending;
        unsigned int pass_count = 0;
        int i;
        do {
-                status = mci_readl(host, RINTSTS);
                pending = mci_readl(host, MINTSTS); /* read-only mask reg */
                /*
@@ -1570,7 +1579,7 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                if (pending & DW_MCI_CMD_ERROR_FLAGS) {
                        mci_writel(host, RINTSTS, DW_MCI_CMD_ERROR_FLAGS);
-                        host->cmd_status = status;
+                        host->cmd_status = pending;
                        smp_wmb();
                        set_bit(EVENT_CMD_COMPLETE, &host->pending_events);
                }
@@ -1578,18 +1587,16 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                if (pending & DW_MCI_DATA_ERROR_FLAGS) {
                        /* if there is an error report DATA_ERROR */
                        mci_writel(host, RINTSTS, DW_MCI_DATA_ERROR_FLAGS);
-                        host->data_status = status;
+                        host->data_status = pending;
                        smp_wmb();
                        set_bit(EVENT_DATA_ERROR, &host->pending_events);
-                        if (!(pending & (SDMMC_INT_DTO | SDMMC_INT_DCRC |
+                        tasklet_schedule(&host->tasklet);
-                                         SDMMC_INT_SBE | SDMMC_INT_EBE)))
-                                tasklet_schedule(&host->tasklet);
                }
                if (pending & SDMMC_INT_DATA_OVER) {
                        mci_writel(host, RINTSTS, SDMMC_INT_DATA_OVER);
                        if (!host->data_status)
-                                host->data_status = status;
+                                host->data_status = pending;
                        smp_wmb();
                        if (host->dir_status == DW_MCI_RECV_STATUS) {
                                if (host->sg != NULL)
@@ -1613,7 +1620,7 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                if (pending & SDMMC_INT_CMD_DONE) {
                        mci_writel(host, RINTSTS, SDMMC_INT_CMD_DONE);
-                        dw_mci_cmd_interrupt(host, status);
+                        dw_mci_cmd_interrupt(host, pending);
                }
                if (pending & SDMMC_INT_CD) {
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index a51f9309ffbb..ad3fcea1269e 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -285,11 +285,11 @@ static irqreturn_t mxs_mmc_irq_handler(int irq, void *dev_id)
        writel(stat & MXS_MMC_IRQ_BITS,
               host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_CLR);
+        spin_unlock(&host->lock);
        if ((stat & BM_SSP_CTRL1_SDIO_IRQ) && (stat & BM_SSP_CTRL1_SDIO_IRQ_EN))
                mmc_signal_sdio_irq(host->mmc);
-        spin_unlock(&host->lock);
        if (stat & BM_SSP_CTRL1_RESP_TIMEOUT_IRQ)
                cmd->error = -ETIMEDOUT;
        else if (stat & BM_SSP_CTRL1_RESP_ERR_IRQ)
@@ -644,11 +644,6 @@ static void mxs_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
                       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
                writel(BM_SSP_CTRL1_SDIO_IRQ_EN,
                       host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_SET);
-                if (readl(host->base + HW_SSP_STATUS(host)) &
-                                BM_SSP_STATUS_SDIO_IRQ)
-                        mmc_signal_sdio_irq(host->mmc);
        } else {
                writel(BM_SSP_CTRL0_SDIO_IRQ_CHECK,
                       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
@@ -657,6 +652,11 @@ static void mxs_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
        }
        spin_unlock_irqrestore(&host->lock, flags);
+        if (enable && readl(host->base + HW_SSP_STATUS(host)) &
+                        BM_SSP_STATUS_SDIO_IRQ)
+                mmc_signal_sdio_irq(host->mmc);
 }
 static const struct mmc_host_ops mxs_mmc_ops = {
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 50e08f03aa65..a5999a74496a 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -668,7 +668,7 @@ mmc_omap_clk_timer(unsigned long data)
 static void
 mmc_omap_xfer_data(struct mmc_omap_host *host, int write)
 {
-        int n;
+        int n, nwords;
        if (host->buffer_bytes_left == 0) {
                host->sg_idx++;
@@ -678,15 +678,23 @@ mmc_omap_xfer_data(struct mmc_omap_host *host, int write)
        n = 64;
        if (n > host->buffer_bytes_left)
                n = host->buffer_bytes_left;
+        nwords = n / 2;
+        nwords += n & 1; /* handle odd number of bytes to transfer */
        host->buffer_bytes_left -= n;
        host->total_bytes_left -= n;
        host->data->bytes_xfered += n;
        if (write) {
-                __raw_writesw(host->virt_base + OMAP_MMC_REG(host, DATA), host->buffer, n);
+                __raw_writesw(host->virt_base + OMAP_MMC_REG(host, DATA),
+                              host->buffer, nwords);
        } else {
-                __raw_readsw(host->virt_base + OMAP_MMC_REG(host, DATA), host->buffer, n);
+                __raw_readsw(host->virt_base + OMAP_MMC_REG(host, DATA),
+                             host->buffer, nwords);
        }
+        host->buffer += nwords;
 }
 static inline void mmc_omap_report_irq(u16 status)
diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
index b97b2f5dafdb..d25f9ab9a54d 100644
--- a/drivers/mmc/host/sdhci-esdhc.h
+++ b/drivers/mmc/host/sdhci-esdhc.h
@@ -48,14 +48,14 @@ static inline void esdhc_set_clock(struct sdhci_host *host, unsigned int clock)
        int div = 1;
        u32 temp;
+        if (clock == 0)
+                goto out;
        temp = sdhci_readl(host, ESDHC_SYSTEM_CONTROL);
        temp &= ~(ESDHC_CLOCK_IPGEN | ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN
                | ESDHC_CLOCK_MASK);
        sdhci_writel(host, temp, ESDHC_SYSTEM_CONTROL);
-        if (clock == 0)
-                goto out;
        while (host->max_clk / pre_div / 16 > clock && pre_div < 256)
                pre_div *= 2;
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 437bc193e170..568307cc7caf 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -340,7 +340,7 @@ retry:
         * of this LEB as it will be deleted and freed in 'ubi_add_to_av()'.
         */
        err = ubi_add_to_av(ubi, ai, new_aeb->pnum, new_aeb->ec, vid_hdr, 0);
-        kfree(new_aeb);
+        kmem_cache_free(ai->aeb_slab_cache, new_aeb);
        ubi_free_vid_hdr(ubi, vid_hdr);
        return err;
@@ -353,7 +353,7 @@ write_error:
                list_add(&new_aeb->u.list, &ai->erase);
                goto retry;
        }
-        kfree(new_aeb);
+        kmem_cache_free(ai->aeb_slab_cache, new_aeb);
 out_free:
        ubi_free_vid_hdr(ubi, vid_hdr);
        return err;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6fae5f3ec7f6..d688a8af432c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -398,7 +398,7 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb,
                     sizeof(qdisc_skb_cb(skb)->slave_dev_queue_mapping));
        skb->queue_mapping = qdisc_skb_cb(skb)->slave_dev_queue_mapping;
-        if (unlikely(netpoll_tx_running(slave_dev)))
+        if (unlikely(netpoll_tx_running(bond->dev)))
                bond_netpoll_send_skb(bond_get_slave_by_dev(bond, slave_dev), skb);
        else
                dev_queue_xmit(skb);
@@ -1235,12 +1235,12 @@ static inline int slave_enable_netpoll(struct slave *slave)
        struct netpoll *np;
        int err = 0;
-        np = kzalloc(sizeof(*np), GFP_KERNEL);
+        np = kzalloc(sizeof(*np), GFP_ATOMIC);
        err = -ENOMEM;
        if (!np)
                goto out;
-        err = __netpoll_setup(np, slave->dev);
+        err = __netpoll_setup(np, slave->dev, GFP_ATOMIC);
        if (err) {
                kfree(np);
                goto out;
@@ -1257,9 +1257,7 @@ static inline void slave_disable_netpoll(struct slave *slave)
                return;
        slave->np = NULL;
-        synchronize_rcu_bh();
+        __netpoll_free_rcu(np);
-        __netpoll_cleanup(np);
-        kfree(np);
 }
 static inline bool slave_dev_support_netpoll(struct net_device *slave_dev)
 {
@@ -1292,7 +1290,7 @@ static void bond_netpoll_cleanup(struct net_device *bond_dev)
        read_unlock(&bond->lock);
 }
-static int bond_netpoll_setup(struct net_device *dev, struct netpoll_info *ni)
+static int bond_netpoll_setup(struct net_device *dev, struct netpoll_info *ni, gfp_t gfp)
 {
        struct bonding *bond = netdev_priv(dev);
        struct slave *slave;
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index a580db29e503..26e7129332ab 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -83,6 +83,11 @@
 #define INSTRUCTION_LOAD_TXB(n) (0x40 + 2 * (n))
 #define INSTRUCTION_READ_RXB(n) (((n) == 0) ? 0x90 : 0x94)
 #define INSTRUCTION_RESET       0xC0
+#define RTS_TXB0                0x01
+#define RTS_TXB1                0x02
+#define RTS_TXB2                0x04
+#define INSTRUCTION_RTS(n)      (0x80 | ((n) & 0x07))
 /* MPC251x registers */
 #define CANSTAT       0x0e
@@ -397,6 +402,7 @@ static void mcp251x_hw_tx_frame(struct spi_device *spi, u8 *buf,
 static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
                          int tx_buf_idx)
 {
+        struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
        u32 sid, eid, exide, rtr;
        u8 buf[SPI_TRANSFER_BUF_LEN];
@@ -418,7 +424,10 @@ static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
        buf[TXBDLC_OFF] = (rtr << DLC_RTR_SHIFT) | frame->can_dlc;
        memcpy(buf + TXBDAT_OFF, frame->data, frame->can_dlc);
        mcp251x_hw_tx_frame(spi, buf, frame->can_dlc, tx_buf_idx);
-        mcp251x_write_reg(spi, TXBCTRL(tx_buf_idx), TXBCTRL_TXREQ);
+        /* use INSTRUCTION_RTS, to avoid "repeated frame problem" */
+        priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx);
+        mcp251x_spi_trans(priv->spi, 1);
 }
 static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
diff --git a/drivers/net/can/sja1000/sja1000_platform.c b/drivers/net/can/sja1000/sja1000_platform.c
index 4f50145f6483..662c5f7eb0c5 100644
--- a/drivers/net/can/sja1000/sja1000_platform.c
+++ b/drivers/net/can/sja1000/sja1000_platform.c
@@ -109,7 +109,9 @@ static int sp_probe(struct platform_device *pdev)
        priv = netdev_priv(dev);
        dev->irq = res_irq->start;
-        priv->irq_flags = res_irq->flags & (IRQF_TRIGGER_MASK | IRQF_SHARED);
+        priv->irq_flags = res_irq->flags & IRQF_TRIGGER_MASK;
+        if (res_irq->flags & IORESOURCE_IRQ_SHAREABLE)
+                priv->irq_flags |= IRQF_SHARED;
        priv->reg_base = addr;
        /* The CAN clock frequency is half the oscillator clock frequency */
        priv->can.clock.freq = pdata->osc_freq / 2;
diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c
index 310596175676..b595d3422b9f 100644
--- a/drivers/net/can/softing/softing_fw.c
+++ b/drivers/net/can/softing/softing_fw.c
@@ -150,7 +150,7 @@ int softing_load_fw(const char *file, struct softing *card,
        const uint8_t *mem, *end, *dat;
        uint16_t type, len;
        uint32_t addr;
-        uint8_t *buf = NULL;
+        uint8_t *buf = NULL, *new_buf;
        int buflen = 0;
        int8_t type_end = 0;
@@ -199,11 +199,12 @@ int softing_load_fw(const char *file, struct softing *card,
                if (len > buflen) {
                        /* align buflen */
                        buflen = (len + (1024-1)) & ~(1024-1);
-                        buf = krealloc(buf, buflen, GFP_KERNEL);
+                        new_buf = krealloc(buf, buflen, GFP_KERNEL);
-                        if (!buf) {
+                        if (!new_buf) {
                                ret = -ENOMEM;
                                goto failed;
                        }
+                        buf = new_buf;
                }
                /* verify record data */
                memcpy_fromio(buf, &dpram[addr + offset], len);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 463b9ec57d80..6d1a24acb77e 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1708,9 +1708,6 @@ struct bnx2x_func_init_params {
                        continue;               \
                else
-#define for_each_napi_rx_queue(bp, var) \
-        for ((var) = 0; (var) < bp->num_napi_queues; (var)++)
 /* Skip OOO FP */
 #define for_each_tx_queue(bp, var) \
        for ((var) = 0; (var) < BNX2X_NUM_QUEUES(bp); (var)++) \
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index e879e19eb0d6..af20c6ee2cd9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2046,6 +2046,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
         */
        bnx2x_setup_tc(bp->dev, bp->max_cos);
+        /* Add all NAPI objects */
+        bnx2x_add_all_napi(bp);
        bnx2x_napi_enable(bp);
        /* set pf load just before approaching the MCP */
@@ -2408,6 +2410,8 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
                /* Disable HW interrupts, NAPI */
                bnx2x_netif_stop(bp, 1);
+                /* Delete all NAPI objects */
+                bnx2x_del_all_napi(bp);
                /* Release IRQs */
                bnx2x_free_irq(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index dfa757e74296..dfd86a55f1dc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -710,17 +710,15 @@ static inline u16 bnx2x_tx_avail(struct bnx2x *bp,
        prod = txdata->tx_bd_prod;
        cons = txdata->tx_bd_cons;
-        /* NUM_TX_RINGS = number of "next-page" entries
+        used = SUB_S16(prod, cons);
-           It will be used as a threshold */
-        used = SUB_S16(prod, cons) + (s16)NUM_TX_RINGS;
 #ifdef BNX2X_STOP_ON_ERROR
        WARN_ON(used < 0);
-        WARN_ON(used > bp->tx_ring_size);
+        WARN_ON(used > txdata->tx_ring_size);
-        WARN_ON((bp->tx_ring_size - used) > MAX_TX_AVAIL);
+        WARN_ON((txdata->tx_ring_size - used) > MAX_TX_AVAIL);
 #endif
-        return (s16)(bp->tx_ring_size) - used;
+        return (s16)(txdata->tx_ring_size) - used;
 }
 static inline int bnx2x_tx_queue_has_work(struct bnx2x_fp_txdata *txdata)
@@ -792,7 +790,7 @@ static inline void bnx2x_add_all_napi(struct bnx2x *bp)
        bp->num_napi_queues = bp->num_queues;
        /* Add NAPI objects */
-        for_each_napi_rx_queue(bp, i)
+        for_each_rx_queue(bp, i)
                netif_napi_add(bp->dev, &bnx2x_fp(bp, i, napi),
                               bnx2x_poll, BNX2X_NAPI_WEIGHT);
 }
@@ -801,7 +799,7 @@ static inline void bnx2x_del_all_napi(struct bnx2x *bp)
 {
        int i;
-        for_each_napi_rx_queue(bp, i)
+        for_each_rx_queue(bp, i)
                netif_napi_del(&bnx2x_fp(bp, i, napi));
 }
@@ -1088,6 +1086,7 @@ static inline void bnx2x_init_txdata(struct bnx2x *bp,
        txdata->txq_index = txq_index;
        txdata->tx_cons_sb = tx_cons_sb;
        txdata->parent_fp = fp;
+        txdata->tx_ring_size = IS_FCOE_FP(fp) ? MAX_TX_AVAIL : bp->tx_ring_size;
        DP(NETIF_MSG_IFUP, "created tx data cid %d, txq %d\n",
           txdata->cid, txdata->txq_index);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
index 3e4cff9b1ebe..b926f58e983b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
@@ -401,11 +401,11 @@ static const struct reg_addr reg_addrs[] = {
        { 0x70000, 8, RI_ALL_ONLINE },
        { 0x70020, 8184, RI_ALL_OFFLINE },
        { 0x78000, 8192, RI_E3E3B0_OFFLINE },
-        { 0x85000, 3, RI_ALL_ONLINE },
+        { 0x85000, 3, RI_ALL_OFFLINE },
-        { 0x8501c, 7, RI_ALL_ONLINE },
+        { 0x8501c, 7, RI_ALL_OFFLINE },
-        { 0x85048, 1, RI_ALL_ONLINE },
+        { 0x85048, 1, RI_ALL_OFFLINE },
-        { 0x85200, 32, RI_ALL_ONLINE },
+        { 0x85200, 32, RI_ALL_OFFLINE },
-        { 0xb0000, 16384, RI_E1H_ONLINE },
+        { 0xb0000, 16384, RI_E1H_OFFLINE },
        { 0xc1000, 7, RI_ALL_ONLINE },
        { 0xc103c, 2, RI_E2E3E3B0_ONLINE },
        { 0xc1800, 2, RI_ALL_ONLINE },
@@ -581,17 +581,12 @@ static const struct reg_addr reg_addrs[] = {
        { 0x140188, 3, RI_E1E1HE2E3_ONLINE },
        { 0x140194, 13, RI_ALL_ONLINE },
        { 0x140200, 6, RI_E1E1HE2E3_ONLINE },
-        { 0x140220, 4, RI_E2E3_ONLINE },
-        { 0x140240, 4, RI_E2E3_ONLINE },
        { 0x140260, 4, RI_E2E3_ONLINE },
        { 0x140280, 4, RI_E2E3_ONLINE },
-        { 0x1402a0, 4, RI_E2E3_ONLINE },
-        { 0x1402c0, 4, RI_E2E3_ONLINE },
        { 0x1402e0, 2, RI_E2E3_ONLINE },
        { 0x1402e8, 2, RI_E2E3E3B0_ONLINE },
        { 0x1402f0, 9, RI_E2E3_ONLINE },
        { 0x140314, 44, RI_E3B0_ONLINE },
-        { 0x1403d0, 70, RI_E3B0_ONLINE },
        { 0x144000, 4, RI_E1E1H_ONLINE },
        { 0x148000, 4, RI_E1E1H_ONLINE },
        { 0x14c000, 4, RI_E1E1H_ONLINE },
@@ -704,7 +699,6 @@ static const struct reg_addr reg_addrs[] = {
        { 0x180398, 1, RI_E2E3E3B0_ONLINE },
        { 0x1803a0, 5, RI_E2E3E3B0_ONLINE },
        { 0x1803b4, 2, RI_E3E3B0_ONLINE },
-        { 0x180400, 1, RI_ALL_ONLINE },
        { 0x180404, 255, RI_E1E1H_OFFLINE },
        { 0x181000, 4, RI_ALL_ONLINE },
        { 0x181010, 1020, RI_ALL_OFFLINE },
@@ -800,9 +794,9 @@ static const struct reg_addr reg_addrs[] = {
        { 0x1b905c, 1, RI_E3E3B0_ONLINE },
        { 0x1b9064, 1, RI_E3B0_ONLINE },
        { 0x1b9080, 10, RI_E3B0_ONLINE },
-        { 0x1b9400, 14, RI_E2E3E3B0_ONLINE },
+        { 0x1b9400, 14, RI_E2E3E3B0_OFFLINE },
-        { 0x1b943c, 19, RI_E2E3E3B0_ONLINE },
+        { 0x1b943c, 19, RI_E2E3E3B0_OFFLINE },
-        { 0x1b9490, 10, RI_E2E3E3B0_ONLINE },
+        { 0x1b9490, 10, RI_E2E3E3B0_OFFLINE },
        { 0x1c0000, 2, RI_ALL_ONLINE },
        { 0x200000, 65, RI_ALL_ONLINE },
        { 0x20014c, 2, RI_E1HE2E3E3B0_ONLINE },
@@ -814,7 +808,6 @@ static const struct reg_addr reg_addrs[] = {
        { 0x200398, 1, RI_E2E3E3B0_ONLINE },
        { 0x2003a0, 1, RI_E2E3E3B0_ONLINE },
        { 0x2003a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x200400, 1, RI_ALL_ONLINE },
        { 0x200404, 255, RI_E1E1H_OFFLINE },
        { 0x202000, 4, RI_ALL_ONLINE },
        { 0x202010, 2044, RI_ALL_OFFLINE },
@@ -921,7 +914,6 @@ static const struct reg_addr reg_addrs[] = {
        { 0x280398, 1, RI_E2E3E3B0_ONLINE },
        { 0x2803a0, 1, RI_E2E3E3B0_ONLINE },
        { 0x2803a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x280400, 1, RI_ALL_ONLINE },
        { 0x280404, 255, RI_E1E1H_OFFLINE },
        { 0x282000, 4, RI_ALL_ONLINE },
        { 0x282010, 2044, RI_ALL_OFFLINE },
@@ -1031,7 +1023,6 @@ static const struct reg_addr reg_addrs[] = {
        { 0x300398, 1, RI_E2E3E3B0_ONLINE },
        { 0x3003a0, 1, RI_E2E3E3B0_ONLINE },
        { 0x3003a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x300400, 1, RI_ALL_ONLINE },
        { 0x300404, 255, RI_E1E1H_OFFLINE },
        { 0x302000, 4, RI_ALL_ONLINE },
        { 0x302010, 2044, RI_ALL_OFFLINE },
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index fc4e0e3885b0..ebf40cd7aa10 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -775,7 +775,7 @@ static void bnx2x_get_regs(struct net_device *dev,
        struct bnx2x *bp = netdev_priv(dev);
        struct dump_hdr dump_hdr = {0};
-        regs->version = 0;
+        regs->version = 1;
        memset(p, 0, regs->len);
        if (!netif_running(bp->dev))
@@ -1587,6 +1587,12 @@ static int bnx2x_set_pauseparam(struct net_device *dev,
                        bp->link_params.req_flow_ctrl[cfg_idx] =
                                BNX2X_FLOW_CTRL_AUTO;
                }
+                bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_NONE;
+                if (epause->rx_pause)
+                        bp->link_params.req_fc_auto_adv |= BNX2X_FLOW_CTRL_RX;
+                if (epause->tx_pause)
+                        bp->link_params.req_fc_auto_adv |= BNX2X_FLOW_CTRL_TX;
        }
        DP(BNX2X_MSG_ETHTOOL,
@@ -2888,11 +2894,9 @@ static void bnx2x_get_channels(struct net_device *dev,
 */
 static void bnx2x_change_num_queues(struct bnx2x *bp, int num_rss)
 {
-        bnx2x_del_all_napi(bp);
        bnx2x_disable_msi(bp);
        BNX2X_NUM_QUEUES(bp) = num_rss + NON_ETH_CONTEXT_USE;
        bnx2x_set_int_mode(bp);
-        bnx2x_add_all_napi(bp);
 }
 /**
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index f4beb46c4709..b046beb435b2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -2667,9 +2667,11 @@ int bnx2x_update_pfc(struct link_params *params,
                return bnx2x_status;
        DP(NETIF_MSG_LINK, "About to update PFC in BMAC\n");
-        if (CHIP_IS_E3(bp))
-                bnx2x_update_pfc_xmac(params, vars, 0);
+        if (CHIP_IS_E3(bp)) {
-        else {
+                if (vars->mac_type == MAC_TYPE_XMAC)
+                        bnx2x_update_pfc_xmac(params, vars, 0);
+        } else {
                val = REG_RD(bp, MISC_REG_RESET_REG_2);
                if ((val &
                     (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << params->port))
@@ -5432,7 +5434,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                switch (speed_mask) {
                case GP_STATUS_10M:
                        vars->line_speed = SPEED_10;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_10TFD;
                        else
                                vars->link_status |= LINK_10THD;
@@ -5440,7 +5442,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                case GP_STATUS_100M:
                        vars->line_speed = SPEED_100;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_100TXFD;
                        else
                                vars->link_status |= LINK_100TXHD;
@@ -5449,7 +5451,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                case GP_STATUS_1G:
                case GP_STATUS_1G_KX:
                        vars->line_speed = SPEED_1000;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_1000TFD;
                        else
                                vars->link_status |= LINK_1000THD;
@@ -5457,7 +5459,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                case GP_STATUS_2_5G:
                        vars->line_speed = SPEED_2500;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                vars->link_status |= LINK_2500TFD;
                        else
                                vars->link_status |= LINK_2500THD;
@@ -5531,6 +5533,7 @@ static int bnx2x_link_settings_status(struct bnx2x_phy *phy,
        if (gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_LINK_STATUS) {
                if (SINGLE_MEDIA_DIRECT(params)) {
+                        vars->duplex = duplex;
                        bnx2x_flow_ctrl_resolve(phy, params, vars, gp_status);
                        if (phy->req_line_speed == SPEED_AUTO_NEG)
                                bnx2x_xgxs_an_resolve(phy, params, vars,
@@ -5625,6 +5628,7 @@ static int bnx2x_warpcore_read_status(struct bnx2x_phy *phy,
                                        LINK_STATUS_PARALLEL_DETECTION_USED;
                        }
                        bnx2x_ext_phy_resolve_fc(phy, params, vars);
+                        vars->duplex = duplex;
                }
        }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 02b5a343b195..211753e01f81 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -7561,8 +7561,14 @@ int bnx2x_set_mac_one(struct bnx2x *bp, u8 *mac,
        }
        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
-        if (rc < 0)
+        if (rc == -EEXIST) {
+                DP(BNX2X_MSG_SP, "Failed to schedule ADD operations: %d\n", rc);
+                /* do not treat adding same MAC as error */
+                rc = 0;
+        } else if (rc < 0)
                BNX2X_ERR("%s MAC failed\n", (set ? "Set" : "Del"));
        return rc;
 }
@@ -8427,6 +8433,8 @@ unload_error:
        /* Disable HW interrupts, NAPI */
        bnx2x_netif_stop(bp, 1);
+        /* Delete all NAPI objects */
+        bnx2x_del_all_napi(bp);
        /* Release IRQs */
        bnx2x_free_irq(bp);
@@ -10292,13 +10300,11 @@ static void __devinit bnx2x_get_fcoe_info(struct bnx2x *bp)
                                dev_info.port_hw_config[port].
                                 fcoe_wwn_node_name_lower);
        } else if (!IS_MF_SD(bp)) {
-                u32 cfg = MF_CFG_RD(bp, func_ext_config[func].func_cfg);
                /*
                 * Read the WWN info only if the FCoE feature is enabled for
                 * this function.
                 */
-                if (cfg & MACP_FUNC_CFG_FLAGS_FCOE_OFFLOAD)
+                if (BNX2X_MF_EXT_PROTOCOL_FCOE(bp) && !CHIP_IS_E1x(bp))
                        bnx2x_get_ext_wwn_info(bp, func);
        } else if (IS_MF_FCOE_SD(bp))
@@ -11071,7 +11077,14 @@ static int bnx2x_set_uc_list(struct bnx2x *bp)
        netdev_for_each_uc_addr(ha, dev) {
                rc = bnx2x_set_mac_one(bp, bnx2x_uc_addr(ha), mac_obj, true,
                                       BNX2X_UC_LIST_MAC, &ramrod_flags);
-                if (rc < 0) {
+                if (rc == -EEXIST) {
+                        DP(BNX2X_MSG_SP,
+                           "Failed to schedule ADD operations: %d\n", rc);
+                        /* do not treat adding same MAC as error */
+                        rc = 0;
+                } else if (rc < 0) {
                        BNX2X_ERR("Failed to schedule ADD operations: %d\n",
                                  rc);
                        return rc;
@@ -11229,10 +11242,12 @@ static int bnx2x_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 static void poll_bnx2x(struct net_device *dev)
 {
        struct bnx2x *bp = netdev_priv(dev);
+        int i;
-        disable_irq(bp->pdev->irq);
+        for_each_eth_queue(bp, i) {
-        bnx2x_interrupt(bp->pdev->irq, dev);
+                struct bnx2x_fastpath *fp = &bp->fp[i];
-        enable_irq(bp->pdev->irq);
+                napi_schedule(&bnx2x_fp(bp, fp->index, napi));
+        }
 }
 #endif
@@ -11899,9 +11914,6 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         */
        bnx2x_set_int_mode(bp);
-        /* Add all NAPI objects */
-        bnx2x_add_all_napi(bp);
        rc = register_netdev(dev);
        if (rc) {
                dev_err(&pdev->dev, "Cannot register net device\n");
@@ -11976,9 +11988,6 @@ static void __devexit bnx2x_remove_one(struct pci_dev *pdev)
        unregister_netdev(dev);
-        /* Delete all NAPI objects */
-        bnx2x_del_all_napi(bp);
        /* Power on: we can't let PCI layer write to us while we are in D3 */
        bnx2x_set_power_state(bp, PCI_D0);
@@ -12025,6 +12034,8 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
        bnx2x_tx_disable(bp);
        bnx2x_netif_stop(bp, 0);
+        /* Delete all NAPI objects */
+        bnx2x_del_all_napi(bp);
        del_timer_sync(&bp->timer);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 332db64dd5be..a1d0446b39b3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -101,6 +101,11 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
        if (CHIP_REV_IS_SLOW(bp))
                return;
+        /* Update MCP's statistics if possible */
+        if (bp->func_stx)
+                memcpy(bnx2x_sp(bp, func_stats), &bp->func_stats,
+                       sizeof(bp->func_stats));
        /* loader */
        if (bp->executer_idx) {
                int loader_idx = PMF_DMAE_C(bp);
@@ -128,8 +133,6 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
        } else if (bp->func_stx) {
                *stats_comp = 0;
-                memcpy(bnx2x_sp(bp, func_stats), &bp->func_stats,
-                       sizeof(bp->func_stats));
                bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
        }
 }
@@ -1151,9 +1154,11 @@ static void bnx2x_stats_update(struct bnx2x *bp)
        if (bp->port.pmf)
                bnx2x_hw_stats_update(bp);
-        if (bnx2x_storm_stats_update(bp) && (bp->stats_pending++ == 3)) {
+        if (bnx2x_storm_stats_update(bp)) {
-                BNX2X_ERR("storm stats were not updated for 3 times\n");
+                if (bp->stats_pending++ == 3) {
-                bnx2x_panic();
+                        BNX2X_ERR("storm stats were not updated for 3 times\n");
+                        bnx2x_panic();
+                }
                return;
        }
diff --git a/drivers/net/ethernet/cirrus/cs89x0.c b/drivers/net/ethernet/cirrus/cs89x0.c
index 845b2020f291..138446957786 100644
--- a/drivers/net/ethernet/cirrus/cs89x0.c
+++ b/drivers/net/ethernet/cirrus/cs89x0.c
@@ -1243,6 +1243,7 @@ static void set_multicast_list(struct net_device *dev)
 {
        struct net_local *lp = netdev_priv(dev);
        unsigned long flags;
+        u16 cfg;
        spin_lock_irqsave(&lp->lock, flags);
        if (dev->flags & IFF_PROMISC)
@@ -1260,11 +1261,10 @@ static void set_multicast_list(struct net_device *dev)
        /* in promiscuous mode, we accept errored packets,
         * so we have to enable interrupts on them also
         */
-        writereg(dev, PP_RxCFG,
+        cfg = lp->curr_rx_cfg;
-                 (lp->curr_rx_cfg |
+        if (lp->rx_mode == RX_ALL_ACCEPT)
-                  (lp->rx_mode == RX_ALL_ACCEPT)
+                cfg |= RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL;
-                  ? (RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL)
+        writereg(dev, PP_RxCFG, cfg);
-                  : 0));
        spin_unlock_irqrestore(&lp->lock, flags);
 }
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 7fac97b4bb59..8c63d06ab12b 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -259,7 +259,7 @@ int be_process_mcc(struct be_adapter *adapter)
        int num = 0, status = 0;
        struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-        spin_lock_bh(&adapter->mcc_cq_lock);
+        spin_lock(&adapter->mcc_cq_lock);
        while ((compl = be_mcc_compl_get(adapter))) {
                if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
                        /* Interpret flags as an async trailer */
@@ -280,7 +280,7 @@ int be_process_mcc(struct be_adapter *adapter)
        if (num)
                be_cq_notify(adapter, mcc_obj->cq.id, mcc_obj->rearm_cq, num);
-        spin_unlock_bh(&adapter->mcc_cq_lock);
+        spin_unlock(&adapter->mcc_cq_lock);
        return status;
 }
@@ -295,7 +295,9 @@ static int be_mcc_wait_compl(struct be_adapter *adapter)
                if (be_error(adapter))
                        return -EIO;
+                local_bh_disable();
                status = be_process_mcc(adapter);
+                local_bh_enable();
                if (atomic_read(&mcc_obj->q.used) == 0)
                        break;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 90a903d83d87..78b8aa8069f0 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3763,7 +3763,9 @@ static void be_worker(struct work_struct *work)
        /* when interrupts are not yet enabled, just reap any pending
        * mcc completions */
        if (!netif_running(adapter->netdev)) {
+                local_bh_disable();
                be_process_mcc(adapter);
+                local_bh_enable();
                goto reschedule;
        }
diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
index 0f2d1a710909..151453309401 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
@@ -174,8 +174,10 @@ static int __devinit fs_enet_mdio_probe(struct platform_device *ofdev)
        new_bus->phy_mask = ~0;
        new_bus->irq = kmalloc(sizeof(int) * PHY_MAX_ADDR, GFP_KERNEL);
-        if (!new_bus->irq)
+        if (!new_bus->irq) {
+                ret = -ENOMEM;
                goto out_unmap_regs;
+        }
        new_bus->parent = &ofdev->dev;
        dev_set_drvdata(&ofdev->dev, new_bus);
diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
index 55bb867258e6..cdf702a59485 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
@@ -137,8 +137,10 @@ static int __devinit fs_enet_mdio_probe(struct platform_device *ofdev)
        snprintf(new_bus->id, MII_BUS_ID_SIZE, "%x", res.start);
        fec->fecp = ioremap(res.start, resource_size(&res));
-        if (!fec->fecp)
+        if (!fec->fecp) {
+                ret = -ENOMEM;
                goto out_fec;
+        }
        if (get_bus_freq) {
                clock = get_bus_freq(ofdev->dev.of_node);
@@ -172,8 +174,10 @@ static int __devinit fs_enet_mdio_probe(struct platform_device *ofdev)
        new_bus->phy_mask = ~0;
        new_bus->irq = kmalloc(sizeof(int) * PHY_MAX_ADDR, GFP_KERNEL);
-        if (!new_bus->irq)
+        if (!new_bus->irq) {
+                ret = -ENOMEM;
                goto out_unmap_regs;
+        }
        new_bus->parent = &ofdev->dev;
        dev_set_drvdata(&ofdev->dev, new_bus);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 4605f7246687..d3233f59a82e 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1041,7 +1041,7 @@ static int gfar_probe(struct platform_device *ofdev)
        if (priv->device_flags & FSL_GIANFAR_DEV_HAS_VLAN) {
                dev->hw_features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-                dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+                dev->features |= NETIF_F_HW_VLAN_RX;
        }
        if (priv->device_flags & FSL_GIANFAR_DEV_HAS_EXTENDED_HASH) {
diff --git a/drivers/net/ethernet/i825xx/znet.c b/drivers/net/ethernet/i825xx/znet.c
index bd1f1ef91e19..ba4e0cea3506 100644
--- a/drivers/net/ethernet/i825xx/znet.c
+++ b/drivers/net/ethernet/i825xx/znet.c
@@ -139,8 +139,11 @@ struct znet_private {
 /* Only one can be built-in;-> */
 static struct net_device *znet_dev;
+#define NETIDBLK_MAGIC          "NETIDBLK"
+#define NETIDBLK_MAGIC_SIZE     8
 struct netidblk {
-        char magic[8];          /* The magic number (string) "NETIDBLK" */
+        char magic[NETIDBLK_MAGIC_SIZE];        /* The magic number (string) "NETIDBLK" */
        unsigned char netid[8]; /* The physical station address */
        char nettype, globalopt;
        char vendor[8];         /* The machine vendor and product name. */
@@ -373,14 +376,16 @@ static int __init znet_probe (void)
        struct znet_private *znet;
        struct net_device *dev;
        char *p;
+        char *plast = phys_to_virt(0x100000 - NETIDBLK_MAGIC_SIZE);
        int err = -ENOMEM;
        /* This code scans the region 0xf0000 to 0xfffff for a "NETIDBLK". */
-        for(p = (char *)phys_to_virt(0xf0000); p < (char *)phys_to_virt(0x100000); p++)
+        for(p = (char *)phys_to_virt(0xf0000); p <= plast; p++)
-                if (*p == 'N'  &&  strncmp(p, "NETIDBLK", 8) == 0)
+                if (*p == 'N' &&
+                    strncmp(p, NETIDBLK_MAGIC, NETIDBLK_MAGIC_SIZE) == 0)
                        break;
-        if (p >= (char *)phys_to_virt(0x100000)) {
+        if (p > plast) {
                if (znet_debug > 1)
                        printk(KERN_INFO "No Z-Note ethernet adaptor found.\n");
                return -ENODEV;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 9010cea68bc3..b68d28a130e6 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
        }
        if (adapter->rx_queue.queue_addr != NULL) {
-                if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) {
+                dma_free_coherent(dev, adapter->rx_queue.queue_len,
-                        dma_unmap_single(dev,
+                                  adapter->rx_queue.queue_addr,
-                                        adapter->rx_queue.queue_dma,
+                                  adapter->rx_queue.queue_dma);
-                                        adapter->rx_queue.queue_len,
-                                        DMA_BIDIRECTIONAL);
-                        adapter->rx_queue.queue_dma = DMA_ERROR_CODE;
-                }
-                kfree(adapter->rx_queue.queue_addr);
                adapter->rx_queue.queue_addr = NULL;
        }
@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_device *netdev)
                goto err_out;
        }
+        dev = &adapter->vdev->dev;
        adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
                                                rxq_entries;
-        adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len,
+        adapter->rx_queue.queue_addr =
-                                                GFP_KERNEL);
+            dma_alloc_coherent(dev, adapter->rx_queue.queue_len,
+                               &adapter->rx_queue.queue_dma, GFP_KERNEL);
        if (!adapter->rx_queue.queue_addr) {
                netdev_err(netdev, "unable to allocate rx queue pages\n");
@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_device *netdev)
                goto err_out;
        }
-        dev = &adapter->vdev->dev;
        adapter->buffer_list_dma = dma_map_single(dev,
                        adapter->buffer_list_addr, 4096, DMA_BIDIRECTIONAL);
        adapter->filter_list_dma = dma_map_single(dev,
                        adapter->filter_list_addr, 4096, DMA_BIDIRECTIONAL);
-        adapter->rx_queue.queue_dma = dma_map_single(dev,
-                        adapter->rx_queue.queue_addr,
-                        adapter->rx_queue.queue_len, DMA_BIDIRECTIONAL);
        if ((dma_mapping_error(dev, adapter->buffer_list_dma)) ||
-            (dma_mapping_error(dev, adapter->filter_list_dma)) ||
+            (dma_mapping_error(dev, adapter->filter_list_dma))) {
-            (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
                netdev_err(netdev, "unable to map filter or buffer list "
                           "pages\n");
                rc = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index cd153326c3cf..cb3356c9af80 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -310,6 +310,7 @@ struct e1000_adapter {
         */
        struct e1000_ring *tx_ring /* One per active queue */
                                                ____cacheline_aligned_in_smp;
+        u32 tx_fifo_limit;
        struct napi_struct napi;
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 46c3b1f9ff89..d01a099475a1 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3517,6 +3517,15 @@ void e1000e_reset(struct e1000_adapter *adapter)
        }
        /*
+         * Alignment of Tx data is on an arbitrary byte boundary with the
+         * maximum size per Tx descriptor limited only to the transmit
+         * allocation of the packet buffer minus 96 bytes with an upper
+         * limit of 24KB due to receive synchronization limitations.
+         */
+        adapter->tx_fifo_limit = min_t(u32, ((er32(PBA) >> 16) << 10) - 96,
+                                       24 << 10);
+        /*
         * Disable Adaptive Interrupt Moderation if 2 full packets cannot
         * fit in receive buffer.
         */
@@ -4785,12 +4794,9 @@ static bool e1000_tx_csum(struct e1000_ring *tx_ring, struct sk_buff *skb)
        return 1;
 }
-#define E1000_MAX_PER_TXD       8192
-#define E1000_MAX_TXD_PWR       12
 static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb,
                        unsigned int first, unsigned int max_per_txd,
-                        unsigned int nr_frags, unsigned int mss)
+                        unsigned int nr_frags)
 {
        struct e1000_adapter *adapter = tx_ring->adapter;
        struct pci_dev *pdev = adapter->pdev;
@@ -5023,20 +5029,19 @@ static int __e1000_maybe_stop_tx(struct e1000_ring *tx_ring, int size)
 static int e1000_maybe_stop_tx(struct e1000_ring *tx_ring, int size)
 {
+        BUG_ON(size > tx_ring->count);
        if (e1000_desc_unused(tx_ring) >= size)
                return 0;
        return __e1000_maybe_stop_tx(tx_ring, size);
 }
-#define TXD_USE_COUNT(S, X) (((S) >> (X)) + 1)
 static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                                    struct net_device *netdev)
 {
        struct e1000_adapter *adapter = netdev_priv(netdev);
        struct e1000_ring *tx_ring = adapter->tx_ring;
        unsigned int first;
-        unsigned int max_per_txd = E1000_MAX_PER_TXD;
-        unsigned int max_txd_pwr = E1000_MAX_TXD_PWR;
        unsigned int tx_flags = 0;
        unsigned int len = skb_headlen(skb);
        unsigned int nr_frags;
@@ -5056,18 +5061,8 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
        }
        mss = skb_shinfo(skb)->gso_size;
-        /*
-         * The controller does a simple calculation to
-         * make sure there is enough room in the FIFO before
-         * initiating the DMA for each buffer.  The calc is:
-         * 4 = ceil(buffer len/mss).  To make sure we don't
-         * overrun the FIFO, adjust the max buffer len if mss
-         * drops.
-         */
        if (mss) {
                u8 hdr_len;
-                max_per_txd = min(mss << 2, max_per_txd);
-                max_txd_pwr = fls(max_per_txd) - 1;
                /*
                 * TSO Workaround for 82571/2/3 Controllers -- if skb->data
@@ -5097,12 +5092,12 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                count++;
        count++;
-        count += TXD_USE_COUNT(len, max_txd_pwr);
+        count += DIV_ROUND_UP(len, adapter->tx_fifo_limit);
        nr_frags = skb_shinfo(skb)->nr_frags;
        for (f = 0; f < nr_frags; f++)
-                count += TXD_USE_COUNT(skb_frag_size(&skb_shinfo(skb)->frags[f]),
+                count += DIV_ROUND_UP(skb_frag_size(&skb_shinfo(skb)->frags[f]),
-                                       max_txd_pwr);
+                                      adapter->tx_fifo_limit);
        if (adapter->hw.mac.tx_pkt_filtering)
                e1000_transfer_dhcp_info(adapter, skb);
@@ -5144,15 +5139,18 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                tx_flags |= E1000_TX_FLAGS_NO_FCS;
        /* if count is 0 then mapping error has occurred */
-        count = e1000_tx_map(tx_ring, skb, first, max_per_txd, nr_frags, mss);
+        count = e1000_tx_map(tx_ring, skb, first, adapter->tx_fifo_limit,
+                             nr_frags);
        if (count) {
                skb_tx_timestamp(skb);
                netdev_sent_queue(netdev, skb->len);
                e1000_tx_queue(tx_ring, tx_flags, count);
                /* Make sure there is space in the ring for the next send. */
-                e1000_maybe_stop_tx(tx_ring, MAX_SKB_FRAGS + 2);
+                e1000_maybe_stop_tx(tx_ring,
+                                    (MAX_SKB_FRAGS *
+                                     DIV_ROUND_UP(PAGE_SIZE,
+                                                  adapter->tx_fifo_limit) + 2));
        } else {
                dev_kfree_skb_any(skb);
                tx_ring->buffer_info[first].time_stamp = 0;
@@ -6327,8 +6325,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        adapter->hw.phy.autoneg_advertised = 0x2f;
        /* ring size defaults */
-        adapter->rx_ring->count = 256;
+        adapter->rx_ring->count = E1000_DEFAULT_RXD;
-        adapter->tx_ring->count = 256;
+        adapter->tx_ring->count = E1000_DEFAULT_TXD;
        /*
         * Initial Wake on LAN setting - If APM wake is enabled in
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index 88b7b3e75ab1..daf417923661 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -358,13 +358,14 @@ void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
 }
 int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                        u64 virt, int obj_size, int nobj, int reserved,
+                        u64 virt, int obj_size, u32 nobj, int reserved,
                        int use_lowmem, int use_coherent)
 {
        int obj_per_chunk;
        int num_icm;
        unsigned chunk_size;
        int i;
+        u64 size;
        obj_per_chunk = MLX4_TABLE_CHUNK_SIZE / obj_size;
        num_icm = (nobj + obj_per_chunk - 1) / obj_per_chunk;
@@ -380,10 +381,12 @@ int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
        table->coherent = use_coherent;
        mutex_init(&table->mutex);
+        size = (u64) nobj * obj_size;
        for (i = 0; i * MLX4_TABLE_CHUNK_SIZE < reserved * obj_size; ++i) {
                chunk_size = MLX4_TABLE_CHUNK_SIZE;
-                if ((i + 1) * MLX4_TABLE_CHUNK_SIZE > nobj * obj_size)
+                if ((i + 1) * MLX4_TABLE_CHUNK_SIZE > size)
-                        chunk_size = PAGE_ALIGN(nobj * obj_size - i * MLX4_TABLE_CHUNK_SIZE);
+                        chunk_size = PAGE_ALIGN(size -
+                                        i * MLX4_TABLE_CHUNK_SIZE);
                table->icm[i] = mlx4_alloc_icm(dev, chunk_size >> PAGE_SHIFT,
                                               (use_lowmem ? GFP_KERNEL : GFP_HIGHUSER) |
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
index 19e4efc0b342..a67744f53506 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
@@ -78,7 +78,7 @@ int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                          int start, int end);
 int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                        u64 virt, int obj_size, int nobj, int reserved,
+                        u64 virt, int obj_size, u32 nobj, int reserved,
                        int use_lowmem, int use_coherent);
 void mlx4_cleanup_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table);
 void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 827b72dfce99..2f816c6aed72 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1234,13 +1234,13 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                                mlx4_info(dev, "non-primary physical function, skipping.\n");
                        else
                                mlx4_err(dev, "QUERY_FW command failed, aborting.\n");
-                        goto unmap_bf;
+                        return err;
                }
                err = mlx4_load_fw(dev);
                if (err) {
                        mlx4_err(dev, "Failed to start FW, aborting.\n");
-                        goto unmap_bf;
+                        return err;
                }
                mlx4_cfg.log_pg_sz_m = 1;
@@ -1304,7 +1304,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                err = mlx4_init_slave(dev);
                if (err) {
                        mlx4_err(dev, "Failed to initialize slave\n");
-                        goto unmap_bf;
+                        return err;
                }
                err = mlx4_slave_cap(dev);
@@ -1324,7 +1324,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
        err = mlx4_QUERY_ADAPTER(dev, &adapter);
        if (err) {
                mlx4_err(dev, "QUERY_ADAPTER command failed, aborting.\n");
-                goto err_close;
+                goto unmap_bf;
        }
        priv->eq_table.inta_pin = adapter.inta_pin;
@@ -1332,6 +1332,9 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
        return 0;
+unmap_bf:
+        unmap_bf_area(dev);
 err_close:
        mlx4_close_hca(dev);
@@ -1344,8 +1347,6 @@ err_stop_fw:
                mlx4_UNMAP_FA(dev);
                mlx4_free_icm(dev, priv->fw.fw_icm, 0);
        }
-unmap_bf:
-        unmap_bf_area(dev);
        return err;
 }
@@ -1996,7 +1997,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
        }
 slave_start:
-        if (mlx4_cmd_init(dev)) {
+        err = mlx4_cmd_init(dev);
+        if (err) {
                mlx4_err(dev, "Failed to init command interface, aborting.\n");
                goto err_sriov;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 4ec3835e1bc2..e151c21baf2b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -137,11 +137,11 @@ static int mlx4_GID_HASH(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox,
        return err;
 }
-static struct mlx4_promisc_qp *get_promisc_qp(struct mlx4_dev *dev, u8 pf_num,
+static struct mlx4_promisc_qp *get_promisc_qp(struct mlx4_dev *dev, u8 port,
                                              enum mlx4_steer_type steer,
                                              u32 qpn)
 {
-        struct mlx4_steer *s_steer = &mlx4_priv(dev)->steer[pf_num];
+        struct mlx4_steer *s_steer = &mlx4_priv(dev)->steer[port - 1];
        struct mlx4_promisc_qp *pqp;
        list_for_each_entry(pqp, &s_steer->promisc_qps[steer], list) {
@@ -182,7 +182,7 @@ static int new_steering_entry(struct mlx4_dev *dev, u8 port,
        /* If the given qpn is also a promisc qp,
         * it should be inserted to duplicates list
         */
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
        if (pqp) {
                dqp = kmalloc(sizeof *dqp, GFP_KERNEL);
                if (!dqp) {
@@ -256,7 +256,7 @@ static int existing_steering_entry(struct mlx4_dev *dev, u8 port,
        s_steer = &mlx4_priv(dev)->steer[port - 1];
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
        if (!pqp)
                return 0; /* nothing to do */
@@ -302,7 +302,7 @@ static bool check_duplicate_entry(struct mlx4_dev *dev, u8 port,
        s_steer = &mlx4_priv(dev)->steer[port - 1];
        /* if qp is not promisc, it cannot be duplicated */
-        if (!get_promisc_qp(dev, 0, steer, qpn))
+        if (!get_promisc_qp(dev, port, steer, qpn))
                return false;
        /* The qp is promisc qp so it is a duplicate on this index
@@ -352,7 +352,7 @@ static bool can_remove_steering_entry(struct mlx4_dev *dev, u8 port,
        members_count = be32_to_cpu(mgm->members_count) & 0xffffff;
        for (i = 0;  i < members_count; i++) {
                qpn = be32_to_cpu(mgm->qp[i]) & MGM_QPN_MASK;
-                if (!get_promisc_qp(dev, 0, steer, qpn) && qpn != tqpn) {
+                if (!get_promisc_qp(dev, port, steer, qpn) && qpn != tqpn) {
                        /* the qp is not promisc, the entry can't be removed */
                        goto out;
                }
@@ -398,7 +398,7 @@ static int add_promisc_qp(struct mlx4_dev *dev, u8 port,
        mutex_lock(&priv->mcg_table.mutex);
-        if (get_promisc_qp(dev, 0, steer, qpn)) {
+        if (get_promisc_qp(dev, port, steer, qpn)) {
                err = 0;  /* Noting to do, already exists */
                goto out_mutex;
        }
@@ -432,8 +432,10 @@ static int add_promisc_qp(struct mlx4_dev *dev, u8 port,
                        if ((be32_to_cpu(mgm->qp[i]) & MGM_QPN_MASK) == qpn) {
                                /* Entry already exists, add to duplicates */
                                dqp = kmalloc(sizeof *dqp, GFP_KERNEL);
-                                if (!dqp)
+                                if (!dqp) {
+                                        err = -ENOMEM;
                                        goto out_mailbox;
+                                }
                                dqp->qpn = qpn;
                                list_add_tail(&dqp->list, &entry->duplicates);
                                found = true;
@@ -501,7 +503,7 @@ static int remove_promisc_qp(struct mlx4_dev *dev, u8 port,
        s_steer = &mlx4_priv(dev)->steer[port - 1];
        mutex_lock(&priv->mcg_table.mutex);
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
        if (unlikely(!pqp)) {
                mlx4_warn(dev, "QP %x is not promiscuous QP\n", qpn);
                /* nothing to do */
@@ -648,13 +650,6 @@ static int find_entry(struct mlx4_dev *dev, u8 port,
        return err;
 }
-struct mlx4_net_trans_rule_hw_ctrl {
-        __be32 ctrl;
-        __be32 vf_vep_port;
-        __be32 qpn;
-        __be32 reserved;
-};
 static void trans_rule_ctrl_to_hw(struct mlx4_net_trans_rule *ctrl,
                                  struct mlx4_net_trans_rule_hw_ctrl *hw)
 {
@@ -678,87 +673,18 @@ static void trans_rule_ctrl_to_hw(struct mlx4_net_trans_rule *ctrl,
        hw->qpn = cpu_to_be32(ctrl->qpn);
 }
-struct mlx4_net_trans_rule_hw_ib {
+const u16 __sw_id_hw[] = {
-        u8      size;
+        [MLX4_NET_TRANS_RULE_ID_ETH]     = 0xE001,
-        u8      rsvd1;
+        [MLX4_NET_TRANS_RULE_ID_IB]      = 0xE005,
-        __be16  id;
+        [MLX4_NET_TRANS_RULE_ID_IPV6]    = 0xE003,
-        u32     rsvd2;
+        [MLX4_NET_TRANS_RULE_ID_IPV4]    = 0xE002,
-        __be32  qpn;
+        [MLX4_NET_TRANS_RULE_ID_TCP]     = 0xE004,
-        __be32  qpn_mask;
+        [MLX4_NET_TRANS_RULE_ID_UDP]     = 0xE006
-        u8      dst_gid[16];
-        u8      dst_gid_msk[16];
-} __packed;
-struct mlx4_net_trans_rule_hw_eth {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        u8      rsvd1[6];
-        u8      dst_mac[6];
-        u16     rsvd2;
-        u8      dst_mac_msk[6];
-        u16     rsvd3;
-        u8      src_mac[6];
-        u16     rsvd4;
-        u8      src_mac_msk[6];
-        u8      rsvd5;
-        u8      ether_type_enable;
-        __be16  ether_type;
-        __be16  vlan_id_msk;
-        __be16  vlan_id;
-} __packed;
-struct mlx4_net_trans_rule_hw_tcp_udp {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        __be16  rsvd1[3];
-        __be16  dst_port;
-        __be16  rsvd2;
-        __be16  dst_port_msk;
-        __be16  rsvd3;
-        __be16  src_port;
-        __be16  rsvd4;
-        __be16  src_port_msk;
-} __packed;
-struct mlx4_net_trans_rule_hw_ipv4 {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        __be32  rsvd1;
-        __be32  dst_ip;
-        __be32  dst_ip_msk;
-        __be32  src_ip;
-        __be32  src_ip_msk;
-} __packed;
-struct _rule_hw {
-        union {
-                struct {
-                        u8 size;
-                        u8 rsvd;
-                        __be16 id;
-                };
-                struct mlx4_net_trans_rule_hw_eth eth;
-                struct mlx4_net_trans_rule_hw_ib ib;
-                struct mlx4_net_trans_rule_hw_ipv4 ipv4;
-                struct mlx4_net_trans_rule_hw_tcp_udp tcp_udp;
-        };
 };
 static int parse_trans_rule(struct mlx4_dev *dev, struct mlx4_spec_list *spec,
                            struct _rule_hw *rule_hw)
 {
-        static const u16 __sw_id_hw[] = {
-                [MLX4_NET_TRANS_RULE_ID_ETH]     = 0xE001,
-                [MLX4_NET_TRANS_RULE_ID_IB]      = 0xE005,
-                [MLX4_NET_TRANS_RULE_ID_IPV6]    = 0xE003,
-                [MLX4_NET_TRANS_RULE_ID_IPV4]    = 0xE002,
-                [MLX4_NET_TRANS_RULE_ID_TCP]     = 0xE004,
-                [MLX4_NET_TRANS_RULE_ID_UDP]     = 0xE006
-        };
        static const size_t __rule_hw_sz[] = {
                [MLX4_NET_TRANS_RULE_ID_ETH] =
                        sizeof(struct mlx4_net_trans_rule_hw_eth),
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 59ebc0339638..dba69d98734a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -249,7 +249,7 @@ struct mlx4_bitmap {
 struct mlx4_buddy {
        unsigned long         **bits;
        unsigned int           *num_free;
-        int                     max_order;
+        u32                     max_order;
        spinlock_t              lock;
 };
@@ -258,7 +258,7 @@ struct mlx4_icm;
 struct mlx4_icm_table {
        u64                     virt;
        int                     num_icm;
-        int                     num_obj;
+        u32                     num_obj;
        int                     obj_size;
        int                     lowmem;
        int                     coherent;
@@ -690,6 +690,82 @@ struct mlx4_steer {
        struct list_head steer_entries[MLX4_NUM_STEERS];
 };
+struct mlx4_net_trans_rule_hw_ctrl {
+        __be32 ctrl;
+        __be32 vf_vep_port;
+        __be32 qpn;
+        __be32 reserved;
+};
+struct mlx4_net_trans_rule_hw_ib {
+        u8 size;
+        u8 rsvd1;
+        __be16 id;
+        u32 rsvd2;
+        __be32 qpn;
+        __be32 qpn_mask;
+        u8 dst_gid[16];
+        u8 dst_gid_msk[16];
+} __packed;
+struct mlx4_net_trans_rule_hw_eth {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        u8      rsvd1[6];
+        u8      dst_mac[6];
+        u16     rsvd2;
+        u8      dst_mac_msk[6];
+        u16     rsvd3;
+        u8      src_mac[6];
+        u16     rsvd4;
+        u8      src_mac_msk[6];
+        u8      rsvd5;
+        u8      ether_type_enable;
+        __be16  ether_type;
+        __be16  vlan_id_msk;
+        __be16  vlan_id;
+} __packed;
+struct mlx4_net_trans_rule_hw_tcp_udp {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        __be16  rsvd1[3];
+        __be16  dst_port;
+        __be16  rsvd2;
+        __be16  dst_port_msk;
+        __be16  rsvd3;
+        __be16  src_port;
+        __be16  rsvd4;
+        __be16  src_port_msk;
+} __packed;
+struct mlx4_net_trans_rule_hw_ipv4 {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        __be32  rsvd1;
+        __be32  dst_ip;
+        __be32  dst_ip_msk;
+        __be32  src_ip;
+        __be32  src_ip_msk;
+} __packed;
+struct _rule_hw {
+        union {
+                struct {
+                        u8 size;
+                        u8 rsvd;
+                        __be16 id;
+                };
+                struct mlx4_net_trans_rule_hw_eth eth;
+                struct mlx4_net_trans_rule_hw_ib ib;
+                struct mlx4_net_trans_rule_hw_ipv4 ipv4;
+                struct mlx4_net_trans_rule_hw_tcp_udp tcp_udp;
+        };
+};
 struct mlx4_priv {
        struct mlx4_dev         dev;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index af55b7ce5341..c202d3ad2a0e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -37,6 +37,7 @@
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
+#include <linux/vmalloc.h>
 #include <linux/mlx4/cmd.h>
@@ -120,7 +121,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
        buddy->max_order = max_order;
        spin_lock_init(&buddy->lock);
-        buddy->bits = kzalloc((buddy->max_order + 1) * sizeof (long *),
+        buddy->bits = kcalloc(buddy->max_order + 1, sizeof (long *),
                              GFP_KERNEL);
        buddy->num_free = kcalloc((buddy->max_order + 1), sizeof *buddy->num_free,
                                  GFP_KERNEL);
@@ -129,10 +130,12 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
        for (i = 0; i <= buddy->max_order; ++i) {
                s = BITS_TO_LONGS(1 << (buddy->max_order - i));
-                buddy->bits[i] = kmalloc(s * sizeof (long), GFP_KERNEL);
+                buddy->bits[i] = kcalloc(s, sizeof (long), GFP_KERNEL | __GFP_NOWARN);
-                if (!buddy->bits[i])
+                if (!buddy->bits[i]) {
-                        goto err_out_free;
+                        buddy->bits[i] = vzalloc(s * sizeof(long));
-                bitmap_zero(buddy->bits[i], 1 << (buddy->max_order - i));
+                        if (!buddy->bits[i])
+                                goto err_out_free;
+                }
        }
        set_bit(0, buddy->bits[buddy->max_order]);
@@ -142,7 +145,10 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
 err_out_free:
        for (i = 0; i <= buddy->max_order; ++i)
-                kfree(buddy->bits[i]);
+                if (buddy->bits[i] && is_vmalloc_addr(buddy->bits[i]))
+                        vfree(buddy->bits[i]);
+                else
+                        kfree(buddy->bits[i]);
 err_out:
        kfree(buddy->bits);
@@ -156,7 +162,10 @@ static void mlx4_buddy_cleanup(struct mlx4_buddy *buddy)
        int i;
        for (i = 0; i <= buddy->max_order; ++i)
-                kfree(buddy->bits[i]);
+                if (is_vmalloc_addr(buddy->bits[i]))
+                        vfree(buddy->bits[i]);
+                else
+                        kfree(buddy->bits[i]);
        kfree(buddy->bits);
        kfree(buddy->num_free);
@@ -668,7 +677,7 @@ int mlx4_init_mr_table(struct mlx4_dev *dev)
                return err;
        err = mlx4_buddy_init(&mr_table->mtt_buddy,
-                              ilog2(dev->caps.num_mtts /
+                              ilog2((u32)dev->caps.num_mtts /
                              (1 << log_mtts_per_seg)));
        if (err)
                goto err_buddy;
@@ -678,7 +687,7 @@ int mlx4_init_mr_table(struct mlx4_dev *dev)
                        mlx4_alloc_mtt_range(dev,
                                             fls(dev->caps.reserved_mtts - 1));
                if (priv->reserved_mtts < 0) {
-                        mlx4_warn(dev, "MTT table of order %d is too small.\n",
+                        mlx4_warn(dev, "MTT table of order %u is too small.\n",
                                  mr_table->mtt_buddy.max_order);
                        err = -ENOMEM;
                        goto err_reserve_mtts;
diff --git a/drivers/net/ethernet/mellanox/mlx4/profile.c b/drivers/net/ethernet/mellanox/mlx4/profile.c
index 9ee4725363d5..8e0c3cc2a1ec 100644
--- a/drivers/net/ethernet/mellanox/mlx4/profile.c
+++ b/drivers/net/ethernet/mellanox/mlx4/profile.c
@@ -76,7 +76,7 @@ u64 mlx4_make_profile(struct mlx4_dev *dev,
                u64 size;
                u64 start;
                int type;
-                int num;
+                u32 num;
                int log_num;
        };
@@ -105,7 +105,7 @@ u64 mlx4_make_profile(struct mlx4_dev *dev,
        si_meminfo(&si);
        request->num_mtt =
                roundup_pow_of_two(max_t(unsigned, request->num_mtt,
-                                         min(1UL << 31,
+                                         min(1UL << (31 - log_mtts_per_seg),
                                             si.totalram >> (log_mtts_per_seg - 1))));
        profile[MLX4_RES_QP].size     = dev_cap->qpc_entry_sz;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 94ceddd17ab2..293c9e820c49 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -42,6 +42,7 @@
 #include <linux/mlx4/cmd.h>
 #include <linux/mlx4/qp.h>
 #include <linux/if_ether.h>
+#include <linux/etherdevice.h>
 #include "mlx4.h"
 #include "fw.h"
@@ -2776,18 +2777,133 @@ ex_put:
        return err;
 }
+/*
+ * MAC validation for Flow Steering rules.
+ * VF can attach rules only with a mac address which is assigned to it.
+ */
+static int validate_eth_header_mac(int slave, struct _rule_hw *eth_header,
+                                   struct list_head *rlist)
+{
+        struct mac_res *res, *tmp;
+        __be64 be_mac;
+        /* make sure it isn't multicast or broadcast mac*/
+        if (!is_multicast_ether_addr(eth_header->eth.dst_mac) &&
+            !is_broadcast_ether_addr(eth_header->eth.dst_mac)) {
+                list_for_each_entry_safe(res, tmp, rlist, list) {
+                        be_mac = cpu_to_be64(res->mac << 16);
+                        if (!memcmp(&be_mac, eth_header->eth.dst_mac, ETH_ALEN))
+                                return 0;
+                }
+                pr_err("MAC %pM doesn't belong to VF %d, Steering rule rejected\n",
+                       eth_header->eth.dst_mac, slave);
+                return -EINVAL;
+        }
+        return 0;
+}
+/*
+ * In case of missing eth header, append eth header with a MAC address
+ * assigned to the VF.
+ */
+static int add_eth_header(struct mlx4_dev *dev, int slave,
+                          struct mlx4_cmd_mailbox *inbox,
+                          struct list_head *rlist, int header_id)
+{
+        struct mac_res *res, *tmp;
+        u8 port;
+        struct mlx4_net_trans_rule_hw_ctrl *ctrl;
+        struct mlx4_net_trans_rule_hw_eth *eth_header;
+        struct mlx4_net_trans_rule_hw_ipv4 *ip_header;
+        struct mlx4_net_trans_rule_hw_tcp_udp *l4_header;
+        __be64 be_mac = 0;
+        __be64 mac_msk = cpu_to_be64(MLX4_MAC_MASK << 16);
+        ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
+        port = be32_to_cpu(ctrl->vf_vep_port) & 0xff;
+        eth_header = (struct mlx4_net_trans_rule_hw_eth *)(ctrl + 1);
+        /* Clear a space in the inbox for eth header */
+        switch (header_id) {
+        case MLX4_NET_TRANS_RULE_ID_IPV4:
+                ip_header =
+                        (struct mlx4_net_trans_rule_hw_ipv4 *)(eth_header + 1);
+                memmove(ip_header, eth_header,
+                        sizeof(*ip_header) + sizeof(*l4_header));
+                break;
+        case MLX4_NET_TRANS_RULE_ID_TCP:
+        case MLX4_NET_TRANS_RULE_ID_UDP:
+                l4_header = (struct mlx4_net_trans_rule_hw_tcp_udp *)
+                            (eth_header + 1);
+                memmove(l4_header, eth_header, sizeof(*l4_header));
+                break;
+        default:
+                return -EINVAL;
+        }
+        list_for_each_entry_safe(res, tmp, rlist, list) {
+                if (port == res->port) {
+                        be_mac = cpu_to_be64(res->mac << 16);
+                        break;
+                }
+        }
+        if (!be_mac) {
+                pr_err("Failed adding eth header to FS rule, Can't find matching MAC for port %d .\n",
+                       port);
+                return -EINVAL;
+        }
+        memset(eth_header, 0, sizeof(*eth_header));
+        eth_header->size = sizeof(*eth_header) >> 2;
+        eth_header->id = cpu_to_be16(__sw_id_hw[MLX4_NET_TRANS_RULE_ID_ETH]);
+        memcpy(eth_header->dst_mac, &be_mac, ETH_ALEN);
+        memcpy(eth_header->dst_mac_msk, &mac_msk, ETH_ALEN);
+        return 0;
+}
 int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                                         struct mlx4_vhcr *vhcr,
                                         struct mlx4_cmd_mailbox *inbox,
                                         struct mlx4_cmd_mailbox *outbox,
                                         struct mlx4_cmd_info *cmd)
 {
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        struct mlx4_resource_tracker *tracker = &priv->mfunc.master.res_tracker;
+        struct list_head *rlist = &tracker->slave_list[slave].res_list[RES_MAC];
        int err;
+        struct mlx4_net_trans_rule_hw_ctrl *ctrl;
+        struct _rule_hw  *rule_header;
+        int header_id;
        if (dev->caps.steering_mode !=
            MLX4_STEERING_MODE_DEVICE_MANAGED)
                return -EOPNOTSUPP;
+        ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
+        rule_header = (struct _rule_hw *)(ctrl + 1);
+        header_id = map_hw_to_sw_id(be16_to_cpu(rule_header->id));
+        switch (header_id) {
+        case MLX4_NET_TRANS_RULE_ID_ETH:
+                if (validate_eth_header_mac(slave, rule_header, rlist))
+                        return -EINVAL;
+                break;
+        case MLX4_NET_TRANS_RULE_ID_IPV4:
+        case MLX4_NET_TRANS_RULE_ID_TCP:
+        case MLX4_NET_TRANS_RULE_ID_UDP:
+                pr_warn("Can't attach FS rule without L2 headers, adding L2 header.\n");
+                if (add_eth_header(dev, slave, inbox, rlist, header_id))
+                        return -EINVAL;
+                vhcr->in_modifier +=
+                        sizeof(struct mlx4_net_trans_rule_hw_eth) >> 2;
+                break;
+        default:
+                pr_err("Corrupted mailbox.\n");
+                return -EINVAL;
+        }
        err = mlx4_cmd_imm(dev, inbox->dma, &vhcr->out_param,
                           vhcr->in_modifier, 0,
                           MLX4_QP_FLOW_STEERING_ATTACH, MLX4_CMD_TIME_CLASS_A,
diff --git a/drivers/net/ethernet/renesas/Kconfig b/drivers/net/ethernet/renesas/Kconfig
index 46df3a04030c..24c2305d7948 100644
--- a/drivers/net/ethernet/renesas/Kconfig
+++ b/drivers/net/ethernet/renesas/Kconfig
@@ -8,7 +8,7 @@ config SH_ETH
                (CPU_SUBTYPE_SH7710 || CPU_SUBTYPE_SH7712 || \
                 CPU_SUBTYPE_SH7763 || CPU_SUBTYPE_SH7619 || \
                 CPU_SUBTYPE_SH7724 || CPU_SUBTYPE_SH7734 || \
-                 CPU_SUBTYPE_SH7757 || ARCH_R8A7740)
+                 CPU_SUBTYPE_SH7757 || ARCH_R8A7740 || ARCH_R8A7779)
        select CRC32
        select NET_CORE
        select MII
@@ -18,4 +18,4 @@ config SH_ETH
          Renesas SuperH Ethernet device driver.
          This driver supporting CPUs are:
                - SH7619, SH7710, SH7712, SH7724, SH7734, SH7763, SH7757,
-                  and R8A7740.
+                  R8A7740 and R8A7779.
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index af0b867a6cf6..bad8f2eec9b4 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -78,7 +78,7 @@ static void sh_eth_select_mii(struct net_device *ndev)
 #endif
 /* There is CPU dependent code */
-#if defined(CONFIG_CPU_SUBTYPE_SH7724)
+#if defined(CONFIG_CPU_SUBTYPE_SH7724) || defined(CONFIG_ARCH_R8A7779)
 #define SH_ETH_RESET_DEFAULT    1
 static void sh_eth_set_duplex(struct net_device *ndev)
 {
@@ -93,13 +93,18 @@ static void sh_eth_set_duplex(struct net_device *ndev)
 static void sh_eth_set_rate(struct net_device *ndev)
 {
        struct sh_eth_private *mdp = netdev_priv(ndev);
+        unsigned int bits = ECMR_RTM;
+#if defined(CONFIG_ARCH_R8A7779)
+        bits |= ECMR_ELB;
+#endif
        switch (mdp->speed) {
        case 10: /* 10BASE */
-                sh_eth_write(ndev, sh_eth_read(ndev, ECMR) & ~ECMR_RTM, ECMR);
+                sh_eth_write(ndev, sh_eth_read(ndev, ECMR) & ~bits, ECMR);
                break;
        case 100:/* 100BASE */
-                sh_eth_write(ndev, sh_eth_read(ndev, ECMR) | ECMR_RTM, ECMR);
+                sh_eth_write(ndev, sh_eth_read(ndev, ECMR) | bits, ECMR);
                break;
        default:
                break;
diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
index bb8c8222122b..4d15bf413bdc 100644
--- a/drivers/net/ethernet/seeq/sgiseeq.c
+++ b/drivers/net/ethernet/seeq/sgiseeq.c
@@ -751,6 +751,7 @@ static int __devinit sgiseeq_probe(struct platform_device *pdev)
        sp->srings = sr;
        sp->rx_desc = sp->srings->rxvector;
        sp->tx_desc = sp->srings->txvector;
+        spin_lock_init(&sp->tx_lock);
        /* A couple calculations now, saves many cycles later. */
        setup_rx_ring(dev, sp->rx_desc, SEEQ_RX_BUFFERS);
diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c
index 8cba2df82b18..5faedd855b77 100644
--- a/drivers/net/ethernet/sfc/ethtool.c
+++ b/drivers/net/ethernet/sfc/ethtool.c
@@ -863,8 +863,8 @@ static int efx_ethtool_get_class_rule(struct efx_nic *efx,
                                       &ip_entry->ip4dst, &ip_entry->pdst);
        if (rc != 0) {
                rc = efx_filter_get_ipv4_full(
-                        &spec, &proto, &ip_entry->ip4src, &ip_entry->psrc,
+                        &spec, &proto, &ip_entry->ip4dst, &ip_entry->pdst,
-                        &ip_entry->ip4dst, &ip_entry->pdst);
+                        &ip_entry->ip4src, &ip_entry->psrc);
                EFX_WARN_ON_PARANOID(rc);
                ip_mask->ip4src = ~0;
                ip_mask->psrc = ~0;
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index e2d083228f3a..719be3912aa9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -22,6 +22,9 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __COMMON_H__
+#define __COMMON_H__
 #include <linux/etherdevice.h>
 #include <linux/netdevice.h>
 #include <linux/phy.h>
@@ -366,3 +369,5 @@ extern void stmmac_set_mac(void __iomem *ioaddr, bool enable);
 extern void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
 extern const struct stmmac_ring_mode_ops ring_mode_ops;
+#endif /* __COMMON_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h
index 9820ec842cc0..223adf95fd03 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs.h
@@ -20,6 +20,10 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __DESCS_H__
+#define __DESCS_H__
 struct dma_desc {
        /* Receive descriptor */
        union {
@@ -166,3 +170,5 @@ enum tdes_csum_insertion {
                                         * is not calculated */
        cic_full = 3,           /* IP header and pseudoheader */
 };
+#endif /* __DESCS_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
index dd8d6e19dff6..7ee9499a6e38 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
@@ -27,6 +27,9 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __DESC_COM_H__
+#define __DESC_COM_H__
 #if defined(CONFIG_STMMAC_RING)
 static inline void ehn_desc_rx_set_on_ring_chain(struct dma_desc *p, int end)
 {
@@ -124,3 +127,5 @@ static inline void norm_set_tx_desc_len(struct dma_desc *p, int len)
        p->des01.tx.buffer1_size = len;
 }
 #endif
+#endif /* __DESC_COM_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac100.h b/drivers/net/ethernet/stmicro/stmmac/dwmac100.h
index 7c6d857a9cc7..2ec6aeae349e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac100.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac100.h
@@ -22,6 +22,9 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __DWMAC100_H__
+#define __DWMAC100_H__
 #include <linux/phy.h>
 #include "common.h"
@@ -119,3 +122,5 @@ enum ttc_control {
 #define DMA_MISSED_FRAME_M_CNTR 0x0000ffff      /* Missed Frame Couinter */
 extern const struct stmmac_dma_ops dwmac100_dma_ops;
+#endif /* __DWMAC100_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
index f90fcb5f9573..0e4cacedc1f0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
@@ -19,6 +19,8 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __DWMAC1000_H__
+#define __DWMAC1000_H__
 #include <linux/phy.h>
 #include "common.h"
@@ -229,6 +231,7 @@ enum rtc_control {
 #define GMAC_MMC_RX_CSUM_OFFLOAD   0x208
 /* Synopsys Core versions */
-#define DWMAC_CORE_3_40 34
+#define DWMAC_CORE_3_40 0x34
 extern const struct stmmac_dma_ops dwmac1000_dma_ops;
+#endif /* __DWMAC1000_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
index e678ce39d014..e49c9a0fd6ff 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h
@@ -22,6 +22,9 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __DWMAC_DMA_H__
+#define __DWMAC_DMA_H__
 /* DMA CRS Control and Status Register Mapping */
 #define DMA_BUS_MODE            0x00001000      /* Bus Mode */
 #define DMA_XMT_POLL_DEMAND     0x00001004      /* Transmit Poll Demand */
@@ -109,3 +112,5 @@ extern void dwmac_dma_start_rx(void __iomem *ioaddr);
 extern void dwmac_dma_stop_rx(void __iomem *ioaddr);
 extern int dwmac_dma_interrupt(void __iomem *ioaddr,
                                struct stmmac_extra_stats *x);
+#endif /* __DWMAC_DMA_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc.h b/drivers/net/ethernet/stmicro/stmmac/mmc.h
index a38352024cb8..67995ef25251 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc.h
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc.h
@@ -22,6 +22,9 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __MMC_H__
+#define __MMC_H__
 /* MMC control register */
 /* When set, all counter are reset */
 #define MMC_CNTRL_COUNTER_RESET         0x1
@@ -129,3 +132,5 @@ struct stmmac_counters {
 extern void dwmac_mmc_ctrl(void __iomem *ioaddr, unsigned int mode);
 extern void dwmac_mmc_intr_all_mask(void __iomem *ioaddr);
 extern void dwmac_mmc_read(void __iomem *ioaddr, struct stmmac_counters *mmc);
+#endif /* __MMC_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
index c07cfe989f6e..0c74a702d461 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
@@ -33,7 +33,7 @@
 #define MMC_TX_INTR             0x00000108      /* MMC TX Interrupt */
 #define MMC_RX_INTR_MASK        0x0000010c      /* MMC Interrupt Mask */
 #define MMC_TX_INTR_MASK        0x00000110      /* MMC Interrupt Mask */
-#define MMC_DEFAUL_MASK         0xffffffff
+#define MMC_DEFAULT_MASK                0xffffffff
 /* MMC TX counter registers */
@@ -147,8 +147,8 @@ void dwmac_mmc_ctrl(void __iomem *ioaddr, unsigned int mode)
 /* To mask all all interrupts.*/
 void dwmac_mmc_intr_all_mask(void __iomem *ioaddr)
 {
-        writel(MMC_DEFAUL_MASK, ioaddr + MMC_RX_INTR_MASK);
+        writel(MMC_DEFAULT_MASK, ioaddr + MMC_RX_INTR_MASK);
-        writel(MMC_DEFAUL_MASK, ioaddr + MMC_TX_INTR_MASK);
+        writel(MMC_DEFAULT_MASK, ioaddr + MMC_TX_INTR_MASK);
 }
 /* This reads the MAC core counters (if actaully supported).
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index f2d3665430ad..e872e1da3137 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -20,6 +20,9 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __STMMAC_H__
+#define __STMMAC_H__
 #define STMMAC_RESOURCE_NAME   "stmmaceth"
 #define DRV_MODULE_VERSION      "March_2012"
@@ -166,3 +169,5 @@ static inline void stmmac_unregister_pci(void)
 {
 }
 #endif /* CONFIG_STMMAC_PCI */
+#endif /* __STMMAC_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index fd8882f9602a..c136162e6473 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2077,7 +2077,7 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
                goto error_netdev_register;
        }
-        priv->stmmac_clk = clk_get(priv->device, NULL);
+        priv->stmmac_clk = clk_get(priv->device, STMMAC_RESOURCE_NAME);
        if (IS_ERR(priv->stmmac_clk)) {
                pr_warning("%s: warning: cannot get CSR clock\n", __func__);
                goto error_clk_get;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.h
index 6863590d184b..aea9b14cdfbe 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.h
@@ -21,6 +21,8 @@
  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
+#ifndef __STMMAC_TIMER_H__
+#define __STMMAC_TIMER_H__
 struct stmmac_timer {
        void (*timer_start) (unsigned int new_freq);
@@ -40,3 +42,5 @@ void stmmac_schedule(struct net_device *dev);
 extern int tmu2_register_user(void *fnt, void *data);
 extern void tmu2_unregister_user(void);
 #endif
+#endif /* __STMMAC_TIMER_H__ */
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 3b5c4571b55e..d15c888e9df8 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -538,11 +538,12 @@ EXPORT_SYMBOL_GPL(cpdma_chan_create);
 int cpdma_chan_destroy(struct cpdma_chan *chan)
 {
-        struct cpdma_ctlr *ctlr = chan->ctlr;
+        struct cpdma_ctlr *ctlr;
        unsigned long flags;
        if (!chan)
                return -EINVAL;
+        ctlr = chan->ctlr;
        spin_lock_irqsave(&ctlr->lock, flags);
        if (chan->state != CPDMA_STATE_IDLE)
diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
index cd7ee204e94a..a9ca4a03d31b 100644
--- a/drivers/net/ethernet/ti/davinci_mdio.c
+++ b/drivers/net/ethernet/ti/davinci_mdio.c
@@ -394,8 +394,10 @@ static int __devexit davinci_mdio_remove(struct platform_device *pdev)
        struct device *dev = &pdev->dev;
        struct davinci_mdio_data *data = dev_get_drvdata(dev);
-        if (data->bus)
+        if (data->bus) {
+                mdiobus_unregister(data->bus);
                mdiobus_free(data->bus);
+        }
        if (data->clk)
                clk_put(data->clk);
diff --git a/drivers/net/fddi/skfp/pmf.c b/drivers/net/fddi/skfp/pmf.c
index 24d8566cfd8b..441b4dc79450 100644
--- a/drivers/net/fddi/skfp/pmf.c
+++ b/drivers/net/fddi/skfp/pmf.c
@@ -673,7 +673,7 @@ void smt_add_para(struct s_smc *smc, struct s_pcon *pcon, u_short para,
                        sm_pm_get_ls(smc,port_to_mib(smc,port))) ;
                break ;
        case SMT_P_REASON :
-                * (u_long *) to = 0 ;
+                *(u32 *)to = 0 ;
                sp_len = 4 ;
                goto sp_done ;
        case SMT_P1033 :                        /* time stamp */
diff --git a/drivers/net/irda/ks959-sir.c b/drivers/net/irda/ks959-sir.c
index 824e2a93fe8a..5f3aeac3f86d 100644
--- a/drivers/net/irda/ks959-sir.c
+++ b/drivers/net/irda/ks959-sir.c
@@ -542,6 +542,7 @@ static int ks959_net_open(struct net_device *netdev)
        sprintf(hwname, "usb#%d", kingsun->usbdev->devnum);
        kingsun->irlap = irlap_open(netdev, &kingsun->qos, hwname);
        if (!kingsun->irlap) {
+                err = -ENOMEM;
                dev_err(&kingsun->usbdev->dev, "irlap_open failed\n");
                goto free_mem;
        }
diff --git a/drivers/net/irda/ksdazzle-sir.c b/drivers/net/irda/ksdazzle-sir.c
index 5a278ab83c2f..2d4b6a1ab202 100644
--- a/drivers/net/irda/ksdazzle-sir.c
+++ b/drivers/net/irda/ksdazzle-sir.c
@@ -436,6 +436,7 @@ static int ksdazzle_net_open(struct net_device *netdev)
        sprintf(hwname, "usb#%d", kingsun->usbdev->devnum);
        kingsun->irlap = irlap_open(netdev, &kingsun->qos, hwname);
        if (!kingsun->irlap) {
+                err = -ENOMEM;
                dev_err(&kingsun->usbdev->dev, "irlap_open failed\n");
                goto free_mem;
        }
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index f9347ea3d381..b3321129a83c 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -640,15 +640,9 @@ static int netconsole_netdev_event(struct notifier_block *this,
                                 * rtnl_lock already held
                                 */
                                if (nt->np.dev) {
-                                        spin_unlock_irqrestore(
-                                                              &target_list_lock,
-                                                              flags);
                                        __netpoll_cleanup(&nt->np);
-                                        spin_lock_irqsave(&target_list_lock,
-                                                          flags);
                                        dev_put(nt->np.dev);
                                        nt->np.dev = NULL;
-                                        netconsole_target_put(nt);
                                }
                                nt->enabled = 0;
                                stopped = true;
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 5c120189ec86..4d4d25efc1e1 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -132,7 +132,7 @@ int mdio_mux_init(struct device *dev,
        pb->mii_bus = parent_bus;
        ret_val = -ENODEV;
-        for_each_child_of_node(dev->of_node, child_bus_node) {
+        for_each_available_child_of_node(dev->of_node, child_bus_node) {
                u32 v;
                r = of_property_read_u32(child_bus_node, "reg", &v);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 87707ab39430..341b65dbbcd3 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -795,16 +795,17 @@ static void team_port_leave(struct team *team, struct team_port *port)
 }
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+static int team_port_enable_netpoll(struct team *team, struct team_port *port,
+                                    gfp_t gfp)
 {
        struct netpoll *np;
        int err;
-        np = kzalloc(sizeof(*np), GFP_KERNEL);
+        np = kzalloc(sizeof(*np), gfp);
        if (!np)
                return -ENOMEM;
-        err = __netpoll_setup(np, port->dev);
+        err = __netpoll_setup(np, port->dev, gfp);
        if (err) {
                kfree(np);
                return err;
@@ -833,7 +834,8 @@ static struct netpoll_info *team_netpoll_info(struct team *team)
 }
 #else
-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+static int team_port_enable_netpoll(struct team *team, struct team_port *port,
+                                    gfp_t gfp)
 {
        return 0;
 }
@@ -913,7 +915,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
        }
        if (team_netpoll_info(team)) {
-                err = team_port_enable_netpoll(team, port);
+                err = team_port_enable_netpoll(team, port, GFP_KERNEL);
                if (err) {
                        netdev_err(dev, "Failed to enable netpoll on device %s\n",
                                   portname);
@@ -1443,7 +1445,7 @@ static void team_netpoll_cleanup(struct net_device *dev)
 }
 static int team_netpoll_setup(struct net_device *dev,
-                              struct netpoll_info *npifo)
+                              struct netpoll_info *npifo, gfp_t gfp)
 {
        struct team *team = netdev_priv(dev);
        struct team_port *port;
@@ -1451,7 +1453,7 @@ static int team_netpoll_setup(struct net_device *dev,
        mutex_lock(&team->lock);
        list_for_each_entry(port, &team->port_list, list) {
-                err = team_port_enable_netpoll(team, port);
+                err = team_port_enable_netpoll(team, port, gfp);
                if (err) {
                        __team_netpoll_cleanup(team);
                        break;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 2ea126a16d79..b1ba68f1a049 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -247,30 +247,12 @@ err:
 */
 static int qmi_wwan_bind_shared(struct usbnet *dev, struct usb_interface *intf)
 {
-        int rv;
        struct qmi_wwan_state *info = (void *)&dev->data;
-        /* ZTE makes devices where the interface descriptors and endpoint
-         * configurations of two or more interfaces are identical, even
-         * though the functions are completely different.  If set, then
-         * driver_info->data is a bitmap of acceptable interface numbers
-         * allowing us to bind to one such interface without binding to
-         * all of them
-         */
-        if (dev->driver_info->data &&
-            !test_bit(intf->cur_altsetting->desc.bInterfaceNumber, &dev->driver_info->data)) {
-                dev_info(&intf->dev, "not on our whitelist - ignored");
-                rv = -ENODEV;
-                goto err;
-        }
        /*  control and data is shared */
        info->control = intf;
        info->data = intf;
-        rv = qmi_wwan_register_subdriver(dev);
+        return qmi_wwan_register_subdriver(dev);
-err:
-        return rv;
 }
 static void qmi_wwan_unbind(struct usbnet *dev, struct usb_interface *intf)
@@ -315,7 +297,7 @@ static int qmi_wwan_suspend(struct usb_interface *intf, pm_message_t message)
        if (ret < 0)
                goto err;
-        if (info->subdriver && info->subdriver->suspend)
+        if (intf == info->control && info->subdriver && info->subdriver->suspend)
                ret = info->subdriver->suspend(intf, message);
        if (ret < 0)
                usbnet_resume(intf);
@@ -328,13 +310,14 @@ static int qmi_wwan_resume(struct usb_interface *intf)
        struct usbnet *dev = usb_get_intfdata(intf);
        struct qmi_wwan_state *info = (void *)&dev->data;
        int ret = 0;
+        bool callsub = (intf == info->control && info->subdriver && info->subdriver->resume);
-        if (info->subdriver && info->subdriver->resume)
+        if (callsub)
                ret = info->subdriver->resume(intf);
        if (ret < 0)
                goto err;
        ret = usbnet_resume(intf);
-        if (ret < 0 && info->subdriver && info->subdriver->resume && info->subdriver->suspend)
+        if (ret < 0 && callsub && info->subdriver->suspend)
                info->subdriver->suspend(intf, PMSG_SUSPEND);
 err:
        return ret;
@@ -356,217 +339,66 @@ static const struct driver_info	qmi_wwan_shared = {
        .manage_power   = qmi_wwan_manage_power,
 };
-static const struct driver_info qmi_wwan_force_int0 = {
-        .description    = "Qualcomm WWAN/QMI device",
-        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_shared,
-        .unbind         = qmi_wwan_unbind,
-        .manage_power   = qmi_wwan_manage_power,
-        .data           = BIT(0), /* interface whitelist bitmap */
-};
-static const struct driver_info qmi_wwan_force_int1 = {
-        .description    = "Qualcomm WWAN/QMI device",
-        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_shared,
-        .unbind         = qmi_wwan_unbind,
-        .manage_power   = qmi_wwan_manage_power,
-        .data           = BIT(1), /* interface whitelist bitmap */
-};
-static const struct driver_info qmi_wwan_force_int2 = {
-        .description    = "Qualcomm WWAN/QMI device",
-        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_shared,
-        .unbind         = qmi_wwan_unbind,
-        .manage_power   = qmi_wwan_manage_power,
-        .data           = BIT(2), /* interface whitelist bitmap */
-};
-static const struct driver_info qmi_wwan_force_int3 = {
-        .description    = "Qualcomm WWAN/QMI device",
-        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_shared,
-        .unbind         = qmi_wwan_unbind,
-        .manage_power   = qmi_wwan_manage_power,
-        .data           = BIT(3), /* interface whitelist bitmap */
-};
-static const struct driver_info qmi_wwan_force_int4 = {
-        .description    = "Qualcomm WWAN/QMI device",
-        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_shared,
-        .unbind         = qmi_wwan_unbind,
-        .manage_power   = qmi_wwan_manage_power,
-        .data           = BIT(4), /* interface whitelist bitmap */
-};
-/* Sierra Wireless provide equally useless interface descriptors
- * Devices in QMI mode can be switched between two different
- * configurations:
- *   a) USB interface #8 is QMI/wwan
- *   b) USB interfaces #8, #19 and #20 are QMI/wwan
- *
- * Both configurations provide a number of other interfaces (serial++),
- * some of which have the same endpoint configuration as we expect, so
- * a whitelist or blacklist is necessary.
- *
- * FIXME: The below whitelist should include BIT(20).  It does not
- * because I cannot get it to work...
- */
-static const struct driver_info qmi_wwan_sierra = {
-        .description    = "Sierra Wireless wwan/QMI device",
-        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_shared,
-        .unbind         = qmi_wwan_unbind,
-        .manage_power   = qmi_wwan_manage_power,
-        .data           = BIT(8) | BIT(19), /* interface whitelist bitmap */
-};
 #define HUAWEI_VENDOR_ID        0x12D1
+/* map QMI/wwan function by a fixed interface number */
+#define QMI_FIXED_INTF(vend, prod, num) \
+        USB_DEVICE_INTERFACE_NUMBER(vend, prod, num), \
+        .driver_info = (unsigned long)&qmi_wwan_shared
 /* Gobi 1000 QMI/wwan interface number is 3 according to qcserial */
 #define QMI_GOBI1K_DEVICE(vend, prod) \
-        USB_DEVICE(vend, prod), \
+        QMI_FIXED_INTF(vend, prod, 3)
-        .driver_info = (unsigned long)&qmi_wwan_force_int3
-/* Gobi 2000 and Gobi 3000 QMI/wwan interface number is 0 according to qcserial */
+/* Gobi 2000/3000 QMI/wwan interface number is 0 according to qcserial */
 #define QMI_GOBI_DEVICE(vend, prod) \
-        USB_DEVICE(vend, prod), \
+        QMI_FIXED_INTF(vend, prod, 0)
-        .driver_info = (unsigned long)&qmi_wwan_force_int0
 static const struct usb_device_id products[] = {
+        /* 1. CDC ECM like devices match on the control interface */
        {       /* Huawei E392, E398 and possibly others sharing both device id and more... */
-                .match_flags        = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO,
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 9),
-                .idVendor           = HUAWEI_VENDOR_ID,
-                .bInterfaceClass    = USB_CLASS_VENDOR_SPEC,
-                .bInterfaceSubClass = 1,
-                .bInterfaceProtocol = 9, /* CDC Ethernet *control* interface */
                .driver_info        = (unsigned long)&qmi_wwan_info,
        },
        {       /* Vodafone/Huawei K5005 (12d1:14c8) and similar modems */
-                .match_flags        = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO,
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
-                .idVendor           = HUAWEI_VENDOR_ID,
-                .bInterfaceClass    = USB_CLASS_VENDOR_SPEC,
-                .bInterfaceSubClass = 1,
-                .bInterfaceProtocol = 57, /* CDC Ethernet *control* interface */
                .driver_info        = (unsigned long)&qmi_wwan_info,
        },
-        {       /* Huawei E392, E398 and possibly others in "Windows mode"
-                 * using a combined control and data interface without any CDC
+        /* 2. Combined interface devices matching on class+protocol */
-                 * functional descriptors
+        {       /* Huawei E392, E398 and possibly others in "Windows mode" */
-                 */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
-                .match_flags        = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = HUAWEI_VENDOR_ID,
-                .bInterfaceClass    = USB_CLASS_VENDOR_SPEC,
-                .bInterfaceSubClass = 1,
-                .bInterfaceProtocol = 17,
                .driver_info        = (unsigned long)&qmi_wwan_shared,
        },
        {       /* Pantech UML290 */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
-                .idVendor           = 0x106c,
-                .idProduct          = 0x3718,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xf0,
-                .bInterfaceProtocol = 0xff,
                .driver_info        = (unsigned long)&qmi_wwan_shared,
        },
-        {       /* ZTE MF820D */
+        {       /* Pantech UML290 - newer firmware */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
-                .idVendor           = 0x19d2,
+                .driver_info        = (unsigned long)&qmi_wwan_shared,
-                .idProduct          = 0x0167,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
-        },
-        {       /* ZTE MF821D */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x0326,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
-        },
-        {       /* ZTE (Vodafone) K3520-Z */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x0055,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int1,
-        },
-        {       /* ZTE (Vodafone) K3565-Z */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x0063,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
-        },
-        {       /* ZTE (Vodafone) K3570-Z */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x1008,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
-        },
-        {       /* ZTE (Vodafone) K3571-Z */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x1010,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
-        },
-        {       /* ZTE (Vodafone) K3765-Z */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x2002,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
-        },
-        {       /* ZTE (Vodafone) K4505-Z */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x0104,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
-        },
-        {       /* ZTE MF60 */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x19d2,
-                .idProduct          = 0x1402,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_force_int2,
-        },
-        {       /* Sierra Wireless MC77xx in QMI mode */
-                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-                .idVendor           = 0x1199,
-                .idProduct          = 0x68a2,
-                .bInterfaceClass    = 0xff,
-                .bInterfaceSubClass = 0xff,
-                .bInterfaceProtocol = 0xff,
-                .driver_info        = (unsigned long)&qmi_wwan_sierra,
        },
-        /* Gobi 1000 devices */
+        /* 3. Combined interface devices matching on interface number */
+        {QMI_FIXED_INTF(0x19d2, 0x0055, 1)},    /* ZTE (Vodafone) K3520-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0063, 4)},    /* ZTE (Vodafone) K3565-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0104, 4)},    /* ZTE (Vodafone) K4505-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0167, 4)},    /* ZTE MF820D */
+        {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
+        {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1010, 4)},    /* ZTE (Vodafone) K3571-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1018, 3)},    /* ZTE (Vodafone) K5006-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1402, 2)},    /* ZTE MF60 */
+        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
+        {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
+        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
+        {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
+        {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
+        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
+        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
        {QMI_GOBI1K_DEVICE(0x03f0, 0x1f1d)},    /* HP un2400 Gobi Modem Device */
-        {QMI_GOBI1K_DEVICE(0x03f0, 0x371d)},    /* HP un2430 Mobile Broadband Module */
        {QMI_GOBI1K_DEVICE(0x04da, 0x250d)},    /* Panasonic Gobi Modem device */
        {QMI_GOBI1K_DEVICE(0x413c, 0x8172)},    /* Dell Gobi Modem device */
        {QMI_GOBI1K_DEVICE(0x1410, 0xa001)},    /* Novatel Gobi Modem device */
@@ -579,9 +411,11 @@ static const struct usb_device_id products[] = {
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9222)},    /* Generic Gobi Modem device */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9009)},    /* Generic Gobi Modem device */
-        /* Gobi 2000 and 3000 devices */
+        /* 5. Gobi 2000 and 3000 devices */
        {QMI_GOBI_DEVICE(0x413c, 0x8186)},      /* Dell Gobi 2000 Modem device (N0218, VU936) */
+        {QMI_GOBI_DEVICE(0x413c, 0x8194)},      /* Dell Gobi 3000 Composite */
        {QMI_GOBI_DEVICE(0x05c6, 0x920b)},      /* Generic Gobi 2000 Modem device */
+        {QMI_GOBI_DEVICE(0x05c6, 0x920d)},      /* Gobi 3000 Composite */
        {QMI_GOBI_DEVICE(0x05c6, 0x9225)},      /* Sony Gobi 2000 Modem device (N0279, VU730) */
        {QMI_GOBI_DEVICE(0x05c6, 0x9245)},      /* Samsung Gobi 2000 Modem device (VL176) */
        {QMI_GOBI_DEVICE(0x03f0, 0x251d)},      /* HP Gobi 2000 Modem device (VP412) */
@@ -589,6 +423,8 @@ static const struct usb_device_id products[] = {
        {QMI_GOBI_DEVICE(0x05c6, 0x9265)},      /* Asus Gobi 2000 Modem device (VR305) */
        {QMI_GOBI_DEVICE(0x05c6, 0x9235)},      /* Top Global Gobi 2000 Modem device (VR306) */
        {QMI_GOBI_DEVICE(0x05c6, 0x9275)},      /* iRex Technologies Gobi 2000 Modem device (VR307) */
+        {QMI_GOBI_DEVICE(0x1199, 0x68a5)},      /* Sierra Wireless Modem */
+        {QMI_GOBI_DEVICE(0x1199, 0x68a9)},      /* Sierra Wireless Modem */
        {QMI_GOBI_DEVICE(0x1199, 0x9001)},      /* Sierra Wireless Gobi 2000 Modem device (VT773) */
        {QMI_GOBI_DEVICE(0x1199, 0x9002)},      /* Sierra Wireless Gobi 2000 Modem device (VT773) */
        {QMI_GOBI_DEVICE(0x1199, 0x9003)},      /* Sierra Wireless Gobi 2000 Modem device (VT773) */
@@ -600,11 +436,17 @@ static const struct usb_device_id products[] = {
        {QMI_GOBI_DEVICE(0x1199, 0x9009)},      /* Sierra Wireless Gobi 2000 Modem device (VT773) */
        {QMI_GOBI_DEVICE(0x1199, 0x900a)},      /* Sierra Wireless Gobi 2000 Modem device (VT773) */
        {QMI_GOBI_DEVICE(0x1199, 0x9011)},      /* Sierra Wireless Gobi 2000 Modem device (MC8305) */
+        {QMI_FIXED_INTF(0x1199, 0x9011, 5)},    /* alternate interface number!? */
        {QMI_GOBI_DEVICE(0x16d8, 0x8002)},      /* CMDTech Gobi 2000 Modem device (VU922) */
        {QMI_GOBI_DEVICE(0x05c6, 0x9205)},      /* Gobi 2000 Modem device */
        {QMI_GOBI_DEVICE(0x1199, 0x9013)},      /* Sierra Wireless Gobi 3000 Modem device (MC8355) */
+        {QMI_GOBI_DEVICE(0x03f0, 0x371d)},      /* HP un2430 Mobile Broadband Module */
        {QMI_GOBI_DEVICE(0x1199, 0x9015)},      /* Sierra Wireless Gobi 3000 Modem device */
        {QMI_GOBI_DEVICE(0x1199, 0x9019)},      /* Sierra Wireless Gobi 3000 Modem device */
+        {QMI_GOBI_DEVICE(0x1199, 0x901b)},      /* Sierra Wireless MC7770 */
+        {QMI_GOBI_DEVICE(0x12d1, 0x14f1)},      /* Sony Gobi 3000 Composite */
+        {QMI_GOBI_DEVICE(0x1410, 0xa021)},      /* Foxconn Gobi 3000 Modem device (Novatel E396) */
        { }                                     /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index d75d1f56becf..8e22417fa6c1 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -68,15 +68,8 @@ static	atomic_t iface_counter = ATOMIC_INIT(0);
 */
 #define SIERRA_NET_USBCTL_BUF_LEN       1024
-/* list of interface numbers - used for constructing interface lists */
-struct sierra_net_iface_info {
-        const u32 infolen;      /* number of interface numbers on list */
-        const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
-};
 struct sierra_net_info_data {
        u16 rx_urb_size;
-        struct sierra_net_iface_info whitelist;
 };
 /* Private data structure */
@@ -637,21 +630,6 @@ static int sierra_net_change_mtu(struct net_device *net, int new_mtu)
        return usbnet_change_mtu(net, new_mtu);
 }
-static int is_whitelisted(const u8 ifnum,
-                        const struct sierra_net_iface_info *whitelist)
-{
-        if (whitelist) {
-                const u8 *list = whitelist->ifaceinfo;
-                int i;
-                for (i = 0; i < whitelist->infolen; i++) {
-                        if (list[i] == ifnum)
-                                return 1;
-                }
-        }
-        return 0;
-}
 static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
 {
        int result = 0;
@@ -678,7 +656,7 @@ static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
                return -EIO;
        }
-        *datap = *attrdata;
+        *datap = le16_to_cpu(*attrdata);
        kfree(attrdata);
        return result;
@@ -706,11 +684,6 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
        dev_dbg(&dev->udev->dev, "%s", __func__);
        ifacenum = intf->cur_altsetting->desc.bInterfaceNumber;
-        /* We only accept certain interfaces */
-        if (!is_whitelisted(ifacenum, &data->whitelist)) {
-                dev_dbg(&dev->udev->dev, "Ignoring interface: %d", ifacenum);
-                return -ENODEV;
-        }
        numendpoints = intf->cur_altsetting->desc.bNumEndpoints;
        /* We have three endpoints, bulk in and out, and a status */
        if (numendpoints != 3) {
@@ -945,13 +918,8 @@ struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
        return NULL;
 }
-static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
 static const struct sierra_net_info_data sierra_net_info_data_direct_ip = {
        .rx_urb_size = 8 * 1024,
-        .whitelist = {
-                .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
-                .ifaceinfo = sierra_net_ifnum_list
-        }
 };
 static const struct driver_info sierra_net_info_direct_ip = {
@@ -965,15 +933,19 @@ static const struct driver_info sierra_net_info_direct_ip = {
        .data = (unsigned long)&sierra_net_info_data_direct_ip,
 };
+#define DIRECT_IP_DEVICE(vend, prod) \
+        {USB_DEVICE_INTERFACE_NUMBER(vend, prod, 7), \
+        .driver_info = (unsigned long)&sierra_net_info_direct_ip}, \
+        {USB_DEVICE_INTERFACE_NUMBER(vend, prod, 10), \
+        .driver_info = (unsigned long)&sierra_net_info_direct_ip}, \
+        {USB_DEVICE_INTERFACE_NUMBER(vend, prod, 11), \
+        .driver_info = (unsigned long)&sierra_net_info_direct_ip}
 static const struct usb_device_id products[] = {
-        {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+        DIRECT_IP_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
-        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        DIRECT_IP_DEVICE(0x0F3D, 0x68A3), /* AT&T Direct IP modem */
-        {USB_DEVICE(0x0F3D, 0x68A3), /* AT&T Direct IP modem */
+        DIRECT_IP_DEVICE(0x1199, 0x68AA), /* Sierra Wireless Direct IP LTE modem */
-        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        DIRECT_IP_DEVICE(0x0F3D, 0x68AA), /* AT&T Direct IP LTE modem */
-        {USB_DEVICE(0x1199, 0x68AA), /* Sierra Wireless Direct IP LTE modem */
-        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
-        {USB_DEVICE(0x0F3D, 0x68AA), /* AT&T Direct IP LTE modem */
-        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
        {}, /* last item */
 };
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 8531c1caac28..fc9f578a1e25 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1201,19 +1201,26 @@ deferred:
 }
 EXPORT_SYMBOL_GPL(usbnet_start_xmit);
-static void rx_alloc_submit(struct usbnet *dev, gfp_t flags)
+static int rx_alloc_submit(struct usbnet *dev, gfp_t flags)
 {
        struct urb      *urb;
        int             i;
+        int             ret = 0;
        /* don't refill the queue all at once */
        for (i = 0; i < 10 && dev->rxq.qlen < RX_QLEN(dev); i++) {
                urb = usb_alloc_urb(0, flags);
                if (urb != NULL) {
-                        if (rx_submit(dev, urb, flags) == -ENOLINK)
+                        ret = rx_submit(dev, urb, flags);
-                                return;
+                        if (ret)
+                                goto err;
+                } else {
+                        ret = -ENOMEM;
+                        goto err;
                }
        }
+err:
+        return ret;
 }
 /*-------------------------------------------------------------------------*/
@@ -1257,7 +1264,8 @@ static void usbnet_bh (unsigned long param)
                int     temp = dev->rxq.qlen;
                if (temp < RX_QLEN(dev)) {
-                        rx_alloc_submit(dev, GFP_ATOMIC);
+                        if (rx_alloc_submit(dev, GFP_ATOMIC) == -ENOLINK)
+                                return;
                        if (temp != dev->rxq.qlen)
                                netif_dbg(dev, link, dev->net,
                                          "rxqlen %d --> %d\n",
@@ -1573,7 +1581,7 @@ int usbnet_resume (struct usb_interface *intf)
                                netif_device_present(dev->net) &&
                                !timer_pending(&dev->delay) &&
                                !test_bit(EVENT_RX_HALT, &dev->flags))
-                                        rx_alloc_submit(dev, GFP_KERNEL);
+                                        rx_alloc_submit(dev, GFP_NOIO);
                        if (!(dev->txq.qlen >= TX_QLEN(dev)))
                                netif_tx_wake_all_queues(dev->net);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 93e0cfb739b8..ce9d4f2c9776 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -3019,6 +3019,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
        netdev->watchdog_timeo = 5 * HZ;
        INIT_WORK(&adapter->work, vmxnet3_reset_work);
+        set_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
        if (adapter->intr.type == VMXNET3_IT_MSIX) {
                int i;
@@ -3043,7 +3044,6 @@ vmxnet3_probe_device(struct pci_dev *pdev,
                goto err_register;
        }
-        set_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
        vmxnet3_check_link(adapter, false);
        atomic_inc(&devices_found);
        return 0;
diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
index 9eb6479306d6..ef36cafd44b7 100644
--- a/drivers/net/wan/dscc4.c
+++ b/drivers/net/wan/dscc4.c
@@ -774,14 +774,15 @@ static int __devinit dscc4_init_one(struct pci_dev *pdev,
        }
        /* Global interrupt queue */
        writel((u32)(((IRQ_RING_SIZE >> 5) - 1) << 20), ioaddr + IQLENR1);
+        rc = -ENOMEM;
        priv->iqcfg = (__le32 *) pci_alloc_consistent(pdev,
                IRQ_RING_SIZE*sizeof(__le32), &priv->iqcfg_dma);
        if (!priv->iqcfg)
                goto err_free_irq_5;
        writel(priv->iqcfg_dma, ioaddr + IQCFG);
-        rc = -ENOMEM;
        /*
         * SCC 0-3 private rx/tx irq structures
         * IQRX/TXi needs to be set soon. Learned it the hard way...
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index aaaca9aa2293..3f575afd8cfc 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -10,6 +10,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/cdev.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
index 283237f6f074..def12b38cbf7 100644
--- a/drivers/net/wimax/i2400m/fw.c
+++ b/drivers/net/wimax/i2400m/fw.c
@@ -326,8 +326,10 @@ int i2400m_barker_db_init(const char *_options)
                unsigned barker;
                options_orig = kstrdup(_options, GFP_KERNEL);
-                if (options_orig == NULL)
+                if (options_orig == NULL) {
+                        result = -ENOMEM;
                        goto error_parse;
+                }
                options = options_orig;
                while ((token = strsep(&options, ",")) != NULL) {
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index efc162e0b511..88b8d64c90f1 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -342,7 +342,7 @@ static int at76_dfu_get_status(struct usb_device *udev,
        return ret;
 }
-static u8 at76_dfu_get_state(struct usb_device *udev, u8 *state)
+static int at76_dfu_get_state(struct usb_device *udev, u8 *state)
 {
        int ret;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 8c4c040a47b8..2aab20ee9f38 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2056,9 +2056,7 @@ ath5k_beacon_update_timers(struct ath5k_hw *ah, u64 bc_tsf)
 void
 ath5k_beacon_config(struct ath5k_hw *ah)
 {
-        unsigned long flags;
+        spin_lock_bh(&ah->block);
-        spin_lock_irqsave(&ah->block, flags);
        ah->bmisscount = 0;
        ah->imask &= ~(AR5K_INT_BMISS | AR5K_INT_SWBA);
@@ -2085,7 +2083,7 @@ ath5k_beacon_config(struct ath5k_hw *ah)
        ath5k_hw_set_imr(ah, ah->imask);
        mmiowb();
-        spin_unlock_irqrestore(&ah->block, flags);
+        spin_unlock_bh(&ah->block);
 }
 static void ath5k_tasklet_beacon(unsigned long data)
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 4026c906cc7b..b7e0258887e7 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -1482,7 +1482,7 @@ ath5k_eeprom_read_target_rate_pwr_info(struct ath5k_hw *ah, unsigned int mode)
        case AR5K_EEPROM_MODE_11A:
                offset += AR5K_EEPROM_TARGET_PWR_OFF_11A(ee->ee_version);
                rate_pcal_info = ee->ee_rate_tpwr_a;
-                ee->ee_rate_target_pwr_num[mode] = AR5K_EEPROM_N_5GHZ_CHAN;
+                ee->ee_rate_target_pwr_num[mode] = AR5K_EEPROM_N_5GHZ_RATE_CHAN;
                break;
        case AR5K_EEPROM_MODE_11B:
                offset += AR5K_EEPROM_TARGET_PWR_OFF_11B(ee->ee_version);
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index dc2bcfeadeb4..94a9bbea6874 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -182,6 +182,7 @@
 #define AR5K_EEPROM_EEP_DELTA           10
 #define AR5K_EEPROM_N_MODES             3
 #define AR5K_EEPROM_N_5GHZ_CHAN         10
+#define AR5K_EEPROM_N_5GHZ_RATE_CHAN    8
 #define AR5K_EEPROM_N_2GHZ_CHAN         3
 #define AR5K_EEPROM_N_2GHZ_CHAN_2413    4
 #define AR5K_EEPROM_N_2GHZ_CHAN_MAX     4
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 260e7dc7f751..d56453e43d7e 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -254,7 +254,6 @@ ath5k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
        struct ath5k_vif *avf = (void *)vif->drv_priv;
        struct ath5k_hw *ah = hw->priv;
        struct ath_common *common = ath5k_hw_common(ah);
-        unsigned long flags;
        mutex_lock(&ah->lock);
@@ -300,9 +299,9 @@ ath5k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
        }
        if (changes & BSS_CHANGED_BEACON) {
-                spin_lock_irqsave(&ah->block, flags);
+                spin_lock_bh(&ah->block);
                ath5k_beacon_update(hw, vif);
-                spin_unlock_irqrestore(&ah->block, flags);
+                spin_unlock_bh(&ah->block);
        }
        if (changes & BSS_CHANGED_BEACON_ENABLED)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 2c9f7d7ed4cc..0ed3846f9cbb 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -142,6 +142,7 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
        };
        int training_power;
        int i, val;
+        u32 am2pm_mask = ah->paprd_ratemask;
        if (IS_CHAN_2GHZ(ah->curchan))
                training_power = ar9003_get_training_power_2g(ah);
@@ -158,10 +159,13 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
        }
        ah->paprd_training_power = training_power;
+        if (AR_SREV_9330(ah))
+                am2pm_mask = 0;
        REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2AM, AR_PHY_PAPRD_AM2AM_MASK,
                      ah->paprd_ratemask);
        REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2PM, AR_PHY_PAPRD_AM2PM_MASK,
-                      ah->paprd_ratemask);
+                      am2pm_mask);
        REG_RMW_FIELD(ah, AR_PHY_PAPRD_HT40, AR_PHY_PAPRD_HT40_MASK,
                      ah->paprd_ratemask_ht40);
@@ -782,6 +786,102 @@ int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain)
 }
 EXPORT_SYMBOL(ar9003_paprd_setup_gain_table);
+static bool ar9003_paprd_retrain_pa_in(struct ath_hw *ah,
+                                       struct ath9k_hw_cal_data *caldata,
+                                       int chain)
+{
+        u32 *pa_in = caldata->pa_table[chain];
+        int capdiv_offset, quick_drop_offset;
+        int capdiv2g, quick_drop;
+        int count = 0;
+        int i;
+        if (!AR_SREV_9485(ah) && !AR_SREV_9330(ah))
+                return false;
+        capdiv2g = REG_READ_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                                  AR_PHY_65NM_CH0_TXRF3_CAPDIV2G);
+        quick_drop = REG_READ_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                                    AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP);
+        if (quick_drop)
+                quick_drop -= 0x40;
+        for (i = 0; i < NUM_BIN + 1; i++) {
+                if (pa_in[i] == 1400)
+                        count++;
+        }
+        if (AR_SREV_9485(ah)) {
+                if (pa_in[23] < 800) {
+                        capdiv_offset = (int)((1000 - pa_in[23] + 75) / 150);
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 7) {
+                                capdiv2g = 7;
+                                if (pa_in[23] < 600) {
+                                        quick_drop++;
+                                        if (quick_drop > 0)
+                                                quick_drop = 0;
+                                }
+                        }
+                } else if (pa_in[23] == 1400) {
+                        quick_drop_offset = min_t(int, count / 3, 2);
+                        quick_drop += quick_drop_offset;
+                        capdiv2g += quick_drop_offset / 2;
+                        if (capdiv2g > 7)
+                                capdiv2g = 7;
+                        if (quick_drop > 0) {
+                                quick_drop = 0;
+                                capdiv2g -= quick_drop_offset;
+                                if (capdiv2g < 0)
+                                        capdiv2g = 0;
+                        }
+                } else {
+                        return false;
+                }
+        } else if (AR_SREV_9330(ah)) {
+                if (pa_in[23] < 1000) {
+                        capdiv_offset = (1000 - pa_in[23]) / 100;
+                        capdiv2g += capdiv_offset;
+                        if (capdiv_offset > 3) {
+                                capdiv_offset = 1;
+                                quick_drop--;
+                        }
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 6)
+                                capdiv2g = 6;
+                        if (quick_drop < -4)
+                                quick_drop = -4;
+                } else if (pa_in[23] == 1400) {
+                        if (count > 3) {
+                                quick_drop++;
+                                capdiv2g -= count / 4;
+                                if (quick_drop > -2)
+                                        quick_drop = -2;
+                        } else {
+                                capdiv2g--;
+                        }
+                        if (capdiv2g < 0)
+                                capdiv2g = 0;
+                } else {
+                        return false;
+                }
+        }
+        REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                      AR_PHY_65NM_CH0_TXRF3_CAPDIV2G, capdiv2g);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP,
+                      quick_drop);
+        return true;
+}
 int ar9003_paprd_create_curve(struct ath_hw *ah,
                              struct ath9k_hw_cal_data *caldata, int chain)
 {
@@ -817,6 +917,9 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
        if (!create_pa_curve(data_L, data_U, pa_table, small_signal_gain))
                status = -2;
+        if (ar9003_paprd_retrain_pa_in(ah, caldata, chain))
+                status = -EINPROGRESS;
        REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
                    AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 7bfbaf065a43..84d3d4956861 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -625,6 +625,10 @@
 #define AR_PHY_AIC_CTRL_4_B0    (AR_SM_BASE + 0x4c0)
 #define AR_PHY_AIC_STAT_2_B0    (AR_SM_BASE + 0x4cc)
+#define AR_PHY_65NM_CH0_TXRF3       0x16048
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G          0x0000001e
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G_S        1
 #define AR_PHY_65NM_CH0_SYNTH4      0x1608c
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   (AR_SREV_9462(ah) ? 0x00000001 : 0x00000002)
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S (AR_SREV_9462(ah) ? 0 : 1)
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index bacdb8fb4ef4..9f83f71742a5 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -341,7 +341,8 @@ void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc)
 {
        struct ath_btcoex *btcoex = &sc->btcoex;
-        ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
+        if (btcoex->hw_timer_enabled)
+                ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
 }
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 60b6a9daff7e..48af40151d23 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -463,9 +463,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
                ah->config.spurchans[i][1] = AR_NO_SPUR;
        }
-        /* PAPRD needs some more work to be enabled */
-        ah->config.paprd_disable = 1;
        ah->config.rx_intr_mitigation = true;
        ah->config.pcieSerDesWrite = true;
@@ -978,9 +975,6 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
        else
                imr_reg |= AR_IMR_TXOK;
-        if (opmode == NL80211_IFTYPE_AP)
-                imr_reg |= AR_IMR_MIB;
        ENABLE_REGWRITE_BUFFER(ah);
        REG_WRITE(ah, AR_IMR, imr_reg);
@@ -1778,6 +1772,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                /* Operating channel changed, reset channel calibration data */
                memset(caldata, 0, sizeof(*caldata));
                ath9k_init_nfcal_hist_buffer(ah, chan);
+        } else if (caldata) {
+                caldata->paprd_packet_sent = false;
        }
        ah->noise = ath9k_hw_getchan_noise(ah, chan);
@@ -2502,7 +2498,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                pCap->tx_desc_len = sizeof(struct ar9003_txc);
                pCap->txs_len = sizeof(struct ar9003_txs);
                if (!ah->config.paprd_disable &&
-                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD) &&
+                    !AR_SREV_9462(ah))
                        pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
        } else {
                pCap->tx_desc_len = sizeof(struct ath_desc);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index ce7332c64efb..6599a75f01fe 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -405,6 +405,7 @@ struct ath9k_hw_cal_data {
        int8_t iCoff;
        int8_t qCoff;
        bool rtt_done;
+        bool paprd_packet_sent;
        bool paprd_done;
        bool nfcal_pending;
        bool nfcal_interference;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index d4549e9aac5c..825a29cc9313 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -254,8 +254,9 @@ void ath_paprd_calibrate(struct work_struct *work)
        int chain_ok = 0;
        int chain;
        int len = 1800;
+        int ret;
-        if (!caldata)
+        if (!caldata || !caldata->paprd_packet_sent || caldata->paprd_done)
                return;
        ath9k_ps_wakeup(sc);
@@ -282,13 +283,6 @@ void ath_paprd_calibrate(struct work_struct *work)
                        continue;
                chain_ok = 0;
-                ath_dbg(common, CALIBRATE,
-                        "Sending PAPRD frame for thermal measurement on chain %d\n",
-                        chain);
-                if (!ath_paprd_send_frame(sc, skb, chain))
-                        goto fail_paprd;
                ar9003_paprd_setup_gain_table(ah, chain);
                ath_dbg(common, CALIBRATE,
@@ -302,7 +296,13 @@ void ath_paprd_calibrate(struct work_struct *work)
                        break;
                }
-                if (ar9003_paprd_create_curve(ah, caldata, chain)) {
+                ret = ar9003_paprd_create_curve(ah, caldata, chain);
+                if (ret == -EINPROGRESS) {
+                        ath_dbg(common, CALIBRATE,
+                                "PAPRD curve on chain %d needs to be re-trained\n",
+                                chain);
+                        break;
+                } else if (ret) {
                        ath_dbg(common, CALIBRATE,
                                "PAPRD create curve failed on chain %d\n",
                                chain);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 7990cd55599c..b42be910a83d 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -773,15 +773,10 @@ bool ath9k_hw_intrpend(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_intrpend);
-void ath9k_hw_disable_interrupts(struct ath_hw *ah)
+void ath9k_hw_kill_interrupts(struct ath_hw *ah)
 {
        struct ath_common *common = ath9k_hw_common(ah);
-        if (!(ah->imask & ATH9K_INT_GLOBAL))
-                atomic_set(&ah->intr_ref_cnt, -1);
-        else
-                atomic_dec(&ah->intr_ref_cnt);
        ath_dbg(common, INTERRUPT, "disable IER\n");
        REG_WRITE(ah, AR_IER, AR_IER_DISABLE);
        (void) REG_READ(ah, AR_IER);
@@ -793,6 +788,17 @@ void ath9k_hw_disable_interrupts(struct ath_hw *ah)
                (void) REG_READ(ah, AR_INTR_SYNC_ENABLE);
        }
 }
+EXPORT_SYMBOL(ath9k_hw_kill_interrupts);
+void ath9k_hw_disable_interrupts(struct ath_hw *ah)
+{
+        if (!(ah->imask & ATH9K_INT_GLOBAL))
+                atomic_set(&ah->intr_ref_cnt, -1);
+        else
+                atomic_dec(&ah->intr_ref_cnt);
+        ath9k_hw_kill_interrupts(ah);
+}
 EXPORT_SYMBOL(ath9k_hw_disable_interrupts);
 void ath9k_hw_enable_interrupts(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 0eba36dca6f8..4a745e68dd94 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -738,6 +738,7 @@ bool ath9k_hw_intrpend(struct ath_hw *ah);
 void ath9k_hw_set_interrupts(struct ath_hw *ah);
 void ath9k_hw_enable_interrupts(struct ath_hw *ah);
 void ath9k_hw_disable_interrupts(struct ath_hw *ah);
+void ath9k_hw_kill_interrupts(struct ath_hw *ah);
 void ar9002_hw_attach_mac_ops(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6049d8b82855..a22df749b8db 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -462,8 +462,10 @@ irqreturn_t ath_isr(int irq, void *dev)
        if (!ath9k_hw_intrpend(ah))
                return IRQ_NONE;
-        if(test_bit(SC_OP_HW_RESET, &sc->sc_flags))
+        if (test_bit(SC_OP_HW_RESET, &sc->sc_flags)) {
+                ath9k_hw_kill_interrupts(ah);
                return IRQ_HANDLED;
+        }
        /*
         * Figure out the reason(s) for the interrupt.  Note
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index d455de9162ec..a978984d78a5 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -321,6 +321,7 @@ static int ath_pci_suspend(struct device *device)
         * Otherwise the chip never moved to full sleep,
         * when no interface is up.
         */
+        ath9k_stop_btcoex(sc);
        ath9k_hw_disable(sc->sc_ah);
        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 12aca02228c2..4480c0cc655f 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -1044,7 +1044,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
        struct ieee80211_hw *hw = sc->hw;
        struct ieee80211_hdr *hdr;
        int retval;
-        bool decrypt_error = false;
        struct ath_rx_status rs;
        enum ath9k_rx_qtype qtype;
        bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
@@ -1066,6 +1065,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
        tsf_lower = tsf & 0xffffffff;
        do {
+                bool decrypt_error = false;
                /* If handling rx interrupt and flush is in progress => exit */
                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
                        break;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 2c9da6b2ecb1..0d4155aec48d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2018,6 +2018,9 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
        ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
+        if (sc->sc_ah->caldata)
+                sc->sc_ah->caldata->paprd_packet_sent = true;
        if (!(tx_flags & ATH_TX_ERROR))
                /* Frame was ACKed */
                tx_info->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index a299d42da8e7..58f89fa9c9f8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -519,7 +519,7 @@ static void brcmf_usb_tx_complete(struct urb *urb)
        else
                devinfo->bus_pub.bus->dstats.tx_errors++;
-        dev_kfree_skb(req->skb);
+        brcmu_pkt_buf_free_skb(req->skb);
        req->skb = NULL;
        brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
@@ -540,7 +540,7 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                devinfo->bus_pub.bus->dstats.rx_packets++;
        } else {
                devinfo->bus_pub.bus->dstats.rx_errors++;
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
                brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                return;
        }
@@ -550,13 +550,15 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
                        brcmf_dbg(ERROR, "rx protocol error\n");
                        brcmu_pkt_buf_free_skb(skb);
+                        brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                        devinfo->bus_pub.bus->dstats.rx_errors++;
                } else {
                        brcmf_rx_packet(devinfo->dev, ifidx, skb);
                        brcmf_usb_rx_refill(devinfo, req);
                }
        } else {
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
+                brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
        }
        return;
@@ -581,14 +583,13 @@ static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
        usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
                          skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
                          req);
-        req->urb->transfer_flags |= URB_ZERO_PACKET;
        req->devinfo = devinfo;
+        brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
        ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (ret == 0) {
+        if (ret) {
-                brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
+                brcmf_usb_del_fromq(devinfo, req);
-        } else {
+                brcmu_pkt_buf_free_skb(req->skb);
-                dev_kfree_skb(req->skb);
                req->skb = NULL;
                brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
        }
@@ -683,23 +684,22 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
        req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq);
        if (!req) {
+                brcmu_pkt_buf_free_skb(skb);
                brcmf_dbg(ERROR, "no req to send\n");
                return -ENOMEM;
        }
-        if (!req->urb) {
-                brcmf_dbg(ERROR, "no urb for req %p\n", req);
-                return -ENOBUFS;
-        }
        req->skb = skb;
        req->devinfo = devinfo;
        usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
                          skb->data, skb->len, brcmf_usb_tx_complete, req);
        req->urb->transfer_flags |= URB_ZERO_PACKET;
+        brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
        ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (!ret) {
+        if (ret) {
-                brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
+                brcmf_dbg(ERROR, "brcmf_usb_tx usb_submit_urb FAILED\n");
-        } else {
+                brcmf_usb_del_fromq(devinfo, req);
+                brcmu_pkt_buf_free_skb(req->skb);
                req->skb = NULL;
                brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
        }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 28c5fbb4af26..c36e92312443 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1876,16 +1876,17 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
        }
        if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status)) {
-                scb_val.val = cpu_to_le32(0);
+                memset(&scb_val, 0, sizeof(scb_val));
                err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_RSSI, &scb_val,
                                      sizeof(struct brcmf_scb_val_le));
-                if (err)
+                if (err) {
                        WL_ERR("Could not get rssi (%d)\n", err);
+                } else {
-                rssi = le32_to_cpu(scb_val.val);
+                        rssi = le32_to_cpu(scb_val.val);
-                sinfo->filled |= STATION_INFO_SIGNAL;
+                        sinfo->filled |= STATION_INFO_SIGNAL;
-                sinfo->signal = rssi;
+                        sinfo->signal = rssi;
-                WL_CONN("RSSI %d dBm\n", rssi);
+                        WL_CONN("RSSI %d dBm\n", rssi);
+                }
        }
 done:
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 192ad5c1fcc8..a5edebeb0b4f 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -1233,6 +1233,9 @@ uint brcms_reset(struct brcms_info *wl)
        /* dpc will not be rescheduled */
        wl->resched = false;
+        /* inform publicly that interface is down */
+        wl->pub->up = false;
        return 0;
 }
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 95aa8e1683ec..83324b321652 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -2042,7 +2042,8 @@ static void isr_indicate_associated(struct ipw2100_priv *priv, u32 status)
                return;
        }
        len = ETH_ALEN;
-        ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID, &bssid, &len);
+        ret = ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID, bssid,
+                                  &len);
        if (ret) {
                IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
                               __LINE__);
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index 46782f1102ac..a47b306b522c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -124,6 +124,9 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
        const struct fw_img *img;
        size_t bufsz;
+        if (!iwl_is_ready_rf(priv))
+                return -EAGAIN;
        /* default is to dump the entire data segment */
        if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
                priv->dbgfs_sram_offset = 0x800000;
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index d9694c58208c..4ffc18dc3a57 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -350,7 +350,7 @@ int iwl_queue_space(const struct iwl_queue *q);
 /*****************************************************
 * Error handling
 ******************************************************/
-int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display);
+int iwl_dump_fh(struct iwl_trans *trans, char **buf);
 void iwl_dump_csr(struct iwl_trans *trans);
 /*****************************************************
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 39a6ca1f009c..d1a61ba6247a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -555,7 +555,7 @@ static void iwl_irq_handle_error(struct iwl_trans *trans)
        }
        iwl_dump_csr(trans);
-        iwl_dump_fh(trans, NULL, false);
+        iwl_dump_fh(trans, NULL);
        iwl_op_mode_nic_error(trans->op_mode);
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 939c2f78df58..1e86ea2266d4 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1649,13 +1649,9 @@ static const char *get_fh_string(int cmd)
 #undef IWL_CMD
 }
-int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
+int iwl_dump_fh(struct iwl_trans *trans, char **buf)
 {
        int i;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        int pos = 0;
-        size_t bufsz = 0;
-#endif
        static const u32 fh_tbl[] = {
                FH_RSCSR_CHNL0_STTS_WPTR_REG,
                FH_RSCSR_CHNL0_RBDCB_BASE_REG,
@@ -1667,29 +1663,35 @@ int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
                FH_TSSR_TX_STATUS_REG,
                FH_TSSR_TX_ERROR_REG
        };
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (display) {
+#ifdef CONFIG_IWLWIFI_DEBUGFS
-                bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+        if (buf) {
+                int pos = 0;
+                size_t bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
                *buf = kmalloc(bufsz, GFP_KERNEL);
                if (!*buf)
                        return -ENOMEM;
                pos += scnprintf(*buf + pos, bufsz - pos,
                                "FH register values:\n");
-                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++)
                        pos += scnprintf(*buf + pos, bufsz - pos,
                                "  %34s: 0X%08x\n",
                                get_fh_string(fh_tbl[i]),
                                iwl_read_direct32(trans, fh_tbl[i]));
-                }
                return pos;
        }
 #endif
        IWL_ERR(trans, "FH register values:\n");
-        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++)
                IWL_ERR(trans, "  %34s: 0X%08x\n",
                        get_fh_string(fh_tbl[i]),
                        iwl_read_direct32(trans, fh_tbl[i]));
-        }
        return 0;
 }
@@ -1982,11 +1984,11 @@ static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
                                     size_t count, loff_t *ppos)
 {
        struct iwl_trans *trans = file->private_data;
-        char *buf;
+        char *buf = NULL;
        int pos = 0;
        ssize_t ret = -EFAULT;
-        ret = pos = iwl_dump_fh(trans, &buf, true);
+        ret = pos = iwl_dump_fh(trans, &buf);
        if (buf) {
                ret = simple_read_from_buffer(user_buf,
                                              count, ppos, buf, pos);
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index e970897f6ab5..4cb234349fbf 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1326,6 +1326,11 @@ static int if_sdio_suspend(struct device *dev)
        mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
+        /* If we're powered off anyway, just let the mmc layer remove the
+         * card. */
+        if (!lbs_iface_active(card->priv))
+                return -ENOSYS;
        dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
                 sdio_func_id(func), flags);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index c68adec3cc8b..565527aee0ea 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -170,7 +170,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
        cmd_code = le16_to_cpu(host_cmd->command);
        cmd_size = le16_to_cpu(host_cmd->size);
-        skb_trim(cmd_node->cmd_skb, cmd_size);
+        /* Adjust skb length */
+        if (cmd_node->cmd_skb->len > cmd_size)
+                /*
+                 * cmd_size is less than sizeof(struct host_cmd_ds_command).
+                 * Trim off the unused portion.
+                 */
+                skb_trim(cmd_node->cmd_skb, cmd_size);
+        else if (cmd_node->cmd_skb->len < cmd_size)
+                /*
+                 * cmd_size is larger than sizeof(struct host_cmd_ds_command)
+                 * because we have appended custom IE TLV. Increase skb length
+                 * accordingly.
+                 */
+                skb_put(cmd_node->cmd_skb, cmd_size - cmd_node->cmd_skb->len);
        do_gettimeofday(&tstamp);
        dev_dbg(adapter->dev, "cmd: DNLD_CMD: (%lu.%lu): %#x, act %#x, len %d,"
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 7f207b6e9552..effb044a8a9d 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -42,7 +42,7 @@ MODULE_FIRMWARE("isl3887usb");
 * whenever you add a new device.
 */
-static struct usb_device_id p54u_table[] __devinitdata = {
+static struct usb_device_id p54u_table[] = {
        /* Version 1 devices (pci chip + net2280) */
        {USB_DEVICE(0x0411, 0x0050)},   /* Buffalo WLI2-USB2-G54 */
        {USB_DEVICE(0x045e, 0x00c2)},   /* Microsoft MN-710 */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 241162e8111d..7a4ae9ee1c63 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -1803,6 +1803,7 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
                                                struct cfg80211_pmksa *pmksa,
                                                int max_pmkids)
 {
+        struct ndis_80211_pmkid *new_pmkids;
        int i, err, newlen;
        unsigned int count;
@@ -1833,11 +1834,12 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
        /* add new pmkid */
        newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);
-        pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
+        new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
-        if (!pmkids) {
+        if (!new_pmkids) {
                err = -ENOMEM;
                goto error;
        }
+        pmkids = new_pmkids;
        pmkids->length = cpu_to_le32(newlen);
        pmkids->bssid_info_count = cpu_to_le32(count + 1);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 8b9dbd76a252..64328af496f5 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
+        u32 reg;
        /*
         * Allocate eeprom data.
@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                return retval;
        /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_BIT8, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+        /*
         * Initialize hw specifications.
         */
        retval = rt2400pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index d3a4a68cc439..7564ae992b73 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -670,6 +670,7 @@
 #define GPIOCSR_BIT5                    FIELD32(0x00000020)
 #define GPIOCSR_BIT6                    FIELD32(0x00000040)
 #define GPIOCSR_BIT7                    FIELD32(0x00000080)
+#define GPIOCSR_BIT8                    FIELD32(0x00000100)
 /*
 * BBPPCSR: BBP Pin control register.
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index d2cf8a4bc8b5..3de0406735f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
+        u32 reg;
        /*
         * Allocate eeprom data.
@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                return retval;
        /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+        /*
         * Initialize hw specifications.
         */
        retval = rt2500pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 3aae36bb0a9e..89fee311d8fd 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
        u16 reg;
        rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
-        return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
+        return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
 }
 #ifdef CONFIG_RT2X00_LIB_LEDS
@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
+        u16 reg;
        /*
         * Allocate eeprom data.
@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                return retval;
        /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
+        rt2x00_set_field16(&reg, MAC_CSR19_BIT8, 0);
+        rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
+        /*
         * Initialize hw specifications.
         */
        retval = rt2500usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index b493306a7eed..196bd5103e4f 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -189,14 +189,15 @@
 * MAC_CSR19: GPIO control register.
 */
 #define MAC_CSR19                       0x0426
-#define MAC_CSR19_BIT0                  FIELD32(0x0001)
+#define MAC_CSR19_BIT0                  FIELD16(0x0001)
-#define MAC_CSR19_BIT1                  FIELD32(0x0002)
+#define MAC_CSR19_BIT1                  FIELD16(0x0002)
-#define MAC_CSR19_BIT2                  FIELD32(0x0004)
+#define MAC_CSR19_BIT2                  FIELD16(0x0004)
-#define MAC_CSR19_BIT3                  FIELD32(0x0008)
+#define MAC_CSR19_BIT3                  FIELD16(0x0008)
-#define MAC_CSR19_BIT4                  FIELD32(0x0010)
+#define MAC_CSR19_BIT4                  FIELD16(0x0010)
-#define MAC_CSR19_BIT5                  FIELD32(0x0020)
+#define MAC_CSR19_BIT5                  FIELD16(0x0020)
-#define MAC_CSR19_BIT6                  FIELD32(0x0040)
+#define MAC_CSR19_BIT6                  FIELD16(0x0040)
-#define MAC_CSR19_BIT7                  FIELD32(0x0080)
+#define MAC_CSR19_BIT7                  FIELD16(0x0080)
+#define MAC_CSR19_BIT8                  FIELD16(0x0100)
 /*
 * MAC_CSR20: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index cb8c2aca54e4..b93516d832fb 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -4089,6 +4089,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
                msleep(1);
                rt2800_register_read(rt2x00dev, LDO_CFG0, &reg);
+                rt2x00_set_field32(&reg, LDO_CFG0_LDO_CORE_VLEVEL, 0);
                rt2x00_set_field32(&reg, LDO_CFG0_BGSEL, 1);
                rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
        }
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 98aa426a3564..4765bbd654cd 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -983,6 +983,7 @@ static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
+        u32 reg;
        /*
         * Allocate eeprom data.
@@ -996,6 +997,14 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                return retval;
        /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+        /*
         * Initialize hw specifications.
         */
        retval = rt2800_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 6cf336595e25..6b4226b71618 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
        skb_pull(entry->skb, RXINFO_DESC_SIZE);
        /*
-         * FIXME: we need to check for rx_pkt_len validity
+         * Check for rx_pkt_len validity. Return if invalid, leaving
+         * rxdesc->size zeroed out by the upper level.
         */
+        if (unlikely(rx_pkt_len == 0 ||
+                        rx_pkt_len > entry->queue->data_size)) {
+                ERROR(entry->queue->rt2x00dev,
+                        "Bad frame size %d, forcing to 0\n", rx_pkt_len);
+                return;
+        }
        rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
        /*
@@ -736,6 +744,7 @@ static int rt2800usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
+        u32 reg;
        /*
         * Allocate eeprom data.
@@ -749,6 +758,14 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                return retval;
        /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+        /*
         * Initialize hw specifications.
         */
        retval = rt2800_probe_hw_mode(rt2x00dev);
@@ -1157,6 +1174,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x1690, 0x0744) },
        { USB_DEVICE(0x1690, 0x0761) },
        { USB_DEVICE(0x1690, 0x0764) },
+        /* ASUS */
+        { USB_DEVICE(0x0b05, 0x179d) },
        /* Cisco */
        { USB_DEVICE(0x167b, 0x4001) },
        /* EnGenius */
@@ -1222,7 +1241,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x0b05, 0x1760) },
        { USB_DEVICE(0x0b05, 0x1761) },
        { USB_DEVICE(0x0b05, 0x1790) },
-        { USB_DEVICE(0x0b05, 0x179d) },
        /* AzureWave */
        { USB_DEVICE(0x13d3, 0x3262) },
        { USB_DEVICE(0x13d3, 0x3284) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index a6b88bd4a1a5..3f07e36f462b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -629,7 +629,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp)
         */
        if (unlikely(rxdesc.size == 0 ||
                     rxdesc.size > entry->queue->data_size)) {
-                WARNING(rt2x00dev, "Wrong frame size %d max %d.\n",
+                ERROR(rt2x00dev, "Wrong frame size %d max %d.\n",
                        rxdesc.size, entry->queue->data_size);
                dev_kfree_skb(entry->skb);
                goto renew_skb;
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 3f7bc5cadf9a..b8ec96163922 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2832,6 +2832,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
+        u32 reg;
        /*
         * Disable power saving.
@@ -2850,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                return retval;
        /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT13, 1);
+        rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
+        /*
         * Initialize hw specifications.
         */
        retval = rt61pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index e3cd6db76b0e..8f3da5a56766 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
 /*
 * MAC_CSR14: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index ba6e434b859d..248436c13ce0 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
+        u32 reg;
        /*
         * Allocate eeprom data.
@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                return retval;
        /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT15, 0);
+        rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
+        /*
         * Initialize hw specifications.
         */
        retval = rt73usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 9f6b470414d3..df1cc116b83b 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
+#define MAC_CSR13_BIT14                 FIELD32(0x00004000)
+#define MAC_CSR13_BIT15                 FIELD32(0x00008000)
 /*
 * MAC_CSR14: LED control register.
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 71a30b026089..533024095c43 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -44,7 +44,7 @@ MODULE_AUTHOR("Larry Finger <Larry.Finger@lwfinger.net>");
 MODULE_DESCRIPTION("RTL8187/RTL8187B USB wireless driver");
 MODULE_LICENSE("GPL");
-static struct usb_device_id rtl8187_table[] __devinitdata = {
+static struct usb_device_id rtl8187_table[] = {
        /* Asus */
        {USB_DEVICE(0x0b05, 0x171d), .driver_info = DEVICE_RTL8187},
        /* Belkin */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 30899901aef5..650f79a1f2bd 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -57,8 +57,7 @@
 static const struct ethtool_ops xennet_ethtool_ops;
 struct netfront_cb {
-        struct page *page;
+        int pull_to;
-        unsigned offset;
 };
 #define NETFRONT_SKB_CB(skb)    ((struct netfront_cb *)((skb)->cb))
@@ -867,15 +866,9 @@ static int handle_incoming_queue(struct net_device *dev,
        struct sk_buff *skb;
        while ((skb = __skb_dequeue(rxq)) != NULL) {
-                struct page *page = NETFRONT_SKB_CB(skb)->page;
+                int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
-                void *vaddr = page_address(page);
-                unsigned offset = NETFRONT_SKB_CB(skb)->offset;
-                memcpy(skb->data, vaddr + offset,
-                       skb_headlen(skb));
-                if (page != skb_frag_page(&skb_shinfo(skb)->frags[0]))
+                __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
-                        __free_page(page);
                /* Ethernet work: Delayed to here as it peeks the header. */
                skb->protocol = eth_type_trans(skb, dev);
@@ -913,7 +906,6 @@ static int xennet_poll(struct napi_struct *napi, int budget)
        struct sk_buff_head errq;
        struct sk_buff_head tmpq;
        unsigned long flags;
-        unsigned int len;
        int err;
        spin_lock(&np->rx_lock);
@@ -955,24 +947,13 @@ err:
                        }
                }
-                NETFRONT_SKB_CB(skb)->page =
+                NETFRONT_SKB_CB(skb)->pull_to = rx->status;
-                        skb_frag_page(&skb_shinfo(skb)->frags[0]);
+                if (NETFRONT_SKB_CB(skb)->pull_to > RX_COPY_THRESHOLD)
-                NETFRONT_SKB_CB(skb)->offset = rx->offset;
+                        NETFRONT_SKB_CB(skb)->pull_to = RX_COPY_THRESHOLD;
-                len = rx->status;
-                if (len > RX_COPY_THRESHOLD)
-                        len = RX_COPY_THRESHOLD;
-                skb_put(skb, len);
-                if (rx->status > len) {
+                skb_shinfo(skb)->frags[0].page_offset = rx->offset;
-                        skb_shinfo(skb)->frags[0].page_offset =
+                skb_frag_size_set(&skb_shinfo(skb)->frags[0], rx->status);
-                                rx->offset + len;
+                skb->data_len = rx->status;
-                        skb_frag_size_set(&skb_shinfo(skb)->frags[0], rx->status - len);
-                        skb->data_len = rx->status - len;
-                } else {
-                        __skb_fill_page_desc(skb, 0, NULL, 0, 0);
-                        skb_shinfo(skb)->nr_frags = 0;
-                }
                i = xennet_fill_frags(np, skb, &tmpq);
@@ -999,7 +980,7 @@ err:
                 * receive throughout using the standard receive
                 * buffer size was cut by 25%(!!!).
                 */
-                skb->truesize += skb->data_len - (RX_COPY_THRESHOLD - len);
+                skb->truesize += skb->data_len - RX_COPY_THRESHOLD;
                skb->len += skb->data_len;
                if (rx->flags & XEN_NETRXF_csum_blank)
diff --git a/drivers/of/base.c b/drivers/of/base.c
index c181b94abc36..d4a1c9a043e1 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -364,6 +364,33 @@ struct device_node *of_get_next_child(const struct device_node *node,
 EXPORT_SYMBOL(of_get_next_child);
 /**
+ *      of_get_next_available_child - Find the next available child node
+ *      @node:  parent node
+ *      @prev:  previous child of the parent node, or NULL to get first
+ *
+ *      This function is like of_get_next_child(), except that it
+ *      automatically skips any disabled nodes (i.e. status = "disabled").
+ */
+struct device_node *of_get_next_available_child(const struct device_node *node,
+        struct device_node *prev)
+{
+        struct device_node *next;
+        read_lock(&devtree_lock);
+        next = prev ? prev->sibling : node->child;
+        for (; next; next = next->sibling) {
+                if (!of_device_is_available(next))
+                        continue;
+                if (of_node_get(next))
+                        break;
+        }
+        of_node_put(prev);
+        read_unlock(&devtree_lock);
+        return next;
+}
+EXPORT_SYMBOL(of_get_next_available_child);
+/**
 *      of_find_node_by_path - Find a node matching a full OF path
 *      @path:  The full path to match
 *
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index fbf7b26c7c8a..c5792d622dc4 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -266,8 +266,8 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
        }
        if (!error)
-                dev_printk(KERN_INFO, &dev->dev,
+                dev_info(&dev->dev, "power state changed by ACPI to %s\n",
-                                "power state changed by ACPI to D%d\n", state);
+                         pci_power_name(state));
        return error;
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 185be3703343..d6fd6b6d9d4b 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -280,8 +280,12 @@ static long local_pci_probe(void *_ddi)
 {
        struct drv_dev_and_id *ddi = _ddi;
        struct device *dev = &ddi->dev->dev;
+        struct device *parent = dev->parent;
        int rc;
+        /* The parent bridge must be in active state when probing */
+        if (parent)
+                pm_runtime_get_sync(parent);
        /* Unbound PCI devices are always set to disabled and suspended.
         * During probe, the device is set to enabled and active and the
         * usage count is incremented.  If the driver supports runtime PM,
@@ -298,6 +302,8 @@ static long local_pci_probe(void *_ddi)
                pm_runtime_set_suspended(dev);
                pm_runtime_put_noidle(dev);
        }
+        if (parent)
+                pm_runtime_put(parent);
        return rc;
 }
@@ -959,6 +965,13 @@ static int pci_pm_poweroff_noirq(struct device *dev)
        if (!pci_dev->state_saved && !pci_is_bridge(pci_dev))
                pci_prepare_to_sleep(pci_dev);
+        /*
+         * The reason for doing this here is the same as for the analogous code
+         * in pci_pm_suspend_noirq().
+         */
+        if (pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)
+                pci_write_config_word(pci_dev, PCI_COMMAND, 0);
        return 0;
 }
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 6869009c7393..02d107b15281 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -458,6 +458,40 @@ boot_vga_show(struct device *dev, struct device_attribute *attr, char *buf)
 }
 struct device_attribute vga_attr = __ATTR_RO(boot_vga);
+static void
+pci_config_pm_runtime_get(struct pci_dev *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device *parent = dev->parent;
+        if (parent)
+                pm_runtime_get_sync(parent);
+        pm_runtime_get_noresume(dev);
+        /*
+         * pdev->current_state is set to PCI_D3cold during suspending,
+         * so wait until suspending completes
+         */
+        pm_runtime_barrier(dev);
+        /*
+         * Only need to resume devices in D3cold, because config
+         * registers are still accessible for devices suspended but
+         * not in D3cold.
+         */
+        if (pdev->current_state == PCI_D3cold)
+                pm_runtime_resume(dev);
+}
+static void
+pci_config_pm_runtime_put(struct pci_dev *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device *parent = dev->parent;
+        pm_runtime_put(dev);
+        if (parent)
+                pm_runtime_put_sync(parent);
+}
 static ssize_t
 pci_read_config(struct file *filp, struct kobject *kobj,
                struct bin_attribute *bin_attr,
@@ -484,6 +518,8 @@ pci_read_config(struct file *filp, struct kobject *kobj,
                size = count;
        }
+        pci_config_pm_runtime_get(dev);
        if ((off & 1) && size) {
                u8 val;
                pci_user_read_config_byte(dev, off, &val);
@@ -529,6 +565,8 @@ pci_read_config(struct file *filp, struct kobject *kobj,
                --size;
        }
+        pci_config_pm_runtime_put(dev);
        return count;
 }
@@ -549,6 +587,8 @@ pci_write_config(struct file* filp, struct kobject *kobj,
                count = size;
        }
        
+        pci_config_pm_runtime_get(dev);
        if ((off & 1) && size) {
                pci_user_write_config_byte(dev, off, data[off - init_off]);
                off++;
@@ -587,6 +627,8 @@ pci_write_config(struct file* filp, struct kobject *kobj,
                --size;
        }
+        pci_config_pm_runtime_put(dev);
        return count;
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index f3ea977a5b1b..ab4bf5a4c2f1 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1941,6 +1941,7 @@ void pci_pm_init(struct pci_dev *dev)
        dev->pm_cap = pm;
        dev->d3_delay = PCI_PM_D3_WAIT;
        dev->d3cold_delay = PCI_PM_D3COLD_WAIT;
+        dev->d3cold_allowed = true;
        dev->d1_support = false;
        dev->d2_support = false;
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 3a7eefcb270a..e76b44777dbf 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -140,9 +140,17 @@ static int pcie_port_runtime_resume(struct device *dev)
 {
        return 0;
 }
+static int pcie_port_runtime_idle(struct device *dev)
+{
+        /* Delay for a short while to prevent too frequent suspend/resume */
+        pm_schedule_suspend(dev, 10);
+        return -EBUSY;
+}
 #else
 #define pcie_port_runtime_suspend       NULL
 #define pcie_port_runtime_resume        NULL
+#define pcie_port_runtime_idle          NULL
 #endif
 static const struct dev_pm_ops pcie_portdrv_pm_ops = {
@@ -155,6 +163,7 @@ static const struct dev_pm_ops pcie_portdrv_pm_ops = {
        .resume_noirq   = pcie_port_resume_noirq,
        .runtime_suspend = pcie_port_runtime_suspend,
        .runtime_resume = pcie_port_runtime_resume,
+        .runtime_idle   = pcie_port_runtime_idle,
 };
 #define PCIE_PORTDRV_PM_OPS     (&pcie_portdrv_pm_ops)
@@ -200,6 +209,11 @@ static int __devinit pcie_portdrv_probe(struct pci_dev *dev,
                return status;
        pci_save_state(dev);
+        /*
+         * D3cold may not work properly on some PCIe port, so disable
+         * it by default.
+         */
+        dev->d3cold_allowed = false;
        if (!pci_match_id(port_runtime_pm_black_list, dev))
                pm_runtime_put_noidle(&dev->dev);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 6c143b4497ca..9f8a6b79a8ec 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -144,15 +144,13 @@ static inline unsigned long decode_bar(struct pci_dev *dev, u32 bar)
        case PCI_BASE_ADDRESS_MEM_TYPE_32:
                break;
        case PCI_BASE_ADDRESS_MEM_TYPE_1M:
-                dev_info(&dev->dev, "1M mem BAR treated as 32-bit BAR\n");
+                /* 1M mem BAR treated as 32-bit BAR */
                break;
        case PCI_BASE_ADDRESS_MEM_TYPE_64:
                flags |= IORESOURCE_MEM_64;
                break;
        default:
-                dev_warn(&dev->dev,
+                /* mem unknown type treated as 32-bit BAR */
-                         "mem unknown type %x treated as 32-bit BAR\n",
-                         mem_type);
                break;
        }
        return flags;
@@ -173,9 +171,11 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
        u32 l, sz, mask;
        u16 orig_cmd;
        struct pci_bus_region region;
+        bool bar_too_big = false, bar_disabled = false;
        mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
+        /* No printks while decoding is disabled! */
        if (!dev->mmio_always_on) {
                pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
                pci_write_config_word(dev, PCI_COMMAND,
@@ -240,8 +240,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                        goto fail;
                if ((sizeof(resource_size_t) < 8) && (sz64 > 0x100000000ULL)) {
-                        dev_err(&dev->dev, "reg %x: can't handle 64-bit BAR\n",
+                        bar_too_big = true;
-                                pos);
                        goto fail;
                }
@@ -252,12 +251,11 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                        region.start = 0;
                        region.end = sz64;
                        pcibios_bus_to_resource(dev, res, &region);
+                        bar_disabled = true;
                } else {
                        region.start = l64;
                        region.end = l64 + sz64;
                        pcibios_bus_to_resource(dev, res, &region);
-                        dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n",
-                                   pos, res);
                }
        } else {
                sz = pci_size(l, sz, mask);
@@ -268,18 +266,23 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                region.start = l;
                region.end = l + sz;
                pcibios_bus_to_resource(dev, res, &region);
-                dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
        }
- out:
+        goto out;
+fail:
+        res->flags = 0;
+out:
        if (!dev->mmio_always_on)
                pci_write_config_word(dev, PCI_COMMAND, orig_cmd);
+        if (bar_too_big)
+                dev_err(&dev->dev, "reg %x: can't handle 64-bit BAR\n", pos);
+        if (res->flags && !bar_disabled)
+                dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
        return (res->flags & IORESOURCE_MEM_64) ? 1 : 0;
- fail:
-        res->flags = 0;
-        goto out;
 }
 static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index fb7f3bebdc69..dc5c126e398a 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -657,11 +657,7 @@ static struct pinctrl *pinctrl_get_locked(struct device *dev)
        if (p != NULL)
                return ERR_PTR(-EBUSY);
-        p = create_pinctrl(dev);
+        return create_pinctrl(dev);
-        if (IS_ERR(p))
-                return p;
-        return p;
 }
 /**
@@ -738,11 +734,8 @@ static struct pinctrl_state *pinctrl_lookup_state_locked(struct pinctrl *p,
                        dev_dbg(p->dev, "using pinctrl dummy state (%s)\n",
                                name);
                        state = create_state(p, name);
-                        if (IS_ERR(state))
+                } else
-                                return state;
+                        state = ERR_PTR(-ENODEV);
-                } else {
-                        return ERR_PTR(-ENODEV);
-                }
        }
        return state;
diff --git a/drivers/pinctrl/pinctrl-imx51.c b/drivers/pinctrl/pinctrl-imx51.c
index 689b3c88dd2e..9fd02162a3c2 100644
--- a/drivers/pinctrl/pinctrl-imx51.c
+++ b/drivers/pinctrl/pinctrl-imx51.c
@@ -974,7 +974,7 @@ static struct imx_pin_reg imx51_pin_regs[] = {
        IMX_PIN_REG(MX51_PAD_EIM_DA13, NO_PAD, 0x050, 0, 0x000, 0), /* MX51_PAD_EIM_DA13__EIM_DA13 */
        IMX_PIN_REG(MX51_PAD_EIM_DA14, NO_PAD, 0x054, 0, 0x000, 0), /* MX51_PAD_EIM_DA14__EIM_DA14 */
        IMX_PIN_REG(MX51_PAD_EIM_DA15, NO_PAD, 0x058, 0, 0x000, 0), /* MX51_PAD_EIM_DA15__EIM_DA15 */
-        IMX_PIN_REG(MX51_PAD_SD2_CMD, NO_PAD, 0x3b4, 2, 0x91c, 3), /* MX51_PAD_SD2_CMD__CSPI_MOSI */
+        IMX_PIN_REG(MX51_PAD_SD2_CMD, 0x7bc, 0x3b4, 2, 0x91c, 3), /* MX51_PAD_SD2_CMD__CSPI_MOSI */
        IMX_PIN_REG(MX51_PAD_SD2_CMD, 0x7bc, 0x3b4, 1, 0x9b0, 2), /* MX51_PAD_SD2_CMD__I2C1_SCL */
        IMX_PIN_REG(MX51_PAD_SD2_CMD, 0x7bc, 0x3b4, 0, 0x000, 0), /* MX51_PAD_SD2_CMD__SD2_CMD */
        IMX_PIN_REG(MX51_PAD_SD2_CLK, 0x7c0, 0x3b8, 2, 0x914, 3), /* MX51_PAD_SD2_CLK__CSPI_SCLK */
diff --git a/drivers/pinctrl/pinctrl-nomadik-db8500.c b/drivers/pinctrl/pinctrl-nomadik-db8500.c
index 5f3e9d0221e1..a39fb7a6fc51 100644
--- a/drivers/pinctrl/pinctrl-nomadik-db8500.c
+++ b/drivers/pinctrl/pinctrl-nomadik-db8500.c
@@ -505,6 +505,8 @@ static const unsigned kp_b_1_pins[] = { DB8500_PIN_F3, DB8500_PIN_F1,
        DB8500_PIN_J3, DB8500_PIN_H2, DB8500_PIN_J2, DB8500_PIN_H1,
        DB8500_PIN_F4, DB8500_PIN_E3, DB8500_PIN_E4, DB8500_PIN_D2,
        DB8500_PIN_C1, DB8500_PIN_D3, DB8500_PIN_C2, DB8500_PIN_D5 };
+static const unsigned kp_b_2_pins[] = { DB8500_PIN_F3, DB8500_PIN_F1,
+        DB8500_PIN_G3, DB8500_PIN_G2, DB8500_PIN_F4, DB8500_PIN_E3};
 static const unsigned sm_b_1_pins[] = { DB8500_PIN_C6, DB8500_PIN_B3,
        DB8500_PIN_C4, DB8500_PIN_E6, DB8500_PIN_A3, DB8500_PIN_B6,
        DB8500_PIN_D6, DB8500_PIN_B7, DB8500_PIN_D7, DB8500_PIN_D8,
@@ -662,6 +664,7 @@ static const struct nmk_pingroup nmk_db8500_groups[] = {
        DB8500_PIN_GROUP(spi3_b_1, NMK_GPIO_ALT_B),
        DB8500_PIN_GROUP(msp1txrx_b_1, NMK_GPIO_ALT_B),
        DB8500_PIN_GROUP(kp_b_1, NMK_GPIO_ALT_B),
+        DB8500_PIN_GROUP(kp_b_2, NMK_GPIO_ALT_B),
        DB8500_PIN_GROUP(sm_b_1, NMK_GPIO_ALT_B),
        DB8500_PIN_GROUP(smcs0_b_1, NMK_GPIO_ALT_B),
        DB8500_PIN_GROUP(smcs1_b_1, NMK_GPIO_ALT_B),
@@ -751,7 +754,7 @@ DB8500_FUNC_GROUPS(msp1, "msp1txrx_a_1", "msp1_a_1", "msp1txrx_b_1");
 DB8500_FUNC_GROUPS(lcdb, "lcdb_a_1");
 DB8500_FUNC_GROUPS(lcd, "lcdvsi0_a_1", "lcdvsi1_a_1", "lcd_d0_d7_a_1",
        "lcd_d8_d11_a_1", "lcd_d12_d23_a_1", "lcd_b_1");
-DB8500_FUNC_GROUPS(kp, "kp_a_1", "kp_b_1", "kp_c_1", "kp_oc1_1");
+DB8500_FUNC_GROUPS(kp, "kp_a_1", "kp_b_1", "kp_b_2", "kp_c_1", "kp_oc1_1");
 DB8500_FUNC_GROUPS(mc2, "mc2_a_1", "mc2rstn_c_1");
 DB8500_FUNC_GROUPS(ssp1, "ssp1_a_1");
 DB8500_FUNC_GROUPS(ssp0, "ssp0_a_1");
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index ec6ac501b23a..3dde6537adb8 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -1292,7 +1292,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
                                                NOMADIK_GPIO_TO_IRQ(pdata->first_gpio),
                                                0, &nmk_gpio_irq_simple_ops, nmk_chip);
        if (!nmk_chip->domain) {
-                pr_err("%s: Failed to create irqdomain\n", np->full_name);
+                dev_err(&dev->dev, "failed to create irqdomain\n");
                ret = -ENOSYS;
                goto out;
        }
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 2a262f5c5c0c..c86bae828c28 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -289,6 +289,7 @@ config IDEAPAD_LAPTOP
        tristate "Lenovo IdeaPad Laptop Extras"
        depends on ACPI
        depends on RFKILL && INPUT
+        depends on SERIO_I8042
        select INPUT_SPARSEKMAP
        help
          This is a driver for the rfkill switches on Lenovo IdeaPad netbooks.
@@ -758,8 +759,11 @@ config SAMSUNG_Q10
 config APPLE_GMUX
        tristate "Apple Gmux Driver"
+        depends on ACPI
        depends on PNP
-        select BACKLIGHT_CLASS_DEVICE
+        depends on BACKLIGHT_CLASS_DEVICE
+        depends on BACKLIGHT_APPLE=n || BACKLIGHT_APPLE
+        depends on ACPI_VIDEO=n || ACPI_VIDEO
        ---help---
          This driver provides support for the gmux device found on many
          Apple laptops, which controls the display mux for the hybrid
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 3782e1cd3697..934d861a3235 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -2196,10 +2196,8 @@ static int __init acer_wmi_init(void)
                interface->capability &= ~ACER_CAP_BRIGHTNESS;
                pr_info("Brightness must be controlled by acpi video driver\n");
        } else {
-#ifdef CONFIG_ACPI_VIDEO
                pr_info("Disabling ACPI video driver\n");
                acpi_video_unregister();
-#endif
        }
        if (wmi_has_guid(WMID_GUID3)) {
diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c
index 905fa01ac8df..db8f63841b42 100644
--- a/drivers/platform/x86/apple-gmux.c
+++ b/drivers/platform/x86/apple-gmux.c
@@ -2,6 +2,7 @@
 *  Gmux driver for Apple laptops
 *
 *  Copyright (C) Canonical Ltd. <seth.forshee@canonical.com>
+ *  Copyright (C) 2010-2012 Andreas Heider <andreas@meetr.de>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
@@ -18,16 +19,30 @@
 #include <linux/pnp.h>
 #include <linux/apple_bl.h>
 #include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/vga_switcheroo.h>
 #include <acpi/video.h>
 #include <asm/io.h>
 struct apple_gmux_data {
        unsigned long iostart;
        unsigned long iolen;
+        bool indexed;
+        struct mutex index_lock;
        struct backlight_device *bdev;
+        /* switcheroo data */
+        acpi_handle dhandle;
+        int gpe;
+        enum vga_switcheroo_client_id resume_client_id;
+        enum vga_switcheroo_state power_state;
+        struct completion powerchange_done;
 };
+static struct apple_gmux_data *apple_gmux_data;
 /*
 * gmux port offsets. Many of these are not yet used, but may be in the
 * future, and it's useful to have them documented here anyhow.
@@ -45,6 +60,9 @@ struct apple_gmux_data {
 #define GMUX_PORT_DISCRETE_POWER        0x50
 #define GMUX_PORT_MAX_BRIGHTNESS        0x70
 #define GMUX_PORT_BRIGHTNESS            0x74
+#define GMUX_PORT_VALUE                 0xc2
+#define GMUX_PORT_READ                  0xd0
+#define GMUX_PORT_WRITE                 0xd4
 #define GMUX_MIN_IO_LEN                 (GMUX_PORT_BRIGHTNESS + 4)
@@ -59,22 +77,174 @@ struct apple_gmux_data {
 #define GMUX_BRIGHTNESS_MASK            0x00ffffff
 #define GMUX_MAX_BRIGHTNESS             GMUX_BRIGHTNESS_MASK
-static inline u8 gmux_read8(struct apple_gmux_data *gmux_data, int port)
+static u8 gmux_pio_read8(struct apple_gmux_data *gmux_data, int port)
 {
        return inb(gmux_data->iostart + port);
 }
-static inline void gmux_write8(struct apple_gmux_data *gmux_data, int port,
+static void gmux_pio_write8(struct apple_gmux_data *gmux_data, int port,
                               u8 val)
 {
        outb(val, gmux_data->iostart + port);
 }
-static inline u32 gmux_read32(struct apple_gmux_data *gmux_data, int port)
+static u32 gmux_pio_read32(struct apple_gmux_data *gmux_data, int port)
 {
        return inl(gmux_data->iostart + port);
 }
+static void gmux_pio_write32(struct apple_gmux_data *gmux_data, int port,
+                             u32 val)
+{
+        int i;
+        u8 tmpval;
+        for (i = 0; i < 4; i++) {
+                tmpval = (val >> (i * 8)) & 0xff;
+                outb(tmpval, gmux_data->iostart + port + i);
+        }
+}
+static int gmux_index_wait_ready(struct apple_gmux_data *gmux_data)
+{
+        int i = 200;
+        u8 gwr = inb(gmux_data->iostart + GMUX_PORT_WRITE);
+        while (i && (gwr & 0x01)) {
+                inb(gmux_data->iostart + GMUX_PORT_READ);
+                gwr = inb(gmux_data->iostart + GMUX_PORT_WRITE);
+                udelay(100);
+                i--;
+        }
+        return !!i;
+}
+static int gmux_index_wait_complete(struct apple_gmux_data *gmux_data)
+{
+        int i = 200;
+        u8 gwr = inb(gmux_data->iostart + GMUX_PORT_WRITE);
+        while (i && !(gwr & 0x01)) {
+                gwr = inb(gmux_data->iostart + GMUX_PORT_WRITE);
+                udelay(100);
+                i--;
+        }
+        if (gwr & 0x01)
+                inb(gmux_data->iostart + GMUX_PORT_READ);
+        return !!i;
+}
+static u8 gmux_index_read8(struct apple_gmux_data *gmux_data, int port)
+{
+        u8 val;
+        mutex_lock(&gmux_data->index_lock);
+        gmux_index_wait_ready(gmux_data);
+        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
+        gmux_index_wait_complete(gmux_data);
+        val = inb(gmux_data->iostart + GMUX_PORT_VALUE);
+        mutex_unlock(&gmux_data->index_lock);
+        return val;
+}
+static void gmux_index_write8(struct apple_gmux_data *gmux_data, int port,
+                              u8 val)
+{
+        mutex_lock(&gmux_data->index_lock);
+        outb(val, gmux_data->iostart + GMUX_PORT_VALUE);
+        gmux_index_wait_ready(gmux_data);
+        outb(port & 0xff, gmux_data->iostart + GMUX_PORT_WRITE);
+        gmux_index_wait_complete(gmux_data);
+        mutex_unlock(&gmux_data->index_lock);
+}
+static u32 gmux_index_read32(struct apple_gmux_data *gmux_data, int port)
+{
+        u32 val;
+        mutex_lock(&gmux_data->index_lock);
+        gmux_index_wait_ready(gmux_data);
+        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
+        gmux_index_wait_complete(gmux_data);
+        val = inl(gmux_data->iostart + GMUX_PORT_VALUE);
+        mutex_unlock(&gmux_data->index_lock);
+        return val;
+}
+static void gmux_index_write32(struct apple_gmux_data *gmux_data, int port,
+                               u32 val)
+{
+        int i;
+        u8 tmpval;
+        mutex_lock(&gmux_data->index_lock);
+        for (i = 0; i < 4; i++) {
+                tmpval = (val >> (i * 8)) & 0xff;
+                outb(tmpval, gmux_data->iostart + GMUX_PORT_VALUE + i);
+        }
+        gmux_index_wait_ready(gmux_data);
+        outb(port & 0xff, gmux_data->iostart + GMUX_PORT_WRITE);
+        gmux_index_wait_complete(gmux_data);
+        mutex_unlock(&gmux_data->index_lock);
+}
+static u8 gmux_read8(struct apple_gmux_data *gmux_data, int port)
+{
+        if (gmux_data->indexed)
+                return gmux_index_read8(gmux_data, port);
+        else
+                return gmux_pio_read8(gmux_data, port);
+}
+static void gmux_write8(struct apple_gmux_data *gmux_data, int port, u8 val)
+{
+        if (gmux_data->indexed)
+                gmux_index_write8(gmux_data, port, val);
+        else
+                gmux_pio_write8(gmux_data, port, val);
+}
+static u32 gmux_read32(struct apple_gmux_data *gmux_data, int port)
+{
+        if (gmux_data->indexed)
+                return gmux_index_read32(gmux_data, port);
+        else
+                return gmux_pio_read32(gmux_data, port);
+}
+static void gmux_write32(struct apple_gmux_data *gmux_data, int port,
+                             u32 val)
+{
+        if (gmux_data->indexed)
+                gmux_index_write32(gmux_data, port, val);
+        else
+                gmux_pio_write32(gmux_data, port, val);
+}
+static bool gmux_is_indexed(struct apple_gmux_data *gmux_data)
+{
+        u16 val;
+        outb(0xaa, gmux_data->iostart + 0xcc);
+        outb(0x55, gmux_data->iostart + 0xcd);
+        outb(0x00, gmux_data->iostart + 0xce);
+        val = inb(gmux_data->iostart + 0xcc) |
+                (inb(gmux_data->iostart + 0xcd) << 8);
+        if (val == 0x55aa)
+                return true;
+        return false;
+}
 static int gmux_get_brightness(struct backlight_device *bd)
 {
        struct apple_gmux_data *gmux_data = bl_get_data(bd);
@@ -90,16 +260,7 @@ static int gmux_update_status(struct backlight_device *bd)
        if (bd->props.state & BL_CORE_SUSPENDED)
                return 0;
-        /*
+        gmux_write32(gmux_data, GMUX_PORT_BRIGHTNESS, brightness);
-         * Older gmux versions require writing out lower bytes first then
-         * setting the upper byte to 0 to flush the values. Newer versions
-         * accept a single u32 write, but the old method also works, so we
-         * just use the old method for all gmux versions.
-         */
-        gmux_write8(gmux_data, GMUX_PORT_BRIGHTNESS, brightness);
-        gmux_write8(gmux_data, GMUX_PORT_BRIGHTNESS + 1, brightness >> 8);
-        gmux_write8(gmux_data, GMUX_PORT_BRIGHTNESS + 2, brightness >> 16);
-        gmux_write8(gmux_data, GMUX_PORT_BRIGHTNESS + 3, 0);
        return 0;
 }
@@ -110,6 +271,146 @@ static const struct backlight_ops gmux_bl_ops = {
        .update_status = gmux_update_status,
 };
+static int gmux_switchto(enum vga_switcheroo_client_id id)
+{
+        if (id == VGA_SWITCHEROO_IGD) {
+                gmux_write8(apple_gmux_data, GMUX_PORT_SWITCH_DDC, 1);
+                gmux_write8(apple_gmux_data, GMUX_PORT_SWITCH_DISPLAY, 2);
+                gmux_write8(apple_gmux_data, GMUX_PORT_SWITCH_EXTERNAL, 2);
+        } else {
+                gmux_write8(apple_gmux_data, GMUX_PORT_SWITCH_DDC, 2);
+                gmux_write8(apple_gmux_data, GMUX_PORT_SWITCH_DISPLAY, 3);
+                gmux_write8(apple_gmux_data, GMUX_PORT_SWITCH_EXTERNAL, 3);
+        }
+        return 0;
+}
+static int gmux_set_discrete_state(struct apple_gmux_data *gmux_data,
+                                   enum vga_switcheroo_state state)
+{
+        INIT_COMPLETION(gmux_data->powerchange_done);
+        if (state == VGA_SWITCHEROO_ON) {
+                gmux_write8(gmux_data, GMUX_PORT_DISCRETE_POWER, 1);
+                gmux_write8(gmux_data, GMUX_PORT_DISCRETE_POWER, 3);
+                pr_debug("Discrete card powered up\n");
+        } else {
+                gmux_write8(gmux_data, GMUX_PORT_DISCRETE_POWER, 1);
+                gmux_write8(gmux_data, GMUX_PORT_DISCRETE_POWER, 0);
+                pr_debug("Discrete card powered down\n");
+        }
+        gmux_data->power_state = state;
+        if (gmux_data->gpe >= 0 &&
+            !wait_for_completion_interruptible_timeout(&gmux_data->powerchange_done,
+                                                       msecs_to_jiffies(200)))
+                pr_warn("Timeout waiting for gmux switch to complete\n");
+        return 0;
+}
+static int gmux_set_power_state(enum vga_switcheroo_client_id id,
+                                enum vga_switcheroo_state state)
+{
+        if (id == VGA_SWITCHEROO_IGD)
+                return 0;
+        return gmux_set_discrete_state(apple_gmux_data, state);
+}
+static int gmux_get_client_id(struct pci_dev *pdev)
+{
+        /*
+         * Early Macbook Pros with switchable graphics use nvidia
+         * integrated graphics. Hardcode that the 9400M is integrated.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL)
+                return VGA_SWITCHEROO_IGD;
+        else if (pdev->vendor == PCI_VENDOR_ID_NVIDIA &&
+                 pdev->device == 0x0863)
+                return VGA_SWITCHEROO_IGD;
+        else
+                return VGA_SWITCHEROO_DIS;
+}
+static enum vga_switcheroo_client_id
+gmux_active_client(struct apple_gmux_data *gmux_data)
+{
+        if (gmux_read8(gmux_data, GMUX_PORT_SWITCH_DISPLAY) == 2)
+                return VGA_SWITCHEROO_IGD;
+        return VGA_SWITCHEROO_DIS;
+}
+static struct vga_switcheroo_handler gmux_handler = {
+        .switchto = gmux_switchto,
+        .power_state = gmux_set_power_state,
+        .get_client_id = gmux_get_client_id,
+};
+static inline void gmux_disable_interrupts(struct apple_gmux_data *gmux_data)
+{
+        gmux_write8(gmux_data, GMUX_PORT_INTERRUPT_ENABLE,
+                    GMUX_INTERRUPT_DISABLE);
+}
+static inline void gmux_enable_interrupts(struct apple_gmux_data *gmux_data)
+{
+        gmux_write8(gmux_data, GMUX_PORT_INTERRUPT_ENABLE,
+                    GMUX_INTERRUPT_ENABLE);
+}
+static inline u8 gmux_interrupt_get_status(struct apple_gmux_data *gmux_data)
+{
+        return gmux_read8(gmux_data, GMUX_PORT_INTERRUPT_STATUS);
+}
+static void gmux_clear_interrupts(struct apple_gmux_data *gmux_data)
+{
+        u8 status;
+        /* to clear interrupts write back current status */
+        status = gmux_interrupt_get_status(gmux_data);
+        gmux_write8(gmux_data, GMUX_PORT_INTERRUPT_STATUS, status);
+}
+static void gmux_notify_handler(acpi_handle device, u32 value, void *context)
+{
+        u8 status;
+        struct pnp_dev *pnp = (struct pnp_dev *)context;
+        struct apple_gmux_data *gmux_data = pnp_get_drvdata(pnp);
+        status = gmux_interrupt_get_status(gmux_data);
+        gmux_disable_interrupts(gmux_data);
+        pr_debug("Notify handler called: status %d\n", status);
+        gmux_clear_interrupts(gmux_data);
+        gmux_enable_interrupts(gmux_data);
+        if (status & GMUX_INTERRUPT_STATUS_POWER)
+                complete(&gmux_data->powerchange_done);
+}
+static int gmux_suspend(struct pnp_dev *pnp, pm_message_t state)
+{
+        struct apple_gmux_data *gmux_data = pnp_get_drvdata(pnp);
+        gmux_data->resume_client_id = gmux_active_client(gmux_data);
+        gmux_disable_interrupts(gmux_data);
+        return 0;
+}
+static int gmux_resume(struct pnp_dev *pnp)
+{
+        struct apple_gmux_data *gmux_data = pnp_get_drvdata(pnp);
+        gmux_enable_interrupts(gmux_data);
+        gmux_switchto(gmux_data->resume_client_id);
+        if (gmux_data->power_state == VGA_SWITCHEROO_OFF)
+                gmux_set_discrete_state(gmux_data, gmux_data->power_state);
+        return 0;
+}
 static int __devinit gmux_probe(struct pnp_dev *pnp,
                                const struct pnp_device_id *id)
 {
@@ -119,6 +420,11 @@ static int __devinit gmux_probe(struct pnp_dev *pnp,
        struct backlight_device *bdev;
        u8 ver_major, ver_minor, ver_release;
        int ret = -ENXIO;
+        acpi_status status;
+        unsigned long long gpe;
+        if (apple_gmux_data)
+                return -EBUSY;
        gmux_data = kzalloc(sizeof(*gmux_data), GFP_KERNEL);
        if (!gmux_data)
@@ -147,21 +453,32 @@ static int __devinit gmux_probe(struct pnp_dev *pnp,
        }
        /*
-         * On some machines the gmux is in ACPI even thought the machine
+         * Invalid version information may indicate either that the gmux
-         * doesn't really have a gmux. Check for invalid version information
+         * device isn't present or that it's a new one that uses indexed
-         * to detect this.
+         * io
         */
        ver_major = gmux_read8(gmux_data, GMUX_PORT_VERSION_MAJOR);
        ver_minor = gmux_read8(gmux_data, GMUX_PORT_VERSION_MINOR);
        ver_release = gmux_read8(gmux_data, GMUX_PORT_VERSION_RELEASE);
        if (ver_major == 0xff && ver_minor == 0xff && ver_release == 0xff) {
-                pr_info("gmux device not present\n");
+                if (gmux_is_indexed(gmux_data)) {
-                ret = -ENODEV;
+                        u32 version;
-                goto err_release;
+                        mutex_init(&gmux_data->index_lock);
+                        gmux_data->indexed = true;
+                        version = gmux_read32(gmux_data,
+                                GMUX_PORT_VERSION_MAJOR);
+                        ver_major = (version >> 24) & 0xff;
+                        ver_minor = (version >> 16) & 0xff;
+                        ver_release = (version >> 8) & 0xff;
+                } else {
+                        pr_info("gmux device not present\n");
+                        ret = -ENODEV;
+                        goto err_release;
+                }
        }
+        pr_info("Found gmux version %d.%d.%d [%s]\n", ver_major, ver_minor,
-        pr_info("Found gmux version %d.%d.%d\n", ver_major, ver_minor,
+                ver_release, (gmux_data->indexed ? "indexed" : "classic"));
-                ver_release);
        memset(&props, 0, sizeof(props));
        props.type = BACKLIGHT_PLATFORM;
@@ -194,13 +511,65 @@ static int __devinit gmux_probe(struct pnp_dev *pnp,
         * Disable the other backlight choices.
         */
        acpi_video_dmi_promote_vendor();
-#ifdef CONFIG_ACPI_VIDEO
        acpi_video_unregister();
-#endif
        apple_bl_unregister();
+        gmux_data->power_state = VGA_SWITCHEROO_ON;
+        gmux_data->dhandle = DEVICE_ACPI_HANDLE(&pnp->dev);
+        if (!gmux_data->dhandle) {
+                pr_err("Cannot find acpi handle for pnp device %s\n",
+                       dev_name(&pnp->dev));
+                ret = -ENODEV;
+                goto err_notify;
+        }
+        status = acpi_evaluate_integer(gmux_data->dhandle, "GMGP", NULL, &gpe);
+        if (ACPI_SUCCESS(status)) {
+                gmux_data->gpe = (int)gpe;
+                status = acpi_install_notify_handler(gmux_data->dhandle,
+                                                     ACPI_DEVICE_NOTIFY,
+                                                     &gmux_notify_handler, pnp);
+                if (ACPI_FAILURE(status)) {
+                        pr_err("Install notify handler failed: %s\n",
+                               acpi_format_exception(status));
+                        ret = -ENODEV;
+                        goto err_notify;
+                }
+                status = acpi_enable_gpe(NULL, gmux_data->gpe);
+                if (ACPI_FAILURE(status)) {
+                        pr_err("Cannot enable gpe: %s\n",
+                               acpi_format_exception(status));
+                        goto err_enable_gpe;
+                }
+        } else {
+                pr_warn("No GPE found for gmux\n");
+                gmux_data->gpe = -1;
+        }
+        if (vga_switcheroo_register_handler(&gmux_handler)) {
+                ret = -ENODEV;
+                goto err_register_handler;
+        }
+        init_completion(&gmux_data->powerchange_done);
+        apple_gmux_data = gmux_data;
+        gmux_enable_interrupts(gmux_data);
        return 0;
+err_register_handler:
+        if (gmux_data->gpe >= 0)
+                acpi_disable_gpe(NULL, gmux_data->gpe);
+err_enable_gpe:
+        if (gmux_data->gpe >= 0)
+                acpi_remove_notify_handler(gmux_data->dhandle,
+                                           ACPI_DEVICE_NOTIFY,
+                                           &gmux_notify_handler);
+err_notify:
+        backlight_device_unregister(bdev);
 err_release:
        release_region(gmux_data->iostart, gmux_data->iolen);
 err_free:
@@ -212,14 +581,23 @@ static void __devexit gmux_remove(struct pnp_dev *pnp)
 {
        struct apple_gmux_data *gmux_data = pnp_get_drvdata(pnp);
+        vga_switcheroo_unregister_handler();
+        gmux_disable_interrupts(gmux_data);
+        if (gmux_data->gpe >= 0) {
+                acpi_disable_gpe(NULL, gmux_data->gpe);
+                acpi_remove_notify_handler(gmux_data->dhandle,
+                                           ACPI_DEVICE_NOTIFY,
+                                           &gmux_notify_handler);
+        }
        backlight_device_unregister(gmux_data->bdev);
        release_region(gmux_data->iostart, gmux_data->iolen);
+        apple_gmux_data = NULL;
        kfree(gmux_data);
        acpi_video_dmi_demote_vendor();
-#ifdef CONFIG_ACPI_VIDEO
        acpi_video_register();
-#endif
        apple_bl_register();
 }
@@ -233,6 +611,8 @@ static struct pnp_driver gmux_pnp_driver = {
        .probe          = gmux_probe,
        .remove         = __devexit_p(gmux_remove),
        .id_table       = gmux_device_ids,
+        .suspend        = gmux_suspend,
+        .resume         = gmux_resume
 };
 static int __init apple_gmux_init(void)
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index e38f91be0b10..4b568df56643 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -85,7 +85,7 @@ static char *wled_type = "unknown";
 static char *bled_type = "unknown";
 module_param(wled_type, charp, 0444);
-MODULE_PARM_DESC(wlan_status, "Set the wled type on boot "
+MODULE_PARM_DESC(wled_type, "Set the wled type on boot "
                 "(unknown, led or rfkill). "
                 "default is unknown");
@@ -863,9 +863,9 @@ static ssize_t show_infos(struct device *dev,
         * The significance of others is yet to be found.
         * If we don't find the method, we assume the device are present.
         */
-        rv = acpi_evaluate_integer(asus->handle, "HRWS", NULL, &temp);
+        rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
        if (!ACPI_FAILURE(rv))
-                len += sprintf(page + len, "HRWS value         : %#x\n",
+                len += sprintf(page + len, "HWRS value         : %#x\n",
                               (uint) temp);
        /*
         * Another value for userspace: the ASYM method returns 0x02 for
@@ -1751,9 +1751,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
         * The significance of others is yet to be found.
         */
        status =
-            acpi_evaluate_integer(asus->handle, "HRWS", NULL, &hwrs_result);
+            acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
        if (!ACPI_FAILURE(status))
-                pr_notice("  HRWS returned %x", (int)hwrs_result);
+                pr_notice("  HWRS returned %x", (int)hwrs_result);
        if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
                asus->have_rsts = true;
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index c7a36f6b0580..c0e9ff489b24 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -47,9 +47,7 @@
 #include <linux/thermal.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
-#ifdef CONFIG_ACPI_VIDEO
 #include <acpi/video.h>
-#endif
 #include "asus-wmi.h"
@@ -101,6 +99,7 @@ MODULE_LICENSE("GPL");
 #define ASUS_WMI_DEVID_WIRELESS_LED     0x00010002
 #define ASUS_WMI_DEVID_CWAP             0x00010003
 #define ASUS_WMI_DEVID_WLAN             0x00010011
+#define ASUS_WMI_DEVID_WLAN_LED         0x00010012
 #define ASUS_WMI_DEVID_BLUETOOTH        0x00010013
 #define ASUS_WMI_DEVID_GPS              0x00010015
 #define ASUS_WMI_DEVID_WIMAX            0x00010017
@@ -731,8 +730,21 @@ static int asus_rfkill_set(void *data, bool blocked)
 {
        struct asus_rfkill *priv = data;
        u32 ctrl_param = !blocked;
+        u32 dev_id = priv->dev_id;
-        return asus_wmi_set_devstate(priv->dev_id, ctrl_param, NULL);
+        /*
+         * If the user bit is set, BIOS can't set and record the wlan status,
+         * it will report the value read from id ASUS_WMI_DEVID_WLAN_LED
+         * while we query the wlan status through WMI(ASUS_WMI_DEVID_WLAN).
+         * So, we have to record wlan status in id ASUS_WMI_DEVID_WLAN_LED
+         * while setting the wlan status through WMI.
+         * This is also the behavior that windows app will do.
+         */
+        if ((dev_id == ASUS_WMI_DEVID_WLAN) &&
+             priv->asus->driver->wlan_ctrl_by_user)
+                dev_id = ASUS_WMI_DEVID_WLAN_LED;
+        return asus_wmi_set_devstate(dev_id, ctrl_param, NULL);
 }
 static void asus_rfkill_query(struct rfkill *rfkill, void *data)
@@ -1653,6 +1665,7 @@ static int asus_wmi_add(struct platform_device *pdev)
        struct asus_wmi *asus;
        acpi_status status;
        int err;
+        u32 result;
        asus = kzalloc(sizeof(struct asus_wmi), GFP_KERNEL);
        if (!asus)
@@ -1689,10 +1702,8 @@ static int asus_wmi_add(struct platform_device *pdev)
        if (asus->driver->quirks->wmi_backlight_power)
                acpi_video_dmi_promote_vendor();
        if (!acpi_video_backlight_support()) {
-#ifdef CONFIG_ACPI_VIDEO
                pr_info("Disabling ACPI video driver\n");
                acpi_video_unregister();
-#endif
                err = asus_wmi_backlight_init(asus);
                if (err && err != -ENODEV)
                        goto fail_backlight;
@@ -1711,6 +1722,10 @@ static int asus_wmi_add(struct platform_device *pdev)
        if (err)
                goto fail_debugfs;
+        asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result);
+        if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT))
+                asus->driver->wlan_ctrl_by_user = 1;
        return 0;
 fail_debugfs:
diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
index 9c1da8b81bea..4c9bd38bb0a2 100644
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -46,6 +46,7 @@ struct quirk_entry {
 struct asus_wmi_driver {
        int                     brightness;
        int                     panel_power;
+        int                     wlan_ctrl_by_user;
        const char              *name;
        struct module           *owner;
diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
index cd33add118ce..c87ff16873f9 100644
--- a/drivers/platform/x86/classmate-laptop.c
+++ b/drivers/platform/x86/classmate-laptop.c
@@ -725,8 +725,10 @@ static void cmpc_tablet_handler(struct acpi_device *dev, u32 event)
        struct input_dev *inputdev = dev_get_drvdata(&dev->dev);
        if (event == 0x81) {
-                if (ACPI_SUCCESS(cmpc_get_tablet(dev->handle, &val)))
+                if (ACPI_SUCCESS(cmpc_get_tablet(dev->handle, &val))) {
                        input_report_switch(inputdev, SW_TABLET_MODE, !val);
+                        input_sync(inputdev);
+                }
        }
 }
@@ -739,8 +741,10 @@ static void cmpc_tablet_idev_init(struct input_dev *inputdev)
        set_bit(SW_TABLET_MODE, inputdev->swbit);
        acpi = to_acpi_device(inputdev->dev.parent);
-        if (ACPI_SUCCESS(cmpc_get_tablet(acpi->handle, &val)))
+        if (ACPI_SUCCESS(cmpc_get_tablet(acpi->handle, &val))) {
                input_report_switch(inputdev, SW_TABLET_MODE, !val);
+                input_sync(inputdev);
+        }
 }
 static int cmpc_tablet_add(struct acpi_device *acpi)
@@ -760,8 +764,10 @@ static int cmpc_tablet_resume(struct device *dev)
        struct input_dev *inputdev = dev_get_drvdata(dev);
        unsigned long long val = 0;
-        if (ACPI_SUCCESS(cmpc_get_tablet(to_acpi_device(dev)->handle, &val)))
+        if (ACPI_SUCCESS(cmpc_get_tablet(to_acpi_device(dev)->handle, &val))) {
                input_report_switch(inputdev, SW_TABLET_MODE, !val);
+                input_sync(inputdev);
+        }
        return 0;
 }
 #endif
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index 4e96e8c0b60f..927c33af67ec 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -211,7 +211,7 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
                .ident = "Dell Inspiron 5420",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Isnpiron 5420"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5420"),
                },
                .driver_data = &quirk_dell_vostro_v130,
        },
@@ -220,7 +220,7 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
                .ident = "Dell Inspiron 5520",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Isnpiron 5520"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5520"),
                },
                .driver_data = &quirk_dell_vostro_v130,
        },
@@ -229,7 +229,7 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
                .ident = "Dell Inspiron 5720",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Isnpiron 5720"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5720"),
                },
                .driver_data = &quirk_dell_vostro_v130,
        },
@@ -238,7 +238,7 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
                .ident = "Dell Inspiron 7420",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Isnpiron 7420"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7420"),
                },
                .driver_data = &quirk_dell_vostro_v130,
        },
@@ -247,7 +247,7 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
                .ident = "Dell Inspiron 7520",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Isnpiron 7520"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7520"),
                },
                .driver_data = &quirk_dell_vostro_v130,
        },
@@ -256,7 +256,7 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
                .ident = "Dell Inspiron 7720",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Isnpiron 7720"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7720"),
                },
                .driver_data = &quirk_dell_vostro_v130,
        },
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index dab91b48d22c..5ca264179f4e 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -610,12 +610,12 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                if (!bus) {
                        pr_warn("Unable to find PCI bus 1?\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                }
                if (pci_bus_read_config_dword(bus, 0, PCI_VENDOR_ID, &l)) {
                        pr_err("Unable to read PCI config space?\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                }
                absent = (l == 0xffffffff);
@@ -627,7 +627,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                                absent ? "absent" : "present");
                        pr_warn("skipped wireless hotplug as probably "
                                "inappropriate for this model\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                }
                if (!blocked) {
@@ -635,7 +635,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                        if (dev) {
                                /* Device already present */
                                pci_dev_put(dev);
-                                goto out_unlock;
+                                goto out_put_dev;
                        }
                        dev = pci_scan_single_device(bus, 0);
                        if (dev) {
@@ -650,6 +650,8 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                                pci_dev_put(dev);
                        }
                }
+out_put_dev:
+                pci_dev_put(port);
        }
 out_unlock:
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 17f6dfd8dbfb..dae7abe1d711 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -36,6 +36,7 @@
 #include <linux/fb.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/i8042.h>
 #define IDEAPAD_RFKILL_DEV_NUM  (3)
@@ -63,8 +64,11 @@ enum {
        VPCCMD_R_3G,
        VPCCMD_W_3G,
        VPCCMD_R_ODD, /* 0x21 */
-        VPCCMD_R_RF = 0x23,
+        VPCCMD_W_FAN,
+        VPCCMD_R_RF,
        VPCCMD_W_RF,
+        VPCCMD_R_FAN = 0x2B,
+        VPCCMD_R_SPECIAL_BUTTONS = 0x31,
        VPCCMD_W_BL_POWER = 0x33,
 };
@@ -356,14 +360,46 @@ static ssize_t store_ideapad_cam(struct device *dev,
                return -EINVAL;
        ret = write_ec_cmd(ideapad_handle, VPCCMD_W_CAMERA, state);
        if (ret < 0)
-                return ret;
+                return -EIO;
        return count;
 }
 static DEVICE_ATTR(camera_power, 0644, show_ideapad_cam, store_ideapad_cam);
+static ssize_t show_ideapad_fan(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        unsigned long result;
+        if (read_ec_data(ideapad_handle, VPCCMD_R_FAN, &result))
+                return sprintf(buf, "-1\n");
+        return sprintf(buf, "%lu\n", result);
+}
+static ssize_t store_ideapad_fan(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        int ret, state;
+        if (!count)
+                return 0;
+        if (sscanf(buf, "%i", &state) != 1)
+                return -EINVAL;
+        if (state < 0 || state > 4 || state == 3)
+                return -EINVAL;
+        ret = write_ec_cmd(ideapad_handle, VPCCMD_W_FAN, state);
+        if (ret < 0)
+                return -EIO;
+        return count;
+}
+static DEVICE_ATTR(fan_mode, 0644, show_ideapad_fan, store_ideapad_fan);
 static struct attribute *ideapad_attributes[] = {
        &dev_attr_camera_power.attr,
+        &dev_attr_fan_mode.attr,
        NULL
 };
@@ -377,7 +413,10 @@ static umode_t ideapad_is_visible(struct kobject *kobj,
        if (attr == &dev_attr_camera_power.attr)
                supported = test_bit(CFG_CAMERA_BIT, &(priv->cfg));
-        else
+        else if (attr == &dev_attr_fan_mode.attr) {
+                unsigned long value;
+                supported = !read_ec_data(ideapad_handle, VPCCMD_R_FAN, &value);
+        } else
                supported = true;
        return supported ? attr->mode : 0;
@@ -518,9 +557,15 @@ static void ideapad_platform_exit(struct ideapad_private *priv)
 */
 static const struct key_entry ideapad_keymap[] = {
        { KE_KEY, 6,  { KEY_SWITCHVIDEOMODE } },
+        { KE_KEY, 7,  { KEY_CAMERA } },
+        { KE_KEY, 11, { KEY_F16 } },
        { KE_KEY, 13, { KEY_WLAN } },
        { KE_KEY, 16, { KEY_PROG1 } },
        { KE_KEY, 17, { KEY_PROG2 } },
+        { KE_KEY, 64, { KEY_PROG3 } },
+        { KE_KEY, 65, { KEY_PROG4 } },
+        { KE_KEY, 66, { KEY_TOUCHPAD_OFF } },
+        { KE_KEY, 67, { KEY_TOUCHPAD_ON } },
        { KE_END, 0 },
 };
@@ -587,6 +632,28 @@ static void ideapad_input_novokey(struct ideapad_private *priv)
                ideapad_input_report(priv, 16);
 }
+static void ideapad_check_special_buttons(struct ideapad_private *priv)
+{
+        unsigned long bit, value;
+        read_ec_data(ideapad_handle, VPCCMD_R_SPECIAL_BUTTONS, &value);
+        for (bit = 0; bit < 16; bit++) {
+                if (test_bit(bit, &value)) {
+                        switch (bit) {
+                        case 6:
+                                /* Thermal Management button */
+                                ideapad_input_report(priv, 65);
+                                break;
+                        case 1:
+                                /* OneKey Theater button */
+                                ideapad_input_report(priv, 64);
+                                break;
+                        }
+                }
+        }
+}
 /*
 * backlight
 */
@@ -691,6 +758,24 @@ static const struct acpi_device_id ideapad_device_ids[] = {
 };
 MODULE_DEVICE_TABLE(acpi, ideapad_device_ids);
+static void ideapad_sync_touchpad_state(struct acpi_device *adevice)
+{
+        struct ideapad_private *priv = dev_get_drvdata(&adevice->dev);
+        unsigned long value;
+        /* Without reading from EC touchpad LED doesn't switch state */
+        if (!read_ec_data(adevice->handle, VPCCMD_R_TOUCHPAD, &value)) {
+                /* Some IdeaPads don't really turn off touchpad - they only
+                 * switch the LED state. We (de)activate KBC AUX port to turn
+                 * touchpad off and on. We send KEY_TOUCHPAD_OFF and
+                 * KEY_TOUCHPAD_ON to not to get out of sync with LED */
+                unsigned char param;
+                i8042_command(&param, value ? I8042_CMD_AUX_ENABLE :
+                              I8042_CMD_AUX_DISABLE);
+                ideapad_input_report(priv, value ? 67 : 66);
+        }
+}
 static int __devinit ideapad_acpi_add(struct acpi_device *adevice)
 {
        int ret, i;
@@ -727,6 +812,7 @@ static int __devinit ideapad_acpi_add(struct acpi_device *adevice)
                        priv->rfk[i] = NULL;
        }
        ideapad_sync_rfk_state(priv);
+        ideapad_sync_touchpad_state(adevice);
        if (!acpi_video_backlight_support()) {
                ret = ideapad_backlight_init(priv);
@@ -785,9 +871,14 @@ static void ideapad_acpi_notify(struct acpi_device *adevice, u32 event)
                                ideapad_sync_rfk_state(priv);
                                break;
                        case 13:
+                        case 11:
+                        case 7:
                        case 6:
                                ideapad_input_report(priv, vpc_bit);
                                break;
+                        case 5:
+                                ideapad_sync_touchpad_state(adevice);
+                                break;
                        case 4:
                                ideapad_backlight_notify_brightness(priv);
                                break;
@@ -797,6 +888,9 @@ static void ideapad_acpi_notify(struct acpi_device *adevice, u32 event)
                        case 2:
                                ideapad_backlight_notify_power(priv);
                                break;
+                        case 0:
+                                ideapad_check_special_buttons(priv);
+                                break;
                        default:
                                pr_info("Unknown event: %lu\n", vpc_bit);
                        }
@@ -804,6 +898,15 @@ static void ideapad_acpi_notify(struct acpi_device *adevice, u32 event)
        }
 }
+static int ideapad_acpi_resume(struct device *device)
+{
+        ideapad_sync_rfk_state(ideapad_priv);
+        ideapad_sync_touchpad_state(to_acpi_device(device));
+        return 0;
+}
+static SIMPLE_DEV_PM_OPS(ideapad_pm, NULL, ideapad_acpi_resume);
 static struct acpi_driver ideapad_acpi_driver = {
        .name = "ideapad_acpi",
        .class = "IdeaPad",
@@ -811,6 +914,7 @@ static struct acpi_driver ideapad_acpi_driver = {
        .ops.add = ideapad_acpi_add,
        .ops.remove = ideapad_acpi_remove,
        .ops.notify = ideapad_acpi_notify,
+        .drv.pm = &ideapad_pm,
        .owner = THIS_MODULE,
 };
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index c1ca7bcebb66..dd90d15f5210 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -26,9 +26,7 @@
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
-#ifdef CONFIG_ACPI_VIDEO
 #include <acpi/video.h>
-#endif
 /*
 * This driver is needed because a number of Samsung laptops do not hook
@@ -1558,9 +1556,7 @@ static int __init samsung_init(void)
                samsung->handle_backlight = false;
        } else if (samsung->quirks->broken_acpi_video) {
                pr_info("Disabling ACPI video driver\n");
-#ifdef CONFIG_ACPI_VIDEO
                acpi_video_unregister();
-#endif
        }
 #endif
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index f28f36ccdcf4..52daaa816e53 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -545,7 +545,7 @@ TPACPI_HANDLE(hkey, ec, "\\_SB.HKEY",	/* 600e/x, 770e, 770x */
 */
 static int acpi_evalf(acpi_handle handle,
-                      void *res, char *method, char *fmt, ...)
+                      int *res, char *method, char *fmt, ...)
 {
        char *fmt0 = fmt;
        struct acpi_object_list params;
@@ -606,7 +606,7 @@ static int acpi_evalf(acpi_handle handle,
                success = (status == AE_OK &&
                           out_obj.type == ACPI_TYPE_INTEGER);
                if (success && res)
-                        *(int *)res = out_obj.integer.value;
+                        *res = out_obj.integer.value;
                break;
        case 'v':               /* void */
                success = status == AE_OK;
@@ -7386,17 +7386,18 @@ static int fan_get_status(u8 *status)
         * Add TPACPI_FAN_RD_ACPI_FANS ? */
        switch (fan_status_access_mode) {
-        case TPACPI_FAN_RD_ACPI_GFAN:
+        case TPACPI_FAN_RD_ACPI_GFAN: {
                /* 570, 600e/x, 770e, 770x */
+                int res;
-                if (unlikely(!acpi_evalf(gfan_handle, &s, NULL, "d")))
+                if (unlikely(!acpi_evalf(gfan_handle, &res, NULL, "d")))
                        return -EIO;
                if (likely(status))
-                        *status = s & 0x07;
+                        *status = res & 0x07;
                break;
+        }
        case TPACPI_FAN_RD_TPEC:
                /* all except 570, 600e/x, 770e, 770x */
                if (unlikely(!acpi_ec_read(fan_status_offset, &s)))
@@ -8664,6 +8665,13 @@ static int __must_check __init get_thinkpad_model_data(
                tp->model_str = kstrdup(s, GFP_KERNEL);
                if (!tp->model_str)
                        return -ENOMEM;
+        } else {
+                s = dmi_get_system_info(DMI_BIOS_VENDOR);
+                if (s && !(strnicmp(s, "Lenovo", 6))) {
+                        tp->model_str = kstrdup(s, GFP_KERNEL);
+                        if (!tp->model_str)
+                                return -ENOMEM;
+                }
        }
        s = dmi_get_system_info(DMI_PRODUCT_NAME);
diff --git a/drivers/pwm/Kconfig b/drivers/pwm/Kconfig
index 8fc3808d7a3e..90c5c7357a50 100644
--- a/drivers/pwm/Kconfig
+++ b/drivers/pwm/Kconfig
@@ -1,12 +1,31 @@
 menuconfig PWM
-        bool "PWM Support"
+        bool "Pulse-Width Modulation (PWM) Support"
        depends on !MACH_JZ4740 && !PUV3_PWM
        help
-          This enables PWM support through the generic PWM framework.
+          Generic Pulse-Width Modulation (PWM) support.
-          You only need to enable this, if you also want to enable
-          one or more of the PWM drivers below.
+          In Pulse-Width Modulation, a variation of the width of pulses
+          in a rectangular pulse signal is used as a means to alter the
-          If unsure, say N.
+          average power of the signal. Applications include efficient
+          power delivery and voltage regulation. In computer systems,
+          PWMs are commonly used to control fans or the brightness of
+          display backlights.
+          This framework provides a generic interface to PWM devices
+          within the Linux kernel. On the driver side it provides an API
+          to register and unregister a PWM chip, an abstraction of a PWM
+          controller, that supports one or more PWM devices. Client
+          drivers can request PWM devices and use the generic framework
+          to configure as well as enable and disable them.
+          This generic framework replaces the legacy PWM framework which
+          allows only a single driver implementing the required API. Not
+          all legacy implementations have been ported to the framework
+          yet. The framework provides an API that is backward compatible
+          with the legacy framework so that existing client drivers
+          continue to work as expected.
+          If unsure, say no.
 if PWM
diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index ecb76909e946..c6e05078d3ad 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -129,8 +129,8 @@ static int pwm_device_request(struct pwm_device *pwm, const char *label)
        return 0;
 }
-static struct pwm_device *of_pwm_simple_xlate(struct pwm_chip *pc,
+static struct pwm_device *
-                                              const struct of_phandle_args *args)
+of_pwm_simple_xlate(struct pwm_chip *pc, const struct of_phandle_args *args)
 {
        struct pwm_device *pwm;
@@ -149,7 +149,7 @@ static struct pwm_device *of_pwm_simple_xlate(struct pwm_chip *pc,
        return pwm;
 }
-void of_pwmchip_add(struct pwm_chip *chip)
+static void of_pwmchip_add(struct pwm_chip *chip)
 {
        if (!chip->dev || !chip->dev->of_node)
                return;
@@ -162,7 +162,7 @@ void of_pwmchip_add(struct pwm_chip *chip)
        of_node_get(chip->dev->of_node);
 }
-void of_pwmchip_remove(struct pwm_chip *chip)
+static void of_pwmchip_remove(struct pwm_chip *chip)
 {
        if (chip->dev && chip->dev->of_node)
                of_node_put(chip->dev->of_node);
@@ -527,7 +527,7 @@ void __init pwm_add_table(struct pwm_lookup *table, size_t num)
 struct pwm_device *pwm_get(struct device *dev, const char *con_id)
 {
        struct pwm_device *pwm = ERR_PTR(-EPROBE_DEFER);
-        const char *dev_id = dev ? dev_name(dev): NULL;
+        const char *dev_id = dev ? dev_name(dev) : NULL;
        struct pwm_chip *chip = NULL;
        unsigned int index = 0;
        unsigned int best = 0;
@@ -609,7 +609,7 @@ void pwm_put(struct pwm_device *pwm)
        mutex_lock(&pwm_lock);
        if (!test_and_clear_bit(PWMF_REQUESTED, &pwm->flags)) {
-                pr_warning("PWM device already freed\n");
+                pr_warn("PWM device already freed\n");
                goto out;
        }
diff --git a/drivers/pwm/pwm-samsung.c b/drivers/pwm/pwm-samsung.c
index d10386528c9c..e5187c0ade9f 100644
--- a/drivers/pwm/pwm-samsung.c
+++ b/drivers/pwm/pwm-samsung.c
@@ -225,6 +225,7 @@ static int s3c_pwm_probe(struct platform_device *pdev)
        /* calculate base of control bits in TCON */
        s3c->tcon_base = id == 0 ? 0 : (id * 4) + 4;
+        s3c->chip.dev = &pdev->dev;
        s3c->chip.ops = &s3c_pwm_ops;
        s3c->chip.base = -1;
        s3c->chip.npwm = 1;
diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c
index 02ce18d5e49a..057465e0553c 100644
--- a/drivers/pwm/pwm-tegra.c
+++ b/drivers/pwm/pwm-tegra.c
@@ -187,10 +187,8 @@ static int tegra_pwm_probe(struct platform_device *pdev)
        }
        pwm->mmio_base = devm_request_and_ioremap(&pdev->dev, r);
-        if (!pwm->mmio_base) {
+        if (!pwm->mmio_base)
-                dev_err(&pdev->dev, "failed to ioremap() region\n");
                return -EADDRNOTAVAIL;
-        }
        platform_set_drvdata(pdev, pwm);
diff --git a/drivers/pwm/pwm-tiecap.c b/drivers/pwm/pwm-tiecap.c
index 3c2ad284ee3e..0b66d0f25922 100644
--- a/drivers/pwm/pwm-tiecap.c
+++ b/drivers/pwm/pwm-tiecap.c
@@ -192,10 +192,8 @@ static int __devinit ecap_pwm_probe(struct platform_device *pdev)
        }
        pc->mmio_base = devm_request_and_ioremap(&pdev->dev, r);
-        if (!pc->mmio_base) {
+        if (!pc->mmio_base)
-                dev_err(&pdev->dev, "failed to ioremap() registers\n");
                return -EADDRNOTAVAIL;
-        }
        ret = pwmchip_add(&pc->chip);
        if (ret < 0) {
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 010d232cb0c8..c3756d1be194 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -371,10 +371,8 @@ static int __devinit ehrpwm_pwm_probe(struct platform_device *pdev)
        }
        pc->mmio_base = devm_request_and_ioremap(&pdev->dev, r);
-        if (!pc->mmio_base) {
+        if (!pc->mmio_base)
-                dev_err(&pdev->dev, "failed to ioremap() registers\n");
                return  -EADDRNOTAVAIL;
-        }
        ret = pwmchip_add(&pc->chip);
        if (ret < 0) {
diff --git a/drivers/pwm/pwm-vt8500.c b/drivers/pwm/pwm-vt8500.c
index 548021439f0c..ad14389b7144 100644
--- a/drivers/pwm/pwm-vt8500.c
+++ b/drivers/pwm/pwm-vt8500.c
@@ -41,7 +41,7 @@ static inline void pwm_busy_wait(void __iomem *reg, u8 bitmask)
                cpu_relax();
        if (unlikely(!loops))
-                pr_warning("Waiting for status bits 0x%x to clear timed out\n",
+                pr_warn("Waiting for status bits 0x%x to clear timed out\n",
                           bitmask);
 }
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 722246cf20ab..5d44252b7342 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -435,6 +435,9 @@ static void tsi721_db_dpc(struct work_struct *work)
                                " info %4.4x\n", DBELL_SID(idb.bytes),
                                DBELL_TID(idb.bytes), DBELL_INF(idb.bytes));
                }
+                wr_ptr = ioread32(priv->regs +
+                                  TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
        }
        iowrite32(rd_ptr & (IDB_QSIZE - 1),
@@ -445,6 +448,10 @@ static void tsi721_db_dpc(struct work_struct *work)
        regval |= TSI721_SR_CHINT_IDBQRCV;
        iowrite32(regval,
                priv->regs + TSI721_SR_CHINTE(IDB_QUEUE));
+        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
+        if (wr_ptr != rd_ptr)
+                schedule_work(&priv->idb_work);
 }
 /**
@@ -2212,7 +2219,7 @@ static int __devinit tsi721_probe(struct pci_dev *pdev,
                                  const struct pci_device_id *id)
 {
        struct tsi721_device *priv;
-        int i, cap;
+        int cap;
        int err;
        u32 regval;
@@ -2232,12 +2239,15 @@ static int __devinit tsi721_probe(struct pci_dev *pdev,
        priv->pdev = pdev;
 #ifdef DEBUG
+        {
+        int i;
        for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
                dev_dbg(&pdev->dev, "res[%d] @ 0x%llx (0x%lx, 0x%lx)\n",
                        i, (unsigned long long)pci_resource_start(pdev, i),
                        (unsigned long)pci_resource_len(pdev, i),
                        pci_resource_flags(pdev, i));
        }
+        }
 #endif
        /*
         * Verify BAR configuration
diff --git a/drivers/regulator/ab3100.c b/drivers/regulator/ab3100.c
index 182b553059c9..c151fd5d8c97 100644
--- a/drivers/regulator/ab3100.c
+++ b/drivers/regulator/ab3100.c
@@ -486,6 +486,7 @@ ab3100_regulator_desc[AB3100_NUM_REGULATORS] = {
                .id   = AB3100_BUCK,
                .ops  = &regulator_ops_variable_sleepable,
                .n_voltages = ARRAY_SIZE(ldo_e_buck_typ_voltages),
+                .volt_table = ldo_e_buck_typ_voltages,
                .type = REGULATOR_VOLTAGE,
                .owner = THIS_MODULE,
                .enable_time = 1000,
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index e9c2085f9dfb..ce0fe72a428e 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -64,14 +64,15 @@ static int anatop_set_voltage_sel(struct regulator_dev *reg, unsigned selector)
 static int anatop_get_voltage_sel(struct regulator_dev *reg)
 {
        struct anatop_regulator *anatop_reg = rdev_get_drvdata(reg);
-        u32 val;
+        u32 val, mask;
        if (!anatop_reg->control_reg)
                return -ENOTSUPP;
        val = anatop_read_reg(anatop_reg->mfd, anatop_reg->control_reg);
-        val = (val & ((1 << anatop_reg->vol_bit_width) - 1)) >>
+        mask = ((1 << anatop_reg->vol_bit_width) - 1) <<
                anatop_reg->vol_bit_shift;
+        val = (val & mask) >> anatop_reg->vol_bit_shift;
        return val - anatop_reg->min_bit_val;
 }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index f092588a078c..48385318175a 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -3217,7 +3217,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
        dev_set_drvdata(&rdev->dev, rdev);
-        if (config->ena_gpio) {
+        if (config->ena_gpio && gpio_is_valid(config->ena_gpio)) {
                ret = gpio_request_one(config->ena_gpio,
                                       GPIOF_DIR_OUT | config->ena_gpio_flags,
                                       rdev_get_name(rdev));
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index 34b67bee9323..8b5944f2d7d1 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -57,16 +57,17 @@ static int gpio_regulator_get_value(struct regulator_dev *dev)
        return -EINVAL;
 }
-static int gpio_regulator_set_value(struct regulator_dev *dev,
+static int gpio_regulator_set_voltage(struct regulator_dev *dev,
-                                        int min, int max, unsigned *selector)
+                                        int min_uV, int max_uV,
+                                        unsigned *selector)
 {
        struct gpio_regulator_data *data = rdev_get_drvdata(dev);
        int ptr, target = 0, state, best_val = INT_MAX;
        for (ptr = 0; ptr < data->nr_states; ptr++)
                if (data->states[ptr].value < best_val &&
-                    data->states[ptr].value >= min &&
+                    data->states[ptr].value >= min_uV &&
-                    data->states[ptr].value <= max) {
+                    data->states[ptr].value <= max_uV) {
                        target = data->states[ptr].gpios;
                        best_val = data->states[ptr].value;
                        if (selector)
@@ -85,13 +86,6 @@ static int gpio_regulator_set_value(struct regulator_dev *dev,
        return 0;
 }
-static int gpio_regulator_set_voltage(struct regulator_dev *dev,
-                                        int min_uV, int max_uV,
-                                        unsigned *selector)
-{
-        return gpio_regulator_set_value(dev, min_uV, max_uV, selector);
-}
 static int gpio_regulator_list_voltage(struct regulator_dev *dev,
                                      unsigned selector)
 {
@@ -106,7 +100,27 @@ static int gpio_regulator_list_voltage(struct regulator_dev *dev,
 static int gpio_regulator_set_current_limit(struct regulator_dev *dev,
                                        int min_uA, int max_uA)
 {
-        return gpio_regulator_set_value(dev, min_uA, max_uA, NULL);
+        struct gpio_regulator_data *data = rdev_get_drvdata(dev);
+        int ptr, target = 0, state, best_val = 0;
+        for (ptr = 0; ptr < data->nr_states; ptr++)
+                if (data->states[ptr].value > best_val &&
+                    data->states[ptr].value >= min_uA &&
+                    data->states[ptr].value <= max_uA) {
+                        target = data->states[ptr].gpios;
+                        best_val = data->states[ptr].value;
+                }
+        if (best_val == 0)
+                return -EINVAL;
+        for (ptr = 0; ptr < data->nr_gpios; ptr++) {
+                state = (target & (1 << ptr)) >> ptr;
+                gpio_set_value(data->gpios[ptr].gpio, state);
+        }
+        data->state = target;
+        return 0;
 }
 static struct regulator_ops gpio_regulator_voltage_ops = {
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 17d19fbbc490..46c7e88f8381 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -486,9 +486,12 @@ static int palmas_map_voltage_ldo(struct regulator_dev *rdev,
 {
        int ret, voltage;
-        ret = ((min_uV - 900000) / 50000) + 1;
+        if (min_uV == 0)
-        if (ret < 0)
+                return 0;
-                return ret;
+        if (min_uV < 900000)
+                min_uV = 900000;
+        ret = DIV_ROUND_UP(min_uV - 900000, 50000) + 1;
        /* Map back into a voltage to verify we're still in bounds */
        voltage = palmas_list_voltage_ldo(rdev, ret);
@@ -586,7 +589,7 @@ static int palmas_ldo_init(struct palmas *palmas, int id,
        addr = palmas_regs_info[id].ctrl_addr;
-        ret = palmas_smps_read(palmas, addr, &reg);
+        ret = palmas_ldo_read(palmas, addr, &reg);
        if (ret)
                return ret;
@@ -596,7 +599,7 @@ static int palmas_ldo_init(struct palmas *palmas, int id,
        if (reg_init->mode_sleep)
                reg |= PALMAS_LDO1_CTRL_MODE_SLEEP;
-        ret = palmas_smps_write(palmas, addr, reg);
+        ret = palmas_ldo_write(palmas, addr, reg);
        if (ret)
                return ret;
@@ -630,7 +633,7 @@ static __devinit int palmas_probe(struct platform_device *pdev)
        ret = palmas_smps_read(palmas, PALMAS_SMPS_CTRL, &reg);
        if (ret)
-                goto err_unregister_regulator;
+                return ret;
        if (reg & PALMAS_SMPS_CTRL_SMPS12_SMPS123_EN)
                pmic->smps123 = 1;
@@ -676,7 +679,9 @@ static __devinit int palmas_probe(struct platform_device *pdev)
                case PALMAS_REG_SMPS10:
                        pmic->desc[id].n_voltages = PALMAS_SMPS10_NUM_VOLTAGES;
                        pmic->desc[id].ops = &palmas_ops_smps10;
-                        pmic->desc[id].vsel_reg = PALMAS_SMPS10_CTRL;
+                        pmic->desc[id].vsel_reg =
+                                        PALMAS_BASE_TO_REG(PALMAS_SMPS_BASE,
+                                                        PALMAS_SMPS10_CTRL);
                        pmic->desc[id].vsel_mask = SMPS10_VSEL;
                        pmic->desc[id].enable_reg =
                                        PALMAS_BASE_TO_REG(PALMAS_SMPS_BASE,
@@ -778,8 +783,10 @@ static __devinit int palmas_probe(struct platform_device *pdev)
                        reg_init = pdata->reg_init[id];
                        if (reg_init) {
                                ret = palmas_ldo_init(palmas, id, reg_init);
-                                if (ret)
+                                if (ret) {
+                                        regulator_unregister(pmic->rdev[id]);
                                        goto err_unregister_regulator;
+                                }
                        }
                }
        }
diff --git a/drivers/regulator/tps6586x-regulator.c b/drivers/regulator/tps6586x-regulator.c
index e6da90ab5153..19241fc30050 100644
--- a/drivers/regulator/tps6586x-regulator.c
+++ b/drivers/regulator/tps6586x-regulator.c
@@ -240,14 +240,16 @@ static struct tps6586x_regulator tps6586x_regulator[] = {
        TPS6586X_LDO(LDO_9, "vinldo9", ldo, SUPPLYV6, 3, 3, ENE, 7, ENE, 7),
        TPS6586X_LDO(LDO_RTC, NULL, ldo, SUPPLYV4, 3, 3, V4, 7, V4, 7),
        TPS6586X_LDO(LDO_1, "vinldo01", dvm, SUPPLYV1, 0, 5, ENC, 1, END, 1),
-        TPS6586X_LDO(SM_2, "sm2", sm2, SUPPLYV2, 0, 5, ENC, 7, END, 7),
+        TPS6586X_LDO(SM_2, "vin-sm2", sm2, SUPPLYV2, 0, 5, ENC, 7, END, 7),
        TPS6586X_DVM(LDO_2, "vinldo23", dvm, LDO2BV1, 0, 5, ENA, 3,
                                        ENB, 3, VCC2, 6),
        TPS6586X_DVM(LDO_4, "vinldo4", ldo4, LDO4V1, 0, 5, ENC, 3,
                                        END, 3, VCC1, 6),
-        TPS6586X_DVM(SM_0, "sm0", dvm, SM0V1, 0, 5, ENA, 1, ENB, 1, VCC1, 2),
+        TPS6586X_DVM(SM_0, "vin-sm0", dvm, SM0V1, 0, 5, ENA, 1,
-        TPS6586X_DVM(SM_1, "sm1", dvm, SM1V1, 0, 5, ENA, 0, ENB, 0, VCC1, 0),
+                                        ENB, 1, VCC1, 2),
+        TPS6586X_DVM(SM_1, "vin-sm1", dvm, SM1V1, 0, 5, ENA, 0,
+                                        ENB, 0, VCC1, 0),
 };
 /*
diff --git a/drivers/regulator/twl-regulator.c b/drivers/regulator/twl-regulator.c
index 242fe90dc565..77a71a5c17c3 100644
--- a/drivers/regulator/twl-regulator.c
+++ b/drivers/regulator/twl-regulator.c
@@ -1037,7 +1037,7 @@ TWL6025_ADJUSTABLE_LDO(LDO7, 0x74, 1000, 3300);
 TWL6025_ADJUSTABLE_LDO(LDO6, 0x60, 1000, 3300);
 TWL6025_ADJUSTABLE_LDO(LDOLN, 0x64, 1000, 3300);
 TWL6025_ADJUSTABLE_LDO(LDOUSB, 0x70, 1000, 3300);
-TWL4030_FIXED_LDO(VINTANA2, 0x3f, 1500, 11, 100, 0x08);
+TWL4030_FIXED_LDO(VINTANA1, 0x3f, 1500, 11, 100, 0x08);
 TWL4030_FIXED_LDO(VINTDIG, 0x47, 1500, 13, 100, 0x08);
 TWL4030_FIXED_LDO(VUSB1V5, 0x71, 1500, 17, 100, 0x08);
 TWL4030_FIXED_LDO(VUSB1V8, 0x74, 1800, 18, 100, 0x08);
@@ -1048,7 +1048,6 @@ TWL6030_FIXED_LDO(VDAC, 0x64, 1800, 0);
 TWL6030_FIXED_LDO(VUSB, 0x70, 3300, 0);
 TWL6030_FIXED_LDO(V1V8, 0x16, 1800, 0);
 TWL6030_FIXED_LDO(V2V1, 0x1c, 2100, 0);
-TWL6030_FIXED_RESOURCE(CLK32KG, 0x8C, 0);
 TWL6025_ADJUSTABLE_SMPS(SMPS3, 0x34);
 TWL6025_ADJUSTABLE_SMPS(SMPS4, 0x10);
 TWL6025_ADJUSTABLE_SMPS(VIO, 0x16);
@@ -1117,7 +1116,7 @@ static const struct of_device_id twl_of_match[] __devinitconst = {
        TWL6025_OF_MATCH("ti,twl6025-ldo6", LDO6),
        TWL6025_OF_MATCH("ti,twl6025-ldoln", LDOLN),
        TWL6025_OF_MATCH("ti,twl6025-ldousb", LDOUSB),
-        TWLFIXED_OF_MATCH("ti,twl4030-vintana2", VINTANA2),
+        TWLFIXED_OF_MATCH("ti,twl4030-vintana1", VINTANA1),
        TWLFIXED_OF_MATCH("ti,twl4030-vintdig", VINTDIG),
        TWLFIXED_OF_MATCH("ti,twl4030-vusb1v5", VUSB1V5),
        TWLFIXED_OF_MATCH("ti,twl4030-vusb1v8", VUSB1V8),
diff --git a/drivers/rtc/rtc-at91sam9.c b/drivers/rtc/rtc-at91sam9.c
index 831868904e02..1dd61f402b04 100644
--- a/drivers/rtc/rtc-at91sam9.c
+++ b/drivers/rtc/rtc-at91sam9.c
@@ -58,6 +58,7 @@ struct sam9_rtc {
        struct rtc_device       *rtcdev;
        u32                     imr;
        void __iomem            *gpbr;
+        int                     irq;
 };
 #define rtt_readl(rtc, field) \
@@ -292,7 +293,7 @@ static int __devinit at91_rtc_probe(struct platform_device *pdev)
 {
        struct resource *r, *r_gpbr;
        struct sam9_rtc *rtc;
-        int             ret;
+        int             ret, irq;
        u32             mr;
        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -302,10 +303,18 @@ static int __devinit at91_rtc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "failed to get interrupt resource\n");
+                return irq;
+        }
        rtc = kzalloc(sizeof *rtc, GFP_KERNEL);
        if (!rtc)
                return -ENOMEM;
+        rtc->irq = irq;
        /* platform setup code should have handled this; sigh */
        if (!device_can_wakeup(&pdev->dev))
                device_init_wakeup(&pdev->dev, 1);
@@ -345,11 +354,10 @@ static int __devinit at91_rtc_probe(struct platform_device *pdev)
        }
        /* register irq handler after we know what name we'll use */
-        ret = request_irq(AT91_ID_SYS, at91_rtc_interrupt,
+        ret = request_irq(rtc->irq, at91_rtc_interrupt, IRQF_SHARED,
-                                IRQF_SHARED,
                                dev_name(&rtc->rtcdev->dev), rtc);
        if (ret) {
-                dev_dbg(&pdev->dev, "can't share IRQ %d?\n", AT91_ID_SYS);
+                dev_dbg(&pdev->dev, "can't share IRQ %d?\n", rtc->irq);
                rtc_device_unregister(rtc->rtcdev);
                goto fail_register;
        }
@@ -386,7 +394,7 @@ static int __devexit at91_rtc_remove(struct platform_device *pdev)
        /* disable all interrupts */
        rtt_writel(rtc, MR, mr & ~(AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN));
-        free_irq(AT91_ID_SYS, rtc);
+        free_irq(rtc->irq, rtc);
        rtc_device_unregister(rtc->rtcdev);
@@ -423,7 +431,7 @@ static int at91_rtc_suspend(struct platform_device *pdev,
        rtc->imr = mr & (AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN);
        if (rtc->imr) {
                if (device_may_wakeup(&pdev->dev) && (mr & AT91_RTT_ALMIEN)) {
-                        enable_irq_wake(AT91_ID_SYS);
+                        enable_irq_wake(rtc->irq);
                        /* don't let RTTINC cause wakeups */
                        if (mr & AT91_RTT_RTTINCIEN)
                                rtt_writel(rtc, MR, mr & ~AT91_RTT_RTTINCIEN);
@@ -441,7 +449,7 @@ static int at91_rtc_resume(struct platform_device *pdev)
        if (rtc->imr) {
                if (device_may_wakeup(&pdev->dev))
-                        disable_irq_wake(AT91_ID_SYS);
+                        disable_irq_wake(rtc->irq);
                mr = rtt_readl(rtc, MR);
                rtt_writel(rtc, MR, mr | rtc->imr);
        }
diff --git a/drivers/rtc/rtc-pcf2123.c b/drivers/rtc/rtc-pcf2123.c
index 836118795c0b..13e4df63974f 100644
--- a/drivers/rtc/rtc-pcf2123.c
+++ b/drivers/rtc/rtc-pcf2123.c
@@ -43,6 +43,7 @@
 #include <linux/rtc.h>
 #include <linux/spi/spi.h>
 #include <linux/module.h>
+#include <linux/sysfs.h>
 #define DRV_VERSION "0.6"
@@ -292,6 +293,7 @@ static int __devinit pcf2123_probe(struct spi_device *spi)
        pdata->rtc = rtc;
        for (i = 0; i < 16; i++) {
+                sysfs_attr_init(&pdata->regs[i].attr.attr);
                sprintf(pdata->regs[i].name, "%1x", i);
                pdata->regs[i].attr.attr.mode = S_IRUGO | S_IWUSR;
                pdata->regs[i].attr.attr.name = pdata->regs[i].name;
diff --git a/drivers/rtc/rtc-rs5c348.c b/drivers/rtc/rtc-rs5c348.c
index 77074ccd2850..fd5c7af04ae5 100644
--- a/drivers/rtc/rtc-rs5c348.c
+++ b/drivers/rtc/rtc-rs5c348.c
@@ -122,9 +122,12 @@ rs5c348_rtc_read_time(struct device *dev, struct rtc_time *tm)
        tm->tm_min = bcd2bin(rxbuf[RS5C348_REG_MINS] & RS5C348_MINS_MASK);
        tm->tm_hour = bcd2bin(rxbuf[RS5C348_REG_HOURS] & RS5C348_HOURS_MASK);
        if (!pdata->rtc_24h) {
-                tm->tm_hour %= 12;
+                if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM) {
-                if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM)
+                        tm->tm_hour -= 20;
+                        tm->tm_hour %= 12;
                        tm->tm_hour += 12;
+                } else
+                        tm->tm_hour %= 12;
        }
        tm->tm_wday = bcd2bin(rxbuf[RS5C348_REG_WDAY] & RS5C348_WDAY_MASK);
        tm->tm_mday = bcd2bin(rxbuf[RS5C348_REG_DAY] & RS5C348_DAY_MASK);
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 40a826a7295f..2fb2b9ea97ec 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3804,7 +3804,7 @@ dasd_eckd_ioctl(struct dasd_block *block, unsigned int cmd, void __user *argp)
        case BIODASDSYMMIO:
                return dasd_symm_io(device, argp);
        default:
-                return -ENOIOCTLCMD;
+                return -ENOTTY;
        }
 }
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index cceae70279f6..654c6921a6d4 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -498,12 +498,9 @@ int dasd_ioctl(struct block_device *bdev, fmode_t mode,
                break;
        default:
                /* if the discipline has an ioctl method try it. */
-                if (base->discipline->ioctl) {
+                rc = -ENOTTY;
+                if (base->discipline->ioctl)
                        rc = base->discipline->ioctl(block, cmd, argp);
-                        if (rc == -ENOIOCTLCMD)
-                                rc = -EINVAL;
-                } else
-                        rc = -EINVAL;
        }
        dasd_put_device(base);
        return rc;
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index dc27598785e5..ed38454228c6 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4066,7 +4066,6 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        spin_lock_init(&instance->cmd_pool_lock);
        spin_lock_init(&instance->hba_lock);
        spin_lock_init(&instance->completion_lock);
-        spin_lock_init(&poll_aen_lock);
        mutex_init(&instance->aen_mutex);
        mutex_init(&instance->reset_mutex);
@@ -5392,6 +5391,8 @@ static int __init megasas_init(void)
        printk(KERN_INFO "megasas: %s %s\n", MEGASAS_VERSION,
               MEGASAS_EXT_VERSION);
+        spin_lock_init(&poll_aen_lock);
        support_poll_for_event = 2;
        support_device_change = 1;
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 9d46fcbe7755..b25757d1e91b 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -2424,10 +2424,13 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
        }
        /* command line tunables  for max controller queue depth */
-        if (max_queue_depth != -1)
+        if (max_queue_depth != -1 && max_queue_depth != 0) {
-                max_request_credit = (max_queue_depth < facts->RequestCredit)
+                max_request_credit = min_t(u16, max_queue_depth +
-                    ? max_queue_depth : facts->RequestCredit;
+                        ioc->hi_priority_depth + ioc->internal_depth,
-        else
+                        facts->RequestCredit);
+                if (max_request_credit > MAX_HBA_QUEUE_DEPTH)
+                        max_request_credit =  MAX_HBA_QUEUE_DEPTH;
+        } else
                max_request_credit = min_t(u16, facts->RequestCredit,
                    MAX_HBA_QUEUE_DEPTH);
@@ -2502,7 +2505,7 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
        /* set the scsi host can_queue depth
         * with some internal commands that could be outstanding
         */
-        ioc->shost->can_queue = ioc->scsiio_depth - (2);
+        ioc->shost->can_queue = ioc->scsiio_depth;
        dinitprintk(ioc, printk(MPT2SAS_INFO_FMT "scsi host: "
            "can_queue depth (%d)\n", ioc->name, ioc->shost->can_queue));
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 4a6381c87253..de2337f255a7 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -42,6 +42,8 @@
 #include <trace/events/scsi.h>
+static void scsi_eh_done(struct scsi_cmnd *scmd);
 #define SENSE_TIMEOUT           (10*HZ)
 /*
@@ -241,6 +243,14 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
        if (! scsi_command_normalize_sense(scmd, &sshdr))
                return FAILED;  /* no valid sense data */
+        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
+                /*
+                 * nasty: for mid-layer issued TURs, we need to return the
+                 * actual sense data without any recovery attempt.  For eh
+                 * issued ones, we need to try to recover and interpret
+                 */
+                return SUCCESS;
        if (scsi_sense_is_deferred(&sshdr))
                return NEEDS_RETRY;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ffd77739ae3e..faa790fba134 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -776,7 +776,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
        }
        if (req->cmd_type == REQ_TYPE_BLOCK_PC) { /* SG_IO ioctl from block level */
-                req->errors = result;
                if (result) {
                        if (sense_valid && req->sense) {
                                /*
@@ -792,6 +791,10 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                        if (!sense_deferred)
                                error = __scsi_error_from_host_byte(cmd, result);
                }
+                /*
+                 * __scsi_error_from_host_byte may have reset the host_byte
+                 */
+                req->errors = cmd->result;
                req->resid_len = scsi_get_resid(cmd);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 56a93794c470..d947ffc20ceb 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -764,6 +764,16 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
        sdev->model = (char *) (sdev->inquiry + 16);
        sdev->rev = (char *) (sdev->inquiry + 32);
+        if (strncmp(sdev->vendor, "ATA     ", 8) == 0) {
+                /*
+                 * sata emulation layer device.  This is a hack to work around
+                 * the SATL power management specifications which state that
+                 * when the SATL detects the device has gone into standby
+                 * mode, it shall respond with NOT READY.
+                 */
+                sdev->allow_restart = 1;
+        }
        if (*bflags & BLIST_ISROM) {
                sdev->type = TYPE_ROM;
                sdev->removable = 1;
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 6e25ef1bce91..a9f4049c6769 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -47,6 +47,8 @@ struct bcm63xx_spi {
        /* Platform data */
        u32                     speed_hz;
        unsigned                fifo_size;
+        unsigned int            msg_type_shift;
+        unsigned int            msg_ctl_width;
        /* Data buffers */
        const unsigned char     *tx_ptr;
@@ -221,13 +223,20 @@ static unsigned int bcm63xx_txrx_bufs(struct spi_device *spi,
        msg_ctl = (t->len << SPI_BYTE_CNT_SHIFT);
        if (t->rx_buf && t->tx_buf)
-                msg_ctl |= (SPI_FD_RW << SPI_MSG_TYPE_SHIFT);
+                msg_ctl |= (SPI_FD_RW << bs->msg_type_shift);
        else if (t->rx_buf)
-                msg_ctl |= (SPI_HD_R << SPI_MSG_TYPE_SHIFT);
+                msg_ctl |= (SPI_HD_R << bs->msg_type_shift);
        else if (t->tx_buf)
-                msg_ctl |= (SPI_HD_W << SPI_MSG_TYPE_SHIFT);
+                msg_ctl |= (SPI_HD_W << bs->msg_type_shift);
-        bcm_spi_writew(bs, msg_ctl, SPI_MSG_CTL);
+        switch (bs->msg_ctl_width) {
+        case 8:
+                bcm_spi_writeb(bs, msg_ctl, SPI_MSG_CTL);
+                break;
+        case 16:
+                bcm_spi_writew(bs, msg_ctl, SPI_MSG_CTL);
+                break;
+        }
        /* Issue the transfer */
        cmd = SPI_CMD_START_IMMEDIATE;
@@ -406,9 +415,21 @@ static int __devinit bcm63xx_spi_probe(struct platform_device *pdev)
        master->transfer_one_message = bcm63xx_spi_transfer_one;
        master->mode_bits = MODEBITS;
        bs->speed_hz = pdata->speed_hz;
+        bs->msg_type_shift = pdata->msg_type_shift;
+        bs->msg_ctl_width = pdata->msg_ctl_width;
        bs->tx_io = (u8 *)(bs->regs + bcm63xx_spireg(SPI_MSG_DATA));
        bs->rx_io = (const u8 *)(bs->regs + bcm63xx_spireg(SPI_RX_DATA));
+        switch (bs->msg_ctl_width) {
+        case 8:
+        case 16:
+                break;
+        default:
+                dev_err(dev, "unsupported MSG_CTL width: %d\n",
+                         bs->msg_ctl_width);
+                goto out_clk_disable;
+        }
        /* Initialize hardware */
        clk_enable(bs->clk);
        bcm_spi_writeb(bs, SPI_INTR_CLEAR_ALL, SPI_INT_STATUS);
@@ -438,7 +459,7 @@ out:
 static int __devexit bcm63xx_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master = platform_get_drvdata(pdev);
+        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
        struct bcm63xx_spi *bs = spi_master_get_devdata(master);
        spi_unregister_master(master);
@@ -452,6 +473,8 @@ static int __devexit bcm63xx_spi_remove(struct platform_device *pdev)
        platform_set_drvdata(pdev, 0);
+        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
index b2d4b9e4e010..764bfee75920 100644
--- a/drivers/spi/spi-coldfire-qspi.c
+++ b/drivers/spi/spi-coldfire-qspi.c
@@ -533,7 +533,6 @@ static int __devexit mcfqspi_remove(struct platform_device *pdev)
        iounmap(mcfqspi->iobase);
        release_mem_region(res->start, resource_size(res));
        spi_unregister_master(master);
-        spi_master_put(master);
        return 0;
 }
@@ -541,7 +540,7 @@ static int __devexit mcfqspi_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM_SLEEP
 static int mcfqspi_suspend(struct device *dev)
 {
-        struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
+        struct spi_master *master = dev_get_drvdata(dev);
        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
        spi_master_suspend(master);
@@ -553,7 +552,7 @@ static int mcfqspi_suspend(struct device *dev)
 static int mcfqspi_resume(struct device *dev)
 {
-        struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
+        struct spi_master *master = dev_get_drvdata(dev);
        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
        spi_master_resume(master);
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index bc4778175e34..b2fb141da375 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -1228,18 +1228,16 @@ static int __devinit omap2_mcspi_probe(struct platform_device *pdev)
        status = spi_register_master(master);
        if (status < 0)
-                goto err_spi_register;
+                goto disable_pm;
        return status;
-err_spi_register:
-        spi_master_put(master);
 disable_pm:
        pm_runtime_disable(&pdev->dev);
 dma_chnl_free:
        kfree(mcspi->dma_channels);
 free_master:
-        kfree(master);
+        spi_master_put(master);
        platform_set_drvdata(pdev, NULL);
        return status;
 }
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index aab518ec2bbc..6abbe23c39b4 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -2053,7 +2053,6 @@ pl022_probe(struct amba_device *adev, const struct amba_id *id)
        printk(KERN_INFO "pl022: mapped registers from 0x%08x to %p\n",
               adev->res.start, pl022->virtbase);
-        pm_runtime_enable(dev);
        pm_runtime_resume(dev);
        pl022->clk = clk_get(&adev->dev, NULL);
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index cfa2c35dfeed..d1c8441f638c 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -1479,40 +1479,40 @@ static const struct dev_pm_ops s3c64xx_spi_pm = {
                           s3c64xx_spi_runtime_resume, NULL)
 };
-struct s3c64xx_spi_port_config s3c2443_spi_port_config = {
+static struct s3c64xx_spi_port_config s3c2443_spi_port_config = {
        .fifo_lvl_mask  = { 0x7f },
        .rx_lvl_offset  = 13,
        .tx_st_done     = 21,
        .high_speed     = true,
 };
-struct s3c64xx_spi_port_config s3c6410_spi_port_config = {
+static struct s3c64xx_spi_port_config s3c6410_spi_port_config = {
        .fifo_lvl_mask  = { 0x7f, 0x7F },
        .rx_lvl_offset  = 13,
        .tx_st_done     = 21,
 };
-struct s3c64xx_spi_port_config s5p64x0_spi_port_config = {
+static struct s3c64xx_spi_port_config s5p64x0_spi_port_config = {
        .fifo_lvl_mask  = { 0x1ff, 0x7F },
        .rx_lvl_offset  = 15,
        .tx_st_done     = 25,
 };
-struct s3c64xx_spi_port_config s5pc100_spi_port_config = {
+static struct s3c64xx_spi_port_config s5pc100_spi_port_config = {
        .fifo_lvl_mask  = { 0x7f, 0x7F },
        .rx_lvl_offset  = 13,
        .tx_st_done     = 21,
        .high_speed     = true,
 };
-struct s3c64xx_spi_port_config s5pv210_spi_port_config = {
+static struct s3c64xx_spi_port_config s5pv210_spi_port_config = {
        .fifo_lvl_mask  = { 0x1ff, 0x7F },
        .rx_lvl_offset  = 15,
        .tx_st_done     = 25,
        .high_speed     = true,
 };
-struct s3c64xx_spi_port_config exynos4_spi_port_config = {
+static struct s3c64xx_spi_port_config exynos4_spi_port_config = {
        .fifo_lvl_mask  = { 0x1ff, 0x7F, 0x7F },
        .rx_lvl_offset  = 15,
        .tx_st_done     = 25,
diff --git a/drivers/staging/android/android_alarm.h b/drivers/staging/android/android_alarm.h
index d0cafd637199..f2ffd963f1c3 100644
--- a/drivers/staging/android/android_alarm.h
+++ b/drivers/staging/android/android_alarm.h
@@ -51,10 +51,12 @@ enum android_alarm_return_flags {
 #define ANDROID_ALARM_WAIT                  _IO('a', 1)
 #define ALARM_IOW(c, type, size)            _IOW('a', (c) | ((type) << 4), size)
+#define ALARM_IOR(c, type, size)            _IOR('a', (c) | ((type) << 4), size)
 /* Set alarm */
 #define ANDROID_ALARM_SET(type)             ALARM_IOW(2, type, struct timespec)
 #define ANDROID_ALARM_SET_AND_WAIT(type)    ALARM_IOW(3, type, struct timespec)
-#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOW(4, type, struct timespec)
+#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOR(4, type, struct timespec)
 #define ANDROID_ALARM_SET_RTC               _IOW('a', 5, struct timespec)
 #define ANDROID_ALARM_BASE_CMD(cmd)         (cmd & ~(_IOC(0, 0, 0xf0, 0)))
 #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd)    (_IOC_NR(cmd) >> 4)
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index c0fdb00783ed..2359151af7e1 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -168,7 +168,7 @@ int comedi_device_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                        dev->board_ptr = comedi_recognize(driv, it->board_name);
                        if (dev->board_ptr)
                                break;
-                } else if (strcmp(driv->driver_name, it->board_name))
+                } else if (strcmp(driv->driver_name, it->board_name) == 0)
                        break;
                module_put(driv->module);
        }
diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index 31986608eaf1..6b4d0d68e637 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -1349,9 +1349,6 @@ static struct pci_dev *pci1710_find_pci_dev(struct comedi_device *dev,
                }
                if (pcidev->vendor != PCI_VENDOR_ID_ADVANTECH)
                        continue;
-                if (pci_is_enabled(pcidev))
-                        continue;
                if (strcmp(this_board->name, DRV_NAME) == 0) {
                        for (i = 0; i < ARRAY_SIZE(boardtypes); ++i) {
                                if (pcidev->device == boardtypes[i].device_id) {
diff --git a/drivers/staging/comedi/drivers/adv_pci1723.c b/drivers/staging/comedi/drivers/adv_pci1723.c
index da5ee69d2c9d..dfde0f6328dd 100644
--- a/drivers/staging/comedi/drivers/adv_pci1723.c
+++ b/drivers/staging/comedi/drivers/adv_pci1723.c
@@ -301,8 +301,6 @@ static struct pci_dev *pci1723_find_pci_dev(struct comedi_device *dev,
                }
                if (pcidev->vendor != PCI_VENDOR_ID_ADVANTECH)
                        continue;
-                if (pci_is_enabled(pcidev))
-                        continue;
                return pcidev;
        }
        dev_err(dev->class_dev,
diff --git a/drivers/staging/comedi/drivers/adv_pci_dio.c b/drivers/staging/comedi/drivers/adv_pci_dio.c
index 97f06dc8e48d..2d4cb7f638b2 100644
--- a/drivers/staging/comedi/drivers/adv_pci_dio.c
+++ b/drivers/staging/comedi/drivers/adv_pci_dio.c
@@ -1064,8 +1064,6 @@ static struct pci_dev *pci_dio_find_pci_dev(struct comedi_device *dev,
                            slot != PCI_SLOT(pcidev->devfn))
                                continue;
                }
-                if (pci_is_enabled(pcidev))
-                        continue;
                for (i = 0; i < ARRAY_SIZE(boardtypes); ++i) {
                        if (boardtypes[i].vendor_id != pcidev->vendor)
                                continue;
diff --git a/drivers/staging/comedi/drivers/amplc_dio200.c b/drivers/staging/comedi/drivers/amplc_dio200.c
index 6c81e377262c..cc8931fde839 100644
--- a/drivers/staging/comedi/drivers/amplc_dio200.c
+++ b/drivers/staging/comedi/drivers/amplc_dio200.c
@@ -1412,6 +1412,13 @@ static int __devinit dio200_attach_pci(struct comedi_device *dev,
                dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                return -EINVAL;
        }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in dio200_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via dio200_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
        return dio200_pci_common_attach(dev, pci_dev);
 }
diff --git a/drivers/staging/comedi/drivers/amplc_pc236.c b/drivers/staging/comedi/drivers/amplc_pc236.c
index aabba9886b7d..f50287903038 100644
--- a/drivers/staging/comedi/drivers/amplc_pc236.c
+++ b/drivers/staging/comedi/drivers/amplc_pc236.c
@@ -565,6 +565,13 @@ static int __devinit pc236_attach_pci(struct comedi_device *dev,
                dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                return -EINVAL;
        }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pc236_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pc236_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
        return pc236_pci_common_attach(dev, pci_dev);
 }
diff --git a/drivers/staging/comedi/drivers/amplc_pc263.c b/drivers/staging/comedi/drivers/amplc_pc263.c
index 40ec1ffebba6..8191c4e28e0a 100644
--- a/drivers/staging/comedi/drivers/amplc_pc263.c
+++ b/drivers/staging/comedi/drivers/amplc_pc263.c
@@ -298,6 +298,13 @@ static int __devinit pc263_attach_pci(struct comedi_device *dev,
                dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                return -EINVAL;
        }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pc263_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pc263_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
        return pc263_pci_common_attach(dev, pci_dev);
 }
diff --git a/drivers/staging/comedi/drivers/amplc_pci224.c b/drivers/staging/comedi/drivers/amplc_pci224.c
index 4e17f13e57f6..8bf109e7bb05 100644
--- a/drivers/staging/comedi/drivers/amplc_pci224.c
+++ b/drivers/staging/comedi/drivers/amplc_pci224.c
@@ -1503,6 +1503,13 @@ pci224_attach_pci(struct comedi_device *dev, struct pci_dev *pci_dev)
                        DRIVER_NAME ": BUG! cannot determine board type!\n");
                return -EINVAL;
        }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pci224_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pci224_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
        return pci224_attach_common(dev, pci_dev, NULL);
 }
diff --git a/drivers/staging/comedi/drivers/amplc_pci230.c b/drivers/staging/comedi/drivers/amplc_pci230.c
index 1b67d0c61fa7..66e74bd12267 100644
--- a/drivers/staging/comedi/drivers/amplc_pci230.c
+++ b/drivers/staging/comedi/drivers/amplc_pci230.c
@@ -2925,6 +2925,13 @@ static int __devinit pci230_attach_pci(struct comedi_device *dev,
                        "amplc_pci230: BUG! cannot determine board type!\n");
                return -EINVAL;
        }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pci230_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pci230_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
        return pci230_attach_common(dev, pci_dev);
 }
diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
index ef28385c1482..cad559a1a730 100644
--- a/drivers/staging/comedi/drivers/daqboard2000.c
+++ b/drivers/staging/comedi/drivers/daqboard2000.c
@@ -718,7 +718,8 @@ static struct pci_dev *daqboard2000_find_pci_dev(struct comedi_device *dev,
                                continue;
                }
                if (pcidev->vendor != PCI_VENDOR_ID_IOTECH ||
-                    pcidev->device != 0x0409)
+                    pcidev->device != 0x0409 ||
+                    pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
                        continue;
                for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
@@ -739,6 +740,7 @@ static int daqboard2000_attach(struct comedi_device *dev,
 {
        struct pci_dev *pcidev;
        struct comedi_subdevice *s;
+        resource_size_t pci_base;
        void *aux_data;
        unsigned int aux_len;
        int result;
@@ -758,11 +760,12 @@ static int daqboard2000_attach(struct comedi_device *dev,
                        "failed to enable PCI device and request regions\n");
                return -EIO;
        }
-        dev->iobase = pci_resource_start(pcidev, 2);
+        dev->iobase = 1;        /* the "detach" needs this */
-        devpriv->plx =
+        pci_base = pci_resource_start(pcidev, 0);
-            ioremap(pci_resource_start(pcidev, 0), DAQBOARD2000_PLX_SIZE);
+        devpriv->plx = ioremap(pci_base, DAQBOARD2000_PLX_SIZE);
-        devpriv->daq = ioremap(dev->iobase, DAQBOARD2000_DAQ_SIZE);
+        pci_base = pci_resource_start(pcidev, 2);
+        devpriv->daq = ioremap(pci_base, DAQBOARD2000_DAQ_SIZE);
        if (!devpriv->plx || !devpriv->daq)
                return -ENOMEM;
@@ -799,8 +802,6 @@ static int daqboard2000_attach(struct comedi_device *dev,
           printk("Interrupt after is: %x\n", interrupt);
         */
-        dev->iobase = (unsigned long)devpriv->daq;
        dev->board_name = this_board->name;
        s = dev->subdevices + 0;
@@ -824,7 +825,7 @@ static int daqboard2000_attach(struct comedi_device *dev,
        s = dev->subdevices + 2;
        result = subdev_8255_init(dev, s, daqboard2000_8255_cb,
-                                  (unsigned long)(dev->iobase + 0x40));
+                                  (unsigned long)(devpriv->daq + 0x40));
 out:
        return result;
diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
index 874e02e47668..67a914a10b55 100644
--- a/drivers/staging/comedi/drivers/das08.c
+++ b/drivers/staging/comedi/drivers/das08.c
@@ -378,7 +378,7 @@ das08jr_ao_winsn(struct comedi_device *dev, struct comedi_subdevice *s,
        int chan;
        lsb = data[0] & 0xff;
-        msb = (data[0] >> 8) & 0xf;
+        msb = (data[0] >> 8) & 0xff;
        chan = CR_CHAN(insn->chanspec);
@@ -623,7 +623,7 @@ static const struct das08_board_struct das08_boards[] = {
                .ai = das08_ai_rinsn,
                .ai_nbits = 16,
                .ai_pg = das08_pg_none,
-                .ai_encoding = das08_encode12,
+                .ai_encoding = das08_encode16,
                .ao = das08jr_ao_winsn,
                .ao_nbits = 16,
                .di = das08jr_di_rbits,
@@ -922,6 +922,13 @@ das08_attach_pci(struct comedi_device *dev, struct pci_dev *pdev)
                dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                return -EINVAL;
        }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in das08_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via das08_attach()
+         * has been removed.
+         */
+        pci_dev_get(pdev);
        return das08_pci_attach_common(dev, pdev);
 }
diff --git a/drivers/staging/comedi/drivers/dt3000.c b/drivers/staging/comedi/drivers/dt3000.c
index a6fe6c9be87e..3476cda0fff0 100644
--- a/drivers/staging/comedi/drivers/dt3000.c
+++ b/drivers/staging/comedi/drivers/dt3000.c
@@ -804,6 +804,7 @@ static int dt3000_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 {
        struct pci_dev *pcidev;
        struct comedi_subdevice *s;
+        resource_size_t pci_base;
        int ret = 0;
        dev_dbg(dev->class_dev, "dt3000:\n");
@@ -820,9 +821,10 @@ static int dt3000_attach(struct comedi_device *dev, struct comedi_devconfig *it)
        ret = comedi_pci_enable(pcidev, "dt3000");
        if (ret < 0)
                return ret;
+        dev->iobase = 1;        /* the "detach" needs this */
-        dev->iobase = pci_resource_start(pcidev, 0);
+        pci_base  = pci_resource_start(pcidev, 0);
-        devpriv->io_addr = ioremap(dev->iobase, DT3000_SIZE);
+        devpriv->io_addr = ioremap(pci_base, DT3000_SIZE);
        if (!devpriv->io_addr)
                return -ENOMEM;
diff --git a/drivers/staging/comedi/drivers/rtd520.c b/drivers/staging/comedi/drivers/rtd520.c
index 112fdc3e9c69..5aa8be1e7b92 100644
--- a/drivers/staging/comedi/drivers/rtd520.c
+++ b/drivers/staging/comedi/drivers/rtd520.c
@@ -1619,9 +1619,8 @@ static int rtd_attach(struct comedi_device *dev, struct comedi_devconfig *it)
        struct rtdPrivate *devpriv;
        struct pci_dev *pcidev;
        struct comedi_subdevice *s;
+        resource_size_t pci_base;
        int ret;
-        resource_size_t physLas1;       /* data area */
-        resource_size_t physLcfg;       /* PLX9080 */
 #ifdef USE_DMA
        int index;
 #endif
@@ -1655,20 +1654,15 @@ static int rtd_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                printk(KERN_INFO "Failed to enable PCI device and request regions.\n");
                return ret;
        }
+        dev->iobase = 1;        /* the "detach" needs this */
-        /*
-         * Initialize base addresses
+        /* Initialize the base addresses */
-         */
+        pci_base = pci_resource_start(pcidev, LAS0_PCIINDEX);
-        /* Get the physical address from PCI config */
+        devpriv->las0 = ioremap_nocache(pci_base, LAS0_PCISIZE);
-        dev->iobase = pci_resource_start(pcidev, LAS0_PCIINDEX);
+        pci_base = pci_resource_start(pcidev, LAS1_PCIINDEX);
-        physLas1 = pci_resource_start(pcidev, LAS1_PCIINDEX);
+        devpriv->las1 = ioremap_nocache(pci_base, LAS1_PCISIZE);
-        physLcfg = pci_resource_start(pcidev, LCFG_PCIINDEX);
+        pci_base = pci_resource_start(pcidev, LCFG_PCIINDEX);
-        /* Now have the kernel map this into memory */
+        devpriv->lcfg = ioremap_nocache(pci_base, LCFG_PCISIZE);
-        /* ASSUME page aligned */
-        devpriv->las0 = ioremap_nocache(dev->iobase, LAS0_PCISIZE);
-        devpriv->las1 = ioremap_nocache(physLas1, LAS1_PCISIZE);
-        devpriv->lcfg = ioremap_nocache(physLcfg, LCFG_PCISIZE);
        if (!devpriv->las0 || !devpriv->las1 || !devpriv->lcfg)
                return -ENOMEM;
diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index 848c7ec06976..11ee83681da7 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -102,6 +102,7 @@ sampling rate. If you sample two channels you get 4kHz and so on.
 #define BULK_TIMEOUT 1000
 /* constants for "firmware" upload and download */
+#define FIRMWARE "usbdux_firmware.bin"
 #define USBDUXSUB_FIRMWARE 0xA0
 #define VENDOR_DIR_IN  0xC0
 #define VENDOR_DIR_OUT 0x40
@@ -2791,7 +2792,7 @@ static int usbdux_usb_probe(struct usb_interface *uinterf,
        ret = request_firmware_nowait(THIS_MODULE,
                                      FW_ACTION_HOTPLUG,
-                                      "usbdux_firmware.bin",
+                                      FIRMWARE,
                                      &udev->dev,
                                      GFP_KERNEL,
                                      usbduxsub + index,
@@ -2850,3 +2851,4 @@ module_comedi_usb_driver(usbdux_driver, usbdux_usb_driver);
 MODULE_AUTHOR("Bernd Porr, BerndPorr@f2s.com");
 MODULE_DESCRIPTION("Stirling/ITL USB-DUX -- Bernd.Porr@f2s.com");
 MODULE_LICENSE("GPL");
+MODULE_FIRMWARE(FIRMWARE);
diff --git a/drivers/staging/comedi/drivers/usbduxfast.c b/drivers/staging/comedi/drivers/usbduxfast.c
index d9911588c10a..8eb41257c6ce 100644
--- a/drivers/staging/comedi/drivers/usbduxfast.c
+++ b/drivers/staging/comedi/drivers/usbduxfast.c
@@ -57,6 +57,7 @@
 /*
 * constants for "firmware" upload and download
 */
+#define FIRMWARE                "usbduxfast_firmware.bin"
 #define USBDUXFASTSUB_FIRMWARE  0xA0
 #define VENDOR_DIR_IN           0xC0
 #define VENDOR_DIR_OUT          0x40
@@ -1706,7 +1707,7 @@ static int usbduxfast_usb_probe(struct usb_interface *uinterf,
        ret = request_firmware_nowait(THIS_MODULE,
                                      FW_ACTION_HOTPLUG,
-                                      "usbduxfast_firmware.bin",
+                                      FIRMWARE,
                                      &udev->dev,
                                      GFP_KERNEL,
                                      usbduxfastsub + index,
@@ -1774,3 +1775,4 @@ module_comedi_usb_driver(usbduxfast_driver, usbduxfast_usb_driver);
 MODULE_AUTHOR("Bernd Porr, BerndPorr@f2s.com");
 MODULE_DESCRIPTION("USB-DUXfast, BerndPorr@f2s.com");
 MODULE_LICENSE("GPL");
+MODULE_FIRMWARE(FIRMWARE);
diff --git a/drivers/staging/comedi/drivers/usbduxsigma.c b/drivers/staging/comedi/drivers/usbduxsigma.c
index 543e604791e2..f54ab8c2fcfd 100644
--- a/drivers/staging/comedi/drivers/usbduxsigma.c
+++ b/drivers/staging/comedi/drivers/usbduxsigma.c
@@ -63,6 +63,7 @@ Status: testing
 #define BULK_TIMEOUT 1000
 /* constants for "firmware" upload and download */
+#define FIRMWARE "usbduxsigma_firmware.bin"
 #define USBDUXSUB_FIRMWARE 0xA0
 #define VENDOR_DIR_IN  0xC0
 #define VENDOR_DIR_OUT 0x40
@@ -2780,7 +2781,7 @@ static int usbduxsigma_usb_probe(struct usb_interface *uinterf,
        ret = request_firmware_nowait(THIS_MODULE,
                                      FW_ACTION_HOTPLUG,
-                                      "usbduxsigma_firmware.bin",
+                                      FIRMWARE,
                                      &udev->dev,
                                      GFP_KERNEL,
                                      usbduxsub + index,
@@ -2845,3 +2846,4 @@ module_comedi_usb_driver(usbduxsigma_driver, usbduxsigma_usb_driver);
 MODULE_AUTHOR("Bernd Porr, BerndPorr@f2s.com");
 MODULE_DESCRIPTION("Stirling/ITL USB-DUX SIGMA -- Bernd.Porr@f2s.com");
 MODULE_LICENSE("GPL");
+MODULE_FIRMWARE(FIRMWARE);
diff --git a/drivers/staging/csr/Kconfig b/drivers/staging/csr/Kconfig
index cee8d48d2af9..ad2a1096e920 100644
--- a/drivers/staging/csr/Kconfig
+++ b/drivers/staging/csr/Kconfig
@@ -1,6 +1,6 @@
 config CSR_WIFI
        tristate "CSR wireless driver"
-        depends on MMC && CFG80211_WEXT
+        depends on MMC && CFG80211_WEXT && INET
        select WIRELESS_EXT
        select WEXT_PRIV
        help
diff --git a/drivers/staging/iio/accel/lis3l02dq_ring.c b/drivers/staging/iio/accel/lis3l02dq_ring.c
index 18d108fd967a..f3da59063ed2 100644
--- a/drivers/staging/iio/accel/lis3l02dq_ring.c
+++ b/drivers/staging/iio/accel/lis3l02dq_ring.c
@@ -121,8 +121,10 @@ static int lis3l02dq_get_buffer_element(struct iio_dev *indio_dev,
        if (rx_array == NULL)
                return -ENOMEM;
        ret = lis3l02dq_read_all(indio_dev, rx_array);
-        if (ret < 0)
+        if (ret < 0) {
+                kfree(rx_array);
                return ret;
+        }
        for (i = 0; i < scan_count; i++)
                data[i] = combine_8_to_16(rx_array[i*4+1],
                                        rx_array[i*4+3]);
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index 22c3923d55eb..19a064d649e3 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -647,6 +647,8 @@ static ssize_t ad7192_write_frequency(struct device *dev,
        ret = strict_strtoul(buf, 10, &lval);
        if (ret)
                return ret;
+        if (lval == 0)
+                return -EINVAL;
        mutex_lock(&indio_dev->mlock);
        if (iio_buffer_enabled(indio_dev)) {
@@ -754,7 +756,7 @@ static ssize_t ad7192_set(struct device *dev,
                else
                        st->mode &= ~AD7192_MODE_ACX;
-                ad7192_write_reg(st, AD7192_REG_GPOCON, 3, st->mode);
+                ad7192_write_reg(st, AD7192_REG_MODE, 3, st->mode);
                break;
        default:
                ret = -EINVAL;
@@ -798,6 +800,11 @@ static const struct attribute_group ad7195_attribute_group = {
        .attrs = ad7195_attributes,
 };
+static unsigned int ad7192_get_temp_scale(bool unipolar)
+{
+        return unipolar ? 2815 * 2 : 2815;
+}
 static int ad7192_read_raw(struct iio_dev *indio_dev,
                           struct iio_chan_spec const *chan,
                           int *val,
@@ -824,19 +831,6 @@ static int ad7192_read_raw(struct iio_dev *indio_dev,
                *val = (smpl >> chan->scan_type.shift) &
                        ((1 << (chan->scan_type.realbits)) - 1);
-                switch (chan->type) {
-                case IIO_VOLTAGE:
-                        if (!unipolar)
-                                *val -= (1 << (chan->scan_type.realbits - 1));
-                        break;
-                case IIO_TEMP:
-                        *val -= 0x800000;
-                        *val /= 2815; /* temp Kelvin */
-                        *val -= 273; /* temp Celsius */
-                        break;
-                default:
-                        return -EINVAL;
-                }
                return IIO_VAL_INT;
        case IIO_CHAN_INFO_SCALE:
@@ -848,11 +842,21 @@ static int ad7192_read_raw(struct iio_dev *indio_dev,
                        mutex_unlock(&indio_dev->mlock);
                        return IIO_VAL_INT_PLUS_NANO;
                case IIO_TEMP:
-                        *val =  1000;
+                        *val = 0;
-                        return IIO_VAL_INT;
+                        *val2 = 1000000000 / ad7192_get_temp_scale(unipolar);
+                        return IIO_VAL_INT_PLUS_NANO;
                default:
                        return -EINVAL;
                }
+        case IIO_CHAN_INFO_OFFSET:
+                if (!unipolar)
+                        *val = -(1 << (chan->scan_type.realbits - 1));
+                else
+                        *val = 0;
+                /* Kelvin to Celsius */
+                if (chan->type == IIO_TEMP)
+                        *val -= 273 * ad7192_get_temp_scale(unipolar);
+                return IIO_VAL_INT;
        }
        return -EINVAL;
@@ -890,7 +894,7 @@ static int ad7192_write_raw(struct iio_dev *indio_dev,
                                }
                                ret = 0;
                        }
+                break;
        default:
                ret = -EINVAL;
        }
@@ -942,20 +946,22 @@ static const struct iio_info ad7195_info = {
          .channel = _chan,                                             \
          .channel2 = _chan2,                                           \
          .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |                 \
-          IIO_CHAN_INFO_SCALE_SHARED_BIT,                               \
+          IIO_CHAN_INFO_SCALE_SHARED_BIT |                              \
+          IIO_CHAN_INFO_OFFSET_SHARED_BIT,                              \
          .address = _address,                                          \
          .scan_index = _si,                                            \
-          .scan_type =  IIO_ST('s', 24, 32, 0)}
+          .scan_type =  IIO_ST('u', 24, 32, 0)}
 #define AD7192_CHAN(_chan, _address, _si)                               \
        { .type = IIO_VOLTAGE,                                          \
          .indexed = 1,                                                 \
          .channel = _chan,                                             \
          .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |                 \
-          IIO_CHAN_INFO_SCALE_SHARED_BIT,                               \
+          IIO_CHAN_INFO_SCALE_SHARED_BIT |                              \
+          IIO_CHAN_INFO_OFFSET_SHARED_BIT,                              \
          .address = _address,                                          \
          .scan_index = _si,                                            \
-          .scan_type =  IIO_ST('s', 24, 32, 0)}
+          .scan_type =  IIO_ST('u', 24, 32, 0)}
 #define AD7192_CHAN_TEMP(_chan, _address, _si)                          \
        { .type = IIO_TEMP,                                             \
@@ -965,7 +971,7 @@ static const struct iio_info ad7195_info = {
          IIO_CHAN_INFO_SCALE_SEPARATE_BIT,                             \
          .address = _address,                                          \
          .scan_index = _si,                                            \
-          .scan_type =  IIO_ST('s', 24, 32, 0)}
+          .scan_type =  IIO_ST('u', 24, 32, 0)}
 static struct iio_chan_spec ad7192_channels[] = {
        AD7192_CHAN_DIFF(1, 2, NULL, AD7192_CH_AIN1P_AIN2M, 0),
diff --git a/drivers/staging/iio/adc/ad7298_ring.c b/drivers/staging/iio/adc/ad7298_ring.c
index fd1d855ff57a..506016f01593 100644
--- a/drivers/staging/iio/adc/ad7298_ring.c
+++ b/drivers/staging/iio/adc/ad7298_ring.c
@@ -76,7 +76,7 @@ static irqreturn_t ad7298_trigger_handler(int irq, void *p)
        struct iio_dev *indio_dev = pf->indio_dev;
        struct ad7298_state *st = iio_priv(indio_dev);
        struct iio_buffer *ring = indio_dev->buffer;
-        s64 time_ns;
+        s64 time_ns = 0;
        __u16 buf[16];
        int b_sent, i;
diff --git a/drivers/staging/iio/adc/ad7780.c b/drivers/staging/iio/adc/ad7780.c
index 1ece2ac8de56..19ee49c95de4 100644
--- a/drivers/staging/iio/adc/ad7780.c
+++ b/drivers/staging/iio/adc/ad7780.c
@@ -131,9 +131,10 @@ static const struct ad7780_chip_info ad7780_chip_info_tbl[] = {
                        .indexed = 1,
                        .channel = 0,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_type = {
-                                .sign = 's',
+                                .sign = 'u',
                                .realbits = 24,
                                .storagebits = 32,
                                .shift = 8,
@@ -146,9 +147,10 @@ static const struct ad7780_chip_info ad7780_chip_info_tbl[] = {
                        .indexed = 1,
                        .channel = 0,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_type = {
-                                .sign = 's',
+                                .sign = 'u',
                                .realbits = 20,
                                .storagebits = 32,
                                .shift = 12,
diff --git a/drivers/staging/iio/adc/ad7793.c b/drivers/staging/iio/adc/ad7793.c
index 76fdd7145fc5..112e2b7b5bc4 100644
--- a/drivers/staging/iio/adc/ad7793.c
+++ b/drivers/staging/iio/adc/ad7793.c
@@ -563,8 +563,9 @@ static ssize_t ad7793_show_scale_available(struct device *dev,
        return len;
 }
-static IIO_DEVICE_ATTR_NAMED(in_m_in_scale_available, in-in_scale_available,
+static IIO_DEVICE_ATTR_NAMED(in_m_in_scale_available,
-                             S_IRUGO, ad7793_show_scale_available, NULL, 0);
+                in_voltage-voltage_scale_available, S_IRUGO,
+                ad7793_show_scale_available, NULL, 0);
 static struct attribute *ad7793_attributes[] = {
        &iio_dev_attr_sampling_frequency.dev_attr.attr,
@@ -604,9 +605,6 @@ static int ad7793_read_raw(struct iio_dev *indio_dev,
                *val = (smpl >> chan->scan_type.shift) &
                        ((1 << (chan->scan_type.realbits)) - 1);
-                if (!unipolar)
-                        *val -= (1 << (chan->scan_type.realbits - 1));
                return IIO_VAL_INT;
        case IIO_CHAN_INFO_SCALE:
@@ -620,25 +618,38 @@ static int ad7793_read_raw(struct iio_dev *indio_dev,
                                return IIO_VAL_INT_PLUS_NANO;
                        } else {
                                /* 1170mV / 2^23 * 6 */
-                                scale_uv = (1170ULL * 100000000ULL * 6ULL)
+                                scale_uv = (1170ULL * 100000000ULL * 6ULL);
-                                        >> (chan->scan_type.realbits -
-                                            (unipolar ? 0 : 1));
                        }
                        break;
                case IIO_TEMP:
-                        /* Always uses unity gain and internal ref */
+                                /* 1170mV / 0.81 mV/C / 2^23 */
-                        scale_uv = (2500ULL * 100000000ULL)
+                                scale_uv = 1444444444444ULL;
-                                >> (chan->scan_type.realbits -
-                                (unipolar ? 0 : 1));
                        break;
                default:
                        return -EINVAL;
                }
-                *val2 = do_div(scale_uv, 100000000) * 10;
+                scale_uv >>= (chan->scan_type.realbits - (unipolar ? 0 : 1));
-                *val =  scale_uv;
+                *val = 0;
+                *val2 = scale_uv;
                return IIO_VAL_INT_PLUS_NANO;
+        case IIO_CHAN_INFO_OFFSET:
+                if (!unipolar)
+                        *val = -(1 << (chan->scan_type.realbits - 1));
+                else
+                        *val = 0;
+                /* Kelvin to Celsius */
+                if (chan->type == IIO_TEMP) {
+                        unsigned long long offset;
+                        unsigned int shift;
+                        shift = chan->scan_type.realbits - (unipolar ? 0 : 1);
+                        offset = 273ULL << shift;
+                        do_div(offset, 1444);
+                        *val -= offset;
+                }
+                return IIO_VAL_INT;
        }
        return -EINVAL;
 }
@@ -676,7 +687,7 @@ static int ad7793_write_raw(struct iio_dev *indio_dev,
                                }
                                ret = 0;
                        }
+                break;
        default:
                ret = -EINVAL;
        }
@@ -720,9 +731,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 0,
                        .address = AD7793_CH_AIN1P_AIN1M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 0,
-                        .scan_type = IIO_ST('s', 24, 32, 0)
+                        .scan_type = IIO_ST('u', 24, 32, 0)
                },
                .channel[1] = {
                        .type = IIO_VOLTAGE,
@@ -732,9 +744,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 1,
                        .address = AD7793_CH_AIN2P_AIN2M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 1,
-                        .scan_type = IIO_ST('s', 24, 32, 0)
+                        .scan_type = IIO_ST('u', 24, 32, 0)
                },
                .channel[2] = {
                        .type = IIO_VOLTAGE,
@@ -744,9 +757,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 2,
                        .address = AD7793_CH_AIN3P_AIN3M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 2,
-                        .scan_type = IIO_ST('s', 24, 32, 0)
+                        .scan_type = IIO_ST('u', 24, 32, 0)
                },
                .channel[3] = {
                        .type = IIO_VOLTAGE,
@@ -757,9 +771,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 2,
                        .address = AD7793_CH_AIN1M_AIN1M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 3,
-                        .scan_type = IIO_ST('s', 24, 32, 0)
+                        .scan_type = IIO_ST('u', 24, 32, 0)
                },
                .channel[4] = {
                        .type = IIO_TEMP,
@@ -769,7 +784,7 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
                        IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
                        .scan_index = 4,
-                        .scan_type = IIO_ST('s', 24, 32, 0),
+                        .scan_type = IIO_ST('u', 24, 32, 0),
                },
                .channel[5] = {
                        .type = IIO_VOLTAGE,
@@ -778,9 +793,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel = 4,
                        .address = AD7793_CH_AVDD_MONITOR,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
+                        IIO_CHAN_INFO_SCALE_SEPARATE_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 5,
-                        .scan_type = IIO_ST('s', 24, 32, 0),
+                        .scan_type = IIO_ST('u', 24, 32, 0),
                },
                .channel[6] = IIO_CHAN_SOFT_TIMESTAMP(6),
        },
@@ -793,9 +809,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 0,
                        .address = AD7793_CH_AIN1P_AIN1M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 0,
-                        .scan_type = IIO_ST('s', 16, 32, 0)
+                        .scan_type = IIO_ST('u', 16, 32, 0)
                },
                .channel[1] = {
                        .type = IIO_VOLTAGE,
@@ -805,9 +822,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 1,
                        .address = AD7793_CH_AIN2P_AIN2M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 1,
-                        .scan_type = IIO_ST('s', 16, 32, 0)
+                        .scan_type = IIO_ST('u', 16, 32, 0)
                },
                .channel[2] = {
                        .type = IIO_VOLTAGE,
@@ -817,9 +835,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 2,
                        .address = AD7793_CH_AIN3P_AIN3M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 2,
-                        .scan_type = IIO_ST('s', 16, 32, 0)
+                        .scan_type = IIO_ST('u', 16, 32, 0)
                },
                .channel[3] = {
                        .type = IIO_VOLTAGE,
@@ -830,9 +849,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel2 = 2,
                        .address = AD7793_CH_AIN1M_AIN1M,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SHARED_BIT,
+                        IIO_CHAN_INFO_SCALE_SHARED_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 3,
-                        .scan_type = IIO_ST('s', 16, 32, 0)
+                        .scan_type = IIO_ST('u', 16, 32, 0)
                },
                .channel[4] = {
                        .type = IIO_TEMP,
@@ -842,7 +862,7 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
                        IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
                        .scan_index = 4,
-                        .scan_type = IIO_ST('s', 16, 32, 0),
+                        .scan_type = IIO_ST('u', 16, 32, 0),
                },
                .channel[5] = {
                        .type = IIO_VOLTAGE,
@@ -851,9 +871,10 @@ static const struct ad7793_chip_info ad7793_chip_info_tbl[] = {
                        .channel = 4,
                        .address = AD7793_CH_AVDD_MONITOR,
                        .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                        IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
+                        IIO_CHAN_INFO_SCALE_SEPARATE_BIT |
+                        IIO_CHAN_INFO_OFFSET_SHARED_BIT,
                        .scan_index = 5,
-                        .scan_type = IIO_ST('s', 16, 32, 0),
+                        .scan_type = IIO_ST('u', 16, 32, 0),
                },
                .channel[6] = IIO_CHAN_SOFT_TIMESTAMP(6),
        },
@@ -901,7 +922,7 @@ static int __devinit ad7793_probe(struct spi_device *spi)
        else if (voltage_uv)
                st->int_vref_mv = voltage_uv / 1000;
        else
-                st->int_vref_mv = 2500; /* Build-in ref */
+                st->int_vref_mv = 1170; /* Build-in ref */
        spi_set_drvdata(spi, indio_dev);
        st->spi = spi;
diff --git a/drivers/staging/iio/gyro/adis16260_core.c b/drivers/staging/iio/gyro/adis16260_core.c
index 93aa431287ac..eb8e9d69efd3 100644
--- a/drivers/staging/iio/gyro/adis16260_core.c
+++ b/drivers/staging/iio/gyro/adis16260_core.c
@@ -195,6 +195,8 @@ static ssize_t adis16260_write_frequency(struct device *dev,
        ret = strict_strtol(buf, 10, &val);
        if (ret)
                return ret;
+        if (val == 0)
+                return -EINVAL;
        mutex_lock(&indio_dev->mlock);
        if (spi_get_device_id(st->us)) {
diff --git a/drivers/staging/iio/imu/adis16400_core.c b/drivers/staging/iio/imu/adis16400_core.c
index 1f4c17779b5a..a618327e06ed 100644
--- a/drivers/staging/iio/imu/adis16400_core.c
+++ b/drivers/staging/iio/imu/adis16400_core.c
@@ -234,6 +234,8 @@ static ssize_t adis16400_write_frequency(struct device *dev,
        ret = strict_strtol(buf, 10, &val);
        if (ret)
                return ret;
+        if (val == 0)
+                return -EINVAL;
        mutex_lock(&indio_dev->mlock);
diff --git a/drivers/staging/iio/meter/ade7753.c b/drivers/staging/iio/meter/ade7753.c
index f04ece7fbc2f..3ccff189f258 100644
--- a/drivers/staging/iio/meter/ade7753.c
+++ b/drivers/staging/iio/meter/ade7753.c
@@ -425,6 +425,8 @@ static ssize_t ade7753_write_frequency(struct device *dev,
        ret = strict_strtol(buf, 10, &val);
        if (ret)
                return ret;
+        if (val == 0)
+                return -EINVAL;
        mutex_lock(&indio_dev->mlock);
diff --git a/drivers/staging/iio/meter/ade7754.c b/drivers/staging/iio/meter/ade7754.c
index 6cee28a5e877..abb1e9c8d094 100644
--- a/drivers/staging/iio/meter/ade7754.c
+++ b/drivers/staging/iio/meter/ade7754.c
@@ -445,6 +445,8 @@ static ssize_t ade7754_write_frequency(struct device *dev,
        ret = strict_strtol(buf, 10, &val);
        if (ret)
                return ret;
+        if (val == 0)
+                return -EINVAL;
        mutex_lock(&indio_dev->mlock);
diff --git a/drivers/staging/iio/meter/ade7759.c b/drivers/staging/iio/meter/ade7759.c
index b3f7e0fa9612..eb0a2a98f388 100644
--- a/drivers/staging/iio/meter/ade7759.c
+++ b/drivers/staging/iio/meter/ade7759.c
@@ -385,6 +385,8 @@ static ssize_t ade7759_write_frequency(struct device *dev,
        ret = strict_strtol(buf, 10, &val);
        if (ret)
                return ret;
+        if (val == 0)
+                return -EINVAL;
        mutex_lock(&indio_dev->mlock);
diff --git a/drivers/staging/omapdrm/omap_connector.c b/drivers/staging/omapdrm/omap_connector.c
index 5e2856c0e0bb..55e9c8655850 100644
--- a/drivers/staging/omapdrm/omap_connector.c
+++ b/drivers/staging/omapdrm/omap_connector.c
@@ -48,13 +48,20 @@ static inline void copy_timings_omap_to_drm(struct drm_display_mode *mode,
        mode->vsync_end = mode->vsync_start + timings->vsw;
        mode->vtotal = mode->vsync_end + timings->vbp;
-        /* note: whether or not it is interlaced, +/- h/vsync, etc,
+        mode->flags = 0;
-         * which should be set in the mode flags, is not exposed in
-         * the omap_video_timings struct.. but hdmi driver tracks
+        if (timings->interlace)
-         * those separately so all we have to have to set the mode
+                mode->flags |= DRM_MODE_FLAG_INTERLACE;
-         * is the way to recover these timings values, and the
-         * omap_dss_driver would do the rest.
+        if (timings->hsync_level == OMAPDSS_SIG_ACTIVE_HIGH)
-         */
+                mode->flags |= DRM_MODE_FLAG_PHSYNC;
+        else
+                mode->flags |= DRM_MODE_FLAG_NHSYNC;
+        if (timings->vsync_level == OMAPDSS_SIG_ACTIVE_HIGH)
+                mode->flags |= DRM_MODE_FLAG_PVSYNC;
+        else
+                mode->flags |= DRM_MODE_FLAG_NVSYNC;
 }
 static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
@@ -71,6 +78,22 @@ static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
        timings->vfp = mode->vsync_start - mode->vdisplay;
        timings->vsw = mode->vsync_end - mode->vsync_start;
        timings->vbp = mode->vtotal - mode->vsync_end;
+        timings->interlace = !!(mode->flags & DRM_MODE_FLAG_INTERLACE);
+        if (mode->flags & DRM_MODE_FLAG_PHSYNC)
+                timings->hsync_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        else
+                timings->hsync_level = OMAPDSS_SIG_ACTIVE_LOW;
+        if (mode->flags & DRM_MODE_FLAG_PVSYNC)
+                timings->vsync_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        else
+                timings->vsync_level = OMAPDSS_SIG_ACTIVE_LOW;
+        timings->data_pclk_edge = OMAPDSS_DRIVE_SIG_RISING_EDGE;
+        timings->de_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        timings->sync_pclk_edge = OMAPDSS_DRIVE_SIG_OPPOSITE_EDGES;
 }
 static void omap_connector_dpms(struct drm_connector *connector, int mode)
@@ -187,7 +210,7 @@ static int omap_connector_get_modes(struct drm_connector *connector)
                }
        } else {
                struct drm_display_mode *mode = drm_mode_create(dev);
-                struct omap_video_timings timings;
+                struct omap_video_timings timings = {0};
                dssdrv->get_timings(dssdev, &timings);
@@ -291,7 +314,7 @@ void omap_connector_mode_set(struct drm_connector *connector,
        struct omap_connector *omap_connector = to_omap_connector(connector);
        struct omap_dss_device *dssdev = omap_connector->dssdev;
        struct omap_dss_driver *dssdrv = dssdev->driver;
-        struct omap_video_timings timings;
+        struct omap_video_timings timings = {0};
        copy_timings_drm_to_omap(&timings, mode);
diff --git a/drivers/staging/ozwpan/ozcdev.c b/drivers/staging/ozwpan/ozcdev.c
index d98321945802..758ce0a8d82e 100644
--- a/drivers/staging/ozwpan/ozcdev.c
+++ b/drivers/staging/ozwpan/ozcdev.c
@@ -8,6 +8,7 @@
 #include <linux/cdev.h>
 #include <linux/uaccess.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
 #include "ozconfig.h"
@@ -213,7 +214,7 @@ static int oz_set_active_pd(u8 *addr)
                if (old_pd)
                        oz_pd_put(old_pd);
        } else {
-                if (!memcmp(addr, "\0\0\0\0\0\0", sizeof(addr))) {
+                if (is_zero_ether_addr(addr)) {
                        spin_lock_bh(&g_cdev.lock);
                        pd = g_cdev.active_pd;
                        g_cdev.active_pd = 0;
diff --git a/drivers/staging/rtl8712/recv_linux.c b/drivers/staging/rtl8712/recv_linux.c
index 0e26d5f6cf2d..495ee1205e02 100644
--- a/drivers/staging/rtl8712/recv_linux.c
+++ b/drivers/staging/rtl8712/recv_linux.c
@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adapter *padapter,
        if (skb == NULL)
                goto _recv_indicatepkt_drop;
        skb->data = precv_frame->u.hdr.rx_data;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
-                     precv_frame->u.hdr.rx_head);
-#else
-        skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
-#endif
        skb->len = precv_frame->u.hdr.len;
+        skb_set_tail_pointer(skb, skb->len);
        if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
                skb->ip_summed = CHECKSUM_UNNECESSARY;
        else
diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c
index e4bdf2a2b582..3aa895ec6507 100644
--- a/drivers/staging/vt6656/dpc.c
+++ b/drivers/staging/vt6656/dpc.c
@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
    } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
        cbHeaderSize += 6;
        pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
-        if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
+        if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
            (*pwType == cpu_to_le16(0xF380))) {
                cbHeaderSize -= 8;
            pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index b06fd5b723fa..d536756549e6 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -189,7 +189,7 @@ DEVICE_PARAM(b80211hEnable, "802.11h mode");
 // Static vars definitions
 //
-static struct usb_device_id vt6656_table[] __devinitdata = {
+static struct usb_device_id vt6656_table[] = {
        {USB_DEVICE(VNT_USB_VENDOR_ID, VNT_USB_PRODUCT_ID)},
        {}
 };
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index bb464527fc1b..b6e04e7b629b 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -1699,7 +1699,7 @@ s_bPacketToWirelessUsb(
    // 802.1H
    if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
        if (pDevice->dwDiagRefCount == 0) {
-                if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
+                if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
                    (psEthHeader->wType == cpu_to_le16(0xF380))) {
                        memcpy((PBYTE) (pbyPayloadHead),
                               abySNAP_Bridgetunnel, 6);
@@ -2838,10 +2838,10 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
    Packet_Type = skb->data[ETH_HLEN+1];
    Descriptor_type = skb->data[ETH_HLEN+1+1+2];
    Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+        if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
-        /* 802.1x OR eapol-key challenge frame transfer */
+                /* 802.1x OR eapol-key challenge frame transfer */
-        if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
+                if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
-                (Packet_Type == 3)) {
+                        (Packet_Type == 3)) {
                        bTxeapol_key = TRUE;
                       if(!(Key_info & BIT3) &&  //WPA or RSN group-key challenge
                           (Key_info & BIT8) && (Key_info & BIT9)) {    //send 2/2 key
@@ -2987,19 +2987,19 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
        }
    }
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+        if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
-        if (pDevice->byBBType != BB_TYPE_11A) {
+                if (pDevice->byBBType != BB_TYPE_11A) {
-            pDevice->wCurrentRate = RATE_1M;
+                        pDevice->wCurrentRate = RATE_1M;
-            pDevice->byACKRate = RATE_1M;
+                        pDevice->byACKRate = RATE_1M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
+                        pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
+                        pDevice->byTopOFDMBasicRate = RATE_6M;
-        } else {
+                } else {
-            pDevice->wCurrentRate = RATE_6M;
+                        pDevice->wCurrentRate = RATE_6M;
-            pDevice->byACKRate = RATE_6M;
+                        pDevice->byACKRate = RATE_6M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
+                        pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
+                        pDevice->byTopOFDMBasicRate = RATE_6M;
-        }
+                }
-    }
+        }
    DBG_PRT(MSG_LEVEL_DEBUG,
            KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
@@ -3015,7 +3015,7 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
    if (bNeedEncryption == TRUE) {
        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
-        if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
+        if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
                bNeedEncryption = FALSE;
            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
            if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
diff --git a/drivers/staging/winbond/wbusb.c b/drivers/staging/winbond/wbusb.c
index ef360547ecec..0ca857ac473e 100644
--- a/drivers/staging/winbond/wbusb.c
+++ b/drivers/staging/winbond/wbusb.c
@@ -25,7 +25,7 @@ MODULE_DESCRIPTION("IS89C35 802.11bg WLAN USB Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION("0.1");
-static const struct usb_device_id wb35_table[] __devinitconst = {
+static const struct usb_device_id wb35_table[] = {
        { USB_DEVICE(0x0416, 0x0035) },
        { USB_DEVICE(0x18E8, 0x6201) },
        { USB_DEVICE(0x18E8, 0x6206) },
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index fabff4d650ef..0970127344e6 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -327,9 +327,9 @@ int prism2_get_station(struct wiphy *wiphy, struct net_device *dev,
        return result;
 }
-int prism2_scan(struct wiphy *wiphy, struct net_device *dev,
+int prism2_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
-                struct cfg80211_scan_request *request)
 {
+        struct net_device *dev = request->wdev->netdev;
        struct prism2_wiphy_private *priv = wiphy_priv(wiphy);
        wlandevice_t *wlandev = dev->ml_priv;
        struct p80211msg_dot11req_scan msg1;
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index c214977b4ab4..52b43b7b83d7 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1251,13 +1251,12 @@ static int zcache_pampd_get_data_and_free(char *data, size_t *bufsize, bool raw,
                                        void *pampd, struct tmem_pool *pool,
                                        struct tmem_oid *oid, uint32_t index)
 {
-        int ret = 0;
        BUG_ON(!is_ephemeral(pool));
-        zbud_decompress((struct page *)(data), pampd);
+        if (zbud_decompress((struct page *)(data), pampd) < 0)
+                return -EINVAL;
        zbud_free_and_delist((struct zbud_hdr *)pampd);
        atomic_dec(&zcache_curr_eph_pampd_count);
-        return ret;
+        return 0;
 }
 /*
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 6e32ff6f2fa0..5552fa7426bc 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -673,8 +673,15 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
        struct scsi_device *sd = pdv->pdv_sd;
        int result;
        struct pscsi_plugin_task *pt = cmd->priv;
-        unsigned char *cdb = &pt->pscsi_cdb[0];
+        unsigned char *cdb;
+        /*
+         * Special case for REPORT_LUNs handling where pscsi_plugin_task has
+         * not been allocated because TCM is handling the emulation directly.
+         */
+        if (!pt)
+                return 0;
+        cdb = &pt->pscsi_cdb[0];
        result = pt->pscsi_result;
        /*
         * Hack to make sure that Write-Protect modepage is set if R/O mode is
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 0eaae23d12b5..4de3186dc44e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1165,8 +1165,6 @@ int target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
                        " 0x%02x\n", cmd->se_tfo->get_fabric_name(),
                                cmd->data_length, size, cmd->t_task_cdb[0]);
-                cmd->cmd_spdtl = size;
                if (cmd->data_direction == DMA_TO_DEVICE) {
                        pr_err("Rejecting underflow/overflow"
                                        " WRITE data\n");
@@ -2294,9 +2292,9 @@ transport_generic_get_mem(struct se_cmd *cmd)
        return 0;
 out:
-        while (i >= 0) {
+        while (i > 0) {
-                __free_page(sg_page(&cmd->t_data_sg[i]));
                i--;
+                __free_page(sg_page(&cmd->t_data_sg[i]));
        }
        kfree(cmd->t_data_sg);
        cmd->t_data_sg = NULL;
@@ -2323,9 +2321,12 @@ int transport_generic_new_cmd(struct se_cmd *cmd)
                if (ret < 0)
                        goto out_fail;
        }
+        /*
-        /* Workaround for handling zero-length control CDBs */
+         * If this command doesn't have any payload and we don't have to call
-        if (!(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) && !cmd->data_length) {
+         * into the fabric for data transfers, go ahead and complete it right
+         * away.
+         */
+        if (!cmd->data_length) {
                spin_lock_irq(&cmd->t_state_lock);
                cmd->t_state = TRANSPORT_COMPLETE;
                cmd->transport_state |= CMD_T_ACTIVE;
diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index c5eb3c33c3db..eea69358ced3 100644
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -131,6 +131,7 @@ extern struct list_head ft_lport_list;
 extern struct mutex ft_lport_lock;
 extern struct fc4_prov ft_prov;
 extern struct target_fabric_configfs *ft_configfs;
+extern unsigned int ft_debug_logging;
 /*
 * Fabric methods.
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index b9cb5006177e..823e6922249d 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -48,7 +48,7 @@
 /*
 * Dump cmd state for debugging.
 */
-void ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
+static void _ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
 {
        struct fc_exch *ep;
        struct fc_seq *sp;
@@ -80,6 +80,12 @@ void ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
        }
 }
+void ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
+{
+        if (unlikely(ft_debug_logging))
+                _ft_dump_cmd(cmd, caller);
+}
 static void ft_free_cmd(struct ft_cmd *cmd)
 {
        struct fc_frame *fp;
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 87901fa74dd7..3c9e5b57caab 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -456,7 +456,9 @@ static void ft_prlo(struct fc_rport_priv *rdata)
        struct ft_tport *tport;
        mutex_lock(&ft_lport_lock);
-        tport = rcu_dereference(rdata->local_port->prov[FC_TYPE_FCP]);
+        tport = rcu_dereference_protected(rdata->local_port->prov[FC_TYPE_FCP],
+                                          lockdep_is_held(&ft_lport_lock));
        if (!tport) {
                mutex_unlock(&ft_lport_lock);
                return;
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 070b442c1f81..4720b4ba096a 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -160,10 +160,12 @@ config SERIAL_KS8695_CONSOLE
 config SERIAL_CLPS711X
        tristate "CLPS711X serial port support"
-        depends on ARM && ARCH_CLPS711X
+        depends on ARCH_CLPS711X
        select SERIAL_CORE
+        default y
        help
-          ::: To be written :::
+          This enables the driver for the on-chip UARTs of the Cirrus
+          Logic EP711x/EP721x/EP731x processors.
 config SERIAL_CLPS711X_CONSOLE
        bool "Support for console on CLPS711X serial port"
@@ -173,9 +175,7 @@ config SERIAL_CLPS711X_CONSOLE
          Even if you say Y here, the currently visible virtual console
          (/dev/tty0) will still be used as the system console by default, but
          you can alter that using a kernel command line option such as
-          "console=ttyCL1". (Try "man bootparam" or see the documentation of
+          "console=ttyCL1".
-          your boot loader (lilo or loadlin) about how to pass options to the
-          kernel at boot time.)
 config SERIAL_SAMSUNG
        tristate "Samsung SoC serial support"
diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
index 144cd3987d4c..3ad079ffd049 100644
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1331,7 +1331,7 @@ static const struct spi_device_id ifx_id_table[] = {
 MODULE_DEVICE_TABLE(spi, ifx_id_table);
 /* spi operations */
-static const struct spi_driver ifx_spi_driver = {
+static struct spi_driver ifx_spi_driver = {
        .driver = {
                .name = DRVNAME,
                .pm = &ifx_spi_pm,
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index d5c689d6217e..e309e8b0aaba 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -132,6 +132,7 @@
 #define  UCR4_OREN       (1<<1)  /* Receiver overrun interrupt enable */
 #define  UCR4_DREN       (1<<0)  /* Recv data ready interrupt enable */
 #define  UFCR_RXTL_SHF   0       /* Receiver trigger level shift */
+#define  UFCR_DCEDTE     (1<<6)  /* DCE/DTE mode select */
 #define  UFCR_RFDIV      (7<<7)  /* Reference freq divider mask */
 #define  UFCR_RFDIV_REG(x)      (((x) < 7 ? 6 - (x) : 6) << 7)
 #define  UFCR_TXTL_SHF   10      /* Transmitter trigger level shift */
@@ -667,22 +668,11 @@ static void imx_break_ctl(struct uart_port *port, int break_state)
 static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
 {
        unsigned int val;
-        unsigned int ufcr_rfdiv;
-        /* set receiver / transmitter trigger level.
-         * RFDIV is set such way to satisfy requested uartclk value
-         */
-        val = TXTL << 10 | RXTL;
-        ufcr_rfdiv = (clk_get_rate(sport->clk_per) + sport->port.uartclk / 2)
-                        / sport->port.uartclk;
-        if(!ufcr_rfdiv)
-                ufcr_rfdiv = 1;
-        val |= UFCR_RFDIV_REG(ufcr_rfdiv);
+        /* set receiver / transmitter trigger level */
+        val = readl(sport->port.membase + UFCR) & (UFCR_RFDIV | UFCR_DCEDTE);
+        val |= TXTL << UFCR_TXTL_SHF | RXTL;
        writel(val, sport->port.membase + UFCR);
        return 0;
 }
@@ -754,6 +744,7 @@ static int imx_startup(struct uart_port *port)
                }
        }
+        spin_lock_irqsave(&sport->port.lock, flags);
        /*
         * Finally, clear and enable interrupts
         */
@@ -807,7 +798,6 @@ static int imx_startup(struct uart_port *port)
        /*
         * Enable modem status interrupts
         */
-        spin_lock_irqsave(&sport->port.lock,flags);
        imx_enable_ms(&sport->port);
        spin_unlock_irqrestore(&sport->port.lock,flags);
@@ -837,10 +827,13 @@ static void imx_shutdown(struct uart_port *port)
 {
        struct imx_port *sport = (struct imx_port *)port;
        unsigned long temp;
+        unsigned long flags;
+        spin_lock_irqsave(&sport->port.lock, flags);
        temp = readl(sport->port.membase + UCR2);
        temp &= ~(UCR2_TXEN);
        writel(temp, sport->port.membase + UCR2);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
        if (USE_IRDA(sport)) {
                struct imxuart_platform_data *pdata;
@@ -869,12 +862,14 @@ static void imx_shutdown(struct uart_port *port)
         * Disable all interrupts, port and break condition.
         */
+        spin_lock_irqsave(&sport->port.lock, flags);
        temp = readl(sport->port.membase + UCR1);
        temp &= ~(UCR1_TXMPTYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN);
        if (USE_IRDA(sport))
                temp &= ~(UCR1_IREN);
        writel(temp, sport->port.membase + UCR1);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 static void
@@ -1217,6 +1212,9 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
        struct imx_port *sport = imx_ports[co->index];
        struct imx_port_ucrs old_ucr;
        unsigned int ucr1;
+        unsigned long flags;
+        spin_lock_irqsave(&sport->port.lock, flags);
        /*
         *      First, save UCR1/2/3 and then disable interrupts
@@ -1242,6 +1240,8 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
        while (!(readl(sport->port.membase + USR2) & USR2_TXDC));
        imx_port_ucrs_restore(&sport->port, &old_ucr);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 /*
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 2e341b81ff89..3a667eed63d6 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -73,6 +73,7 @@
 #define AUART_CTRL0_CLKGATE                     (1 << 30)
 #define AUART_CTRL2_CTSEN                       (1 << 15)
+#define AUART_CTRL2_RTSEN                       (1 << 14)
 #define AUART_CTRL2_RTS                         (1 << 11)
 #define AUART_CTRL2_RXE                         (1 << 9)
 #define AUART_CTRL2_TXE                         (1 << 8)
@@ -259,9 +260,12 @@ static void mxs_auart_set_mctrl(struct uart_port *u, unsigned mctrl)
        u32 ctrl = readl(u->membase + AUART_CTRL2);
-        ctrl &= ~AUART_CTRL2_RTS;
+        ctrl &= ~AUART_CTRL2_RTSEN;
-        if (mctrl & TIOCM_RTS)
+        if (mctrl & TIOCM_RTS) {
-                ctrl |= AUART_CTRL2_RTS;
+                if (u->state->port.flags & ASYNC_CTS_FLOW)
+                        ctrl |= AUART_CTRL2_RTSEN;
+        }
        s->ctrl = mctrl;
        writel(ctrl, u->membase + AUART_CTRL2);
 }
@@ -359,9 +363,9 @@ static void mxs_auart_settermios(struct uart_port *u,
        /* figure out the hardware flow control settings */
        if (cflag & CRTSCTS)
-                ctrl2 |= AUART_CTRL2_CTSEN;
+                ctrl2 |= AUART_CTRL2_CTSEN | AUART_CTRL2_RTSEN;
        else
-                ctrl2 &= ~AUART_CTRL2_CTSEN;
+                ctrl2 &= ~(AUART_CTRL2_CTSEN | AUART_CTRL2_RTSEN);
        /* set baud rate */
        baud = uart_get_baud_rate(u, termios, old, 0, u->uartclk);
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index 654755a990df..333c8d012b0e 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -1348,10 +1348,16 @@ static int pmz_verify_port(struct uart_port *port, struct serial_struct *ser)
 static int pmz_poll_get_char(struct uart_port *port)
 {
        struct uart_pmac_port *uap = (struct uart_pmac_port *)port;
+        int tries = 2;
-        while ((read_zsreg(uap, R0) & Rx_CH_AV) == 0)
+        while (tries) {
-                udelay(5);
+                if ((read_zsreg(uap, R0) & Rx_CH_AV) != 0)
-        return read_zsdata(uap);
+                        return read_zsdata(uap);
+                if (tries--)
+                        udelay(5);
+        }
+        return NO_POLL_CHAR;
 }
 static void pmz_poll_put_char(struct uart_port *port, unsigned char c)
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index a7773a3e02b1..7065df6036ca 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -13,7 +13,7 @@ config USB_ARCH_HAS_OHCI
        default y if PXA3xx
        default y if ARCH_EP93XX
        default y if ARCH_AT91
-        default y if ARCH_PNX4008 && I2C
+        default y if ARCH_PNX4008
        default y if MFD_TC6393XB
        default y if ARCH_W90X900
        default y if ARCH_DAVINCI_DA8XX
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index 8337fb5d988d..47e499c9c0b6 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -1,9 +1,9 @@
 config USB_CHIPIDEA
        tristate "ChipIdea Highspeed Dual Role Controller"
-        depends on USB
+        depends on USB || USB_GADGET
        help
-          Say Y here if your system has a dual role high speed USB
+          Say Y here if your system has a dual role high speed USB
-          controller based on ChipIdea silicon IP. Currently, only the
+          controller based on ChipIdea silicon IP. Currently, only the
          peripheral mode is supported.
          When compiled dynamically, the module will be called ci-hdrc.ko.
@@ -12,7 +12,7 @@ if USB_CHIPIDEA
 config USB_CHIPIDEA_UDC
        bool "ChipIdea device controller"
-        depends on USB_GADGET
+        depends on USB_GADGET=y || USB_GADGET=USB_CHIPIDEA
        select USB_GADGET_DUALSPEED
        help
          Say Y here to enable device controller functionality of the
@@ -20,6 +20,7 @@ config USB_CHIPIDEA_UDC
 config USB_CHIPIDEA_HOST
        bool "ChipIdea host controller"
+        depends on USB=y || USB=USB_CHIPIDEA
        select USB_EHCI_ROOT_HUB_TT
        help
          Say Y here to enable host controller functionality of the
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index c7a032a4f0c5..d214448b677e 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -78,8 +78,7 @@ static inline int ep_to_bit(struct ci13xxx *ci, int n)
 }
 /**
- * hw_device_state: enables/disables interrupts & starts/stops device (execute
+ * hw_device_state: enables/disables interrupts (execute without interruption)
- *                  without interruption)
 * @dma: 0 => disable, !0 => enable and set dma engine
 *
 * This function returns an error code
@@ -91,9 +90,7 @@ static int hw_device_state(struct ci13xxx *ci, u32 dma)
                /* interrupt, error, port change, reset, sleep/suspend */
                hw_write(ci, OP_USBINTR, ~0,
                             USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
-                hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
        } else {
-                hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
                hw_write(ci, OP_USBINTR, ~0, 0);
        }
        return 0;
@@ -774,10 +771,7 @@ __acquires(mEp->lock)
 {
        struct ci13xxx_req *mReq, *mReqTemp;
        struct ci13xxx_ep *mEpTemp = mEp;
-        int uninitialized_var(retval);
+        int retval = 0;
-        if (list_empty(&mEp->qh.queue))
-                return -EINVAL;
        list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
                        queue) {
@@ -1420,6 +1414,21 @@ static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
        return -ENOTSUPP;
 }
+/* Change Data+ pullup status
+ * this func is used by usb_gadget_connect/disconnet
+ */
+static int ci13xxx_pullup(struct usb_gadget *_gadget, int is_on)
+{
+        struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
+        if (is_on)
+                hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
+        else
+                hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
+        return 0;
+}
 static int ci13xxx_start(struct usb_gadget *gadget,
                         struct usb_gadget_driver *driver);
 static int ci13xxx_stop(struct usb_gadget *gadget,
@@ -1432,6 +1441,7 @@ static int ci13xxx_stop(struct usb_gadget *gadget,
 static const struct usb_gadget_ops usb_gadget_ops = {
        .vbus_session   = ci13xxx_vbus_session,
        .wakeup         = ci13xxx_wakeup,
+        .pullup         = ci13xxx_pullup,
        .vbus_draw      = ci13xxx_vbus_draw,
        .udc_start      = ci13xxx_start,
        .udc_stop       = ci13xxx_stop,
@@ -1455,7 +1465,12 @@ static int init_eps(struct ci13xxx *ci)
                        mEp->ep.name      = mEp->name;
                        mEp->ep.ops       = &usb_ep_ops;
-                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+                        /*
+                         * for ep0: maxP defined in desc, for other
+                         * eps, maxP is set by epautoconfig() called
+                         * by gadget layer
+                         */
+                        mEp->ep.maxpacket = (unsigned short)~0;
                        INIT_LIST_HEAD(&mEp->qh.queue);
                        mEp->qh.ptr = dma_pool_alloc(ci->qh_pool, GFP_KERNEL,
@@ -1475,6 +1490,7 @@ static int init_eps(struct ci13xxx *ci)
                                else
                                        ci->ep0in = mEp;
+                                mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
                                continue;
                        }
@@ -1484,6 +1500,17 @@ static int init_eps(struct ci13xxx *ci)
        return retval;
 }
+static void destroy_eps(struct ci13xxx *ci)
+{
+        int i;
+        for (i = 0; i < ci->hw_ep_max; i++) {
+                struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];
+                dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);
+        }
+}
 /**
 * ci13xxx_start: register a gadget driver
 * @gadget: our gadget
@@ -1691,7 +1718,7 @@ static int udc_start(struct ci13xxx *ci)
        if (ci->platdata->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
                if (ci->transceiver == NULL) {
                        retval = -ENODEV;
-                        goto free_pools;
+                        goto destroy_eps;
                }
        }
@@ -1729,7 +1756,7 @@ static int udc_start(struct ci13xxx *ci)
 remove_trans:
        if (!IS_ERR_OR_NULL(ci->transceiver)) {
-                otg_set_peripheral(ci->transceiver->otg, &ci->gadget);
+                otg_set_peripheral(ci->transceiver->otg, NULL);
                if (ci->global_phy)
                        usb_put_phy(ci->transceiver);
        }
@@ -1742,6 +1769,8 @@ unreg_device:
 put_transceiver:
        if (!IS_ERR_OR_NULL(ci->transceiver) && ci->global_phy)
                usb_put_phy(ci->transceiver);
+destroy_eps:
+        destroy_eps(ci);
 free_pools:
        dma_pool_destroy(ci->td_pool);
 free_qh_pool:
@@ -1756,18 +1785,12 @@ free_qh_pool:
 */
 static void udc_stop(struct ci13xxx *ci)
 {
-        int i;
        if (ci == NULL)
                return;
        usb_del_gadget_udc(&ci->gadget);
-        for (i = 0; i < ci->hw_ep_max; i++) {
+        destroy_eps(ci);
-                struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];
-                dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);
-        }
        dma_pool_destroy(ci->td_pool);
        dma_pool_destroy(ci->qh_pool);
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 56d6bf668488..f763ed7ba91e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1104,7 +1104,8 @@ skip_normal_probe:
        }
-        if (data_interface->cur_altsetting->desc.bNumEndpoints < 2)
+        if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
+            control_interface->cur_altsetting->desc.bNumEndpoints == 0)
                return -EINVAL;
        epctrl = &control_interface->cur_altsetting->endpoint[0].desc;
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 65a55abb791f..5f0cb417b736 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -109,12 +109,14 @@ static struct usb_driver wdm_driver;
 /* return intfdata if we own the interface, else look up intf in the list */
 static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 {
-        struct wdm_device *desc = NULL;
+        struct wdm_device *desc;
        spin_lock(&wdm_device_list_lock);
        list_for_each_entry(desc, &wdm_device_list, device_list)
                if (desc->intf == intf)
-                        break;
+                        goto found;
+        desc = NULL;
+found:
        spin_unlock(&wdm_device_list_lock);
        return desc;
@@ -122,12 +124,14 @@ static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 static struct wdm_device *wdm_find_device_by_minor(int minor)
 {
-        struct wdm_device *desc = NULL;
+        struct wdm_device *desc;
        spin_lock(&wdm_device_list_lock);
        list_for_each_entry(desc, &wdm_device_list, device_list)
                if (desc->intf->minor == minor)
-                        break;
+                        goto found;
+        desc = NULL;
+found:
        spin_unlock(&wdm_device_list_lock);
        return desc;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f15501f4c585..e77a8e8eaa23 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -71,6 +71,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x04b4, 0x0526), .driver_info =
                        USB_QUIRK_CONFIG_INTF_STRINGS },
+        /* Microchip Joss Optical infrared touchboard device */
+        { USB_DEVICE(0x04d8, 0x000c), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
        /* Samsung Android phone modem - ID conflict with SPH-I500 */
        { USB_DEVICE(0x04e8, 0x6601), .driver_info =
                        USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index c34452a7304f..a68ff53124dc 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -436,16 +436,21 @@ static int __devinit dwc3_probe(struct platform_device *pdev)
                dev_err(dev, "missing IRQ\n");
                return -ENODEV;
        }
-        dwc->xhci_resources[1] = *res;
+        dwc->xhci_resources[1].start = res->start;
+        dwc->xhci_resources[1].end = res->end;
+        dwc->xhci_resources[1].flags = res->flags;
+        dwc->xhci_resources[1].name = res->name;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res) {
                dev_err(dev, "missing memory resource\n");
                return -ENODEV;
        }
-        dwc->xhci_resources[0] = *res;
+        dwc->xhci_resources[0].start = res->start;
        dwc->xhci_resources[0].end = dwc->xhci_resources[0].start +
                                        DWC3_XHCI_REGS_END;
+        dwc->xhci_resources[0].flags = res->flags;
+        dwc->xhci_resources[0].name = res->name;
         /*
          * Request memory region but exclude xHCI regs,
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 9b94886b66e5..e4d5ca86b9da 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -720,7 +720,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                transferred = min_t(u32, ur->length,
                                transfer_size - length);
                memcpy(ur->buf, dwc->ep0_bounce, transferred);
-                dwc->ep0_bounced = false;
        } else {
                transferred = ur->length - length;
        }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 58fdfad96b4d..c2813c2b005a 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -263,8 +263,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
        if (req->request.status == -EINPROGRESS)
                req->request.status = status;
-        usb_gadget_unmap_request(&dwc->gadget, &req->request,
+        if (dwc->ep0_bounced && dep->number == 0)
-                        req->direction);
+                dwc->ep0_bounced = false;
+        else
+                usb_gadget_unmap_request(&dwc->gadget, &req->request,
+                                req->direction);
        dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n",
                        req, dep->name, req->request.actual,
@@ -1026,6 +1029,7 @@ static void __dwc3_gadget_start_isoc(struct dwc3 *dwc,
        if (list_empty(&dep->request_list)) {
                dev_vdbg(dwc->dev, "ISOC ep %s run out for requests.\n",
                        dep->name);
+                dep->flags |= DWC3_EP_PENDING_REQUEST;
                return;
        }
@@ -1089,6 +1093,17 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
        if (dep->flags & DWC3_EP_PENDING_REQUEST) {
                int     ret;
+                /*
+                 * If xfernotready is already elapsed and it is a case
+                 * of isoc transfer, then issue END TRANSFER, so that
+                 * you can receive xfernotready again and can have
+                 * notion of current microframe.
+                 */
+                if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                        dwc3_stop_active_transfer(dwc, dep->number);
+                        return 0;
+                }
                ret = __dwc3_gadget_kick_transfer(dep, 0, true);
                if (ret && ret != -EBUSY) {
                        struct dwc3     *dwc = dep->dwc;
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index c9e66dfb02e6..1e35963bd4ed 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -475,8 +475,7 @@ static int at91_ep_enable(struct usb_ep *_ep,
        unsigned long   flags;
        if (!_ep || !ep
-                        || !desc || ep->ep.desc
+                        || !desc || _ep->name == ep0name
-                        || _ep->name == ep0name
                        || desc->bDescriptorType != USB_DT_ENDPOINT
                        || (maxpacket = usb_endpoint_maxp(desc)) == 0
                        || maxpacket > ep->maxpacket) {
@@ -530,7 +529,6 @@ ok:
        tmp |= AT91_UDP_EPEDS;
        __raw_writel(tmp, ep->creg);
-        ep->ep.desc = desc;
        ep->ep.maxpacket = maxpacket;
        /*
@@ -1635,7 +1633,6 @@ static int at91_start(struct usb_gadget *gadget,
        udc->driver = driver;
        udc->gadget.dev.driver = &driver->driver;
        udc->gadget.dev.of_node = udc->pdev->dev.of_node;
-        dev_set_drvdata(&udc->gadget.dev, &driver->driver);
        udc->enabled = 1;
        udc->selfpowered = 1;
@@ -1656,7 +1653,6 @@ static int at91_stop(struct usb_gadget *gadget,
        spin_unlock_irqrestore(&udc->lock, flags);
        udc->gadget.dev.driver = NULL;
-        dev_set_drvdata(&udc->gadget.dev, NULL);
        udc->driver = NULL;
        DBG("unbound from %s\n", driver->driver.name);
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index b799106027ad..afdbb1cbf5d9 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -1916,6 +1916,27 @@ done:
        return retval;
 }
+/* usb 3.0 root hub device descriptor */
+struct {
+        struct usb_bos_descriptor bos;
+        struct usb_ss_cap_descriptor ss_cap;
+} __packed usb3_bos_desc = {
+        .bos = {
+                .bLength                = USB_DT_BOS_SIZE,
+                .bDescriptorType        = USB_DT_BOS,
+                .wTotalLength           = cpu_to_le16(sizeof(usb3_bos_desc)),
+                .bNumDeviceCaps         = 1,
+        },
+        .ss_cap = {
+                .bLength                = USB_DT_USB_SS_CAP_SIZE,
+                .bDescriptorType        = USB_DT_DEVICE_CAPABILITY,
+                .bDevCapabilityType     = USB_SS_CAP_TYPE,
+                .wSpeedSupported        = cpu_to_le16(USB_5GBPS_OPERATION),
+                .bFunctionalitySupport  = ilog2(USB_5GBPS_OPERATION),
+        },
+};
 static inline void
 ss_hub_descriptor(struct usb_hub_descriptor *desc)
 {
@@ -2006,6 +2027,18 @@ static int dummy_hub_control(
                else
                        hub_descriptor((struct usb_hub_descriptor *) buf);
                break;
+        case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
+                if (hcd->speed != HCD_USB3)
+                        goto error;
+                if ((wValue >> 8) != USB_DT_BOS)
+                        goto error;
+                memcpy(buf, &usb3_bos_desc, sizeof(usb3_bos_desc));
+                retval = sizeof(usb3_bos_desc);
+                break;
        case GetHubStatus:
                *(__le32 *) buf = cpu_to_le32(0);
                break;
@@ -2503,10 +2536,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
        hs_hcd->has_tt = 1;
        retval = usb_add_hcd(hs_hcd, 0, 0);
-        if (retval != 0) {
+        if (retval)
-                usb_put_hcd(hs_hcd);
+                goto put_usb2_hcd;
-                return retval;
-        }
        if (mod_data.is_super_speed) {
                ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
@@ -2525,6 +2556,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
 put_usb3_hcd:
        usb_put_hcd(ss_hcd);
 dealloc_usb2_hcd:
+        usb_remove_hcd(hs_hcd);
+put_usb2_hcd:
        usb_put_hcd(hs_hcd);
        the_controller.hs_hcd = the_controller.ss_hcd = NULL;
        return retval;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 8adc79d1b402..829aba75a6df 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -34,11 +34,15 @@
 /* Debugging ****************************************************************/
 #ifdef VERBOSE_DEBUG
+#ifndef pr_vdebug
 #  define pr_vdebug pr_debug
+#endif /* pr_vdebug */
 #  define ffs_dump_mem(prefix, ptr, len) \
        print_hex_dump_bytes(pr_fmt(prefix ": "), DUMP_PREFIX_NONE, ptr, len)
 #else
+#ifndef pr_vdebug
 #  define pr_vdebug(...)                 do { } while (0)
+#endif /* pr_vdebug */
 #  define ffs_dump_mem(prefix, ptr, len) do { } while (0)
 #endif /* VERBOSE_DEBUG */
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index b13e0bb5f5b8..0bb617e1dda2 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -3599,6 +3599,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
        if (hsotg->num_of_eps == 0) {
                dev_err(dev, "wrong number of EPs (zero)\n");
+                ret = -EINVAL;
                goto err_supplies;
        }
@@ -3606,6 +3607,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
                      GFP_KERNEL);
        if (!eps) {
                dev_err(dev, "cannot get memory\n");
+                ret = -ENOMEM;
                goto err_supplies;
        }
@@ -3622,6 +3624,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
                                                     GFP_KERNEL);
        if (!hsotg->ctrl_req) {
                dev_err(dev, "failed to allocate ctrl req\n");
+                ret = -ENOMEM;
                goto err_ep_mem;
        }
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 90e82e288eb9..0e5230926154 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -669,6 +669,8 @@ static int eth_stop(struct net_device *net)
        spin_lock_irqsave(&dev->lock, flags);
        if (dev->port_usb) {
                struct gether   *link = dev->port_usb;
+                const struct usb_endpoint_descriptor *in;
+                const struct usb_endpoint_descriptor *out;
                if (link->close)
                        link->close(link);
@@ -682,10 +684,14 @@ static int eth_stop(struct net_device *net)
                 * their own pace; the network stack can handle old packets.
                 * For the moment we leave this here, since it works.
                 */
+                in = link->in_ep->desc;
+                out = link->out_ep->desc;
                usb_ep_disable(link->in_ep);
                usb_ep_disable(link->out_ep);
                if (netif_carrier_ok(net)) {
                        DBG(dev, "host still using in/out endpoints\n");
+                        link->in_ep->desc = in;
+                        link->out_ep->desc = out;
                        usb_ep_enable(link->in_ep);
                        usb_ep_enable(link->out_ep);
                }
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 5b3f5fffea92..da6d479ff9a6 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -132,11 +132,15 @@ static unsigned	n_ports;
 #ifdef VERBOSE_DEBUG
+#ifndef pr_vdebug
 #define pr_vdebug(fmt, arg...) \
        pr_debug(fmt, ##arg)
+#endif /* pr_vdebug */
 #else
+#ifndef pr_vdebig
 #define pr_vdebug(fmt, arg...) \
        ({ if (0) pr_debug(fmt, ##arg); })
+#endif /* pr_vdebug */
 #endif
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index bb55eb4a7d48..d7fe287d0678 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -56,15 +56,6 @@
 #define EHCI_INSNREG05_ULPI_EXTREGADD_SHIFT             8
 #define EHCI_INSNREG05_ULPI_WRDATA_SHIFT                0
-/* Errata i693 */
-static struct clk       *utmi_p1_fck;
-static struct clk       *utmi_p2_fck;
-static struct clk       *xclk60mhsp1_ck;
-static struct clk       *xclk60mhsp2_ck;
-static struct clk       *usbhost_p1_fck;
-static struct clk       *usbhost_p2_fck;
-static struct clk       *init_60m_fclk;
 /*-------------------------------------------------------------------------*/
 static const struct hc_driver ehci_omap_hc_driver;
@@ -80,40 +71,6 @@ static inline u32 ehci_read(void __iomem *base, u32 reg)
        return __raw_readl(base + reg);
 }
-/* Erratum i693 workaround sequence */
-static void omap_ehci_erratum_i693(struct ehci_hcd *ehci)
-{
-        int ret = 0;
-        /* Switch to the internal 60 MHz clock */
-        ret = clk_set_parent(utmi_p1_fck, init_60m_fclk);
-        if (ret != 0)
-                ehci_err(ehci, "init_60m_fclk set parent"
-                        "failed error:%d\n", ret);
-        ret = clk_set_parent(utmi_p2_fck, init_60m_fclk);
-        if (ret != 0)
-                ehci_err(ehci, "init_60m_fclk set parent"
-                        "failed error:%d\n", ret);
-        clk_enable(usbhost_p1_fck);
-        clk_enable(usbhost_p2_fck);
-        /* Wait 1ms and switch back to the external clock */
-        mdelay(1);
-        ret = clk_set_parent(utmi_p1_fck, xclk60mhsp1_ck);
-        if (ret != 0)
-                ehci_err(ehci, "xclk60mhsp1_ck set parent"
-                        "failed error:%d\n", ret);
-        ret = clk_set_parent(utmi_p2_fck, xclk60mhsp2_ck);
-        if (ret != 0)
-                ehci_err(ehci, "xclk60mhsp2_ck set parent"
-                        "failed error:%d\n", ret);
-        clk_disable(usbhost_p1_fck);
-        clk_disable(usbhost_p2_fck);
-}
 static void omap_ehci_soft_phy_reset(struct usb_hcd *hcd, u8 port)
 {
@@ -195,50 +152,6 @@ static int omap_ehci_init(struct usb_hcd *hcd)
        return rc;
 }
-static int omap_ehci_hub_control(
-        struct usb_hcd  *hcd,
-        u16             typeReq,
-        u16             wValue,
-        u16             wIndex,
-        char            *buf,
-        u16             wLength
-)
-{
-        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
-        u32 __iomem *status_reg = &ehci->regs->port_status[
-                                (wIndex & 0xff) - 1];
-        u32             temp;
-        unsigned long   flags;
-        int             retval = 0;
-        spin_lock_irqsave(&ehci->lock, flags);
-        if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
-                temp = ehci_readl(ehci, status_reg);
-                if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
-                        retval = -EPIPE;
-                        goto done;
-                }
-                temp &= ~PORT_WKCONN_E;
-                temp |= PORT_WKDISC_E | PORT_WKOC_E;
-                ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
-                omap_ehci_erratum_i693(ehci);
-                set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
-                goto done;
-        }
-        spin_unlock_irqrestore(&ehci->lock, flags);
-        /* Handle the hub control events here */
-        return ehci_hub_control(hcd, typeReq, wValue, wIndex, buf, wLength);
-done:
-        spin_unlock_irqrestore(&ehci->lock, flags);
-        return retval;
-}
 static void disable_put_regulator(
                struct ehci_hcd_omap_platform_data *pdata)
 {
@@ -351,79 +264,9 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
                goto err_pm_runtime;
        }
-        /* get clocks */
-        utmi_p1_fck = clk_get(dev, "utmi_p1_gfclk");
-        if (IS_ERR(utmi_p1_fck)) {
-                ret = PTR_ERR(utmi_p1_fck);
-                dev_err(dev, "utmi_p1_gfclk failed error:%d\n", ret);
-                goto err_add_hcd;
-        }
-        xclk60mhsp1_ck = clk_get(dev, "xclk60mhsp1_ck");
-        if (IS_ERR(xclk60mhsp1_ck)) {
-                ret = PTR_ERR(xclk60mhsp1_ck);
-                dev_err(dev, "xclk60mhsp1_ck failed error:%d\n", ret);
-                goto err_utmi_p1_fck;
-        }
-        utmi_p2_fck = clk_get(dev, "utmi_p2_gfclk");
-        if (IS_ERR(utmi_p2_fck)) {
-                ret = PTR_ERR(utmi_p2_fck);
-                dev_err(dev, "utmi_p2_gfclk failed error:%d\n", ret);
-                goto err_xclk60mhsp1_ck;
-        }
-        xclk60mhsp2_ck = clk_get(dev, "xclk60mhsp2_ck");
-        if (IS_ERR(xclk60mhsp2_ck)) {
-                ret = PTR_ERR(xclk60mhsp2_ck);
-                dev_err(dev, "xclk60mhsp2_ck failed error:%d\n", ret);
-                goto err_utmi_p2_fck;
-        }
-        usbhost_p1_fck = clk_get(dev, "usb_host_hs_utmi_p1_clk");
-        if (IS_ERR(usbhost_p1_fck)) {
-                ret = PTR_ERR(usbhost_p1_fck);
-                dev_err(dev, "usbhost_p1_fck failed error:%d\n", ret);
-                goto err_xclk60mhsp2_ck;
-        }
-        usbhost_p2_fck = clk_get(dev, "usb_host_hs_utmi_p2_clk");
-        if (IS_ERR(usbhost_p2_fck)) {
-                ret = PTR_ERR(usbhost_p2_fck);
-                dev_err(dev, "usbhost_p2_fck failed error:%d\n", ret);
-                goto err_usbhost_p1_fck;
-        }
-        init_60m_fclk = clk_get(dev, "init_60m_fclk");
-        if (IS_ERR(init_60m_fclk)) {
-                ret = PTR_ERR(init_60m_fclk);
-                dev_err(dev, "init_60m_fclk failed error:%d\n", ret);
-                goto err_usbhost_p2_fck;
-        }
        return 0;
-err_usbhost_p2_fck:
-        clk_put(usbhost_p2_fck);
-err_usbhost_p1_fck:
-        clk_put(usbhost_p1_fck);
-err_xclk60mhsp2_ck:
-        clk_put(xclk60mhsp2_ck);
-err_utmi_p2_fck:
-        clk_put(utmi_p2_fck);
-err_xclk60mhsp1_ck:
-        clk_put(xclk60mhsp1_ck);
-err_utmi_p1_fck:
-        clk_put(utmi_p1_fck);
-err_add_hcd:
-        usb_remove_hcd(hcd);
 err_pm_runtime:
        disable_put_regulator(pdata);
        pm_runtime_put_sync(dev);
@@ -454,14 +297,6 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
        iounmap(hcd->regs);
        usb_put_hcd(hcd);
-        clk_put(utmi_p1_fck);
-        clk_put(utmi_p2_fck);
-        clk_put(xclk60mhsp1_ck);
-        clk_put(xclk60mhsp2_ck);
-        clk_put(usbhost_p1_fck);
-        clk_put(usbhost_p2_fck);
-        clk_put(init_60m_fclk);
        pm_runtime_put_sync(dev);
        pm_runtime_disable(dev);
@@ -532,7 +367,7 @@ static const struct hc_driver ehci_omap_hc_driver = {
         * root hub support
         */
        .hub_status_data        = ehci_hub_status_data,
-        .hub_control            = omap_ehci_hub_control,
+        .hub_control            = ehci_hub_control,
        .bus_suspend            = ehci_bus_suspend,
        .bus_resume             = ehci_bus_resume,
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 9bc39ca460c8..4b66374bdc8e 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -128,9 +128,17 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
        else {
                qtd = list_entry (qh->qtd_list.next,
                                struct ehci_qtd, qtd_list);
-                /* first qtd may already be partially processed */
+                /*
-                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
+                 * first qtd may already be partially processed.
+                 * If we come here during unlink, the QH overlay region
+                 * might have reference to the just unlinked qtd. The
+                 * qtd is updated in qh_completions(). Update the QH
+                 * overlay here.
+                 */
+                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
+                        qh->hw->hw_qtd_next = qtd->hw_next;
                        qtd = NULL;
+                }
        }
        if (qtd)
diff --git a/drivers/usb/host/ehci-sead3.c b/drivers/usb/host/ehci-sead3.c
index 58c96bd50d22..0c9e43cfaff5 100644
--- a/drivers/usb/host/ehci-sead3.c
+++ b/drivers/usb/host/ehci-sead3.c
@@ -40,7 +40,7 @@ static int ehci_sead3_setup(struct usb_hcd *hcd)
        ehci->need_io_watchdog = 0;
        /* Set burst length to 16 words. */
-        ehci_writel(ehci, 0x1010, &ehci->regs->reserved[1]);
+        ehci_writel(ehci, 0x1010, &ehci->regs->reserved1[1]);
        return ret;
 }
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 950e95efa381..26dedb30ad0b 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -799,11 +799,12 @@ static int tegra_ehci_remove(struct platform_device *pdev)
 #endif
        usb_remove_hcd(hcd);
-        usb_put_hcd(hcd);
        tegra_usb_phy_close(tegra->phy);
        iounmap(hcd->regs);
+        usb_put_hcd(hcd);
        clk_disable_unprepare(tegra->clk);
        clk_put(tegra->clk);
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 2ed112d3e159..256326322cfd 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -543,12 +543,12 @@ static void postproc_ep(struct isp1362_hcd *isp1362_hcd, struct isp1362_ep *ep)
                            usb_pipein(urb->pipe) ? "IN" : "OUT", ep->nextpid,
                            short_ok ? "" : "not_",
                            PTD_GET_COUNT(ptd), ep->maxpacket, len);
+                        /* save the data underrun error code for later and
+                         * proceed with the status stage
+                         */
+                        urb->actual_length += PTD_GET_COUNT(ptd);
                        if (usb_pipecontrol(urb->pipe)) {
                                ep->nextpid = USB_PID_ACK;
-                                /* save the data underrun error code for later and
-                                 * proceed with the status stage
-                                 */
-                                urb->actual_length += PTD_GET_COUNT(ptd);
                                BUG_ON(urb->actual_length > urb->transfer_buffer_length);
                                if (urb->status == -EINPROGRESS)
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index a665b3eaa746..aaa8d2bce217 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -570,6 +570,16 @@ static int __devinit ohci_hcd_at91_drv_probe(struct platform_device *pdev)
        if (pdata) {
                at91_for_each_port(i) {
+                        /*
+                         * do not configure PIO if not in relation with
+                         * real USB port on board
+                         */
+                        if (i >= pdata->ports) {
+                                pdata->vbus_pin[i] = -EINVAL;
+                                pdata->overcurrent_pin[i] = -EINVAL;
+                                break;
+                        }
                        if (!gpio_is_valid(pdata->vbus_pin[i]))
                                continue;
                        gpio = pdata->vbus_pin[i];
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index df0828cb2aa3..966d1484ee79 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -75,7 +75,9 @@
 #define NB_PIF0_PWRDOWN_1       0x01100013
 #define USB_INTEL_XUSB2PR      0xD0
+#define USB_INTEL_USB2PRM      0xD4
 #define USB_INTEL_USB3_PSSEN   0xD8
+#define USB_INTEL_USB3PRM      0xDC
 static struct amd_chipset_info {
        struct pci_dev  *nb_dev;
@@ -772,10 +774,18 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
                return;
        }
-        ports_available = 0xffffffff;
+        /* Read USB3PRM, the USB 3.0 Port Routing Mask Register
+         * Indicate the ports that can be changed from OS.
+         */
+        pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM,
+                        &ports_available);
+        dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n",
+                        ports_available);
        /* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
-         * Register, to turn on SuperSpeed terminations for all
+         * Register, to turn on SuperSpeed terminations for the
-         * available ports.
+         * switchable ports.
         */
        pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
                        cpu_to_le32(ports_available));
@@ -785,7 +795,16 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
        dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled "
                        "under xHCI: 0x%x\n", ports_available);
-        ports_available = 0xffffffff;
+        /* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register
+         * Indicate the USB 2.0 ports to be controlled by the xHCI host.
+         */
+        pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM,
+                        &ports_available);
+        dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n",
+                        ports_available);
        /* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to
         * switch the USB 2.0 power and data lines over to the xHCI
         * host.
@@ -800,6 +819,13 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
 }
 EXPORT_SYMBOL_GPL(usb_enable_xhci_ports);
+void usb_disable_xhci_ports(struct pci_dev *xhci_pdev)
+{
+        pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN, 0x0);
+        pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR, 0x0);
+}
+EXPORT_SYMBOL_GPL(usb_disable_xhci_ports);
 /**
 * PCI Quirks for xHCI.
 *
@@ -815,12 +841,12 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
        void __iomem *op_reg_base;
        u32 val;
        int timeout;
+        int len = pci_resource_len(pdev, 0);
        if (!mmio_resource_enabled(pdev, 0))
                return;
-        base = ioremap_nocache(pci_resource_start(pdev, 0),
+        base = ioremap_nocache(pci_resource_start(pdev, 0), len);
-                                pci_resource_len(pdev, 0));
        if (base == NULL)
                return;
@@ -830,9 +856,17 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
         */
        ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
        do {
+                if ((ext_cap_offset + sizeof(val)) > len) {
+                        /* We're reading garbage from the controller */
+                        dev_warn(&pdev->dev,
+                                 "xHCI controller failing to respond");
+                        return;
+                }
                if (!ext_cap_offset)
                        /* We've reached the end of the extended capabilities */
                        goto hc_init;
                val = readl(base + ext_cap_offset);
                if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
                        break;
@@ -863,9 +897,10 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
        /* Disable any BIOS SMIs and clear all SMI events*/
        writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
+hc_init:
        if (usb_is_intel_switchable_xhci(pdev))
                usb_enable_xhci_ports(pdev);
-hc_init:
        op_reg_base = base + XHCI_HC_LENGTH(readl(base));
        /* Wait for the host controller to be ready before writing any
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index b1002a8ef96f..7f69a39163ce 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -10,10 +10,12 @@ void usb_amd_quirk_pll_disable(void);
 void usb_amd_quirk_pll_enable(void);
 bool usb_is_intel_switchable_xhci(struct pci_dev *pdev);
 void usb_enable_xhci_ports(struct pci_dev *xhci_pdev);
+void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 #else
 static inline void usb_amd_quirk_pll_disable(void) {}
 static inline void usb_amd_quirk_pll_enable(void) {}
 static inline void usb_amd_dev_put(void) {}
+static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 #endif  /* CONFIG_PCI */
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 74bfc868b7ad..d5eb357aa5c4 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -493,11 +493,48 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
                 * when this bit is set.
                 */
                pls |= USB_PORT_STAT_CONNECTION;
+        } else {
+                /*
+                 * If CAS bit isn't set but the Port is already at
+                 * Compliance Mode, fake a connection so the USB core
+                 * notices the Compliance state and resets the port.
+                 * This resolves an issue generated by the SN65LVPE502CP
+                 * in which sometimes the port enters compliance mode
+                 * caused by a delay on the host-device negotiation.
+                 */
+                if (pls == USB_SS_PORT_LS_COMP_MOD)
+                        pls |= USB_PORT_STAT_CONNECTION;
        }
        /* update status field */
        *status |= pls;
 }
+/*
+ * Function for Compliance Mode Quirk.
+ *
+ * This Function verifies if all xhc USB3 ports have entered U0, if so,
+ * the compliance mode timer is deleted. A port won't enter
+ * compliance mode if it has previously entered U0.
+ */
+void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
+{
+        u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1);
+        bool port_in_u0 = ((status & PORT_PLS_MASK) == XDEV_U0);
+        if (!(xhci->quirks & XHCI_COMP_MODE_QUIRK))
+                return;
+        if ((xhci->port_status_u0 != all_ports_seen_u0) && port_in_u0) {
+                xhci->port_status_u0 |= 1 << wIndex;
+                if (xhci->port_status_u0 == all_ports_seen_u0) {
+                        del_timer_sync(&xhci->comp_mode_recovery_timer);
+                        xhci_dbg(xhci, "All USB3 ports have entered U0 already!\n");
+                        xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted.\n");
+                }
+        }
+}
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                u16 wIndex, char *buf, u16 wLength)
 {
@@ -651,6 +688,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                /* Update Port Link State for super speed ports*/
                if (hcd->speed == HCD_USB3) {
                        xhci_hub_report_link_state(&status, temp);
+                        /*
+                         * Verify if all USB3 Ports Have entered U0 already.
+                         * Delete Compliance Mode Timer if so.
+                         */
+                        xhci_del_comp_mod_timer(xhci, temp, wIndex);
                }
                if (bus_state->port_c_suspend & (1 << wIndex))
                        status |= 1 << USB_PORT_FEAT_C_SUSPEND;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 18b231b0c5d3..9bfd4ca1153c 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -94,11 +94,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
                xhci->limit_active_eps = 64;
                xhci->quirks |= XHCI_SW_BW_CHECKING;
+                /*
+                 * PPT desktop boards DH77EB and DH77DF will power back on after
+                 * a few seconds of being shutdown.  The fix for this is to
+                 * switch the ports from xHCI to EHCI on shutdown.  We can't use
+                 * DMI information to find those particular boards (since each
+                 * vendor will change the board name), so we have to key off all
+                 * PPT chipsets.
+                 */
+                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
        }
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
                xhci->quirks |= XHCI_RESET_ON_RESUME;
                xhci_dbg(xhci, "QUIRK: Resetting on resume\n");
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
        }
        if (pdev->vendor == PCI_VENDOR_ID_VIA)
                xhci->quirks |= XHCI_RESET_ON_RESUME;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 689bc18b051d..df90fe51b4aa 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -118,7 +118,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
                goto put_hcd;
        }
-        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
        if (!hcd->regs) {
                dev_dbg(&pdev->dev, "error mapping memory\n");
                ret = -EFAULT;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 8275645889da..643c2f3f3e73 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -145,29 +145,37 @@ static void next_trb(struct xhci_hcd *xhci,
 */
 static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring)
 {
-        union xhci_trb *next;
        unsigned long long addr;
        ring->deq_updates++;
-        /* If this is not event ring, there is one more usable TRB */
+        /*
+         * If this is not event ring, and the dequeue pointer
+         * is not on a link TRB, there is one more usable TRB
+         */
        if (ring->type != TYPE_EVENT &&
                        !last_trb(xhci, ring, ring->deq_seg, ring->dequeue))
                ring->num_trbs_free++;
-        next = ++(ring->dequeue);
-        /* Update the dequeue pointer further if that was a link TRB or we're at
+        do {
-         * the end of an event ring segment (which doesn't have link TRBS)
+                /*
-         */
+                 * Update the dequeue pointer further if that was a link TRB or
-        while (last_trb(xhci, ring, ring->deq_seg, next)) {
+                 * we're at the end of an event ring segment (which doesn't have
-                if (ring->type == TYPE_EVENT && last_trb_on_last_seg(xhci,
+                 * link TRBS)
-                                ring, ring->deq_seg, next)) {
+                 */
-                        ring->cycle_state = (ring->cycle_state ? 0 : 1);
+                if (last_trb(xhci, ring, ring->deq_seg, ring->dequeue)) {
+                        if (ring->type == TYPE_EVENT &&
+                                        last_trb_on_last_seg(xhci, ring,
+                                                ring->deq_seg, ring->dequeue)) {
+                                ring->cycle_state = (ring->cycle_state ? 0 : 1);
+                        }
+                        ring->deq_seg = ring->deq_seg->next;
+                        ring->dequeue = ring->deq_seg->trbs;
+                } else {
+                        ring->dequeue++;
                }
-                ring->deq_seg = ring->deq_seg->next;
+        } while (last_trb(xhci, ring, ring->deq_seg, ring->dequeue));
-                ring->dequeue = ring->deq_seg->trbs;
-                next = ring->dequeue;
-        }
        addr = (unsigned long long) xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);
 }
@@ -2073,8 +2081,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
                        trb_comp_code = COMP_SHORT_TX;
                else
-                        xhci_warn(xhci, "WARN Successful completion on short TX: "
+                        xhci_warn_ratelimited(xhci,
-                                        "needs XHCI_TRUST_TX_LENGTH quirk?\n");
+                                        "WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?\n");
        case COMP_SHORT_TX:
                break;
        case COMP_STOP:
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7648b2d4b268..6ece0ed288d4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -26,6 +26,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include "xhci.h"
@@ -166,7 +167,7 @@ int xhci_reset(struct xhci_hcd *xhci)
        xhci_writel(xhci, command, &xhci->op_regs->command);
        ret = handshake(xhci, &xhci->op_regs->command,
-                        CMD_RESET, 0, 250 * 1000);
+                        CMD_RESET, 0, 10 * 1000 * 1000);
        if (ret)
                return ret;
@@ -175,7 +176,8 @@ int xhci_reset(struct xhci_hcd *xhci)
         * xHCI cannot write to any doorbells or operational registers other
         * than status until the "Controller Not Ready" flag is cleared.
         */
-        ret = handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000);
+        ret = handshake(xhci, &xhci->op_regs->status,
+                        STS_CNR, 0, 10 * 1000 * 1000);
        for (i = 0; i < 2; ++i) {
                xhci->bus_state[i].port_c_suspend = 0;
@@ -397,6 +399,95 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
 #endif
+static void compliance_mode_recovery(unsigned long arg)
+{
+        struct xhci_hcd *xhci;
+        struct usb_hcd *hcd;
+        u32 temp;
+        int i;
+        xhci = (struct xhci_hcd *)arg;
+        for (i = 0; i < xhci->num_usb3_ports; i++) {
+                temp = xhci_readl(xhci, xhci->usb3_ports[i]);
+                if ((temp & PORT_PLS_MASK) == USB_SS_PORT_LS_COMP_MOD) {
+                        /*
+                         * Compliance Mode Detected. Letting USB Core
+                         * handle the Warm Reset
+                         */
+                        xhci_dbg(xhci, "Compliance Mode Detected->Port %d!\n",
+                                        i + 1);
+                        xhci_dbg(xhci, "Attempting Recovery routine!\n");
+                        hcd = xhci->shared_hcd;
+                        if (hcd->state == HC_STATE_SUSPENDED)
+                                usb_hcd_resume_root_hub(hcd);
+                        usb_hcd_poll_rh_status(hcd);
+                }
+        }
+        if (xhci->port_status_u0 != ((1 << xhci->num_usb3_ports)-1))
+                mod_timer(&xhci->comp_mode_recovery_timer,
+                        jiffies + msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+}
+/*
+ * Quirk to work around issue generated by the SN65LVPE502CP USB3.0 re-driver
+ * that causes ports behind that hardware to enter compliance mode sometimes.
+ * The quirk creates a timer that polls every 2 seconds the link state of
+ * each host controller's port and recovers it by issuing a Warm reset
+ * if Compliance mode is detected, otherwise the port will become "dead" (no
+ * device connections or disconnections will be detected anymore). Becasue no
+ * status event is generated when entering compliance mode (per xhci spec),
+ * this quirk is needed on systems that have the failing hardware installed.
+ */
+static void compliance_mode_recovery_timer_init(struct xhci_hcd *xhci)
+{
+        xhci->port_status_u0 = 0;
+        init_timer(&xhci->comp_mode_recovery_timer);
+        xhci->comp_mode_recovery_timer.data = (unsigned long) xhci;
+        xhci->comp_mode_recovery_timer.function = compliance_mode_recovery;
+        xhci->comp_mode_recovery_timer.expires = jiffies +
+                        msecs_to_jiffies(COMP_MODE_RCVRY_MSECS);
+        set_timer_slack(&xhci->comp_mode_recovery_timer,
+                        msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+        add_timer(&xhci->comp_mode_recovery_timer);
+        xhci_dbg(xhci, "Compliance Mode Recovery Timer Initialized.\n");
+}
+/*
+ * This function identifies the systems that have installed the SN65LVPE502CP
+ * USB3.0 re-driver and that need the Compliance Mode Quirk.
+ * Systems:
+ * Vendor: Hewlett-Packard -> System Models: Z420, Z620 and Z820
+ */
+static bool compliance_mode_recovery_timer_quirk_check(void)
+{
+        const char *dmi_product_name, *dmi_sys_vendor;
+        dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
+        dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+        if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
+                return false;
+        if (strstr(dmi_product_name, "Z420") ||
+                        strstr(dmi_product_name, "Z620") ||
+                        strstr(dmi_product_name, "Z820"))
+                return true;
+        return false;
+}
+static int xhci_all_ports_seen_u0(struct xhci_hcd *xhci)
+{
+        return (xhci->port_status_u0 == ((1 << xhci->num_usb3_ports)-1));
+}
 /*
 * Initialize memory for HCD and xHC (one-time init).
 *
@@ -420,6 +511,12 @@ int xhci_init(struct usb_hcd *hcd)
        retval = xhci_mem_init(xhci, GFP_KERNEL);
        xhci_dbg(xhci, "Finished xhci_init\n");
+        /* Initializing Compliance Mode Recovery Data If Needed */
+        if (compliance_mode_recovery_timer_quirk_check()) {
+                xhci->quirks |= XHCI_COMP_MODE_QUIRK;
+                compliance_mode_recovery_timer_init(xhci);
+        }
        return retval;
 }
@@ -628,6 +725,11 @@ void xhci_stop(struct usb_hcd *hcd)
        del_timer_sync(&xhci->event_ring_timer);
 #endif
+        /* Deleting Compliance Mode Recovery Timer */
+        if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+                        (!(xhci_all_ports_seen_u0(xhci))))
+                del_timer_sync(&xhci->comp_mode_recovery_timer);
        if (xhci->quirks & XHCI_AMD_PLL_FIX)
                usb_amd_dev_put();
@@ -658,6 +760,9 @@ void xhci_shutdown(struct usb_hcd *hcd)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
+                usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
        spin_lock_irq(&xhci->lock);
        xhci_halt(xhci);
        spin_unlock_irq(&xhci->lock);
@@ -802,6 +907,16 @@ int xhci_suspend(struct xhci_hcd *xhci)
        }
        spin_unlock_irq(&xhci->lock);
+        /*
+         * Deleting Compliance Mode Recovery Timer because the xHCI Host
+         * is about to be suspended.
+         */
+        if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+                        (!(xhci_all_ports_seen_u0(xhci)))) {
+                del_timer_sync(&xhci->comp_mode_recovery_timer);
+                xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted!\n");
+        }
        /* step 5: remove core well power */
        /* synchronize irq when using MSI-X */
        xhci_msix_sync_irqs(xhci);
@@ -934,6 +1049,16 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                usb_hcd_resume_root_hub(hcd);
                usb_hcd_resume_root_hub(xhci->shared_hcd);
        }
+        /*
+         * If system is subject to the Quirk, Compliance Mode Timer needs to
+         * be re-initialized Always after a system resume. Ports are subject
+         * to suffer the Compliance Mode issue again. It doesn't matter if
+         * ports have entered previously to U0 before system's suspension.
+         */
+        if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
+                compliance_mode_recovery_timer_init(xhci);
        return retval;
 }
 #endif  /* CONFIG_PM */
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 55c0785810c9..1a05908c6673 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1494,6 +1494,8 @@ struct xhci_hcd {
 #define XHCI_TRUST_TX_LENGTH    (1 << 10)
 #define XHCI_LPM_SUPPORT        (1 << 11)
 #define XHCI_INTEL_HOST         (1 << 12)
+#define XHCI_SPURIOUS_REBOOT    (1 << 13)
+#define XHCI_COMP_MODE_QUIRK    (1 << 14)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
        /* There are two roothubs to keep track of bus suspend info for */
@@ -1510,6 +1512,11 @@ struct xhci_hcd {
        unsigned                sw_lpm_support:1;
        /* support xHCI 1.0 spec USB2 hardware LPM */
        unsigned                hw_lpm_support:1;
+        /* Compliance Mode Recovery Data */
+        struct timer_list       comp_mode_recovery_timer;
+        u32                     port_status_u0;
+/* Compliance Mode Timer Triggered every 2 seconds */
+#define COMP_MODE_RCVRY_MSECS 2000
 };
 /* convert between an HCD pointer and the corresponding EHCI_HCD */
@@ -1537,6 +1544,8 @@ static inline struct usb_hcd *xhci_to_hcd(struct xhci_hcd *xhci)
        dev_err(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
 #define xhci_warn(xhci, fmt, args...) \
        dev_warn(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
+#define xhci_warn_ratelimited(xhci, fmt, args...) \
+        dev_warn_ratelimited(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
 /* TODO: copied from ehci.h - can be refactored? */
 /* xHCI spec says all registers are little endian */
diff --git a/drivers/usb/misc/emi62.c b/drivers/usb/misc/emi62.c
index ff08015b230c..ae794b90766b 100644
--- a/drivers/usb/misc/emi62.c
+++ b/drivers/usb/misc/emi62.c
@@ -232,7 +232,7 @@ wraperr:
        return err;
 }
-static const struct usb_device_id id_table[] __devinitconst = {
+static const struct usb_device_id id_table[] = {
        { USB_DEVICE(EMI62_VENDOR_ID, EMI62_PRODUCT_ID) },
        { }                                             /* Terminating entry */
 };
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index ef0c3f9f0947..6259f0d99324 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -8,7 +8,7 @@ config USB_MUSB_HDRC
        tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
        depends on USB && USB_GADGET
        select NOP_USB_XCEIV if (ARCH_DAVINCI || MACH_OMAP3EVM || BLACKFIN)
-        select NOP_USB_XCEIV if (SOC_OMAPTI81XX || SOC_OMAPAM33XX)
+        select NOP_USB_XCEIV if (SOC_TI81XX || SOC_AM33XX)
        select TWL4030_USB if MACH_OMAP_3430SDP
        select TWL6030_USB if MACH_OMAP_4430SDP || MACH_OMAP4_PANDA
        select USB_OTG_UTILS
@@ -57,7 +57,7 @@ config USB_MUSB_AM35X
 config USB_MUSB_DSPS
        tristate "TI DSPS platforms"
-        depends on SOC_OMAPTI81XX || SOC_OMAPAM33XX
+        depends on SOC_TI81XX || SOC_AM33XX
 config USB_MUSB_BLACKFIN
        tristate "Blackfin"
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 217808d9fbe1..494772fc9e23 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -479,9 +479,9 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id)
                ret = -ENODEV;
                goto err0;
        }
-        strcpy((u8 *)res->name, "mc");
        res->parent = NULL;
        resources[1] = *res;
+        resources[1].name = "mc";
        /* allocate the child platform device */
        musb = platform_device_alloc("musb-hdrc", -1);
@@ -566,27 +566,28 @@ static int __devinit dsps_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, glue);
-        /* create the child platform device for first instances of musb */
-        ret = dsps_create_musb_pdev(glue, 0);
-        if (ret != 0) {
-                dev_err(&pdev->dev, "failed to create child pdev\n");
-                goto err2;
-        }
        /* enable the usbss clocks */
        pm_runtime_enable(&pdev->dev);
        ret = pm_runtime_get_sync(&pdev->dev);
        if (ret < 0) {
                dev_err(&pdev->dev, "pm_runtime_get_sync FAILED");
+                goto err2;
+        }
+        /* create the child platform device for first instances of musb */
+        ret = dsps_create_musb_pdev(glue, 0);
+        if (ret != 0) {
+                dev_err(&pdev->dev, "failed to create child pdev\n");
                goto err3;
        }
        return 0;
 err3:
-        pm_runtime_disable(&pdev->dev);
+        pm_runtime_put(&pdev->dev);
 err2:
+        pm_runtime_disable(&pdev->dev);
        kfree(glue->wrp);
 err1:
        kfree(glue);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 4bb717d0bd41..1ae378d5fc6f 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2049,7 +2049,7 @@ static int musb_urb_enqueue(
         * we only have work to do in the former case.
         */
        spin_lock_irqsave(&musb->lock, flags);
-        if (hep->hcpriv) {
+        if (hep->hcpriv || !next_urb(qh)) {
                /* some concurrent activity submitted another urb to hep...
                 * odd, rare, error prone, but legal.
                 */
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 57a608584e16..c1be687e00ec 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -388,7 +388,7 @@ dma_controller_create(struct musb *musb, void __iomem *base)
        struct platform_device *pdev = to_platform_device(dev);
        int irq = platform_get_irq_byname(pdev, "dma");
-        if (irq == 0) {
+        if (irq <= 0) {
                dev_err(dev, "No DMA interrupt line!\n");
                return NULL;
        }
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 1a1bd9cf40c5..341625442377 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1215,7 +1215,7 @@ static int __devinit tusb_probe(struct platform_device *pdev)
        ret = platform_device_add(musb);
        if (ret) {
                dev_err(&pdev->dev, "failed to register musb device\n");
-                goto err1;
+                goto err2;
        }
        return 0;
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 8c9bb1ad3069..681da06170c2 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -603,12 +603,12 @@ static int usbhsc_resume(struct device *dev)
        struct usbhs_priv *priv = dev_get_drvdata(dev);
        struct platform_device *pdev = usbhs_priv_to_pdev(priv);
-        usbhs_platform_call(priv, phy_reset, pdev);
        if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL))
                usbhsc_power_ctrl(priv, 1);
-        usbhsc_hotplug(priv);
+        usbhs_platform_call(priv, phy_reset, pdev);
+        usbhsc_drvcllbck_notify_hotplug(pdev);
        return 0;
 }
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index ecd173032fd4..143c4e9e1be4 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -818,7 +818,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
            usbhs_pipe_is_dcp(pipe))
                goto usbhsf_pio_prepare_push;
-        if (len % 4) /* 32bit alignment */
+        if (len & 0x7) /* 8byte alignment */
                goto usbhsf_pio_prepare_push;
        if ((uintptr_t)(pkt->buf + pkt->actual) & 0x7) /* 8byte alignment */
@@ -905,7 +905,7 @@ static int usbhsf_dma_try_pop(struct usbhs_pkt *pkt, int *is_done)
        /* use PIO if packet is less than pio_dma_border */
        len = usbhsf_fifo_rcv_len(priv, fifo);
        len = min(pkt->length - pkt->actual, len);
-        if (len % 4) /* 32bit alignment */
+        if (len & 0x7) /* 8byte alignment */
                goto usbhsf_pio_prepare_pop_unselect;
        if (len < usbhs_get_dparam(priv, pio_dma_border))
diff --git a/drivers/usb/renesas_usbhs/mod_host.c b/drivers/usb/renesas_usbhs/mod_host.c
index 1834cf50888c..9b69a1323294 100644
--- a/drivers/usb/renesas_usbhs/mod_host.c
+++ b/drivers/usb/renesas_usbhs/mod_host.c
@@ -1266,6 +1266,12 @@ static int usbhsh_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
        return ret;
 }
+static int usbhsh_bus_nop(struct usb_hcd *hcd)
+{
+        /* nothing to do */
+        return 0;
+}
 static struct hc_driver usbhsh_driver = {
        .description =          usbhsh_hcd_name,
        .hcd_priv_size =        sizeof(struct usbhsh_hpriv),
@@ -1290,6 +1296,8 @@ static struct hc_driver usbhsh_driver = {
         */
        .hub_status_data =      usbhsh_hub_status_data,
        .hub_control =          usbhsh_hub_control,
+        .bus_suspend =          usbhsh_bus_nop,
+        .bus_resume =           usbhsh_bus_nop,
 };
 /*
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index f398d1e34474..c15f2e7cefc7 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -61,18 +61,23 @@ static int usb_serial_device_probe(struct device *dev)
                goto exit;
        }
+        /* make sure suspend/resume doesn't race against port_probe */
+        retval = usb_autopm_get_interface(port->serial->interface);
+        if (retval)
+                goto exit;
        driver = port->serial->type;
        if (driver->port_probe) {
                retval = driver->port_probe(port);
                if (retval)
-                        goto exit;
+                        goto exit_with_autopm;
        }
        retval = device_create_file(dev, &dev_attr_port_number);
        if (retval) {
                if (driver->port_remove)
                        retval = driver->port_remove(port);
-                goto exit;
+                goto exit_with_autopm;
        }
        minor = port->number;
@@ -81,6 +86,8 @@ static int usb_serial_device_probe(struct device *dev)
                 "%s converter now attached to ttyUSB%d\n",
                 driver->description, minor);
+exit_with_autopm:
+        usb_autopm_put_interface(port->serial->interface);
 exit:
        return retval;
 }
@@ -96,6 +103,9 @@ static int usb_serial_device_remove(struct device *dev)
        if (!port)
                return -ENODEV;
+        /* make sure suspend/resume doesn't race against port_remove */
+        usb_autopm_get_interface(port->serial->interface);
        device_remove_file(&port->dev, &dev_attr_port_number);
        driver = port->serial->type;
@@ -107,6 +117,7 @@ static int usb_serial_device_remove(struct device *dev)
        dev_info(dev, "%s converter now disconnected from ttyUSB%d\n",
                 driver->description, minor);
+        usb_autopm_put_interface(port->serial->interface);
        return retval;
 }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index bc912e5a3beb..f906b3aec217 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -704,6 +704,7 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) },
        { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
        { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
@@ -804,13 +805,33 @@ static struct usb_device_id id_table_combined [] = {
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
+                                        USB_CLASS_VENDOR_SPEC,
+                                        USB_SUBCLASS_VENDOR_SPEC, 0x00) },
        { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
        { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
        { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
+        { USB_DEVICE(FTDI_VID, PI_C865_PID) },
+        { USB_DEVICE(FTDI_VID, PI_C857_PID) },
+        { USB_DEVICE(PI_VID, PI_C866_PID) },
+        { USB_DEVICE(PI_VID, PI_C663_PID) },
+        { USB_DEVICE(PI_VID, PI_C725_PID) },
+        { USB_DEVICE(PI_VID, PI_E517_PID) },
+        { USB_DEVICE(PI_VID, PI_C863_PID) },
        { USB_DEVICE(PI_VID, PI_E861_PID) },
+        { USB_DEVICE(PI_VID, PI_C867_PID) },
+        { USB_DEVICE(PI_VID, PI_E609_PID) },
+        { USB_DEVICE(PI_VID, PI_E709_PID) },
+        { USB_DEVICE(PI_VID, PI_100F_PID) },
+        { USB_DEVICE(PI_VID, PI_1011_PID) },
+        { USB_DEVICE(PI_VID, PI_1012_PID) },
+        { USB_DEVICE(PI_VID, PI_1013_PID) },
+        { USB_DEVICE(PI_VID, PI_1014_PID) },
+        { USB_DEVICE(PI_VID, PI_1015_PID) },
+        { USB_DEVICE(PI_VID, PI_1016_PID) },
+        { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
        { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
        { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 5661c7e2d415..41fe5826100c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -75,6 +75,9 @@
 #define FTDI_OPENDCC_GATEWAY_PID        0xBFDB
 #define FTDI_OPENDCC_GBM_PID    0xBFDC
+/* NZR SEM 16+ USB (http://www.nzr.de) */
+#define FTDI_NZR_SEM_USB_PID    0xC1E0  /* NZR SEM-LOG16+ */
 /*
 * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
 */
@@ -539,7 +542,10 @@
 /*
 * Microchip Technology, Inc.
 *
- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by:
+ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
+ * used by single function CDC ACM class based firmware demo
+ * applications.  The VID/PID has also been used in firmware
+ * emulating FTDI serial chips by:
 * Hornby Elite - Digital Command Control Console
 * http://www.hornby.com/hornby-dcc/controllers/
 */
@@ -791,8 +797,34 @@
 * Physik Instrumente
 * http://www.physikinstrumente.com/en/products/
 */
+/* These two devices use the VID of FTDI */
+#define PI_C865_PID     0xe0a0  /* PI C-865 Piezomotor Controller */
+#define PI_C857_PID     0xe0a1  /* PI Encoder Trigger Box */
 #define PI_VID              0x1a72  /* Vendor ID */
-#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
+#define PI_C866_PID     0x1000  /* PI C-866 Piezomotor Controller */
+#define PI_C663_PID     0x1001  /* PI C-663 Mercury-Step */
+#define PI_C725_PID     0x1002  /* PI C-725 Piezomotor Controller */
+#define PI_E517_PID     0x1005  /* PI E-517 Digital Piezo Controller Operation Module */
+#define PI_C863_PID     0x1007  /* PI C-863 */
+#define PI_E861_PID     0x1008  /* PI E-861 Piezomotor Controller */
+#define PI_C867_PID     0x1009  /* PI C-867 Piezomotor Controller */
+#define PI_E609_PID     0x100D  /* PI E-609 Digital Piezo Controller */
+#define PI_E709_PID     0x100E  /* PI E-709 Digital Piezo Controller */
+#define PI_100F_PID     0x100F  /* PI Digital Piezo Controller */
+#define PI_1011_PID     0x1011  /* PI Digital Piezo Controller */
+#define PI_1012_PID     0x1012  /* PI Motion Controller */
+#define PI_1013_PID     0x1013  /* PI Motion Controller */
+#define PI_1014_PID     0x1014  /* PI Device */
+#define PI_1015_PID     0x1015  /* PI Device */
+#define PI_1016_PID     0x1016  /* PI Digital Servo Module */
+/*
+ * Kondo Kagaku Co.Ltd.
+ * http://www.kondo-robot.com/EN
+ */
+#define KONDO_VID               0x165c
+#define KONDO_USB_SERIAL_PID    0x0002
 /*
 * Bayer Ascensia Contour blood glucose meter USB-converter cable.
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index 5811d34b6c6b..2cb30c535839 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -227,7 +227,6 @@ static void ipw_release(struct usb_serial *serial)
 {
        struct usb_wwan_intf_private *data = usb_get_serial_data(serial);
-        usb_wwan_release(serial);
        usb_set_serial_data(serial, NULL);
        kfree(data);
 }
@@ -309,12 +308,12 @@ static struct usb_serial_driver ipw_device = {
        .description =          "IPWireless converter",
        .id_table =             id_table,
        .num_ports =            1,
-        .disconnect =           usb_wwan_disconnect,
        .open =                 ipw_open,
        .close =                ipw_close,
        .probe =                ipw_probe,
        .attach =               usb_wwan_startup,
        .release =              ipw_release,
+        .port_remove =          usb_wwan_port_remove,
        .dtr_rts =              ipw_dtr_rts,
        .write =                usb_wwan_write,
 };
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 57eca2448424..2f6da1e89bfa 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -82,8 +82,7 @@
 * Defines used for sending commands to port
 */
-#define WAIT_FOR_EVER   (HZ * 0)        /* timeout urb is wait for ever */
+#define MOS_WDR_TIMEOUT         5000    /* default urb timeout */
-#define MOS_WDR_TIMEOUT (HZ * 5)        /* default urb timeout */
 #define MOS_PORT1       0x0200
 #define MOS_PORT2       0x0300
@@ -1232,9 +1231,12 @@ static int mos7840_chars_in_buffer(struct tty_struct *tty)
                return 0;
        spin_lock_irqsave(&mos7840_port->pool_lock, flags);
-        for (i = 0; i < NUM_URBS; ++i)
+        for (i = 0; i < NUM_URBS; ++i) {
-                if (mos7840_port->busy[i])
+                if (mos7840_port->busy[i]) {
-                        chars += URB_TRANSFER_BUFFER_SIZE;
+                        struct urb *urb = mos7840_port->write_urb_pool[i];
+                        chars += urb->transfer_buffer_length;
+                }
+        }
        spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
        dbg("%s - returns %d", __func__, chars);
        return chars;
@@ -1344,7 +1346,7 @@ static void mos7840_close(struct usb_serial_port *port)
 static void mos7840_block_until_chase_response(struct tty_struct *tty,
                                        struct moschip_port *mos7840_port)
 {
-        int timeout = 1 * HZ;
+        int timeout = msecs_to_jiffies(1000);
        int wait = 10;
        int count;
@@ -2672,7 +2674,7 @@ static int mos7840_startup(struct usb_serial *serial)
        /* setting configuration feature to one */
        usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
-                        (__u8) 0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5 * HZ);
+                        (__u8) 0x03, 0x00, 0x01, 0x00, NULL, 0x00, MOS_WDR_TIMEOUT);
        return 0;
 error:
        for (/* nothing */; i >= 0; i--) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 08ff9b862049..5ce88d1bc6f1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -80,85 +80,9 @@ static void option_instat_callback(struct urb *urb);
 #define OPTION_PRODUCT_GTM380_MODEM             0x7201
 #define HUAWEI_VENDOR_ID                        0x12D1
-#define HUAWEI_PRODUCT_E600                     0x1001
-#define HUAWEI_PRODUCT_E220                     0x1003
-#define HUAWEI_PRODUCT_E220BIS                  0x1004
-#define HUAWEI_PRODUCT_E1401                    0x1401
-#define HUAWEI_PRODUCT_E1402                    0x1402
-#define HUAWEI_PRODUCT_E1403                    0x1403
-#define HUAWEI_PRODUCT_E1404                    0x1404
-#define HUAWEI_PRODUCT_E1405                    0x1405
-#define HUAWEI_PRODUCT_E1406                    0x1406
-#define HUAWEI_PRODUCT_E1407                    0x1407
-#define HUAWEI_PRODUCT_E1408                    0x1408
-#define HUAWEI_PRODUCT_E1409                    0x1409
-#define HUAWEI_PRODUCT_E140A                    0x140A
-#define HUAWEI_PRODUCT_E140B                    0x140B
-#define HUAWEI_PRODUCT_E140C                    0x140C
-#define HUAWEI_PRODUCT_E140D                    0x140D
-#define HUAWEI_PRODUCT_E140E                    0x140E
-#define HUAWEI_PRODUCT_E140F                    0x140F
-#define HUAWEI_PRODUCT_E1410                    0x1410
-#define HUAWEI_PRODUCT_E1411                    0x1411
-#define HUAWEI_PRODUCT_E1412                    0x1412
-#define HUAWEI_PRODUCT_E1413                    0x1413
-#define HUAWEI_PRODUCT_E1414                    0x1414
-#define HUAWEI_PRODUCT_E1415                    0x1415
-#define HUAWEI_PRODUCT_E1416                    0x1416
-#define HUAWEI_PRODUCT_E1417                    0x1417
-#define HUAWEI_PRODUCT_E1418                    0x1418
-#define HUAWEI_PRODUCT_E1419                    0x1419
-#define HUAWEI_PRODUCT_E141A                    0x141A
-#define HUAWEI_PRODUCT_E141B                    0x141B
-#define HUAWEI_PRODUCT_E141C                    0x141C
-#define HUAWEI_PRODUCT_E141D                    0x141D
-#define HUAWEI_PRODUCT_E141E                    0x141E
-#define HUAWEI_PRODUCT_E141F                    0x141F
-#define HUAWEI_PRODUCT_E1420                    0x1420
-#define HUAWEI_PRODUCT_E1421                    0x1421
-#define HUAWEI_PRODUCT_E1422                    0x1422
-#define HUAWEI_PRODUCT_E1423                    0x1423
-#define HUAWEI_PRODUCT_E1424                    0x1424
-#define HUAWEI_PRODUCT_E1425                    0x1425
-#define HUAWEI_PRODUCT_E1426                    0x1426
-#define HUAWEI_PRODUCT_E1427                    0x1427
-#define HUAWEI_PRODUCT_E1428                    0x1428
-#define HUAWEI_PRODUCT_E1429                    0x1429
-#define HUAWEI_PRODUCT_E142A                    0x142A
-#define HUAWEI_PRODUCT_E142B                    0x142B
-#define HUAWEI_PRODUCT_E142C                    0x142C
-#define HUAWEI_PRODUCT_E142D                    0x142D
-#define HUAWEI_PRODUCT_E142E                    0x142E
-#define HUAWEI_PRODUCT_E142F                    0x142F
-#define HUAWEI_PRODUCT_E1430                    0x1430
-#define HUAWEI_PRODUCT_E1431                    0x1431
-#define HUAWEI_PRODUCT_E1432                    0x1432
-#define HUAWEI_PRODUCT_E1433                    0x1433
-#define HUAWEI_PRODUCT_E1434                    0x1434
-#define HUAWEI_PRODUCT_E1435                    0x1435
-#define HUAWEI_PRODUCT_E1436                    0x1436
-#define HUAWEI_PRODUCT_E1437                    0x1437
-#define HUAWEI_PRODUCT_E1438                    0x1438
-#define HUAWEI_PRODUCT_E1439                    0x1439
-#define HUAWEI_PRODUCT_E143A                    0x143A
-#define HUAWEI_PRODUCT_E143B                    0x143B
-#define HUAWEI_PRODUCT_E143C                    0x143C
-#define HUAWEI_PRODUCT_E143D                    0x143D
-#define HUAWEI_PRODUCT_E143E                    0x143E
-#define HUAWEI_PRODUCT_E143F                    0x143F
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
-#define HUAWEI_PRODUCT_E14AC                    0x14AC
-#define HUAWEI_PRODUCT_K3806                    0x14AE
 #define HUAWEI_PRODUCT_K4605                    0x14C6
-#define HUAWEI_PRODUCT_K5005                    0x14C8
-#define HUAWEI_PRODUCT_K3770                    0x14C9
-#define HUAWEI_PRODUCT_K3771                    0x14CA
-#define HUAWEI_PRODUCT_K4510                    0x14CB
-#define HUAWEI_PRODUCT_K4511                    0x14CC
-#define HUAWEI_PRODUCT_ETS1220                  0x1803
-#define HUAWEI_PRODUCT_E353                     0x1506
-#define HUAWEI_PRODUCT_E173S                    0x1C05
 #define QUANTA_VENDOR_ID                        0x0408
 #define QUANTA_PRODUCT_Q101                     0xEA02
@@ -615,104 +539,123 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLX) },
        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GKE) },
        { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1401, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1402, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1403, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1404, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1405, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1406, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1407, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1408, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1409, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140A, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140B, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140C, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140D, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140E, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E140F, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1410, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1411, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1412, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1413, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1414, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1415, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1416, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1417, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1418, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1419, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141A, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141B, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141C, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141D, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141E, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E141F, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1420, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1421, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1422, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1423, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1424, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1425, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1426, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1427, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1428, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1429, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142A, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142B, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142C, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142D, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142E, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E142F, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1430, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1431, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1432, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1433, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1434, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1435, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1436, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1437, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1438, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1439, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143A, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143B, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143C, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173S, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x01) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x02) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x03) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x04) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x05) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x06) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x0A) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x0B) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x0D) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x0E) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x0F) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x10) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x12) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x13) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x14) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x15) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x17) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x18) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x02, 0x01) },  /* E398 3G Modem */
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x19) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x02, 0x02) },  /* E398 3G PC UI Interface */
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x1A) },
-        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x02, 0x03) },  /* E398 3G Application Interface */
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7C) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) },
@@ -1147,6 +1090,10 @@ static const struct usb_device_id option_ids[] = {
         .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
         .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
        { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
        { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
        { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
@@ -1297,8 +1244,8 @@ static struct usb_serial_driver option_1port_device = {
        .tiocmset          = usb_wwan_tiocmset,
        .ioctl             = usb_wwan_ioctl,
        .attach            = usb_wwan_startup,
-        .disconnect        = usb_wwan_disconnect,
        .release           = option_release,
+        .port_remove       = usb_wwan_port_remove,
        .read_int_callback = option_instat_callback,
 #ifdef CONFIG_PM
        .suspend           = usb_wwan_suspend,
@@ -1414,8 +1361,6 @@ static void option_release(struct usb_serial *serial)
        struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial);
        struct option_private *priv = intfdata->private;
-        usb_wwan_release(serial);
        kfree(priv);
        kfree(intfdata);
 }
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 8d103019d6aa..bfd50779f0c9 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -199,43 +199,49 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
        /* default to enabling interface */
        altsetting = 0;
-        switch (ifnum) {
-                /* Composite mode; don't bind to the QMI/net interface as that
-                 * gets handled by other drivers.
-                 */
+        /* Composite mode; don't bind to the QMI/net interface as that
+         * gets handled by other drivers.
+         */
+        if (is_gobi1k) {
                /* Gobi 1K USB layout:
                 * 0: serial port (doesn't respond)
                 * 1: serial port (doesn't respond)
                 * 2: AT-capable modem port
                 * 3: QMI/net
-                 *
+                 */
-                 * Gobi 2K+ USB layout:
+                if (ifnum == 2)
+                        dev_dbg(dev, "Modem port found\n");
+                else
+                        altsetting = -1;
+        } else {
+                /* Gobi 2K+ USB layout:
                 * 0: QMI/net
                 * 1: DM/DIAG (use libqcdm from ModemManager for communication)
                 * 2: AT-capable modem port
                 * 3: NMEA
                 */
+                switch (ifnum) {
-        case 1:
+                case 0:
-                if (is_gobi1k)
+                        /* Don't claim the QMI/net interface */
                        altsetting = -1;
-                else
+                        break;
+                case 1:
                        dev_dbg(dev, "Gobi 2K+ DM/DIAG interface found\n");
-                break;
+                        break;
-        case 2:
+                case 2:
-                dev_dbg(dev, "Modem port found\n");
+                        dev_dbg(dev, "Modem port found\n");
-                break;
+                        break;
-        case 3:
+                case 3:
-                if (is_gobi1k)
-                        altsetting = -1;
-                else
                        /*
                         * NMEA (serial line 9600 8N1)
                         * # echo "\$GPS_START" > /dev/ttyUSBx
                         * # echo "\$GPS_STOP"  > /dev/ttyUSBx
                         */
                        dev_dbg(dev, "Gobi 2K+ NMEA GPS interface found\n");
+                        break;
+                }
        }
 done:
@@ -262,8 +268,7 @@ static void qc_release(struct usb_serial *serial)
 {
        struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
-        /* Call usb_wwan release & free the private data allocated in qcprobe */
+        /* Free the private data allocated in qcprobe */
-        usb_wwan_release(serial);
        usb_set_serial_data(serial, NULL);
        kfree(priv);
 }
@@ -283,8 +288,8 @@ static struct usb_serial_driver qcdevice = {
        .write_room          = usb_wwan_write_room,
        .chars_in_buffer     = usb_wwan_chars_in_buffer,
        .attach              = usb_wwan_startup,
-        .disconnect          = usb_wwan_disconnect,
        .release             = qc_release,
+        .port_remove         = usb_wwan_port_remove,
 #ifdef CONFIG_PM
        .suspend             = usb_wwan_suspend,
        .resume              = usb_wwan_resume,
diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h
index c47b6ec03063..1f034d2397c6 100644
--- a/drivers/usb/serial/usb-wwan.h
+++ b/drivers/usb/serial/usb-wwan.h
@@ -9,8 +9,7 @@ extern void usb_wwan_dtr_rts(struct usb_serial_port *port, int on);
 extern int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port);
 extern void usb_wwan_close(struct usb_serial_port *port);
 extern int usb_wwan_startup(struct usb_serial *serial);
-extern void usb_wwan_disconnect(struct usb_serial *serial);
+extern int usb_wwan_port_remove(struct usb_serial_port *port);
-extern void usb_wwan_release(struct usb_serial *serial);
 extern int usb_wwan_write_room(struct tty_struct *tty);
 extern void usb_wwan_set_termios(struct tty_struct *tty,
                                 struct usb_serial_port *port,
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index f35971dff4a5..6855d5ed0331 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -565,62 +565,52 @@ bail_out_error:
 }
 EXPORT_SYMBOL(usb_wwan_startup);
-static void stop_read_write_urbs(struct usb_serial *serial)
+int usb_wwan_port_remove(struct usb_serial_port *port)
 {
-        int i, j;
+        int i;
-        struct usb_serial_port *port;
        struct usb_wwan_port_private *portdata;
-        /* Stop reading/writing urbs */
+        portdata = usb_get_serial_port_data(port);
-        for (i = 0; i < serial->num_ports; ++i) {
+        usb_set_serial_port_data(port, NULL);
-                port = serial->port[i];
-                portdata = usb_get_serial_port_data(port);
+        /* Stop reading/writing urbs and free them */
-                for (j = 0; j < N_IN_URB; j++)
+        for (i = 0; i < N_IN_URB; i++) {
-                        usb_kill_urb(portdata->in_urbs[j]);
+                usb_kill_urb(portdata->in_urbs[i]);
-                for (j = 0; j < N_OUT_URB; j++)
+                usb_free_urb(portdata->in_urbs[i]);
-                        usb_kill_urb(portdata->out_urbs[j]);
+                free_page((unsigned long)portdata->in_buffer[i]);
+        }
+        for (i = 0; i < N_OUT_URB; i++) {
+                usb_kill_urb(portdata->out_urbs[i]);
+                usb_free_urb(portdata->out_urbs[i]);
+                kfree(portdata->out_buffer[i]);
        }
-}
-void usb_wwan_disconnect(struct usb_serial *serial)
+        /* Now free port private data */
-{
+        kfree(portdata);
-        stop_read_write_urbs(serial);
+        return 0;
 }
-EXPORT_SYMBOL(usb_wwan_disconnect);
+EXPORT_SYMBOL(usb_wwan_port_remove);
-void usb_wwan_release(struct usb_serial *serial)
+#ifdef CONFIG_PM
+static void stop_read_write_urbs(struct usb_serial *serial)
 {
        int i, j;
        struct usb_serial_port *port;
        struct usb_wwan_port_private *portdata;
-        /* Now free them */
+        /* Stop reading/writing urbs */
        for (i = 0; i < serial->num_ports; ++i) {
                port = serial->port[i];
                portdata = usb_get_serial_port_data(port);
+                if (!portdata)
-                for (j = 0; j < N_IN_URB; j++) {
+                        continue;
-                        usb_free_urb(portdata->in_urbs[j]);
+                for (j = 0; j < N_IN_URB; j++)
-                        free_page((unsigned long)
+                        usb_kill_urb(portdata->in_urbs[j]);
-                                  portdata->in_buffer[j]);
+                for (j = 0; j < N_OUT_URB; j++)
-                        portdata->in_urbs[j] = NULL;
+                        usb_kill_urb(portdata->out_urbs[j]);
-                }
-                for (j = 0; j < N_OUT_URB; j++) {
-                        usb_free_urb(portdata->out_urbs[j]);
-                        kfree(portdata->out_buffer[j]);
-                        portdata->out_urbs[j] = NULL;
-                }
-        }
-        /* Now free per port private data */
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-                kfree(usb_get_serial_port_data(port));
        }
 }
-EXPORT_SYMBOL(usb_wwan_release);
-#ifdef CONFIG_PM
 int usb_wwan_suspend(struct usb_serial *serial, pm_message_t message)
 {
        struct usb_wwan_intf_private *intfdata = serial->private;
@@ -712,7 +702,7 @@ int usb_wwan_resume(struct usb_serial *serial)
                /* skip closed ports */
                spin_lock_irq(&intfdata->susp_lock);
-                if (!portdata->opened) {
+                if (!portdata || !portdata->opened) {
                        spin_unlock_irq(&intfdata->susp_lock);
                        continue;
                }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 9591e2b509d7..17830c9c7cc6 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -264,6 +264,7 @@ static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group)
        return group;
 }
+/* called with vfio.group_lock held */
 static void vfio_group_release(struct kref *kref)
 {
        struct vfio_group *group = container_of(kref, struct vfio_group, kref);
@@ -287,13 +288,7 @@ static void vfio_group_release(struct kref *kref)
 static void vfio_group_put(struct vfio_group *group)
 {
-        mutex_lock(&vfio.group_lock);
+        kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock);
-        /*
-         * Release needs to unlock to unregister the notifier, so only
-         * unlock if not released.
-         */
-        if (!kref_put(&group->kref, vfio_group_release))
-                mutex_unlock(&vfio.group_lock);
 }
 /* Assume group_lock or group reference is held */
@@ -401,7 +396,6 @@ static void vfio_device_release(struct kref *kref)
                                                  struct vfio_device, kref);
        struct vfio_group *group = device->group;
-        mutex_lock(&group->device_lock);
        list_del(&device->group_next);
        mutex_unlock(&group->device_lock);
@@ -416,8 +410,9 @@ static void vfio_device_release(struct kref *kref)
 /* Device reference always implies a group reference */
 static void vfio_device_put(struct vfio_device *device)
 {
-        kref_put(&device->kref, vfio_device_release);
+        struct vfio_group *group = device->group;
-        vfio_group_put(device->group);
+        kref_put_mutex(&device->kref, vfio_device_release, &group->device_lock);
+        vfio_group_put(group);
 }
 static void vfio_device_get(struct vfio_device *device)
@@ -1116,10 +1111,10 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf)
                 */
                filep->f_mode |= (FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
-                fd_install(ret, filep);
                vfio_device_get(device);
                atomic_inc(&group->container_users);
+                fd_install(ret, filep);
                break;
        }
        mutex_unlock(&group->device_lock);
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index fb366540ed54..ed8e2e6c8df2 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -53,9 +53,14 @@
 #include "vhost.h"
 #include "tcm_vhost.h"
+enum {
+        VHOST_SCSI_VQ_CTL = 0,
+        VHOST_SCSI_VQ_EVT = 1,
+        VHOST_SCSI_VQ_IO = 2,
+};
 struct vhost_scsi {
-        atomic_t vhost_ref_cnt;
+        struct tcm_vhost_tpg *vs_tpg;   /* Protected by vhost_scsi->dev.mutex */
-        struct tcm_vhost_tpg *vs_tpg;
        struct vhost_dev dev;
        struct vhost_virtqueue vqs[3];
@@ -131,8 +136,7 @@ static u32 tcm_vhost_get_default_depth(struct se_portal_group *se_tpg)
        return 1;
 }
-static u32 tcm_vhost_get_pr_transport_id(
+static u32 tcm_vhost_get_pr_transport_id(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        struct se_node_acl *se_nacl,
        struct t10_pr_registration *pr_reg,
        int *format_code,
@@ -162,8 +166,7 @@ static u32 tcm_vhost_get_pr_transport_id(
                        format_code, buf);
 }
-static u32 tcm_vhost_get_pr_transport_id_len(
+static u32 tcm_vhost_get_pr_transport_id_len(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        struct se_node_acl *se_nacl,
        struct t10_pr_registration *pr_reg,
        int *format_code)
@@ -192,8 +195,7 @@ static u32 tcm_vhost_get_pr_transport_id_len(
                        format_code);
 }
-static char *tcm_vhost_parse_pr_out_transport_id(
+static char *tcm_vhost_parse_pr_out_transport_id(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        const char *buf,
        u32 *out_tid_len,
        char **port_nexus_ptr)
@@ -236,8 +238,7 @@ static struct se_node_acl *tcm_vhost_alloc_fabric_acl(
        return &nacl->se_node_acl;
 }
-static void tcm_vhost_release_fabric_acl(
+static void tcm_vhost_release_fabric_acl(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        struct se_node_acl *se_nacl)
 {
        struct tcm_vhost_nacl *nacl = container_of(se_nacl,
@@ -297,7 +298,16 @@ static int tcm_vhost_get_cmd_state(struct se_cmd *se_cmd)
        return 0;
 }
-static void vhost_scsi_complete_cmd(struct tcm_vhost_cmd *);
+static void vhost_scsi_complete_cmd(struct tcm_vhost_cmd *tv_cmd)
+{
+        struct vhost_scsi *vs = tv_cmd->tvc_vhost;
+        spin_lock_bh(&vs->vs_completion_lock);
+        list_add_tail(&tv_cmd->tvc_completion_list, &vs->vs_completion_list);
+        spin_unlock_bh(&vs->vs_completion_lock);
+        vhost_work_queue(&vs->dev, &vs->vs_completion_work);
+}
 static int tcm_vhost_queue_data_in(struct se_cmd *se_cmd)
 {
@@ -381,7 +391,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
                                        vs_completion_work);
        struct tcm_vhost_cmd *tv_cmd;
-        while ((tv_cmd = vhost_scsi_get_cmd_from_completion(vs)) != NULL) {
+        while ((tv_cmd = vhost_scsi_get_cmd_from_completion(vs))) {
                struct virtio_scsi_cmd_resp v_rsp;
                struct se_cmd *se_cmd = &tv_cmd->tvc_se_cmd;
                int ret;
@@ -408,19 +418,6 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
        vhost_signal(&vs->dev, &vs->vqs[2]);
 }
-static void vhost_scsi_complete_cmd(struct tcm_vhost_cmd *tv_cmd)
-{
-        struct vhost_scsi *vs = tv_cmd->tvc_vhost;
-        pr_debug("%s tv_cmd %p\n", __func__, tv_cmd);
-        spin_lock_bh(&vs->vs_completion_lock);
-        list_add_tail(&tv_cmd->tvc_completion_list, &vs->vs_completion_list);
-        spin_unlock_bh(&vs->vs_completion_lock);
-        vhost_work_queue(&vs->dev, &vs->vs_completion_work);
-}
 static struct tcm_vhost_cmd *vhost_scsi_allocate_cmd(
        struct tcm_vhost_tpg *tv_tpg,
        struct virtio_scsi_cmd_req *v_req,
@@ -533,8 +530,8 @@ static int vhost_scsi_map_iov_to_sgl(struct tcm_vhost_cmd *tv_cmd,
        sg = kmalloc(sizeof(tv_cmd->tvc_sgl[0]) * sgl_count, GFP_ATOMIC);
        if (!sg)
                return -ENOMEM;
-        pr_debug("%s sg %p sgl_count %u is_err %ld\n", __func__,
+        pr_debug("%s sg %p sgl_count %u is_err %d\n", __func__,
-               sg, sgl_count, IS_ERR(sg));
+               sg, sgl_count, !sg);
        sg_init_table(sg, sgl_count);
        tv_cmd->tvc_sgl = sg;
@@ -787,12 +784,12 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs)
 static void vhost_scsi_ctl_handle_kick(struct vhost_work *work)
 {
-        pr_err("%s: The handling func for control queue.\n", __func__);
+        pr_debug("%s: The handling func for control queue.\n", __func__);
 }
 static void vhost_scsi_evt_handle_kick(struct vhost_work *work)
 {
-        pr_err("%s: The handling func for event queue.\n", __func__);
+        pr_debug("%s: The handling func for event queue.\n", __func__);
 }
 static void vhost_scsi_handle_kick(struct vhost_work *work)
@@ -825,11 +822,6 @@ static int vhost_scsi_set_endpoint(
                        return -EFAULT;
                }
        }
-        if (vs->vs_tpg) {
-                mutex_unlock(&vs->dev.mutex);
-                return -EEXIST;
-        }
        mutex_unlock(&vs->dev.mutex);
        mutex_lock(&tcm_vhost_mutex);
@@ -839,7 +831,7 @@ static int vhost_scsi_set_endpoint(
                        mutex_unlock(&tv_tpg->tv_tpg_mutex);
                        continue;
                }
-                if (atomic_read(&tv_tpg->tv_tpg_vhost_count)) {
+                if (tv_tpg->tv_tpg_vhost_count != 0) {
                        mutex_unlock(&tv_tpg->tv_tpg_mutex);
                        continue;
                }
@@ -847,14 +839,20 @@ static int vhost_scsi_set_endpoint(
                if (!strcmp(tv_tport->tport_name, t->vhost_wwpn) &&
                    (tv_tpg->tport_tpgt == t->vhost_tpgt)) {
-                        atomic_inc(&tv_tpg->tv_tpg_vhost_count);
+                        tv_tpg->tv_tpg_vhost_count++;
-                        smp_mb__after_atomic_inc();
                        mutex_unlock(&tv_tpg->tv_tpg_mutex);
                        mutex_unlock(&tcm_vhost_mutex);
                        mutex_lock(&vs->dev.mutex);
+                        if (vs->vs_tpg) {
+                                mutex_unlock(&vs->dev.mutex);
+                                mutex_lock(&tv_tpg->tv_tpg_mutex);
+                                tv_tpg->tv_tpg_vhost_count--;
+                                mutex_unlock(&tv_tpg->tv_tpg_mutex);
+                                return -EEXIST;
+                        }
                        vs->vs_tpg = tv_tpg;
-                        atomic_inc(&vs->vhost_ref_cnt);
                        smp_mb__after_atomic_inc();
                        mutex_unlock(&vs->dev.mutex);
                        return 0;
@@ -871,38 +869,42 @@ static int vhost_scsi_clear_endpoint(
 {
        struct tcm_vhost_tport *tv_tport;
        struct tcm_vhost_tpg *tv_tpg;
-        int index;
+        int index, ret;
        mutex_lock(&vs->dev.mutex);
        /* Verify that ring has been setup correctly. */
        for (index = 0; index < vs->dev.nvqs; ++index) {
                if (!vhost_vq_access_ok(&vs->vqs[index])) {
-                        mutex_unlock(&vs->dev.mutex);
+                        ret = -EFAULT;
-                        return -EFAULT;
+                        goto err;
                }
        }
        if (!vs->vs_tpg) {
-                mutex_unlock(&vs->dev.mutex);
+                ret = -ENODEV;
-                return -ENODEV;
+                goto err;
        }
        tv_tpg = vs->vs_tpg;
        tv_tport = tv_tpg->tport;
        if (strcmp(tv_tport->tport_name, t->vhost_wwpn) ||
            (tv_tpg->tport_tpgt != t->vhost_tpgt)) {
-                mutex_unlock(&vs->dev.mutex);
                pr_warn("tv_tport->tport_name: %s, tv_tpg->tport_tpgt: %hu"
                        " does not match t->vhost_wwpn: %s, t->vhost_tpgt: %hu\n",
                        tv_tport->tport_name, tv_tpg->tport_tpgt,
                        t->vhost_wwpn, t->vhost_tpgt);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err;
        }
-        atomic_dec(&tv_tpg->tv_tpg_vhost_count);
+        tv_tpg->tv_tpg_vhost_count--;
        vs->vs_tpg = NULL;
        mutex_unlock(&vs->dev.mutex);
        return 0;
+err:
+        mutex_unlock(&vs->dev.mutex);
+        return ret;
 }
 static int vhost_scsi_open(struct inode *inode, struct file *f)
@@ -918,9 +920,9 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
        INIT_LIST_HEAD(&s->vs_completion_list);
        spin_lock_init(&s->vs_completion_lock);
-        s->vqs[0].handle_kick = vhost_scsi_ctl_handle_kick;
+        s->vqs[VHOST_SCSI_VQ_CTL].handle_kick = vhost_scsi_ctl_handle_kick;
-        s->vqs[1].handle_kick = vhost_scsi_evt_handle_kick;
+        s->vqs[VHOST_SCSI_VQ_EVT].handle_kick = vhost_scsi_evt_handle_kick;
-        s->vqs[2].handle_kick = vhost_scsi_handle_kick;
+        s->vqs[VHOST_SCSI_VQ_IO].handle_kick = vhost_scsi_handle_kick;
        r = vhost_dev_init(&s->dev, s->vqs, 3);
        if (r < 0) {
                kfree(s);
@@ -949,6 +951,18 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
        return 0;
 }
+static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
+{
+        vhost_poll_flush(&vs->dev.vqs[index].poll);
+}
+static void vhost_scsi_flush(struct vhost_scsi *vs)
+{
+        vhost_scsi_flush_vq(vs, VHOST_SCSI_VQ_CTL);
+        vhost_scsi_flush_vq(vs, VHOST_SCSI_VQ_EVT);
+        vhost_scsi_flush_vq(vs, VHOST_SCSI_VQ_IO);
+}
 static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
 {
        if (features & ~VHOST_FEATURES)
@@ -961,7 +975,8 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
                return -EFAULT;
        }
        vs->dev.acked_features = features;
-        /* TODO possibly smp_wmb() and flush vqs */
+        smp_wmb();
+        vhost_scsi_flush(vs);
        mutex_unlock(&vs->dev.mutex);
        return 0;
 }
@@ -974,26 +989,25 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
        void __user *argp = (void __user *)arg;
        u64 __user *featurep = argp;
        u64 features;
-        int r;
+        int r, abi_version = VHOST_SCSI_ABI_VERSION;
        switch (ioctl) {
        case VHOST_SCSI_SET_ENDPOINT:
                if (copy_from_user(&backend, argp, sizeof backend))
                        return -EFAULT;
+                if (backend.reserved != 0)
+                        return -EOPNOTSUPP;
                return vhost_scsi_set_endpoint(vs, &backend);
        case VHOST_SCSI_CLEAR_ENDPOINT:
                if (copy_from_user(&backend, argp, sizeof backend))
                        return -EFAULT;
+                if (backend.reserved != 0)
+                        return -EOPNOTSUPP;
                return vhost_scsi_clear_endpoint(vs, &backend);
        case VHOST_SCSI_GET_ABI_VERSION:
-                if (copy_from_user(&backend, argp, sizeof backend))
+                if (copy_to_user(argp, &abi_version, sizeof abi_version))
-                        return -EFAULT;
-                backend.abi_version = VHOST_SCSI_ABI_VERSION;
-                if (copy_to_user(argp, &backend, sizeof backend))
                        return -EFAULT;
                return 0;
        case VHOST_GET_FEATURES:
@@ -1013,11 +1027,21 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
        }
 }
+#ifdef CONFIG_COMPAT
+static long vhost_scsi_compat_ioctl(struct file *f, unsigned int ioctl,
+                                unsigned long arg)
+{
+        return vhost_scsi_ioctl(f, ioctl, (unsigned long)compat_ptr(arg));
+}
+#endif
 static const struct file_operations vhost_scsi_fops = {
        .owner          = THIS_MODULE,
        .release        = vhost_scsi_release,
        .unlocked_ioctl = vhost_scsi_ioctl,
-        /* TODO compat ioctl? */
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = vhost_scsi_compat_ioctl,
+#endif
        .open           = vhost_scsi_open,
        .llseek         = noop_llseek,
 };
@@ -1054,28 +1078,28 @@ static char *tcm_vhost_dump_proto_id(struct tcm_vhost_tport *tport)
        return "Unknown";
 }
-static int tcm_vhost_port_link(
+static int tcm_vhost_port_link(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        struct se_lun *lun)
 {
        struct tcm_vhost_tpg *tv_tpg = container_of(se_tpg,
                                struct tcm_vhost_tpg, se_tpg);
-        atomic_inc(&tv_tpg->tv_tpg_port_count);
+        mutex_lock(&tv_tpg->tv_tpg_mutex);
-        smp_mb__after_atomic_inc();
+        tv_tpg->tv_tpg_port_count++;
+        mutex_unlock(&tv_tpg->tv_tpg_mutex);
        return 0;
 }
-static void tcm_vhost_port_unlink(
+static void tcm_vhost_port_unlink(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        struct se_lun *se_lun)
 {
        struct tcm_vhost_tpg *tv_tpg = container_of(se_tpg,
                                struct tcm_vhost_tpg, se_tpg);
-        atomic_dec(&tv_tpg->tv_tpg_port_count);
+        mutex_lock(&tv_tpg->tv_tpg_mutex);
-        smp_mb__after_atomic_dec();
+        tv_tpg->tv_tpg_port_count--;
+        mutex_unlock(&tv_tpg->tv_tpg_mutex);
 }
 static struct se_node_acl *tcm_vhost_make_nodeacl(
@@ -1122,8 +1146,7 @@ static void tcm_vhost_drop_nodeacl(struct se_node_acl *se_acl)
        kfree(nacl);
 }
-static int tcm_vhost_make_nexus(
+static int tcm_vhost_make_nexus(struct tcm_vhost_tpg *tv_tpg,
-        struct tcm_vhost_tpg *tv_tpg,
        const char *name)
 {
        struct se_portal_group *se_tpg;
@@ -1168,7 +1191,7 @@ static int tcm_vhost_make_nexus(
                return -ENOMEM;
        }
        /*
-         * Now register the TCM vHost virtual I_T Nexus as active with the
+         * Now register the TCM vhost virtual I_T Nexus as active with the
         * call to __transport_register_session()
         */
        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
@@ -1179,8 +1202,7 @@ static int tcm_vhost_make_nexus(
        return 0;
 }
-static int tcm_vhost_drop_nexus(
+static int tcm_vhost_drop_nexus(struct tcm_vhost_tpg *tpg)
-        struct tcm_vhost_tpg *tpg)
 {
        struct se_session *se_sess;
        struct tcm_vhost_nexus *tv_nexus;
@@ -1198,27 +1220,27 @@ static int tcm_vhost_drop_nexus(
                return -ENODEV;
        }
-        if (atomic_read(&tpg->tv_tpg_port_count)) {
+        if (tpg->tv_tpg_port_count != 0) {
                mutex_unlock(&tpg->tv_tpg_mutex);
-                pr_err("Unable to remove TCM_vHost I_T Nexus with"
+                pr_err("Unable to remove TCM_vhost I_T Nexus with"
                        " active TPG port count: %d\n",
-                        atomic_read(&tpg->tv_tpg_port_count));
+                        tpg->tv_tpg_port_count);
-                return -EPERM;
+                return -EBUSY;
        }
-        if (atomic_read(&tpg->tv_tpg_vhost_count)) {
+        if (tpg->tv_tpg_vhost_count != 0) {
                mutex_unlock(&tpg->tv_tpg_mutex);
-                pr_err("Unable to remove TCM_vHost I_T Nexus with"
+                pr_err("Unable to remove TCM_vhost I_T Nexus with"
                        " active TPG vhost count: %d\n",
-                        atomic_read(&tpg->tv_tpg_vhost_count));
+                        tpg->tv_tpg_vhost_count);
-                return -EPERM;
+                return -EBUSY;
        }
-        pr_debug("TCM_vHost_ConfigFS: Removing I_T Nexus to emulated"
+        pr_debug("TCM_vhost_ConfigFS: Removing I_T Nexus to emulated"
                " %s Initiator Port: %s\n", tcm_vhost_dump_proto_id(tpg->tport),
                tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
        /*
-         * Release the SCSI I_T Nexus to the emulated vHost Target Port
+         * Release the SCSI I_T Nexus to the emulated vhost Target Port
         */
        transport_deregister_session(tv_nexus->tvn_se_sess);
        tpg->tpg_nexus = NULL;
@@ -1228,8 +1250,7 @@ static int tcm_vhost_drop_nexus(
        return 0;
 }
-static ssize_t tcm_vhost_tpg_show_nexus(
+static ssize_t tcm_vhost_tpg_show_nexus(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        char *page)
 {
        struct tcm_vhost_tpg *tv_tpg = container_of(se_tpg,
@@ -1250,8 +1271,7 @@ static ssize_t tcm_vhost_tpg_show_nexus(
        return ret;
 }
-static ssize_t tcm_vhost_tpg_store_nexus(
+static ssize_t tcm_vhost_tpg_store_nexus(struct se_portal_group *se_tpg,
-        struct se_portal_group *se_tpg,
        const char *page,
        size_t count)
 {
@@ -1336,8 +1356,7 @@ static struct configfs_attribute *tcm_vhost_tpg_attrs[] = {
        NULL,
 };
-static struct se_portal_group *tcm_vhost_make_tpg(
+static struct se_portal_group *tcm_vhost_make_tpg(struct se_wwn *wwn,
-        struct se_wwn *wwn,
        struct config_group *group,
        const char *name)
 {
@@ -1385,7 +1404,7 @@ static void tcm_vhost_drop_tpg(struct se_portal_group *se_tpg)
        list_del(&tpg->tv_tpg_list);
        mutex_unlock(&tcm_vhost_mutex);
        /*
-         * Release the virtual I_T Nexus for this vHost TPG
+         * Release the virtual I_T Nexus for this vhost TPG
         */
        tcm_vhost_drop_nexus(tpg);
        /*
@@ -1395,8 +1414,7 @@ static void tcm_vhost_drop_tpg(struct se_portal_group *se_tpg)
        kfree(tpg);
 }
-static struct se_wwn *tcm_vhost_make_tport(
+static struct se_wwn *tcm_vhost_make_tport(struct target_fabric_configfs *tf,
-        struct target_fabric_configfs *tf,
        struct config_group *group,
        const char *name)
 {
@@ -1592,7 +1610,10 @@ static void tcm_vhost_deregister_configfs(void)
 static int __init tcm_vhost_init(void)
 {
        int ret = -ENOMEM;
+        /*
+         * Use our own dedicated workqueue for submitting I/O into
+         * target core to avoid contention within system_wq.
+         */
        tcm_vhost_workqueue = alloc_workqueue("tcm_vhost", 0, 0);
        if (!tcm_vhost_workqueue)
                goto out;
diff --git a/drivers/vhost/tcm_vhost.h b/drivers/vhost/tcm_vhost.h
index c983ed21e413..d9e93557d669 100644
--- a/drivers/vhost/tcm_vhost.h
+++ b/drivers/vhost/tcm_vhost.h
@@ -47,9 +47,9 @@ struct tcm_vhost_tpg {
        /* Vhost port target portal group tag for TCM */
        u16 tport_tpgt;
        /* Used to track number of TPG Port/Lun Links wrt to explict I_T Nexus shutdown */
-        atomic_t tv_tpg_port_count;
+        int tv_tpg_port_count;
-        /* Used for vhost_scsi device reference to tpg_nexus */
+        /* Used for vhost_scsi device reference to tpg_nexus, protected by tv_tpg_mutex */
-        atomic_t tv_tpg_vhost_count;
+        int tv_tpg_vhost_count;
        /* list for tcm_vhost_list */
        struct list_head tv_tpg_list;
        /* Used to protect access for tpg_nexus */
@@ -91,11 +91,13 @@ struct tcm_vhost_tport {
 struct vhost_scsi_target {
        int abi_version;
-        unsigned char vhost_wwpn[TRANSPORT_IQN_LEN];
+        char vhost_wwpn[TRANSPORT_IQN_LEN];
        unsigned short vhost_tpgt;
+        unsigned short reserved;
 };
 /* VHOST_SCSI specific defines */
 #define VHOST_SCSI_SET_ENDPOINT _IOW(VHOST_VIRTIO, 0x40, struct vhost_scsi_target)
 #define VHOST_SCSI_CLEAR_ENDPOINT _IOW(VHOST_VIRTIO, 0x41, struct vhost_scsi_target)
-#define VHOST_SCSI_GET_ABI_VERSION _IOW(VHOST_VIRTIO, 0x42, struct vhost_scsi_target)
+/* Changing this breaks userspace. */
+#define VHOST_SCSI_GET_ABI_VERSION _IOW(VHOST_VIRTIO, 0x42, int)
diff --git a/drivers/video/auo_k190x.c b/drivers/video/auo_k190x.c
index 77da6a2f43dc..c03ecdd31e4c 100644
--- a/drivers/video/auo_k190x.c
+++ b/drivers/video/auo_k190x.c
@@ -987,7 +987,6 @@ err_regfb:
        fb_dealloc_cmap(&info->cmap);
 err_cmap:
        fb_deferred_io_cleanup(info);
-        kfree(info->fbdefio);
 err_defio:
        vfree((void *)info->screen_base);
 err_irq:
@@ -1022,7 +1021,6 @@ int  __devexit auok190x_common_remove(struct platform_device *pdev)
        fb_dealloc_cmap(&info->cmap);
        fb_deferred_io_cleanup(info);
-        kfree(info->fbdefio);
        vfree((void *)info->screen_base);
diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c
index 28b1a834906b..61b182bf32a2 100644
--- a/drivers/video/console/bitblit.c
+++ b/drivers/video/console/bitblit.c
@@ -162,7 +162,7 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
        image.depth = 1;
        if (attribute) {
-                buf = kmalloc(cellsize, GFP_KERNEL);
+                buf = kmalloc(cellsize, GFP_ATOMIC);
                if (!buf)
                        return;
        }
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 2e471c22abf5..fdefa8fd72c4 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -372,8 +372,15 @@ static void fb_flashcursor(struct work_struct *work)
        struct vc_data *vc = NULL;
        int c;
        int mode;
+        int ret;
+        /* FIXME: we should sort out the unbind locking instead */
+        /* instead we just fail to flash the cursor if we can't get
+         * the lock instead of blocking fbcon deinit */
+        ret = console_trylock();
+        if (ret == 0)
+                return;
-        console_lock();
        if (ops && ops->currcon != -1)
                vc = vc_cons[ops->currcon].d;
@@ -442,7 +449,7 @@ static int __init fb_console_setup(char *this_opt)
        while ((options = strsep(&this_opt, ",")) != NULL) {
                if (!strncmp(options, "font:", 5))
-                        strcpy(fontname, options + 5);
+                        strlcpy(fontname, options + 5, sizeof(fontname));
                
                if (!strncmp(options, "scrollback:", 11)) {
                        options += 11;
diff --git a/drivers/video/mb862xx/mb862xxfbdrv.c b/drivers/video/mb862xx/mb862xxfbdrv.c
index 00ce1f34b496..57d940be5f3d 100644
--- a/drivers/video/mb862xx/mb862xxfbdrv.c
+++ b/drivers/video/mb862xx/mb862xxfbdrv.c
@@ -328,6 +328,8 @@ static int mb862xxfb_ioctl(struct fb_info *fbi, unsigned int cmd,
        case MB862XX_L1_SET_CFG:
                if (copy_from_user(l1_cfg, argp, sizeof(*l1_cfg)))
                        return -EFAULT;
+                if (l1_cfg->dh == 0 || l1_cfg->dw == 0)
+                        return -EINVAL;
                if ((l1_cfg->sw >= l1_cfg->dw) && (l1_cfg->sh >= l1_cfg->dh)) {
                        /* downscaling */
                        outreg(cap, GC_CAP_CSC,
diff --git a/drivers/video/omap2/dss/sdi.c b/drivers/video/omap2/dss/sdi.c
index 5d31699fbd3c..f43bfe17b3b6 100644
--- a/drivers/video/omap2/dss/sdi.c
+++ b/drivers/video/omap2/dss/sdi.c
@@ -105,6 +105,20 @@ int omapdss_sdi_display_enable(struct omap_dss_device *dssdev)
        sdi_config_lcd_manager(dssdev);
+        /*
+         * LCLK and PCLK divisors are located in shadow registers, and we
+         * normally write them to DISPC registers when enabling the output.
+         * However, SDI uses pck-free as source clock for its PLL, and pck-free
+         * is affected by the divisors. And as we need the PLL before enabling
+         * the output, we need to write the divisors early.
+         *
+         * It seems just writing to the DISPC register is enough, and we don't
+         * need to care about the shadow register mechanism for pck-free. The
+         * exact reason for this is unknown.
+         */
+        dispc_mgr_set_clock_div(dssdev->manager->id,
+                        &sdi.mgr_config.clock_info);
        dss_sdi_init(dssdev->phy.sdi.datapairs);
        r = dss_sdi_enable();
        if (r)
diff --git a/drivers/video/omap2/omapfb/omapfb-main.c b/drivers/video/omap2/omapfb/omapfb-main.c
index 08ec1a7103f2..fc671d3d8004 100644
--- a/drivers/video/omap2/omapfb/omapfb-main.c
+++ b/drivers/video/omap2/omapfb/omapfb-main.c
@@ -1192,7 +1192,7 @@ static int _setcolreg(struct fb_info *fbi, u_int regno, u_int red, u_int green,
                        break;
                if (regno < 16) {
-                        u16 pal;
+                        u32 pal;
                        pal = ((red >> (16 - var->red.length)) <<
                                        var->red.offset) |
                                ((green >> (16 - var->green.length)) <<
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index d90062b211f8..92d08e7fcba2 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -91,6 +91,11 @@ static struct w1_family w1_therm_family_DS28EA00 = {
        .fops = &w1_therm_fops,
 };
+static struct w1_family w1_therm_family_DS1825 = {
+        .fid = W1_THERM_DS1825,
+        .fops = &w1_therm_fops,
+};
 struct w1_therm_family_converter
 {
        u8                      broken;
@@ -120,6 +125,10 @@ static struct w1_therm_family_converter w1_therm_families[] = {
                .f              = &w1_therm_family_DS28EA00,
                .convert        = w1_DS18B20_convert_temp
        },
+        {
+                .f              = &w1_therm_family_DS1825,
+                .convert        = w1_DS18B20_convert_temp
+        }
 };
 static inline int w1_DS18B20_convert_temp(u8 rom[9])
diff --git a/drivers/w1/w1_family.h b/drivers/w1/w1_family.h
index b00ada44a89b..a1f0ce151d53 100644
--- a/drivers/w1/w1_family.h
+++ b/drivers/w1/w1_family.h
@@ -39,6 +39,7 @@
 #define W1_EEPROM_DS2431        0x2D
 #define W1_FAMILY_DS2760        0x30
 #define W1_FAMILY_DS2780        0x32
+#define W1_THERM_DS1825         0x3B
 #define W1_FAMILY_DS2781        0x3D
 #define W1_THERM_DS28EA00       0x42
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 3fe82d0e8caa..5b06d31ab6a9 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -166,18 +166,17 @@ static long booke_wdt_ioctl(struct file *file,
        switch (cmd) {
        case WDIOC_GETSUPPORT:
-                if (copy_to_user((void *)arg, &ident, sizeof(ident)))
+                return copy_to_user(p, &ident, sizeof(ident)) ? -EFAULT : 0;
-                        return -EFAULT;
        case WDIOC_GETSTATUS:
                return put_user(0, p);
        case WDIOC_GETBOOTSTATUS:
                /* XXX: something is clearing TSR */
                tmp = mfspr(SPRN_TSR) & TSR_WRS(3);
                /* returns CARDRESET if last reset was caused by the WDT */
-                return (tmp ? WDIOF_CARDRESET : 0);
+                return put_user((tmp ? WDIOF_CARDRESET : 0), p);
        case WDIOC_SETOPTIONS:
                if (get_user(tmp, p))
-                        return -EINVAL;
+                        return -EFAULT;
                if (tmp == WDIOS_ENABLECARD) {
                        booke_wdt_ping();
                        break;
diff --git a/drivers/watchdog/da9052_wdt.c b/drivers/watchdog/da9052_wdt.c
index 3f75129eb0a9..f7abbaeebcaf 100644
--- a/drivers/watchdog/da9052_wdt.c
+++ b/drivers/watchdog/da9052_wdt.c
@@ -21,7 +21,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
-#include <linux/delay.h>
 #include <linux/mfd/da9052/reg.h>
 #include <linux/mfd/da9052/da9052.h>
diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
index d4c50d63acbc..97ca359ae2bd 100644
--- a/drivers/xen/platform-pci.c
+++ b/drivers/xen/platform-pci.c
@@ -101,19 +101,6 @@ static int platform_pci_resume(struct pci_dev *pdev)
        return 0;
 }
-static void __devinit prepare_shared_info(void)
-{
-#ifdef CONFIG_KEXEC
-        unsigned long addr;
-        struct shared_info *hvm_shared_info;
-        addr = alloc_xen_mmio(PAGE_SIZE);
-        hvm_shared_info = ioremap(addr, PAGE_SIZE);
-        memset(hvm_shared_info, 0, PAGE_SIZE);
-        xen_hvm_prepare_kexec(hvm_shared_info, addr >> PAGE_SHIFT);
-#endif
-}
 static int __devinit platform_pci_init(struct pci_dev *pdev,
                                       const struct pci_device_id *ent)
 {
@@ -151,8 +138,6 @@ static int __devinit platform_pci_init(struct pci_dev *pdev,
        platform_mmio = mmio_addr;
        platform_mmiolen = mmio_len;
-        prepare_shared_info();
        if (!xen_have_vector_callback) {
                ret = xen_allocate_irq(pdev);
                if (ret) {
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index 1afb4fba11b4..4d519488d304 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -232,7 +232,7 @@ xen_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
                return ret;
        if (hwdev && hwdev->coherent_dma_mask)
-                dma_mask = hwdev->coherent_dma_mask;
+                dma_mask = dma_alloc_coherent_mask(hwdev, flags);
        phys = virt_to_phys(ret);
        dev_addr = xen_phys_to_bus(phys);
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 097e536e8672..03342728bf23 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -353,16 +353,16 @@ static int __devinit pcistub_init_device(struct pci_dev *dev)
        if (err)
                goto config_release;
-        dev_dbg(&dev->dev, "reseting (FLR, D3, etc) the device\n");
-        __pci_reset_function_locked(dev);
        /* We need the device active to save the state. */
        dev_dbg(&dev->dev, "save state of device\n");
        pci_save_state(dev);
        dev_data->pci_saved_state = pci_store_saved_state(dev);
        if (!dev_data->pci_saved_state)
                dev_err(&dev->dev, "Could not store PCI conf saved state!\n");
+        else {
+                dev_dbg(&dev->dev, "reseting (FLR, D3, etc) the device\n");
+                __pci_reset_function_locked(dev);
+        }
        /* Now disable the device (this also ensures some private device
         * data is setup before we export)
         */
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 8c0e56d92938..842d00048a65 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -399,11 +399,6 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
                        DPRINTK("checking mountpoint %p %.*s",
                                dentry, (int)dentry->d_name.len, dentry->d_name.name);
-                        /* Path walk currently on this dentry? */
-                        ino_count = atomic_read(&ino->count) + 2;
-                        if (dentry->d_count > ino_count)
-                                goto next;
                        /* Can we umount this guy */
                        if (autofs4_mount_busy(mnt, dentry))
                                goto next;
diff --git a/fs/bio.c b/fs/bio.c
index 5eaa70c9d96e..71072ab99128 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -73,7 +73,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
 {
        unsigned int sz = sizeof(struct bio) + extra_size;
        struct kmem_cache *slab = NULL;
-        struct bio_slab *bslab;
+        struct bio_slab *bslab, *new_bio_slabs;
        unsigned int i, entry = -1;
        mutex_lock(&bio_slab_lock);
@@ -97,11 +97,12 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
        if (bio_slab_nr == bio_slab_max && entry == -1) {
                bio_slab_max <<= 1;
-                bio_slabs = krealloc(bio_slabs,
+                new_bio_slabs = krealloc(bio_slabs,
-                                     bio_slab_max * sizeof(struct bio_slab),
+                                         bio_slab_max * sizeof(struct bio_slab),
-                                     GFP_KERNEL);
+                                         GFP_KERNEL);
-                if (!bio_slabs)
+                if (!new_bio_slabs)
                        goto out_unlock;
+                bio_slabs = new_bio_slabs;
        }
        if (entry == -1)
                entry = bio_slab_nr++;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 1e519195d45b..38e721b35d45 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1578,10 +1578,12 @@ ssize_t blkdev_aio_write(struct kiocb *iocb, const struct iovec *iov,
                         unsigned long nr_segs, loff_t pos)
 {
        struct file *file = iocb->ki_filp;
+        struct blk_plug plug;
        ssize_t ret;
        BUG_ON(iocb->ki_pos != pos);
+        blk_start_plug(&plug);
        ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
        if (ret > 0 || ret == -EIOCBQUEUED) {
                ssize_t err;
@@ -1590,6 +1592,7 @@ ssize_t blkdev_aio_write(struct kiocb *iocb, const struct iovec *iov,
                if (err < 0 && ret > 0)
                        ret = err;
        }
+        blk_finish_plug(&plug);
        return ret;
 }
 EXPORT_SYMBOL_GPL(blkdev_aio_write);
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index a256f3b2a845..ff6475f409d6 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1438,10 +1438,10 @@ int iterate_inodes_from_logical(u64 logical, struct btrfs_fs_info *fs_info,
        ret = extent_from_logical(fs_info, logical, path,
                                        &found_key);
        btrfs_release_path(path);
-        if (ret & BTRFS_EXTENT_FLAG_TREE_BLOCK)
-                ret = -EINVAL;
        if (ret < 0)
                return ret;
+        if (ret & BTRFS_EXTENT_FLAG_TREE_BLOCK)
+                return -EINVAL;
        extent_item_pos = logical - found_key.objectid;
        ret = iterate_extent_inodes(fs_info, found_key.objectid,
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 86eff48dab78..43d1c5a3a030 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -818,6 +818,7 @@ static void free_workspace(int type, struct list_head *workspace)
        btrfs_compress_op[idx]->free_workspace(workspace);
        atomic_dec(alloc_workspace);
 wake:
+        smp_mb();
        if (waitqueue_active(workspace_wait))
                wake_up(workspace_wait);
 }
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 9d7621f271ff..6d183f60d63a 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -421,12 +421,6 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,
        spin_unlock(&fs_info->tree_mod_seq_lock);
        /*
-         * we removed the lowest blocker from the blocker list, so there may be
-         * more processible delayed refs.
-         */
-        wake_up(&fs_info->tree_mod_seq_wait);
-        /*
         * anything that's lower than the lowest existing (read: blocked)
         * sequence number can be removed from the tree.
         */
@@ -631,6 +625,9 @@ __tree_mod_log_free_eb(struct btrfs_fs_info *fs_info, struct extent_buffer *eb)
        u32 nritems;
        int ret;
+        if (btrfs_header_level(eb) == 0)
+                return;
        nritems = btrfs_header_nritems(eb);
        for (i = nritems - 1; i >= 0; i--) {
                ret = tree_mod_log_insert_key_locked(fs_info, eb, i,
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 4bab807227ad..0d195b507660 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1252,7 +1252,6 @@ struct btrfs_fs_info {
        atomic_t tree_mod_seq;
        struct list_head tree_mod_seq_list;
        struct seq_list tree_mod_seq_elem;
-        wait_queue_head_t tree_mod_seq_wait;
        /* this protects tree_mod_log */
        rwlock_t tree_mod_log_lock;
@@ -3192,7 +3191,7 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
 int btrfs_lookup_bio_sums(struct btrfs_root *root, struct inode *inode,
                          struct bio *bio, u32 *dst);
 int btrfs_lookup_bio_sums_dio(struct btrfs_root *root, struct inode *inode,
-                              struct bio *bio, u64 logical_offset, u32 *dst);
+                              struct bio *bio, u64 logical_offset);
 int btrfs_insert_file_extent(struct btrfs_trans_handle *trans,
                             struct btrfs_root *root,
                             u64 objectid, u64 pos,
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 335605c8ceab..07d5eeb1e6f1 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -512,8 +512,8 @@ static void __btrfs_remove_delayed_item(struct btrfs_delayed_item *delayed_item)
        rb_erase(&delayed_item->rb_node, root);
        delayed_item->delayed_node->count--;
-        atomic_dec(&delayed_root->items);
+        if (atomic_dec_return(&delayed_root->items) <
-        if (atomic_read(&delayed_root->items) < BTRFS_DELAYED_BACKGROUND &&
+            BTRFS_DELAYED_BACKGROUND &&
            waitqueue_active(&delayed_root->wait))
                wake_up(&delayed_root->wait);
 }
@@ -1028,9 +1028,10 @@ do_again:
                btrfs_release_delayed_item(prev);
                ret = 0;
                btrfs_release_path(path);
-                if (curr)
+                if (curr) {
+                        mutex_unlock(&node->mutex);
                        goto do_again;
-                else
+                } else
                        goto delete_fail;
        }
@@ -1055,8 +1056,7 @@ static void btrfs_release_delayed_inode(struct btrfs_delayed_node *delayed_node)
                delayed_node->count--;
                delayed_root = delayed_node->root->fs_info->delayed_root;
-                atomic_dec(&delayed_root->items);
+                if (atomic_dec_return(&delayed_root->items) <
-                if (atomic_read(&delayed_root->items) <
                    BTRFS_DELAYED_BACKGROUND &&
                    waitqueue_active(&delayed_root->wait))
                        wake_up(&delayed_root->wait);
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index da7419ed01bb..ae9411773397 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -38,17 +38,14 @@
 static int comp_tree_refs(struct btrfs_delayed_tree_ref *ref2,
                          struct btrfs_delayed_tree_ref *ref1)
 {
-        if (ref1->node.type == BTRFS_TREE_BLOCK_REF_KEY) {
+        if (ref1->root < ref2->root)
-                if (ref1->root < ref2->root)
+                return -1;
-                        return -1;
+        if (ref1->root > ref2->root)
-                if (ref1->root > ref2->root)
+                return 1;
-                        return 1;
+        if (ref1->parent < ref2->parent)
-        } else {
+                return -1;
-                if (ref1->parent < ref2->parent)
+        if (ref1->parent > ref2->parent)
-                        return -1;
+                return 1;
-                if (ref1->parent > ref2->parent)
-                        return 1;
-        }
        return 0;
 }
@@ -85,7 +82,8 @@ static int comp_data_refs(struct btrfs_delayed_data_ref *ref2,
 * type of the delayed backrefs and content of delayed backrefs.
 */
 static int comp_entry(struct btrfs_delayed_ref_node *ref2,
-                      struct btrfs_delayed_ref_node *ref1)
+                      struct btrfs_delayed_ref_node *ref1,
+                      bool compare_seq)
 {
        if (ref1->bytenr < ref2->bytenr)
                return -1;
@@ -102,10 +100,12 @@ static int comp_entry(struct btrfs_delayed_ref_node *ref2,
        if (ref1->type > ref2->type)
                return 1;
        /* merging of sequenced refs is not allowed */
-        if (ref1->seq < ref2->seq)
+        if (compare_seq) {
-                return -1;
+                if (ref1->seq < ref2->seq)
-        if (ref1->seq > ref2->seq)
+                        return -1;
-                return 1;
+                if (ref1->seq > ref2->seq)
+                        return 1;
+        }
        if (ref1->type == BTRFS_TREE_BLOCK_REF_KEY ||
            ref1->type == BTRFS_SHARED_BLOCK_REF_KEY) {
                return comp_tree_refs(btrfs_delayed_node_to_tree_ref(ref2),
@@ -139,7 +139,7 @@ static struct btrfs_delayed_ref_node *tree_insert(struct rb_root *root,
                entry = rb_entry(parent_node, struct btrfs_delayed_ref_node,
                                 rb_node);
-                cmp = comp_entry(entry, ins);
+                cmp = comp_entry(entry, ins, 1);
                if (cmp < 0)
                        p = &(*p)->rb_left;
                else if (cmp > 0)
@@ -233,6 +233,114 @@ int btrfs_delayed_ref_lock(struct btrfs_trans_handle *trans,
        return 0;
 }
+static void inline drop_delayed_ref(struct btrfs_trans_handle *trans,
+                                    struct btrfs_delayed_ref_root *delayed_refs,
+                                    struct btrfs_delayed_ref_node *ref)
+{
+        rb_erase(&ref->rb_node, &delayed_refs->root);
+        ref->in_tree = 0;
+        btrfs_put_delayed_ref(ref);
+        delayed_refs->num_entries--;
+        if (trans->delayed_ref_updates)
+                trans->delayed_ref_updates--;
+}
+static int merge_ref(struct btrfs_trans_handle *trans,
+                     struct btrfs_delayed_ref_root *delayed_refs,
+                     struct btrfs_delayed_ref_node *ref, u64 seq)
+{
+        struct rb_node *node;
+        int merged = 0;
+        int mod = 0;
+        int done = 0;
+        node = rb_prev(&ref->rb_node);
+        while (node) {
+                struct btrfs_delayed_ref_node *next;
+                next = rb_entry(node, struct btrfs_delayed_ref_node, rb_node);
+                node = rb_prev(node);
+                if (next->bytenr != ref->bytenr)
+                        break;
+                if (seq && next->seq >= seq)
+                        break;
+                if (comp_entry(ref, next, 0))
+                        continue;
+                if (ref->action == next->action) {
+                        mod = next->ref_mod;
+                } else {
+                        if (ref->ref_mod < next->ref_mod) {
+                                struct btrfs_delayed_ref_node *tmp;
+                                tmp = ref;
+                                ref = next;
+                                next = tmp;
+                                done = 1;
+                        }
+                        mod = -next->ref_mod;
+                }
+                merged++;
+                drop_delayed_ref(trans, delayed_refs, next);
+                ref->ref_mod += mod;
+                if (ref->ref_mod == 0) {
+                        drop_delayed_ref(trans, delayed_refs, ref);
+                        break;
+                } else {
+                        /*
+                         * You can't have multiples of the same ref on a tree
+                         * block.
+                         */
+                        WARN_ON(ref->type == BTRFS_TREE_BLOCK_REF_KEY ||
+                                ref->type == BTRFS_SHARED_BLOCK_REF_KEY);
+                }
+                if (done)
+                        break;
+                node = rb_prev(&ref->rb_node);
+        }
+        return merged;
+}
+void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+                              struct btrfs_fs_info *fs_info,
+                              struct btrfs_delayed_ref_root *delayed_refs,
+                              struct btrfs_delayed_ref_head *head)
+{
+        struct rb_node *node;
+        u64 seq = 0;
+        spin_lock(&fs_info->tree_mod_seq_lock);
+        if (!list_empty(&fs_info->tree_mod_seq_list)) {
+                struct seq_list *elem;
+                elem = list_first_entry(&fs_info->tree_mod_seq_list,
+                                        struct seq_list, list);
+                seq = elem->seq;
+        }
+        spin_unlock(&fs_info->tree_mod_seq_lock);
+        node = rb_prev(&head->node.rb_node);
+        while (node) {
+                struct btrfs_delayed_ref_node *ref;
+                ref = rb_entry(node, struct btrfs_delayed_ref_node,
+                               rb_node);
+                if (ref->bytenr != head->node.bytenr)
+                        break;
+                /* We can't merge refs that are outside of our seq count */
+                if (seq && ref->seq >= seq)
+                        break;
+                if (merge_ref(trans, delayed_refs, ref, seq))
+                        node = rb_prev(&head->node.rb_node);
+                else
+                        node = rb_prev(node);
+        }
+}
 int btrfs_check_delayed_seq(struct btrfs_fs_info *fs_info,
                            struct btrfs_delayed_ref_root *delayed_refs,
                            u64 seq)
@@ -336,18 +444,11 @@ update_existing_ref(struct btrfs_trans_handle *trans,
                 * every changing the extent allocation tree.
                 */
                existing->ref_mod--;
-                if (existing->ref_mod == 0) {
+                if (existing->ref_mod == 0)
-                        rb_erase(&existing->rb_node,
+                        drop_delayed_ref(trans, delayed_refs, existing);
-                                 &delayed_refs->root);
+                else
-                        existing->in_tree = 0;
-                        btrfs_put_delayed_ref(existing);
-                        delayed_refs->num_entries--;
-                        if (trans->delayed_ref_updates)
-                                trans->delayed_ref_updates--;
-                } else {
                        WARN_ON(existing->type == BTRFS_TREE_BLOCK_REF_KEY ||
                                existing->type == BTRFS_SHARED_BLOCK_REF_KEY);
-                }
        } else {
                WARN_ON(existing->type == BTRFS_TREE_BLOCK_REF_KEY ||
                        existing->type == BTRFS_SHARED_BLOCK_REF_KEY);
@@ -662,9 +763,6 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
        add_delayed_tree_ref(fs_info, trans, &ref->node, bytenr,
                                   num_bytes, parent, ref_root, level, action,
                                   for_cow);
-        if (!need_ref_seq(for_cow, ref_root) &&
-            waitqueue_active(&fs_info->tree_mod_seq_wait))
-                wake_up(&fs_info->tree_mod_seq_wait);
        spin_unlock(&delayed_refs->lock);
        if (need_ref_seq(for_cow, ref_root))
                btrfs_qgroup_record_ref(trans, &ref->node, extent_op);
@@ -713,9 +811,6 @@ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
        add_delayed_data_ref(fs_info, trans, &ref->node, bytenr,
                                   num_bytes, parent, ref_root, owner, offset,
                                   action, for_cow);
-        if (!need_ref_seq(for_cow, ref_root) &&
-            waitqueue_active(&fs_info->tree_mod_seq_wait))
-                wake_up(&fs_info->tree_mod_seq_wait);
        spin_unlock(&delayed_refs->lock);
        if (need_ref_seq(for_cow, ref_root))
                btrfs_qgroup_record_ref(trans, &ref->node, extent_op);
@@ -744,8 +839,6 @@ int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
                                   num_bytes, BTRFS_UPDATE_DELAYED_HEAD,
                                   extent_op->is_data);
-        if (waitqueue_active(&fs_info->tree_mod_seq_wait))
-                wake_up(&fs_info->tree_mod_seq_wait);
        spin_unlock(&delayed_refs->lock);
        return 0;
 }
diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
index 0d7c90c366b6..ab5300595847 100644
--- a/fs/btrfs/delayed-ref.h
+++ b/fs/btrfs/delayed-ref.h
@@ -167,6 +167,10 @@ int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
                                struct btrfs_trans_handle *trans,
                                u64 bytenr, u64 num_bytes,
                                struct btrfs_delayed_extent_op *extent_op);
+void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+                              struct btrfs_fs_info *fs_info,
+                              struct btrfs_delayed_ref_root *delayed_refs,
+                              struct btrfs_delayed_ref_head *head);
 struct btrfs_delayed_ref_head *
 btrfs_find_delayed_ref_head(struct btrfs_trans_handle *trans, u64 bytenr);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 62e0cafd6e25..22e98e04c2ea 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -377,9 +377,13 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
                ret = read_extent_buffer_pages(io_tree, eb, start,
                                               WAIT_COMPLETE,
                                               btree_get_extent, mirror_num);
-                if (!ret && !verify_parent_transid(io_tree, eb,
+                if (!ret) {
+                        if (!verify_parent_transid(io_tree, eb,
                                                   parent_transid, 0))
-                        break;
+                                break;
+                        else
+                                ret = -EIO;
+                }
                /*
                 * This buffer's crc is fine, but its contents are corrupted, so
@@ -754,9 +758,7 @@ static void run_one_async_done(struct btrfs_work *work)
        limit = btrfs_async_submit_limit(fs_info);
        limit = limit * 2 / 3;
-        atomic_dec(&fs_info->nr_async_submits);
+        if (atomic_dec_return(&fs_info->nr_async_submits) < limit &&
-        if (atomic_read(&fs_info->nr_async_submits) < limit &&
            waitqueue_active(&fs_info->async_submit_wait))
                wake_up(&fs_info->async_submit_wait);
@@ -2032,8 +2034,6 @@ int open_ctree(struct super_block *sb,
        fs_info->free_chunk_space = 0;
        fs_info->tree_mod_log = RB_ROOT;
-        init_waitqueue_head(&fs_info->tree_mod_seq_wait);
        /* readahead state */
        INIT_RADIX_TREE(&fs_info->reada_tree, GFP_NOFS & ~__GFP_WAIT);
        spin_lock_init(&fs_info->reada_lock);
@@ -2528,8 +2528,7 @@ retry_root_backup:
                goto fail_trans_kthread;
        /* do not make disk changes in broken FS */
-        if (btrfs_super_log_root(disk_super) != 0 &&
+        if (btrfs_super_log_root(disk_super) != 0) {
-            !(fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR)) {
                u64 bytenr = btrfs_super_log_root(disk_super);
                if (fs_devices->rw_devices == 0) {
@@ -3189,30 +3188,14 @@ int close_ctree(struct btrfs_root *root)
        /* clear out the rbtree of defraggable inodes */
        btrfs_run_defrag_inodes(fs_info);
-        /*
-         * Here come 2 situations when btrfs is broken to flip readonly:
-         *
-         * 1. when btrfs flips readonly somewhere else before
-         * btrfs_commit_super, sb->s_flags has MS_RDONLY flag,
-         * and btrfs will skip to write sb directly to keep
-         * ERROR state on disk.
-         *
-         * 2. when btrfs flips readonly just in btrfs_commit_super,
-         * and in such case, btrfs cannot write sb via btrfs_commit_super,
-         * and since fs_state has been set BTRFS_SUPER_FLAG_ERROR flag,
-         * btrfs will cleanup all FS resources first and write sb then.
-         */
        if (!(fs_info->sb->s_flags & MS_RDONLY)) {
                ret = btrfs_commit_super(root);
                if (ret)
                        printk(KERN_ERR "btrfs: commit super ret %d\n", ret);
        }
-        if (fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
+        if (fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR)
-                ret = btrfs_error_commit_super(root);
+                btrfs_error_commit_super(root);
-                if (ret)
-                        printk(KERN_ERR "btrfs: commit super ret %d\n", ret);
-        }
        btrfs_put_block_group_cache(fs_info);
@@ -3434,18 +3417,11 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
        if (read_only)
                return 0;
-        if (fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
-                printk(KERN_WARNING "warning: mount fs with errors, "
-                       "running btrfsck is recommended\n");
-        }
        return 0;
 }
-int btrfs_error_commit_super(struct btrfs_root *root)
+void btrfs_error_commit_super(struct btrfs_root *root)
 {
-        int ret;
        mutex_lock(&root->fs_info->cleaner_mutex);
        btrfs_run_delayed_iputs(root);
        mutex_unlock(&root->fs_info->cleaner_mutex);
@@ -3455,10 +3431,6 @@ int btrfs_error_commit_super(struct btrfs_root *root)
        /* cleanup FS via transaction */
        btrfs_cleanup_transaction(root);
-        ret = write_ctree_super(NULL, root, 0);
-        return ret;
 }
 static void btrfs_destroy_ordered_operations(struct btrfs_root *root)
@@ -3782,14 +3754,17 @@ int btrfs_cleanup_transaction(struct btrfs_root *root)
                /* FIXME: cleanup wait for commit */
                t->in_commit = 1;
                t->blocked = 1;
+                smp_mb();
                if (waitqueue_active(&root->fs_info->transaction_blocked_wait))
                        wake_up(&root->fs_info->transaction_blocked_wait);
                t->blocked = 0;
+                smp_mb();
                if (waitqueue_active(&root->fs_info->transaction_wait))
                        wake_up(&root->fs_info->transaction_wait);
                t->commit_done = 1;
+                smp_mb();
                if (waitqueue_active(&t->commit_wait))
                        wake_up(&t->commit_wait);
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index 95e147eea239..c5b00a735fef 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -54,7 +54,7 @@ int write_ctree_super(struct btrfs_trans_handle *trans,
                      struct btrfs_root *root, int max_mirrors);
 struct buffer_head *btrfs_read_dev_super(struct block_device *bdev);
 int btrfs_commit_super(struct btrfs_root *root);
-int btrfs_error_commit_super(struct btrfs_root *root);
+void btrfs_error_commit_super(struct btrfs_root *root);
 struct extent_buffer *btrfs_find_tree_block(struct btrfs_root *root,
                                            u64 bytenr, u32 blocksize);
 struct btrfs_root *btrfs_read_fs_root_no_radix(struct btrfs_root *tree_root,
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 4e1b153b7c47..ba58024d40d3 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2252,6 +2252,16 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
                }
                /*
+                 * We need to try and merge add/drops of the same ref since we
+                 * can run into issues with relocate dropping the implicit ref
+                 * and then it being added back again before the drop can
+                 * finish.  If we merged anything we need to re-loop so we can
+                 * get a good ref.
+                 */
+                btrfs_merge_delayed_refs(trans, fs_info, delayed_refs,
+                                         locked_ref);
+                /*
                 * locked_ref is the head node, so we have to go one
                 * node back for any delayed ref updates
                 */
@@ -2318,12 +2328,23 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
                ref->in_tree = 0;
                rb_erase(&ref->rb_node, &delayed_refs->root);
                delayed_refs->num_entries--;
-                /*
+                if (locked_ref) {
-                 * we modified num_entries, but as we're currently running
+                        /*
-                 * delayed refs, skip
+                         * when we play the delayed ref, also correct the
-                 *     wake_up(&delayed_refs->seq_wait);
+                         * ref_mod on head
-                 * here.
+                         */
-                 */
+                        switch (ref->action) {
+                        case BTRFS_ADD_DELAYED_REF:
+                        case BTRFS_ADD_DELAYED_EXTENT:
+                                locked_ref->node.ref_mod -= ref->ref_mod;
+                                break;
+                        case BTRFS_DROP_DELAYED_REF:
+                                locked_ref->node.ref_mod += ref->ref_mod;
+                                break;
+                        default:
+                                WARN_ON(1);
+                        }
+                }
                spin_unlock(&delayed_refs->lock);
                ret = run_one_delayed_ref(trans, root, ref, extent_op,
@@ -2350,22 +2371,6 @@ next:
        return count;
 }
-static void wait_for_more_refs(struct btrfs_fs_info *fs_info,
-                               struct btrfs_delayed_ref_root *delayed_refs,
-                               unsigned long num_refs,
-                               struct list_head *first_seq)
-{
-        spin_unlock(&delayed_refs->lock);
-        pr_debug("waiting for more refs (num %ld, first %p)\n",
-                 num_refs, first_seq);
-        wait_event(fs_info->tree_mod_seq_wait,
-                   num_refs != delayed_refs->num_entries ||
-                   fs_info->tree_mod_seq_list.next != first_seq);
-        pr_debug("done waiting for more refs (num %ld, first %p)\n",
-                 delayed_refs->num_entries, fs_info->tree_mod_seq_list.next);
-        spin_lock(&delayed_refs->lock);
-}
 #ifdef SCRAMBLE_DELAYED_REFS
 /*
 * Normally delayed refs get processed in ascending bytenr order. This
@@ -2460,13 +2465,11 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
        struct btrfs_delayed_ref_root *delayed_refs;
        struct btrfs_delayed_ref_node *ref;
        struct list_head cluster;
-        struct list_head *first_seq = NULL;
        int ret;
        u64 delayed_start;
        int run_all = count == (unsigned long)-1;
        int run_most = 0;
-        unsigned long num_refs = 0;
+        int loops;
-        int consider_waiting;
        /* We'll clean this up in btrfs_cleanup_transaction */
        if (trans->aborted)
@@ -2484,7 +2487,7 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
        delayed_refs = &trans->transaction->delayed_refs;
        INIT_LIST_HEAD(&cluster);
 again:
-        consider_waiting = 0;
+        loops = 0;
        spin_lock(&delayed_refs->lock);
 #ifdef SCRAMBLE_DELAYED_REFS
@@ -2512,31 +2515,6 @@ again:
                if (ret)
                        break;
-                if (delayed_start >= delayed_refs->run_delayed_start) {
-                        if (consider_waiting == 0) {
-                                /*
-                                 * btrfs_find_ref_cluster looped. let's do one
-                                 * more cycle. if we don't run any delayed ref
-                                 * during that cycle (because we can't because
-                                 * all of them are blocked) and if the number of
-                                 * refs doesn't change, we avoid busy waiting.
-                                 */
-                                consider_waiting = 1;
-                                num_refs = delayed_refs->num_entries;
-                                first_seq = root->fs_info->tree_mod_seq_list.next;
-                        } else {
-                                wait_for_more_refs(root->fs_info, delayed_refs,
-                                                   num_refs, first_seq);
-                                /*
-                                 * after waiting, things have changed. we
-                                 * dropped the lock and someone else might have
-                                 * run some refs, built new clusters and so on.
-                                 * therefore, we restart staleness detection.
-                                 */
-                                consider_waiting = 0;
-                        }
-                }
                ret = run_clustered_refs(trans, root, &cluster);
                if (ret < 0) {
                        spin_unlock(&delayed_refs->lock);
@@ -2549,9 +2527,26 @@ again:
                if (count == 0)
                        break;
-                if (ret || delayed_refs->run_delayed_start == 0) {
+                if (delayed_start >= delayed_refs->run_delayed_start) {
+                        if (loops == 0) {
+                                /*
+                                 * btrfs_find_ref_cluster looped. let's do one
+                                 * more cycle. if we don't run any delayed ref
+                                 * during that cycle (because we can't because
+                                 * all of them are blocked), bail out.
+                                 */
+                                loops = 1;
+                        } else {
+                                /*
+                                 * no runnable refs left, stop trying
+                                 */
+                                BUG_ON(run_all);
+                                break;
+                        }
+                }
+                if (ret) {
                        /* refs were run, let's reset staleness detection */
-                        consider_waiting = 0;
+                        loops = 0;
                }
        }
@@ -3007,17 +3002,16 @@ again:
        }
        spin_unlock(&block_group->lock);
-        num_pages = (int)div64_u64(block_group->key.offset, 1024 * 1024 * 1024);
+        /*
+         * Try to preallocate enough space based on how big the block group is.
+         * Keep in mind this has to include any pinned space which could end up
+         * taking up quite a bit since it's not folded into the other space
+         * cache.
+         */
+        num_pages = (int)div64_u64(block_group->key.offset, 256 * 1024 * 1024);
        if (!num_pages)
                num_pages = 1;
-        /*
-         * Just to make absolutely sure we have enough space, we're going to
-         * preallocate 12 pages worth of space for each block group.  In
-         * practice we ought to use at most 8, but we need extra space so we can
-         * add our header and have a terminator between the extents and the
-         * bitmaps.
-         */
        num_pages *= 16;
        num_pages *= PAGE_CACHE_SIZE;
@@ -4571,8 +4565,10 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
        if (root->fs_info->quota_enabled) {
                ret = btrfs_qgroup_reserve(root, num_bytes +
                                           nr_extents * root->leafsize);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&BTRFS_I(inode)->delalloc_mutex);
                        return ret;
+                }
        }
        ret = reserve_metadata_bytes(root, block_rsv, to_reserve, flush);
@@ -5294,9 +5290,6 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
        rb_erase(&head->node.rb_node, &delayed_refs->root);
        delayed_refs->num_entries--;
-        smp_mb();
-        if (waitqueue_active(&root->fs_info->tree_mod_seq_wait))
-                wake_up(&root->fs_info->tree_mod_seq_wait);
        /*
         * we don't take a ref on the node because we're removing it from the
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 45c81bb4ac82..4c878476bb91 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2330,23 +2330,10 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
                        ret = tree->ops->readpage_end_io_hook(page, start, end,
                                                              state, mirror);
-                        if (ret) {
+                        if (ret)
-                                /* no IO indicated but software detected errors
-                                 * in the block, either checksum errors or
-                                 * issues with the contents */
-                                struct btrfs_root *root =
-                                        BTRFS_I(page->mapping->host)->root;
-                                struct btrfs_device *device;
                                uptodate = 0;
-                                device = btrfs_find_device_for_logical(
+                        else
-                                                root, start, mirror);
-                                if (device)
-                                        btrfs_dev_stat_inc_and_print(device,
-                                                BTRFS_DEV_STAT_CORRUPTION_ERRS);
-                        } else {
                                clean_io_failure(start, page);
-                        }
                }
                if (!uptodate && tree->ops && tree->ops->readpage_io_failed_hook) {
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index b45b9de0c21d..857d93cd01dc 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -272,9 +272,9 @@ int btrfs_lookup_bio_sums(struct btrfs_root *root, struct inode *inode,
 }
 int btrfs_lookup_bio_sums_dio(struct btrfs_root *root, struct inode *inode,
-                              struct bio *bio, u64 offset, u32 *dst)
+                              struct bio *bio, u64 offset)
 {
-        return __btrfs_lookup_bio_sums(root, inode, bio, offset, dst, 1);
+        return __btrfs_lookup_bio_sums(root, inode, bio, offset, NULL, 1);
 }
 int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 6e8f416773d4..ec154f954646 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1008,9 +1008,7 @@ static noinline void async_cow_submit(struct btrfs_work *work)
        nr_pages = (async_cow->end - async_cow->start + PAGE_CACHE_SIZE) >>
                PAGE_CACHE_SHIFT;
-        atomic_sub(nr_pages, &root->fs_info->async_delalloc_pages);
+        if (atomic_sub_return(nr_pages, &root->fs_info->async_delalloc_pages) <
-        if (atomic_read(&root->fs_info->async_delalloc_pages) <
            5 * 1024 * 1024 &&
            waitqueue_active(&root->fs_info->async_submit_wait))
                wake_up(&root->fs_info->async_submit_wait);
@@ -1885,8 +1883,11 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
                                trans = btrfs_join_transaction_nolock(root);
                        else
                                trans = btrfs_join_transaction(root);
-                        if (IS_ERR(trans))
+                        if (IS_ERR(trans)) {
-                                return PTR_ERR(trans);
+                                ret = PTR_ERR(trans);
+                                trans = NULL;
+                                goto out;
+                        }
                        trans->block_rsv = &root->fs_info->delalloc_block_rsv;
                        ret = btrfs_update_inode_fallback(trans, root, inode);
                        if (ret) /* -ENOMEM or corruption */
@@ -3174,7 +3175,7 @@ int btrfs_unlink_subvol(struct btrfs_trans_handle *trans,
        btrfs_i_size_write(dir, dir->i_size - name_len * 2);
        inode_inc_iversion(dir);
        dir->i_mtime = dir->i_ctime = CURRENT_TIME;
-        ret = btrfs_update_inode(trans, root, dir);
+        ret = btrfs_update_inode_fallback(trans, root, dir);
        if (ret)
                btrfs_abort_transaction(trans, root, ret);
 out:
@@ -5774,18 +5775,112 @@ out:
        return ret;
 }
+static int lock_extent_direct(struct inode *inode, u64 lockstart, u64 lockend,
+                              struct extent_state **cached_state, int writing)
+{
+        struct btrfs_ordered_extent *ordered;
+        int ret = 0;
+        while (1) {
+                lock_extent_bits(&BTRFS_I(inode)->io_tree, lockstart, lockend,
+                                 0, cached_state);
+                /*
+                 * We're concerned with the entire range that we're going to be
+                 * doing DIO to, so we need to make sure theres no ordered
+                 * extents in this range.
+                 */
+                ordered = btrfs_lookup_ordered_range(inode, lockstart,
+                                                     lockend - lockstart + 1);
+                /*
+                 * We need to make sure there are no buffered pages in this
+                 * range either, we could have raced between the invalidate in
+                 * generic_file_direct_write and locking the extent.  The
+                 * invalidate needs to happen so that reads after a write do not
+                 * get stale data.
+                 */
+                if (!ordered && (!writing ||
+                    !test_range_bit(&BTRFS_I(inode)->io_tree,
+                                    lockstart, lockend, EXTENT_UPTODATE, 0,
+                                    *cached_state)))
+                        break;
+                unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, lockend,
+                                     cached_state, GFP_NOFS);
+                if (ordered) {
+                        btrfs_start_ordered_extent(inode, ordered, 1);
+                        btrfs_put_ordered_extent(ordered);
+                } else {
+                        /* Screw you mmap */
+                        ret = filemap_write_and_wait_range(inode->i_mapping,
+                                                           lockstart,
+                                                           lockend);
+                        if (ret)
+                                break;
+                        /*
+                         * If we found a page that couldn't be invalidated just
+                         * fall back to buffered.
+                         */
+                        ret = invalidate_inode_pages2_range(inode->i_mapping,
+                                        lockstart >> PAGE_CACHE_SHIFT,
+                                        lockend >> PAGE_CACHE_SHIFT);
+                        if (ret)
+                                break;
+                }
+                cond_resched();
+        }
+        return ret;
+}
 static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                                   struct buffer_head *bh_result, int create)
 {
        struct extent_map *em;
        struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct extent_state *cached_state = NULL;
        u64 start = iblock << inode->i_blkbits;
+        u64 lockstart, lockend;
        u64 len = bh_result->b_size;
        struct btrfs_trans_handle *trans;
+        int unlock_bits = EXTENT_LOCKED;
+        int ret;
+        if (create) {
+                ret = btrfs_delalloc_reserve_space(inode, len);
+                if (ret)
+                        return ret;
+                unlock_bits |= EXTENT_DELALLOC | EXTENT_DIRTY;
+        } else {
+                len = min_t(u64, len, root->sectorsize);
+        }
+        lockstart = start;
+        lockend = start + len - 1;
+        /*
+         * If this errors out it's because we couldn't invalidate pagecache for
+         * this range and we need to fallback to buffered.
+         */
+        if (lock_extent_direct(inode, lockstart, lockend, &cached_state, create))
+                return -ENOTBLK;
+        if (create) {
+                ret = set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart,
+                                     lockend, EXTENT_DELALLOC, NULL,
+                                     &cached_state, GFP_NOFS);
+                if (ret)
+                        goto unlock_err;
+        }
        em = btrfs_get_extent(inode, NULL, 0, start, len, 0);
-        if (IS_ERR(em))
+        if (IS_ERR(em)) {
-                return PTR_ERR(em);
+                ret = PTR_ERR(em);
+                goto unlock_err;
+        }
        /*
         * Ok for INLINE and COMPRESSED extents we need to fallback on buffered
@@ -5804,17 +5899,16 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
        if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) ||
            em->block_start == EXTENT_MAP_INLINE) {
                free_extent_map(em);
-                return -ENOTBLK;
+                ret = -ENOTBLK;
+                goto unlock_err;
        }
        /* Just a good old fashioned hole, return */
        if (!create && (em->block_start == EXTENT_MAP_HOLE ||
                        test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
                free_extent_map(em);
-                /* DIO will do one hole at a time, so just unlock a sector */
+                ret = 0;
-                unlock_extent(&BTRFS_I(inode)->io_tree, start,
+                goto unlock_err;
-                              start + root->sectorsize - 1);
-                return 0;
        }
        /*
@@ -5827,8 +5921,9 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
         *
         */
        if (!create) {
-                len = em->len - (start - em->start);
+                len = min(len, em->len - (start - em->start));
-                goto map;
+                lockstart = start + len;
+                goto unlock;
        }
        if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags) ||
@@ -5860,7 +5955,7 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                        btrfs_end_transaction(trans, root);
                        if (ret) {
                                free_extent_map(em);
-                                return ret;
+                                goto unlock_err;
                        }
                        goto unlock;
                }
@@ -5873,14 +5968,12 @@ must_cow:
         */
        len = bh_result->b_size;
        em = btrfs_new_extent_direct(inode, em, start, len);
-        if (IS_ERR(em))
+        if (IS_ERR(em)) {
-                return PTR_ERR(em);
+                ret = PTR_ERR(em);
+                goto unlock_err;
+        }
        len = min(len, em->len - (start - em->start));
 unlock:
-        clear_extent_bit(&BTRFS_I(inode)->io_tree, start, start + len - 1,
-                          EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DIRTY, 1,
-                          0, NULL, GFP_NOFS);
-map:
        bh_result->b_blocknr = (em->block_start + (start - em->start)) >>
                inode->i_blkbits;
        bh_result->b_size = len;
@@ -5898,9 +5991,44 @@ map:
                        i_size_write(inode, start + len);
        }
+        /*
+         * In the case of write we need to clear and unlock the entire range,
+         * in the case of read we need to unlock only the end area that we
+         * aren't using if there is any left over space.
+         */
+        if (lockstart < lockend) {
+                if (create && len < lockend - lockstart) {
+                        clear_extent_bit(&BTRFS_I(inode)->io_tree, lockstart,
+                                         lockstart + len - 1, unlock_bits, 1, 0,
+                                         &cached_state, GFP_NOFS);
+                        /*
+                         * Beside unlock, we also need to cleanup reserved space
+                         * for the left range by attaching EXTENT_DO_ACCOUNTING.
+                         */
+                        clear_extent_bit(&BTRFS_I(inode)->io_tree,
+                                         lockstart + len, lockend,
+                                         unlock_bits | EXTENT_DO_ACCOUNTING,
+                                         1, 0, NULL, GFP_NOFS);
+                } else {
+                        clear_extent_bit(&BTRFS_I(inode)->io_tree, lockstart,
+                                         lockend, unlock_bits, 1, 0,
+                                         &cached_state, GFP_NOFS);
+                }
+        } else {
+                free_extent_state(cached_state);
+        }
        free_extent_map(em);
        return 0;
+unlock_err:
+        if (create)
+                unlock_bits |= EXTENT_DO_ACCOUNTING;
+        clear_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, lockend,
+                         unlock_bits, 1, 0, &cached_state, GFP_NOFS);
+        return ret;
 }
 struct btrfs_dio_private {
@@ -5908,7 +6036,6 @@ struct btrfs_dio_private {
        u64 logical_offset;
        u64 disk_bytenr;
        u64 bytes;
-        u32 *csums;
        void *private;
        /* number of bios pending for this dio */
@@ -5928,7 +6055,6 @@ static void btrfs_endio_direct_read(struct bio *bio, int err)
        struct inode *inode = dip->inode;
        struct btrfs_root *root = BTRFS_I(inode)->root;
        u64 start;
-        u32 *private = dip->csums;
        start = dip->logical_offset;
        do {
@@ -5936,8 +6062,12 @@ static void btrfs_endio_direct_read(struct bio *bio, int err)
                        struct page *page = bvec->bv_page;
                        char *kaddr;
                        u32 csum = ~(u32)0;
+                        u64 private = ~(u32)0;
                        unsigned long flags;
+                        if (get_state_private(&BTRFS_I(inode)->io_tree,
+                                              start, &private))
+                                goto failed;
                        local_irq_save(flags);
                        kaddr = kmap_atomic(page);
                        csum = btrfs_csum_data(root, kaddr + bvec->bv_offset,
@@ -5947,18 +6077,18 @@ static void btrfs_endio_direct_read(struct bio *bio, int err)
                        local_irq_restore(flags);
                        flush_dcache_page(bvec->bv_page);
-                        if (csum != *private) {
+                        if (csum != private) {
+failed:
                                printk(KERN_ERR "btrfs csum failed ino %llu off"
                                      " %llu csum %u private %u\n",
                                      (unsigned long long)btrfs_ino(inode),
                                      (unsigned long long)start,
-                                      csum, *private);
+                                      csum, (unsigned)private);
                                err = -EIO;
                        }
                }
                start += bvec->bv_len;
-                private++;
                bvec++;
        } while (bvec <= bvec_end);
@@ -5966,7 +6096,6 @@ static void btrfs_endio_direct_read(struct bio *bio, int err)
                      dip->logical_offset + dip->bytes - 1);
        bio->bi_private = dip->private;
-        kfree(dip->csums);
        kfree(dip);
        /* If we had a csum failure make sure to clear the uptodate flag */
@@ -6072,7 +6201,7 @@ static struct bio *btrfs_dio_bio_alloc(struct block_device *bdev,
 static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
                                         int rw, u64 file_offset, int skip_sum,
-                                         u32 *csums, int async_submit)
+                                         int async_submit)
 {
        int write = rw & REQ_WRITE;
        struct btrfs_root *root = BTRFS_I(inode)->root;
@@ -6105,8 +6234,7 @@ static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
                if (ret)
                        goto err;
        } else if (!skip_sum) {
-                ret = btrfs_lookup_bio_sums_dio(root, inode, bio,
+                ret = btrfs_lookup_bio_sums_dio(root, inode, bio, file_offset);
-                                          file_offset, csums);
                if (ret)
                        goto err;
        }
@@ -6132,10 +6260,8 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
        u64 submit_len = 0;
        u64 map_length;
        int nr_pages = 0;
-        u32 *csums = dip->csums;
        int ret = 0;
        int async_submit = 0;
-        int write = rw & REQ_WRITE;
        map_length = orig_bio->bi_size;
        ret = btrfs_map_block(map_tree, READ, start_sector << 9,
@@ -6171,16 +6297,13 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
                        atomic_inc(&dip->pending_bios);
                        ret = __btrfs_submit_dio_bio(bio, inode, rw,
                                                     file_offset, skip_sum,
-                                                     csums, async_submit);
+                                                     async_submit);
                        if (ret) {
                                bio_put(bio);
                                atomic_dec(&dip->pending_bios);
                                goto out_err;
                        }
-                        /* Write's use the ordered csums */
-                        if (!write && !skip_sum)
-                                csums = csums + nr_pages;
                        start_sector += submit_len >> 9;
                        file_offset += submit_len;
@@ -6210,7 +6333,7 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
 submit:
        ret = __btrfs_submit_dio_bio(bio, inode, rw, file_offset, skip_sum,
-                                     csums, async_submit);
+                                     async_submit);
        if (!ret)
                return 0;
@@ -6246,17 +6369,6 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode,
                ret = -ENOMEM;
                goto free_ordered;
        }
-        dip->csums = NULL;
-        /* Write's use the ordered csum stuff, so we don't need dip->csums */
-        if (!write && !skip_sum) {
-                dip->csums = kmalloc(sizeof(u32) * bio->bi_vcnt, GFP_NOFS);
-                if (!dip->csums) {
-                        kfree(dip);
-                        ret = -ENOMEM;
-                        goto free_ordered;
-                }
-        }
        dip->private = bio->bi_private;
        dip->inode = inode;
@@ -6341,132 +6453,22 @@ static ssize_t check_direct_IO(struct btrfs_root *root, int rw, struct kiocb *io
 out:
        return retval;
 }
 static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
                        const struct iovec *iov, loff_t offset,
                        unsigned long nr_segs)
 {
        struct file *file = iocb->ki_filp;
        struct inode *inode = file->f_mapping->host;
-        struct btrfs_ordered_extent *ordered;
-        struct extent_state *cached_state = NULL;
-        u64 lockstart, lockend;
-        ssize_t ret;
-        int writing = rw & WRITE;
-        int write_bits = 0;
-        size_t count = iov_length(iov, nr_segs);
        if (check_direct_IO(BTRFS_I(inode)->root, rw, iocb, iov,
-                            offset, nr_segs)) {
+                            offset, nr_segs))
                return 0;
-        }
-        lockstart = offset;
-        lockend = offset + count - 1;
-        if (writing) {
-                ret = btrfs_delalloc_reserve_space(inode, count);
-                if (ret)
-                        goto out;
-        }
-        while (1) {
-                lock_extent_bits(&BTRFS_I(inode)->io_tree, lockstart, lockend,
-                                 0, &cached_state);
-                /*
-                 * We're concerned with the entire range that we're going to be
-                 * doing DIO to, so we need to make sure theres no ordered
-                 * extents in this range.
-                 */
-                ordered = btrfs_lookup_ordered_range(inode, lockstart,
-                                                     lockend - lockstart + 1);
-                /*
-                 * We need to make sure there are no buffered pages in this
-                 * range either, we could have raced between the invalidate in
-                 * generic_file_direct_write and locking the extent.  The
-                 * invalidate needs to happen so that reads after a write do not
-                 * get stale data.
-                 */
-                if (!ordered && (!writing ||
-                    !test_range_bit(&BTRFS_I(inode)->io_tree,
-                                    lockstart, lockend, EXTENT_UPTODATE, 0,
-                                    cached_state)))
-                        break;
-                unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, lockend,
-                                     &cached_state, GFP_NOFS);
-                if (ordered) {
-                        btrfs_start_ordered_extent(inode, ordered, 1);
-                        btrfs_put_ordered_extent(ordered);
-                } else {
-                        /* Screw you mmap */
-                        ret = filemap_write_and_wait_range(file->f_mapping,
-                                                           lockstart,
-                                                           lockend);
-                        if (ret)
-                                goto out;
-                        /*
-                         * If we found a page that couldn't be invalidated just
-                         * fall back to buffered.
-                         */
-                        ret = invalidate_inode_pages2_range(file->f_mapping,
-                                        lockstart >> PAGE_CACHE_SHIFT,
-                                        lockend >> PAGE_CACHE_SHIFT);
-                        if (ret) {
-                                if (ret == -EBUSY)
-                                        ret = 0;
-                                goto out;
-                        }
-                }
-                cond_resched();
-        }
-        /*
+        return __blockdev_direct_IO(rw, iocb, inode,
-         * we don't use btrfs_set_extent_delalloc because we don't want
-         * the dirty or uptodate bits
-         */
-        if (writing) {
-                write_bits = EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING;
-                ret = set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, lockend,
-                                     EXTENT_DELALLOC, NULL, &cached_state,
-                                     GFP_NOFS);
-                if (ret) {
-                        clear_extent_bit(&BTRFS_I(inode)->io_tree, lockstart,
-                                         lockend, EXTENT_LOCKED | write_bits,
-                                         1, 0, &cached_state, GFP_NOFS);
-                        goto out;
-                }
-        }
-        free_extent_state(cached_state);
-        cached_state = NULL;
-        ret = __blockdev_direct_IO(rw, iocb, inode,
                   BTRFS_I(inode)->root->fs_info->fs_devices->latest_bdev,
                   iov, offset, nr_segs, btrfs_get_blocks_direct, NULL,
                   btrfs_submit_direct, 0);
-        if (ret < 0 && ret != -EIOCBQUEUED) {
-                clear_extent_bit(&BTRFS_I(inode)->io_tree, offset,
-                              offset + iov_length(iov, nr_segs) - 1,
-                              EXTENT_LOCKED | write_bits, 1, 0,
-                              &cached_state, GFP_NOFS);
-        } else if (ret >= 0 && ret < iov_length(iov, nr_segs)) {
-                /*
-                 * We're falling back to buffered, unlock the section we didn't
-                 * do IO on.
-                 */
-                clear_extent_bit(&BTRFS_I(inode)->io_tree, offset + ret,
-                              offset + iov_length(iov, nr_segs) - 1,
-                              EXTENT_LOCKED | write_bits, 1, 0,
-                              &cached_state, GFP_NOFS);
-        }
-out:
-        free_extent_state(cached_state);
-        return ret;
 }
 static int btrfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 7bb755677a22..9df50fa8a078 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -424,7 +424,7 @@ static noinline int create_subvol(struct btrfs_root *root,
        uuid_le_gen(&new_uuid);
        memcpy(root_item.uuid, new_uuid.b, BTRFS_UUID_SIZE);
        root_item.otime.sec = cpu_to_le64(cur_time.tv_sec);
-        root_item.otime.nsec = cpu_to_le64(cur_time.tv_nsec);
+        root_item.otime.nsec = cpu_to_le32(cur_time.tv_nsec);
        root_item.ctime = root_item.otime;
        btrfs_set_root_ctransid(&root_item, trans->transid);
        btrfs_set_root_otransid(&root_item, trans->transid);
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index a44eff074805..2a1762c66041 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -67,7 +67,7 @@ void btrfs_clear_lock_blocking_rw(struct extent_buffer *eb, int rw)
 {
        if (eb->lock_nested) {
                read_lock(&eb->lock);
-                if (&eb->lock_nested && current->pid == eb->lock_owner) {
+                if (eb->lock_nested && current->pid == eb->lock_owner) {
                        read_unlock(&eb->lock);
                        return;
                }
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index bc424ae5a81a..38b42e7bc91d 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1364,13 +1364,17 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans,
        spin_lock(&fs_info->qgroup_lock);
        dstgroup = add_qgroup_rb(fs_info, objectid);
-        if (!dstgroup)
+        if (IS_ERR(dstgroup)) {
+                ret = PTR_ERR(dstgroup);
                goto unlock;
+        }
        if (srcid) {
                srcgroup = find_qgroup_rb(fs_info, srcid);
-                if (!srcgroup)
+                if (!srcgroup) {
+                        ret = -EINVAL;
                        goto unlock;
+                }
                dstgroup->rfer = srcgroup->rfer - level_size;
                dstgroup->rfer_cmpr = srcgroup->rfer_cmpr - level_size;
                srcgroup->excl = level_size;
@@ -1379,8 +1383,10 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans,
                qgroup_dirty(fs_info, srcgroup);
        }
-        if (!inherit)
+        if (!inherit) {
+                ret = -EINVAL;
                goto unlock;
+        }
        i_qgroups = (u64 *)(inherit + 1);
        for (i = 0; i < inherit->num_qgroups; ++i) {
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 6bb465cca20f..10d8e4d88071 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -544,8 +544,8 @@ void btrfs_update_root_times(struct btrfs_trans_handle *trans,
        struct timespec ct = CURRENT_TIME;
        spin_lock(&root->root_times_lock);
-        item->ctransid = trans->transid;
+        item->ctransid = cpu_to_le64(trans->transid);
        item->ctime.sec = cpu_to_le64(ct.tv_sec);
-        item->ctime.nsec = cpu_to_le64(ct.tv_nsec);
+        item->ctime.nsec = cpu_to_le32(ct.tv_nsec);
        spin_unlock(&root->root_times_lock);
 }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index f2eb24c477a3..83d6f9f9c220 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -838,7 +838,6 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
        struct btrfs_trans_handle *trans;
        struct btrfs_fs_info *fs_info = btrfs_sb(sb);
        struct btrfs_root *root = fs_info->tree_root;
-        int ret;
        trace_btrfs_sync_fs(wait);
@@ -849,11 +848,17 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
        btrfs_wait_ordered_extents(root, 0, 0);
-        trans = btrfs_start_transaction(root, 0);
+        spin_lock(&fs_info->trans_lock);
+        if (!fs_info->running_transaction) {
+                spin_unlock(&fs_info->trans_lock);
+                return 0;
+        }
+        spin_unlock(&fs_info->trans_lock);
+        trans = btrfs_join_transaction(root);
        if (IS_ERR(trans))
                return PTR_ERR(trans);
-        ret = btrfs_commit_transaction(trans, root);
+        return btrfs_commit_transaction(trans, root);
-        return ret;
 }
 static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry)
@@ -1530,6 +1535,8 @@ static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
        while (cur_devices) {
                head = &cur_devices->devices;
                list_for_each_entry(dev, head, dev_list) {
+                        if (dev->missing)
+                                continue;
                        if (!first_dev || dev->devid < first_dev->devid)
                                first_dev = dev;
                }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 17be3dedacba..27c26004e050 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1031,6 +1031,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                         dentry->d_name.len * 2);
+        parent_inode->i_mtime = parent_inode->i_ctime = CURRENT_TIME;
        ret = btrfs_update_inode(trans, parent_root, parent_inode);
        if (ret)
                goto abort_trans_dput;
@@ -1066,7 +1067,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        memcpy(new_root_item->parent_uuid, root->root_item.uuid,
                        BTRFS_UUID_SIZE);
        new_root_item->otime.sec = cpu_to_le64(cur_time.tv_sec);
-        new_root_item->otime.nsec = cpu_to_le64(cur_time.tv_nsec);
+        new_root_item->otime.nsec = cpu_to_le32(cur_time.tv_nsec);
        btrfs_set_root_otransid(new_root_item, trans->transid);
        memset(&new_root_item->stime, 0, sizeof(new_root_item->stime));
        memset(&new_root_item->rtime, 0, sizeof(new_root_item->rtime));
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e86ae04abe6a..88b969aeeb71 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -227,9 +227,8 @@ loop_lock:
                cur = pending;
                pending = pending->bi_next;
                cur->bi_next = NULL;
-                atomic_dec(&fs_info->nr_async_bios);
-                if (atomic_read(&fs_info->nr_async_bios) < limit &&
+                if (atomic_dec_return(&fs_info->nr_async_bios) < limit &&
                    waitqueue_active(&fs_info->async_submit_wait))
                        wake_up(&fs_info->async_submit_wait);
@@ -569,9 +568,11 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                memcpy(new_device, device, sizeof(*new_device));
                /* Safe because we are under uuid_mutex */
-                name = rcu_string_strdup(device->name->str, GFP_NOFS);
+                if (device->name) {
-                BUG_ON(device->name && !name); /* -ENOMEM */
+                        name = rcu_string_strdup(device->name->str, GFP_NOFS);
-                rcu_assign_pointer(new_device->name, name);
+                        BUG_ON(device->name && !name); /* -ENOMEM */
+                        rcu_assign_pointer(new_device->name, name);
+                }
                new_device->bdev = NULL;
                new_device->writeable = 0;
                new_device->in_fs_metadata = 0;
@@ -4605,28 +4606,6 @@ int btrfs_read_sys_array(struct btrfs_root *root)
        return ret;
 }
-struct btrfs_device *btrfs_find_device_for_logical(struct btrfs_root *root,
-                                                   u64 logical, int mirror_num)
-{
-        struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
-        int ret;
-        u64 map_length = 0;
-        struct btrfs_bio *bbio = NULL;
-        struct btrfs_device *device;
-        BUG_ON(mirror_num == 0);
-        ret = btrfs_map_block(map_tree, WRITE, logical, &map_length, &bbio,
-                              mirror_num);
-        if (ret) {
-                BUG_ON(bbio != NULL);
-                return NULL;
-        }
-        BUG_ON(mirror_num != bbio->mirror_num);
-        device = bbio->stripes[mirror_num - 1].dev;
-        kfree(bbio);
-        return device;
-}
 int btrfs_read_chunk_tree(struct btrfs_root *root)
 {
        struct btrfs_path *path;
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 5479325987b3..53c06af92e8d 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -289,8 +289,6 @@ int btrfs_cancel_balance(struct btrfs_fs_info *fs_info);
 int btrfs_chunk_readonly(struct btrfs_root *root, u64 chunk_offset);
 int find_free_dev_extent(struct btrfs_device *device, u64 num_bytes,
                         u64 *start, u64 *max_avail);
-struct btrfs_device *btrfs_find_device_for_logical(struct btrfs_root *root,
-                                                   u64 logical, int mirror_num);
 void btrfs_dev_stat_print_on_error(struct btrfs_device *device);
 void btrfs_dev_stat_inc_and_print(struct btrfs_device *dev, int index);
 int btrfs_get_dev_stats(struct btrfs_root *root,
diff --git a/fs/buffer.c b/fs/buffer.c
index 9f6d2e41281d..58e2e7b77372 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -914,7 +914,7 @@ link_dev_buffers(struct page *page, struct buffer_head *head)
 /*
 * Initialise the state of a blockdev page's buffers.
 */ 
-static void
+static sector_t
 init_page_buffers(struct page *page, struct block_device *bdev,
                        sector_t block, int size)
 {
@@ -936,33 +936,41 @@ init_page_buffers(struct page *page, struct block_device *bdev,
                block++;
                bh = bh->b_this_page;
        } while (bh != head);
+        /*
+         * Caller needs to validate requested block against end of device.
+         */
+        return end_block;
 }
 /*
 * Create the page-cache page that contains the requested block.
 *
- * This is user purely for blockdev mappings.
+ * This is used purely for blockdev mappings.
 */
-static struct page *
+static int
 grow_dev_page(struct block_device *bdev, sector_t block,
-                pgoff_t index, int size)
+                pgoff_t index, int size, int sizebits)
 {
        struct inode *inode = bdev->bd_inode;
        struct page *page;
        struct buffer_head *bh;
+        sector_t end_block;
+        int ret = 0;            /* Will call free_more_memory() */
        page = find_or_create_page(inode->i_mapping, index,
                (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
        if (!page)
-                return NULL;
+                return ret;
        BUG_ON(!PageLocked(page));
        if (page_has_buffers(page)) {
                bh = page_buffers(page);
                if (bh->b_size == size) {
-                        init_page_buffers(page, bdev, block, size);
+                        end_block = init_page_buffers(page, bdev,
-                        return page;
+                                                index << sizebits, size);
+                        goto done;
                }
                if (!try_to_free_buffers(page))
                        goto failed;
@@ -982,14 +990,14 @@ grow_dev_page(struct block_device *bdev, sector_t block,
         */
        spin_lock(&inode->i_mapping->private_lock);
        link_dev_buffers(page, bh);
-        init_page_buffers(page, bdev, block, size);
+        end_block = init_page_buffers(page, bdev, index << sizebits, size);
        spin_unlock(&inode->i_mapping->private_lock);
-        return page;
+done:
+        ret = (block < end_block) ? 1 : -ENXIO;
 failed:
        unlock_page(page);
        page_cache_release(page);
-        return NULL;
+        return ret;
 }
 /*
@@ -999,7 +1007,6 @@ failed:
 static int
 grow_buffers(struct block_device *bdev, sector_t block, int size)
 {
-        struct page *page;
        pgoff_t index;
        int sizebits;
@@ -1023,22 +1030,14 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
                        bdevname(bdev, b));
                return -EIO;
        }
-        block = index << sizebits;
        /* Create a page with the proper size buffers.. */
-        page = grow_dev_page(bdev, block, index, size);
+        return grow_dev_page(bdev, block, index, size, sizebits);
-        if (!page)
-                return 0;
-        unlock_page(page);
-        page_cache_release(page);
-        return 1;
 }
 static struct buffer_head *
 __getblk_slow(struct block_device *bdev, sector_t block, int size)
 {
-        int ret;
-        struct buffer_head *bh;
        /* Size must be multiple of hard sectorsize */
        if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
                        (size < 512 || size > PAGE_SIZE))) {
@@ -1051,21 +1050,20 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
                return NULL;
        }
-retry:
+        for (;;) {
-        bh = __find_get_block(bdev, block, size);
+                struct buffer_head *bh;
-        if (bh)
+                int ret;
-                return bh;
-        ret = grow_buffers(bdev, block, size);
-        if (ret == 0) {
-                free_more_memory();
-                goto retry;
-        } else if (ret > 0) {
                bh = __find_get_block(bdev, block, size);
                if (bh)
                        return bh;
+                ret = grow_buffers(bdev, block, size);
+                if (ret < 0)
+                        return NULL;
+                if (ret == 0)
+                        free_more_memory();
        }
-        return NULL;
 }
 /*
@@ -1321,10 +1319,6 @@ EXPORT_SYMBOL(__find_get_block);
 * which corresponds to the passed block_device, block and size. The
 * returned buffer has its reference count incremented.
 *
- * __getblk() cannot fail - it just keeps trying.  If you pass it an
- * illegal block number, __getblk() will happily return a buffer_head
- * which represents the non-existent block.  Very weird.
- *
 * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers()
 * attempt is failing.  FIXME, perhaps?
 */
diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c
index fb962efdacee..6d59006bfa27 100644
--- a/fs/ceph/debugfs.c
+++ b/fs/ceph/debugfs.c
@@ -201,6 +201,7 @@ int ceph_fs_debugfs_init(struct ceph_fs_client *fsc)
        int err = -ENOMEM;
        dout("ceph_fs_debugfs_init\n");
+        BUG_ON(!fsc->client->debugfs_dir);
        fsc->debugfs_congestion_kb =
                debugfs_create_file("writeback_congestion_kb",
                                    0600,
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 9fff9f3b17e4..4b5762ef7c2b 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -992,11 +992,15 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
        if (rinfo->head->is_dentry) {
                struct inode *dir = req->r_locked_dir;
-                err = fill_inode(dir, &rinfo->diri, rinfo->dirfrag,
+                if (dir) {
-                                 session, req->r_request_started, -1,
+                        err = fill_inode(dir, &rinfo->diri, rinfo->dirfrag,
-                                 &req->r_caps_reservation);
+                                         session, req->r_request_started, -1,
-                if (err < 0)
+                                         &req->r_caps_reservation);
-                        return err;
+                        if (err < 0)
+                                return err;
+                } else {
+                        WARN_ON_ONCE(1);
+                }
        }
        /*
@@ -1004,6 +1008,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
         * will have trouble splicing in the virtual snapdir later
         */
        if (rinfo->head->is_dentry && !req->r_aborted &&
+            req->r_locked_dir &&
            (rinfo->head->is_target || strncmp(req->r_dentry->d_name.name,
                                               fsc->mount_options->snapdir_name,
                                               req->r_dentry->d_name.len))) {
diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
index 8e3fb69fbe62..1396ceb46797 100644
--- a/fs/ceph/ioctl.c
+++ b/fs/ceph/ioctl.c
@@ -42,7 +42,8 @@ static long __validate_layout(struct ceph_mds_client *mdsc,
        /* validate striping parameters */
        if ((l->object_size & ~PAGE_MASK) ||
            (l->stripe_unit & ~PAGE_MASK) ||
-            ((unsigned)l->object_size % (unsigned)l->stripe_unit))
+            (l->stripe_unit != 0 &&
+             ((unsigned)l->object_size % (unsigned)l->stripe_unit)))
                return -EINVAL;
        /* make sure it's a valid data pool */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 074923ce593d..f0cf934ba877 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1576,9 +1576,14 @@ cifs_readv_callback(struct mid_q_entry *mid)
                /* result already set, check signature */
                if (server->sec_mode &
                    (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
-                        if (cifs_verify_signature(rdata->iov, rdata->nr_iov,
+                        int rc = 0;
-                                          server, mid->sequence_number + 1))
-                                cERROR(1, "Unexpected SMB signature");
+                        rc = cifs_verify_signature(rdata->iov, rdata->nr_iov,
+                                                   server,
+                                                   mid->sequence_number + 1);
+                        if (rc)
+                                cERROR(1, "SMB signature verification returned "
+                                       "error = %d", rc);
                }
                /* FIXME: should this be counted toward the initiating task? */
                task_io_account_read(rdata->bytes);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index cbe709ad6663..781025be48bc 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -356,19 +356,12 @@ cifs_create_get_file_info:
 cifs_create_set_dentry:
        if (rc != 0) {
                cFYI(1, "Create worked, get_inode_info failed rc = %d", rc);
+                CIFSSMBClose(xid, tcon, *fileHandle);
                goto out;
        }
        d_drop(direntry);
        d_add(direntry, newinode);
-        /* ENOENT for create?  How weird... */
-        rc = -ENOENT;
-        if (!newinode) {
-                CIFSSMBClose(xid, tcon, *fileHandle);
-                goto out;
-        }
-        rc = 0;
 out:
        kfree(buf);
        kfree(full_path);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 9154192b0683..71e9ad9f5961 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -917,7 +917,7 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
        if (!buf) {
                mutex_unlock(&cinode->lock_mutex);
                free_xid(xid);
-                return rc;
+                return -ENOMEM;
        }
        for (i = 0; i < 2; i++) {
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 7354877fa3bd..cb79c7edecb0 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -124,10 +124,10 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
 {
        struct cifsInodeInfo *cifs_i = CIFS_I(inode);
        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
-        unsigned long oldtime = cifs_i->time;
        cifs_revalidate_cache(inode, fattr);
+        spin_lock(&inode->i_lock);
        inode->i_atime = fattr->cf_atime;
        inode->i_mtime = fattr->cf_mtime;
        inode->i_ctime = fattr->cf_ctime;
@@ -148,9 +148,6 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
        else
                cifs_i->time = jiffies;
-        cFYI(1, "inode 0x%p old_time=%ld new_time=%ld", inode,
-                 oldtime, cifs_i->time);
        cifs_i->delete_pending = fattr->cf_flags & CIFS_FATTR_DELETE_PENDING;
        cifs_i->server_eof = fattr->cf_eof;
@@ -158,7 +155,6 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
         * Can't safely change the file size here if the client is writing to
         * it due to potential races.
         */
-        spin_lock(&inode->i_lock);
        if (is_size_safe_to_change(cifs_i, fattr->cf_eof)) {
                i_size_write(inode, fattr->cf_eof);
@@ -859,12 +855,14 @@ struct inode *cifs_root_iget(struct super_block *sb)
        if (rc && tcon->ipc) {
                cFYI(1, "ipc connection - fake read inode");
+                spin_lock(&inode->i_lock);
                inode->i_mode |= S_IFDIR;
                set_nlink(inode, 2);
                inode->i_op = &cifs_ipc_inode_ops;
                inode->i_fop = &simple_dir_operations;
                inode->i_uid = cifs_sb->mnt_uid;
                inode->i_gid = cifs_sb->mnt_gid;
+                spin_unlock(&inode->i_lock);
        } else if (rc) {
                iget_failed(inode);
                inode = ERR_PTR(rc);
@@ -1110,6 +1108,15 @@ undo_setattr:
        goto out_close;
 }
+/* copied from fs/nfs/dir.c with small changes */
+static void
+cifs_drop_nlink(struct inode *inode)
+{
+        spin_lock(&inode->i_lock);
+        if (inode->i_nlink > 0)
+                drop_nlink(inode);
+        spin_unlock(&inode->i_lock);
+}
 /*
 * If dentry->d_inode is null (usually meaning the cached dentry
@@ -1166,13 +1173,13 @@ retry_std_delete:
 psx_del_no_retry:
        if (!rc) {
                if (inode)
-                        drop_nlink(inode);
+                        cifs_drop_nlink(inode);
        } else if (rc == -ENOENT) {
                d_drop(dentry);
        } else if (rc == -ETXTBSY) {
                rc = cifs_rename_pending_delete(full_path, dentry, xid);
                if (rc == 0)
-                        drop_nlink(inode);
+                        cifs_drop_nlink(inode);
        } else if ((rc == -EACCES) && (dosattr == 0) && inode) {
                attrs = kzalloc(sizeof(*attrs), GFP_KERNEL);
                if (attrs == NULL) {
@@ -1241,9 +1248,10 @@ cifs_mkdir_qinfo(struct inode *inode, struct dentry *dentry, umode_t mode,
         * setting nlink not necessary except in cases where we failed to get it
         * from the server or was set bogus
         */
+        spin_lock(&dentry->d_inode->i_lock);
        if ((dentry->d_inode) && (dentry->d_inode->i_nlink < 2))
                set_nlink(dentry->d_inode, 2);
+        spin_unlock(&dentry->d_inode->i_lock);
        mode &= ~current_umask();
        /* must turn on setgid bit if parent dir has it */
        if (inode->i_mode & S_ISGID)
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 09e4b3ae4564..e6ce3b112875 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -433,7 +433,9 @@ cifs_hardlink(struct dentry *old_file, struct inode *inode,
        if (old_file->d_inode) {
                cifsInode = CIFS_I(old_file->d_inode);
                if (rc == 0) {
+                        spin_lock(&old_file->d_inode->i_lock);
                        inc_nlink(old_file->d_inode);
+                        spin_unlock(&old_file->d_inode->i_lock);
 /* BB should we make this contingent on superblock flag NOATIME? */
 /*                      old_file->d_inode->i_ctime = CURRENT_TIME;*/
                        /* parent dir timestamps will update from srv
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index a4ff5d547554..e4d3b9964167 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -52,7 +52,8 @@ check_smb2_hdr(struct smb2_hdr *hdr, __u64 mid)
                        cERROR(1, "Bad protocol string signature header %x",
                                  *(unsigned int *) hdr->ProtocolId);
                if (mid != hdr->MessageId)
-                        cERROR(1, "Mids do not match");
+                        cERROR(1, "Mids do not match: %llu and %llu", mid,
+                                  hdr->MessageId);
        }
        cERROR(1, "Bad SMB detected. The Mid=%llu", hdr->MessageId);
        return 1;
@@ -107,7 +108,7 @@ smb2_check_message(char *buf, unsigned int length)
         * ie Validate the wct via smb2_struct_sizes table above
         */
-        if (length < 2 + sizeof(struct smb2_hdr)) {
+        if (length < sizeof(struct smb2_pdu)) {
                if ((length >= sizeof(struct smb2_hdr)) && (hdr->Status != 0)) {
                        pdu->StructureSize2 = 0;
                        /*
@@ -121,15 +122,15 @@ smb2_check_message(char *buf, unsigned int length)
                return 1;
        }
        if (len > CIFSMaxBufSize + MAX_SMB2_HDR_SIZE - 4) {
-                cERROR(1, "SMB length greater than maximum, mid=%lld", mid);
+                cERROR(1, "SMB length greater than maximum, mid=%llu", mid);
                return 1;
        }
        if (check_smb2_hdr(hdr, mid))
                return 1;
-        if (hdr->StructureSize != SMB2_HEADER_SIZE) {
+        if (hdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) {
-                cERROR(1, "Illegal structure size %d",
+                cERROR(1, "Illegal structure size %u",
                          le16_to_cpu(hdr->StructureSize));
                return 1;
        }
@@ -161,8 +162,9 @@ smb2_check_message(char *buf, unsigned int length)
        if (4 + len != clc_len) {
                cFYI(1, "Calculated size %u length %u mismatch mid %llu",
                        clc_len, 4 + len, mid);
-                if (clc_len == 4 + len + 1) /* BB FIXME (fix samba) */
+                /* server can return one byte more */
-                        return 0; /* BB workaround Samba 3 bug SessSetup rsp */
+                if (clc_len == 4 + len + 1)
+                        return 0;
                return 1;
        }
        return 0;
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index f37a1b41b402..15dc8eea8273 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -87,10 +87,6 @@
 #define SMB2_PROTO_NUMBER __constant_cpu_to_le32(0x424d53fe)
-#define SMB2_HEADER_SIZE __constant_le16_to_cpu(64)
-#define SMB2_ERROR_STRUCTURE_SIZE2 __constant_le16_to_cpu(9)
 /*
 * SMB2 Header Definition
 *
@@ -99,6 +95,9 @@
 * "PDU" :  "Protocol Data Unit" (ie a network "frame")
 *
 */
+#define SMB2_HEADER_STRUCTURE_SIZE __constant_cpu_to_le16(64)
 struct smb2_hdr {
        __be32 smb2_buf_length; /* big endian on wire */
                                /* length is only two or three bytes - with
@@ -140,6 +139,9 @@ struct smb2_pdu {
 *  command code name for the struct. Note that structures must be packed.
 *
 */
+#define SMB2_ERROR_STRUCTURE_SIZE2 __constant_cpu_to_le16(9)
 struct smb2_err_rsp {
        struct smb2_hdr hdr;
        __le16 StructureSize;
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 83867ef348df..d9b639b95fa8 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -503,13 +503,16 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
        /* convert the length into a more usable form */
        if (server->sec_mode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                struct kvec iov;
+                int rc = 0;
                iov.iov_base = mid->resp_buf;
                iov.iov_len = len;
                /* FIXME: add code to kill session */
-                if (cifs_verify_signature(&iov, 1, server,
+                rc = cifs_verify_signature(&iov, 1, server,
-                                          mid->sequence_number + 1) != 0)
+                                           mid->sequence_number + 1);
-                        cERROR(1, "Unexpected SMB signature");
+                if (rc)
+                        cERROR(1, "SMB signature verification returned error = "
+                               "%d", rc);
        }
        /* BB special case reconnect tid and uid here? */
diff --git a/fs/compat.c b/fs/compat.c
index 6161255fac45..1bdb350ea5d3 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1155,11 +1155,14 @@ compat_sys_readv(unsigned long fd, const struct compat_iovec __user *vec,
        struct file *file;
        int fput_needed;
        ssize_t ret;
+        loff_t pos;
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;
-        ret = compat_readv(file, vec, vlen, &file->f_pos);
+        pos = file->f_pos;
+        ret = compat_readv(file, vec, vlen, &pos);
+        file->f_pos = pos;
        fput_light(file, fput_needed);
        return ret;
 }
@@ -1221,11 +1224,14 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec,
        struct file *file;
        int fput_needed;
        ssize_t ret;
+        loff_t pos;
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;
-        ret = compat_writev(file, vec, vlen, &file->f_pos);
+        pos = file->f_pos;
+        ret = compat_writev(file, vec, vlen, &pos);
+        file->f_pos = pos;
        fput_light(file, fput_needed);
        return ret;
 }
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 1faf4cb56f39..f86c720dba0e 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1062,6 +1062,7 @@ do_blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
        unsigned long user_addr;
        size_t bytes;
        struct buffer_head map_bh = { 0, };
+        struct blk_plug plug;
        if (rw & WRITE)
                rw = WRITE_ODIRECT;
@@ -1177,6 +1178,8 @@ do_blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                                PAGE_SIZE - user_addr / PAGE_SIZE);
        }
+        blk_start_plug(&plug);
        for (seg = 0; seg < nr_segs; seg++) {
                user_addr = (unsigned long)iov[seg].iov_base;
                sdio.size += bytes = iov[seg].iov_len;
@@ -1235,6 +1238,8 @@ do_blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
        if (sdio.bio)
                dio_bio_submit(dio, &sdio);
+        blk_finish_plug(&plug);
        /*
         * It is possible that, we return short IO due to end of file.
         * In that case, we need to release all the pages we got hold on.
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 44ce5c6a541d..d45ba4568128 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -275,8 +275,14 @@ out:
 static int ecryptfs_flush(struct file *file, fl_owner_t td)
 {
-        return file->f_mode & FMODE_WRITE
+        struct file *lower_file = ecryptfs_file_to_lower(file);
-               ? filemap_write_and_wait(file->f_mapping) : 0;
+        if (lower_file->f_op && lower_file->f_op->flush) {
+                filemap_write_and_wait(file->f_mapping);
+                return lower_file->f_op->flush(lower_file, td);
+        }
+        return 0;
 }
 static int ecryptfs_release(struct inode *inode, struct file *file)
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 534b129ea676..cc7709e7c508 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -619,6 +619,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        struct dentry *lower_old_dir_dentry;
        struct dentry *lower_new_dir_dentry;
        struct dentry *trap = NULL;
+        struct inode *target_inode;
        lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
        lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
@@ -626,6 +627,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        dget(lower_new_dentry);
        lower_old_dir_dentry = dget_parent(lower_old_dentry);
        lower_new_dir_dentry = dget_parent(lower_new_dentry);
+        target_inode = new_dentry->d_inode;
        trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
        /* source should not be ancestor of target */
        if (trap == lower_old_dentry) {
@@ -641,6 +643,9 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                        lower_new_dir_dentry->d_inode, lower_new_dentry);
        if (rc)
                goto out_lock;
+        if (target_inode)
+                fsstack_copy_attr_all(target_inode,
+                                      ecryptfs_inode_to_lower(target_inode));
        fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
        if (new_dir != old_dir)
                fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 2768138eefee..9b627c15010a 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -162,6 +162,7 @@ void ecryptfs_put_lower_file(struct inode *inode)
        inode_info = ecryptfs_inode_to_private(inode);
        if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,
                                      &inode_info->lower_file_mutex)) {
+                filemap_write_and_wait(inode->i_mapping);
                fput(inode_info->lower_file);
                inode_info->lower_file = NULL;
                mutex_unlock(&inode_info->lower_file_mutex);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 1c8b55670804..eedec84c1809 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1654,8 +1654,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
                error = PTR_ERR(file);
                goto out_free_fd;
        }
-        fd_install(fd, file);
        ep->file = file;
+        fd_install(fd, file);
        return fd;
 out_free_fd:
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index a07597307fd1..ff574b4e345e 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -3072,6 +3072,8 @@ static int ext3_do_update_inode(handle_t *handle,
        struct ext3_inode_info *ei = EXT3_I(inode);
        struct buffer_head *bh = iloc->bh;
        int err = 0, rc, block;
+        int need_datasync = 0;
+        __le32 disksize;
        uid_t i_uid;
        gid_t i_gid;
@@ -3113,7 +3115,11 @@ again:
                raw_inode->i_gid_high = 0;
        }
        raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
-        raw_inode->i_size = cpu_to_le32(ei->i_disksize);
+        disksize = cpu_to_le32(ei->i_disksize);
+        if (disksize != raw_inode->i_size) {
+                need_datasync = 1;
+                raw_inode->i_size = disksize;
+        }
        raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
        raw_inode->i_ctime = cpu_to_le32(inode->i_ctime.tv_sec);
        raw_inode->i_mtime = cpu_to_le32(inode->i_mtime.tv_sec);
@@ -3129,8 +3135,11 @@ again:
        if (!S_ISREG(inode->i_mode)) {
                raw_inode->i_dir_acl = cpu_to_le32(ei->i_dir_acl);
        } else {
-                raw_inode->i_size_high =
+                disksize = cpu_to_le32(ei->i_disksize >> 32);
-                        cpu_to_le32(ei->i_disksize >> 32);
+                if (disksize != raw_inode->i_size_high) {
+                        raw_inode->i_size_high = disksize;
+                        need_datasync = 1;
+                }
                if (ei->i_disksize > 0x7fffffffULL) {
                        struct super_block *sb = inode->i_sb;
                        if (!EXT3_HAS_RO_COMPAT_FEATURE(sb,
@@ -3183,6 +3192,8 @@ again:
        ext3_clear_inode_state(inode, EXT3_STATE_NEW);
        atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
+        if (need_datasync)
+                atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
 out_brelse:
        brelse (bh);
        ext3_std_error(inode->i_sb, err);
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index d23b31ca9d7a..1b5089067d01 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -280,14 +280,18 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
        return desc;
 }
-static int ext4_valid_block_bitmap(struct super_block *sb,
+/*
-                                   struct ext4_group_desc *desc,
+ * Return the block number which was discovered to be invalid, or 0 if
-                                   unsigned int block_group,
+ * the block bitmap is valid.
-                                   struct buffer_head *bh)
+ */
+static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
+                                            struct ext4_group_desc *desc,
+                                            unsigned int block_group,
+                                            struct buffer_head *bh)
 {
        ext4_grpblk_t offset;
        ext4_grpblk_t next_zero_bit;
-        ext4_fsblk_t bitmap_blk;
+        ext4_fsblk_t blk;
        ext4_fsblk_t group_first_block;
        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
@@ -297,37 +301,33 @@ static int ext4_valid_block_bitmap(struct super_block *sb,
                 * or it has to also read the block group where the bitmaps
                 * are located to verify they are set.
                 */
-                return 1;
+                return 0;
        }
        group_first_block = ext4_group_first_block_no(sb, block_group);
        /* check whether block bitmap block number is set */
-        bitmap_blk = ext4_block_bitmap(sb, desc);
+        blk = ext4_block_bitmap(sb, desc);
-        offset = bitmap_blk - group_first_block;
+        offset = blk - group_first_block;
        if (!ext4_test_bit(offset, bh->b_data))
                /* bad block bitmap */
-                goto err_out;
+                return blk;
        /* check whether the inode bitmap block number is set */
-        bitmap_blk = ext4_inode_bitmap(sb, desc);
+        blk = ext4_inode_bitmap(sb, desc);
-        offset = bitmap_blk - group_first_block;
+        offset = blk - group_first_block;
        if (!ext4_test_bit(offset, bh->b_data))
                /* bad block bitmap */
-                goto err_out;
+                return blk;
        /* check whether the inode table block number is set */
-        bitmap_blk = ext4_inode_table(sb, desc);
+        blk = ext4_inode_table(sb, desc);
-        offset = bitmap_blk - group_first_block;
+        offset = blk - group_first_block;
        next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
                                offset + EXT4_SB(sb)->s_itb_per_group,
                                offset);
-        if (next_zero_bit >= offset + EXT4_SB(sb)->s_itb_per_group)
+        if (next_zero_bit < offset + EXT4_SB(sb)->s_itb_per_group)
-                /* good bitmap for inode tables */
+                /* bad bitmap for inode tables */
-                return 1;
+                return blk;
-err_out:
-        ext4_error(sb, "Invalid block bitmap - block_group = %d, block = %llu",
-                        block_group, bitmap_blk);
        return 0;
 }
@@ -336,14 +336,26 @@ void ext4_validate_block_bitmap(struct super_block *sb,
                               unsigned int block_group,
                               struct buffer_head *bh)
 {
+        ext4_fsblk_t    blk;
        if (buffer_verified(bh))
                return;
        ext4_lock_group(sb, block_group);
-        if (ext4_valid_block_bitmap(sb, desc, block_group, bh) &&
+        blk = ext4_valid_block_bitmap(sb, desc, block_group, bh);
-            ext4_block_bitmap_csum_verify(sb, block_group, desc, bh,
+        if (unlikely(blk != 0)) {
-                                          EXT4_BLOCKS_PER_GROUP(sb) / 8))
+                ext4_unlock_group(sb, block_group);
-                set_buffer_verified(bh);
+                ext4_error(sb, "bg %u: block %llu: invalid block bitmap",
+                           block_group, blk);
+                return;
+        }
+        if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
+                        desc, bh, EXT4_BLOCKS_PER_GROUP(sb) / 8))) {
+                ext4_unlock_group(sb, block_group);
+                ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
+                return;
+        }
+        set_buffer_verified(bh);
        ext4_unlock_group(sb, block_group);
 }
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
index f8716eab9995..5c2d1813ebe9 100644
--- a/fs/ext4/bitmap.c
+++ b/fs/ext4/bitmap.c
@@ -79,7 +79,6 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
        if (provided == calculated)
                return 1;
-        ext4_error(sb, "Bad block bitmap checksum: block_group = %u", group);
        return 0;
 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index cd0c7ed06772..aabbb3f53683 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2662,6 +2662,7 @@ cont:
                }
                path[0].p_depth = depth;
                path[0].p_hdr = ext_inode_hdr(inode);
+                i = 0;
                if (ext4_ext_check(inode, path[0].p_hdr, depth)) {
                        err = -EIO;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 3e0851e4f468..c6e0cb3d1f4a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -948,6 +948,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
        ei->i_reserved_meta_blocks = 0;
        ei->i_allocated_meta_blocks = 0;
        ei->i_da_metadata_calc_len = 0;
+        ei->i_da_metadata_calc_last_lblock = 0;
        spin_lock_init(&(ei->i_block_reservation_lock));
 #ifdef CONFIG_QUOTA
        ei->i_reserved_quota = 0;
@@ -3108,6 +3109,10 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp,
        ext4_group_t            i, ngroups = ext4_get_groups_count(sb);
        int                     s, j, count = 0;
+        if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_BIGALLOC))
+                return (ext4_bg_has_super(sb, grp) + ext4_bg_num_gdb(sb, grp) +
+                        sbi->s_itb_per_group + 2);
        first_block = le32_to_cpu(sbi->s_es->s_first_data_block) +
                (grp * EXT4_BLOCKS_PER_GROUP(sb));
        last_block = first_block + EXT4_BLOCKS_PER_GROUP(sb) - 1;
@@ -4419,6 +4424,7 @@ static void ext4_clear_journal_err(struct super_block *sb,
                ext4_commit_super(sb, 1);
                jbd2_journal_clear_err(journal);
+                jbd2_journal_update_sb_errno(journal);
        }
 }
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index 03ff5b1eba93..75a20c092dd4 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -117,7 +117,7 @@ static ssize_t fuse_conn_max_background_write(struct file *file,
                                              const char __user *buf,
                                              size_t count, loff_t *ppos)
 {
-        unsigned val;
+        unsigned uninitialized_var(val);
        ssize_t ret;
        ret = fuse_conn_limit_write(file, buf, count, ppos, &val,
@@ -154,7 +154,7 @@ static ssize_t fuse_conn_congestion_threshold_write(struct file *file,
                                                    const char __user *buf,
                                                    size_t count, loff_t *ppos)
 {
-        unsigned val;
+        unsigned uninitialized_var(val);
        ssize_t ret;
        ret = fuse_conn_limit_write(file, buf, count, ppos, &val,
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index 3426521f3205..ee8d55042298 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -396,7 +396,7 @@ err_device:
 err_region:
        unregister_chrdev_region(devt, 1);
 err:
-        fc->conn_error = 1;
+        fuse_conn_kill(fc);
        goto out;
 }
@@ -532,8 +532,6 @@ static int cuse_channel_release(struct inode *inode, struct file *file)
                cdev_del(cc->cdev);
        }
-        /* kill connection and shutdown channel */
-        fuse_conn_kill(&cc->fc);
        rc = fuse_dev_release(inode, file);     /* puts the base reference */
        return rc;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 7df2b5e8fbe1..f4246cfc8d87 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1576,6 +1576,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
                req->pages[req->num_pages] = page;
                req->num_pages++;
+                offset = 0;
                num -= this_num;
                total_len += this_num;
                index++;
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8964cf3999b2..324bc0850534 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -383,6 +383,9 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry,
        struct fuse_entry_out outentry;
        struct fuse_file *ff;
+        /* Userspace expects S_IFREG in create mode */
+        BUG_ON((mode & S_IFMT) != S_IFREG);
        forget = fuse_alloc_forget();
        err = -ENOMEM;
        if (!forget)
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index ce0a2838ccd0..fca222dabe3c 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -367,11 +367,6 @@ void fuse_conn_kill(struct fuse_conn *fc)
        wake_up_all(&fc->waitq);
        wake_up_all(&fc->blocked_waitq);
        wake_up_all(&fc->reserved_req_waitq);
-        mutex_lock(&fuse_mutex);
-        list_del(&fc->entry);
-        fuse_ctl_remove_conn(fc);
-        mutex_unlock(&fuse_mutex);
-        fuse_bdi_destroy(fc);
 }
 EXPORT_SYMBOL_GPL(fuse_conn_kill);
@@ -380,7 +375,14 @@ static void fuse_put_super(struct super_block *sb)
        struct fuse_conn *fc = get_fuse_conn_super(sb);
        fuse_send_destroy(fc);
        fuse_conn_kill(fc);
+        mutex_lock(&fuse_mutex);
+        list_del(&fc->entry);
+        fuse_ctl_remove_conn(fc);
+        mutex_unlock(&fuse_mutex);
+        fuse_bdi_destroy(fc);
        fuse_conn_put(fc);
 }
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index d1d791ef38de..382000ffac1f 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -323,6 +323,29 @@ static long gfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 }
 /**
+ * gfs2_size_hint - Give a hint to the size of a write request
+ * @file: The struct file
+ * @offset: The file offset of the write
+ * @size: The length of the write
+ *
+ * When we are about to do a write, this function records the total
+ * write size in order to provide a suitable hint to the lower layers
+ * about how many blocks will be required.
+ *
+ */
+static void gfs2_size_hint(struct file *filep, loff_t offset, size_t size)
+{
+        struct inode *inode = filep->f_dentry->d_inode;
+        struct gfs2_sbd *sdp = GFS2_SB(inode);
+        struct gfs2_inode *ip = GFS2_I(inode);
+        size_t blks = (size + sdp->sd_sb.sb_bsize - 1) >> sdp->sd_sb.sb_bsize_shift;
+        int hint = min_t(size_t, INT_MAX, blks);
+        atomic_set(&ip->i_res->rs_sizehint, hint);
+}
+/**
 * gfs2_allocate_page_backing - Use bmap to allocate blocks
 * @page: The (locked) page to allocate backing for
 *
@@ -382,8 +405,7 @@ static int gfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
        if (ret)
                return ret;
-        atomic_set(&ip->i_res->rs_sizehint,
+        gfs2_size_hint(vma->vm_file, pos, PAGE_CACHE_SIZE);
-                   PAGE_CACHE_SIZE >> sdp->sd_sb.sb_bsize_shift);
        gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
        ret = gfs2_glock_nq(&gh);
@@ -663,7 +685,8 @@ static ssize_t gfs2_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
        if (ret)
                return ret;
-        atomic_set(&ip->i_res->rs_sizehint, writesize >> sdp->sd_sb.sb_bsize_shift);
+        gfs2_size_hint(file, pos, writesize);
        if (file->f_flags & O_APPEND) {
                struct gfs2_holder gh;
@@ -789,7 +812,7 @@ static long gfs2_fallocate(struct file *file, int mode, loff_t offset,
        if (unlikely(error))
                goto out_uninit;
-        atomic_set(&ip->i_res->rs_sizehint, len >> sdp->sd_sb.sb_bsize_shift);
+        gfs2_size_hint(file, offset, len);
        while (len > 0) {
                if (len < bytes)
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 4ce22e547308..753af3d86bbc 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1722,7 +1722,9 @@ static int gfs2_setxattr(struct dentry *dentry, const char *name,
        gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
        ret = gfs2_glock_nq(&gh);
        if (ret == 0) {
-                ret = generic_setxattr(dentry, name, data, size, flags);
+                ret = gfs2_rs_alloc(ip);
+                if (ret == 0)
+                        ret = generic_setxattr(dentry, name, data, size, flags);
                gfs2_glock_dq(&gh);
        }
        gfs2_holder_uninit(&gh);
@@ -1757,7 +1759,9 @@ static int gfs2_removexattr(struct dentry *dentry, const char *name)
        gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
        ret = gfs2_glock_nq(&gh);
        if (ret == 0) {
-                ret = generic_removexattr(dentry, name);
+                ret = gfs2_rs_alloc(ip);
+                if (ret == 0)
+                        ret = generic_removexattr(dentry, name);
                gfs2_glock_dq(&gh);
        }
        gfs2_holder_uninit(&gh);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 4d34887a601d..c9ed814eeb6f 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1961,7 +1961,7 @@ static void gfs2_rgrp_error(struct gfs2_rgrpd *rgd)
 * @dinode: 1 if this block is a dinode block, otherwise data block
 * @nblocks: desired extent length
 *
- * Lay claim to previously allocated block reservation blocks.
+ * Lay claim to previously reserved blocks.
 * Returns: Starting block number of the blocks claimed.
 * Sets *nblocks to the actual extent length allocated.
 */
@@ -1970,19 +1970,17 @@ static u64 claim_reserved_blks(struct gfs2_inode *ip, bool dinode,
 {
        struct gfs2_blkreserv *rs = ip->i_res;
        struct gfs2_rgrpd *rgd = rs->rs_rgd;
-        struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
        struct gfs2_bitmap *bi;
        u64 start_block = gfs2_rs_startblk(rs);
        const unsigned int elen = *nblocks;
-        /*BUG_ON(!gfs2_glock_is_locked_by_me(ip->i_gl));*/
-        gfs2_assert_withdraw(sdp, rgd);
-        /*BUG_ON(!gfs2_glock_is_locked_by_me(rgd->rd_gl));*/
        bi = rs->rs_bi;
        gfs2_trans_add_bh(rgd->rd_gl, bi->bi_bh, 1);
        for (*nblocks = 0; *nblocks < elen && rs->rs_free; (*nblocks)++) {
-                /* Make sure the bitmap hasn't changed */
+                if (gfs2_testbit(rgd, bi->bi_bh->b_data + bi->bi_offset,
+                                 bi->bi_len, rs->rs_biblk) != GFS2_BLKST_FREE)
+                        break;
                gfs2_setbit(rgd, bi->bi_clone, bi, rs->rs_biblk,
                            dinode ? GFS2_BLKST_DINODE : GFS2_BLKST_USED);
                rs->rs_biblk++;
@@ -1991,20 +1989,12 @@ static u64 claim_reserved_blks(struct gfs2_inode *ip, bool dinode,
                BUG_ON(!rgd->rd_reserved);
                rgd->rd_reserved--;
                dinode = false;
-                trace_gfs2_rs(ip, rs, TRACE_RS_CLAIM);
        }
-        if (!rs->rs_free) {
+        trace_gfs2_rs(ip, rs, TRACE_RS_CLAIM);
-                struct gfs2_rgrpd *rgd = ip->i_res->rs_rgd;
+        if (!rs->rs_free || *nblocks != elen)
                gfs2_rs_deltree(rs);
-                /* -nblocks because we haven't returned to do the math yet.
-                   I'm doing the math backwards to prevent negative numbers,
-                   but think of it as:
-                   if (unclaimed_blocks(rgd) - *nblocks >= RGRP_RSRV_MINBLKS */
-                if (unclaimed_blocks(rgd) >= RGRP_RSRV_MINBLKS + *nblocks)
-                        rg_mblk_search(rgd, ip);
-        }
        return start_block;
 }
@@ -2037,34 +2027,34 @@ int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *nblocks,
        if (ip->i_res->rs_requested == 0)
                return -ECANCELED;
-        /* Check if we have a multi-block reservation, and if so, claim the
+        /* If we have a reservation, claim blocks from it. */
-           next free block from it. */
        if (gfs2_rs_active(ip->i_res)) {
                BUG_ON(!ip->i_res->rs_free);
                rgd = ip->i_res->rs_rgd;
                block = claim_reserved_blks(ip, dinode, nblocks);
-        } else {
+                if (*nblocks)
-                rgd = ip->i_rgd;
+                        goto found_blocks;
+        }
-                if (!dinode && rgrp_contains_block(rgd, ip->i_goal))
+        rgd = ip->i_rgd;
-                        goal = ip->i_goal - rgd->rd_data0;
-                else
-                        goal = rgd->rd_last_alloc;
-                blk = rgblk_search(rgd, goal, GFS2_BLKST_FREE, &bi);
-                /* Since all blocks are reserved in advance, this shouldn't
-                   happen */
-                if (blk == BFITNOENT) {
-                        printk(KERN_WARNING "BFITNOENT, nblocks=%u\n",
-                               *nblocks);
-                        printk(KERN_WARNING "FULL=%d\n",
-                               test_bit(GBF_FULL, &rgd->rd_bits->bi_flags));
-                        goto rgrp_error;
-                }
-                block = gfs2_alloc_extent(rgd, bi, blk, dinode, nblocks);
+        if (!dinode && rgrp_contains_block(rgd, ip->i_goal))
+                goal = ip->i_goal - rgd->rd_data0;
+        else
+                goal = rgd->rd_last_alloc;
+        blk = rgblk_search(rgd, goal, GFS2_BLKST_FREE, &bi);
+        /* Since all blocks are reserved in advance, this shouldn't happen */
+        if (blk == BFITNOENT) {
+                printk(KERN_WARNING "BFITNOENT, nblocks=%u\n", *nblocks);
+                printk(KERN_WARNING "FULL=%d\n",
+                       test_bit(GBF_FULL, &rgd->rd_bits->bi_flags));
+                goto rgrp_error;
        }
+        block = gfs2_alloc_extent(rgd, bi, blk, dinode, nblocks);
+found_blocks:
        ndata = *nblocks;
        if (dinode)
                ndata--;
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 09357508ec9a..a2862339323b 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -1113,6 +1113,11 @@ static void mark_journal_empty(journal_t *journal)
        BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
        spin_lock(&journal->j_state_lock);
+        /* Is it already empty? */
+        if (sb->s_start == 0) {
+                spin_unlock(&journal->j_state_lock);
+                return;
+        }
        jbd_debug(1, "JBD: Marking journal as empty (seq %d)\n",
                  journal->j_tail_sequence);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 8625da27eccf..e149b99a7ffb 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1377,7 +1377,7 @@ static void jbd2_mark_journal_empty(journal_t *journal)
 * Update a journal's errno.  Write updated superblock to disk waiting for IO
 * to complete.
 */
-static void jbd2_journal_update_sb_errno(journal_t *journal)
+void jbd2_journal_update_sb_errno(journal_t *journal)
 {
        journal_superblock_t *sb = journal->j_superblock;
@@ -1390,6 +1390,7 @@ static void jbd2_journal_update_sb_errno(journal_t *journal)
        jbd2_write_superblock(journal, WRITE_SYNC);
 }
+EXPORT_SYMBOL(jbd2_journal_update_sb_errno);
 /*
 * Read the superblock for a given journal, performing initial
diff --git a/fs/logfs/dev_bdev.c b/fs/logfs/dev_bdev.c
index df0de27c2733..e784a217b500 100644
--- a/fs/logfs/dev_bdev.c
+++ b/fs/logfs/dev_bdev.c
@@ -26,6 +26,7 @@ static int sync_request(struct page *page, struct block_device *bdev, int rw)
        struct completion complete;
        bio_init(&bio);
+        bio.bi_max_vecs = 1;
        bio.bi_io_vec = &bio_vec;
        bio_vec.bv_page = page;
        bio_vec.bv_len = PAGE_SIZE;
@@ -95,12 +96,11 @@ static int __bdev_writeseg(struct super_block *sb, u64 ofs, pgoff_t index,
        struct address_space *mapping = super->s_mapping_inode->i_mapping;
        struct bio *bio;
        struct page *page;
-        struct request_queue *q = bdev_get_queue(sb->s_bdev);
+        unsigned int max_pages;
-        unsigned int max_pages = queue_max_hw_sectors(q) >> (PAGE_SHIFT - 9);
        int i;
-        if (max_pages > BIO_MAX_PAGES)
+        max_pages = min(nr_pages, (size_t) bio_get_nr_vecs(super->s_bdev));
-                max_pages = BIO_MAX_PAGES;
        bio = bio_alloc(GFP_NOFS, max_pages);
        BUG_ON(!bio);
@@ -190,12 +190,11 @@ static int do_erase(struct super_block *sb, u64 ofs, pgoff_t index,
 {
        struct logfs_super *super = logfs_super(sb);
        struct bio *bio;
-        struct request_queue *q = bdev_get_queue(sb->s_bdev);
+        unsigned int max_pages;
-        unsigned int max_pages = queue_max_hw_sectors(q) >> (PAGE_SHIFT - 9);
        int i;
-        if (max_pages > BIO_MAX_PAGES)
+        max_pages = min(nr_pages, (size_t) bio_get_nr_vecs(super->s_bdev));
-                max_pages = BIO_MAX_PAGES;
        bio = bio_alloc(GFP_NOFS, max_pages);
        BUG_ON(!bio);
diff --git a/fs/logfs/inode.c b/fs/logfs/inode.c
index a422f42238b2..6984562738d3 100644
--- a/fs/logfs/inode.c
+++ b/fs/logfs/inode.c
@@ -156,10 +156,26 @@ static void __logfs_destroy_inode(struct inode *inode)
        call_rcu(&inode->i_rcu, logfs_i_callback);
 }
+static void __logfs_destroy_meta_inode(struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        BUG_ON(li->li_block);
+        call_rcu(&inode->i_rcu, logfs_i_callback);
+}
 static void logfs_destroy_inode(struct inode *inode)
 {
        struct logfs_inode *li = logfs_inode(inode);
+        if (inode->i_ino < LOGFS_RESERVED_INOS) {
+                /*
+                 * The reserved inodes are never destroyed unless we are in
+                 * unmont path.
+                 */
+                __logfs_destroy_meta_inode(inode);
+                return;
+        }
        BUG_ON(list_empty(&li->li_freeing_list));
        spin_lock(&logfs_inode_lock);
        li->li_refcount--;
@@ -373,8 +389,8 @@ static void logfs_put_super(struct super_block *sb)
 {
        struct logfs_super *super = logfs_super(sb);
        /* kill the meta-inodes */
-        iput(super->s_master_inode);
        iput(super->s_segfile_inode);
+        iput(super->s_master_inode);
        iput(super->s_mapping_inode);
 }
diff --git a/fs/logfs/journal.c b/fs/logfs/journal.c
index 1e1c369df22b..2a09b8d73989 100644
--- a/fs/logfs/journal.c
+++ b/fs/logfs/journal.c
@@ -565,7 +565,7 @@ static void write_wbuf(struct super_block *sb, struct logfs_area *area,
        index = ofs >> PAGE_SHIFT;
        page_ofs = ofs & (PAGE_SIZE - 1);
-        page = find_lock_page(mapping, index);
+        page = find_or_create_page(mapping, index, GFP_NOFS);
        BUG_ON(!page);
        memcpy(wbuf, page_address(page) + page_ofs, super->s_writesize);
        unlock_page(page);
diff --git a/fs/logfs/readwrite.c b/fs/logfs/readwrite.c
index f1cb512c5019..5be0abef603d 100644
--- a/fs/logfs/readwrite.c
+++ b/fs/logfs/readwrite.c
@@ -2189,7 +2189,6 @@ void logfs_evict_inode(struct inode *inode)
                return;
        }
-        BUG_ON(inode->i_ino < LOGFS_RESERVED_INOS);
        page = inode_to_page(inode);
        BUG_ON(!page); /* FIXME: Use emergency page */
        logfs_put_write_page(page);
diff --git a/fs/logfs/segment.c b/fs/logfs/segment.c
index e28d090c98d6..038da0991794 100644
--- a/fs/logfs/segment.c
+++ b/fs/logfs/segment.c
@@ -886,7 +886,7 @@ static struct logfs_area *alloc_area(struct super_block *sb)
 static void map_invalidatepage(struct page *page, unsigned long l)
 {
-        BUG();
+        return;
 }
 static int map_releasepage(struct page *page, gfp_t g)
diff --git a/fs/namei.c b/fs/namei.c
index 1b464390dde8..dd1ed1b8e98e 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -352,6 +352,7 @@ int __inode_permission(struct inode *inode, int mask)
 /**
 * sb_permission - Check superblock-level permissions
 * @sb: Superblock of inode to check permission on
+ * @inode: Inode to check permission on
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Separate out file-system wide checks from inode-specific permission checks.
@@ -656,6 +657,7 @@ int sysctl_protected_hardlinks __read_mostly = 1;
 /**
 * may_follow_link - Check symlink following for unsafe situations
 * @link: The path of the symlink
+ * @nd: nameidata pathwalk data
 *
 * In the case of the sysctl_protected_symlinks sysctl being enabled,
 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
@@ -2414,7 +2416,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                goto out;
        }
-        mode = op->mode & S_IALLUGO;
+        mode = op->mode;
        if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
                mode &= ~current_umask();
@@ -2452,7 +2454,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
        }
        if (open_flag & O_CREAT) {
-                error = may_o_create(&nd->path, dentry, op->mode);
+                error = may_o_create(&nd->path, dentry, mode);
                if (error) {
                        create_error = error;
                        if (open_flag & O_EXCL)
@@ -2489,6 +2491,10 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                        dput(dentry);
                        dentry = file->f_path.dentry;
                }
+                if (create_error && dentry->d_inode == NULL) {
+                        error = create_error;
+                        goto out;
+                }
                goto looked_up;
        }
diff --git a/fs/nfs/Makefile b/fs/nfs/Makefile
index 8bf3a3f6925a..b7db60897f91 100644
--- a/fs/nfs/Makefile
+++ b/fs/nfs/Makefile
@@ -12,19 +12,19 @@ nfs-$(CONFIG_ROOT_NFS)	+= nfsroot.o
 nfs-$(CONFIG_SYSCTL)    += sysctl.o
 nfs-$(CONFIG_NFS_FSCACHE) += fscache.o fscache-index.o
-obj-$(CONFIG_NFS_V2) += nfs2.o
+obj-$(CONFIG_NFS_V2) += nfsv2.o
-nfs2-y := nfs2super.o proc.o nfs2xdr.o
+nfsv2-y := nfs2super.o proc.o nfs2xdr.o
-obj-$(CONFIG_NFS_V3) += nfs3.o
+obj-$(CONFIG_NFS_V3) += nfsv3.o
-nfs3-y := nfs3super.o nfs3client.o nfs3proc.o nfs3xdr.o
+nfsv3-y := nfs3super.o nfs3client.o nfs3proc.o nfs3xdr.o
-nfs3-$(CONFIG_NFS_V3_ACL) += nfs3acl.o
+nfsv3-$(CONFIG_NFS_V3_ACL) += nfs3acl.o
-obj-$(CONFIG_NFS_V4) += nfs4.o
+obj-$(CONFIG_NFS_V4) += nfsv4.o
-nfs4-y := nfs4proc.o nfs4xdr.o nfs4state.o nfs4renewd.o nfs4super.o nfs4file.o \
+nfsv4-y := nfs4proc.o nfs4xdr.o nfs4state.o nfs4renewd.o nfs4super.o nfs4file.o \
          delegation.o idmap.o callback.o callback_xdr.o callback_proc.o \
          nfs4namespace.o nfs4getroot.o nfs4client.o
-nfs4-$(CONFIG_SYSCTL)   += nfs4sysctl.o
+nfsv4-$(CONFIG_SYSCTL)  += nfs4sysctl.o
-nfs4-$(CONFIG_NFS_V4_1) += pnfs.o pnfs_dev.o
+nfsv4-$(CONFIG_NFS_V4_1)        += pnfs.o pnfs_dev.o
 obj-$(CONFIG_PNFS_FILE_LAYOUT) += nfs_layout_nfsv41_files.o
 nfs_layout_nfsv41_files-y := nfs4filelayout.o nfs4filelayoutdev.o
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 9fc0d9dfc91b..99694442b93f 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -105,7 +105,7 @@ struct nfs_subversion *get_nfs_version(unsigned int version)
        if (IS_ERR(nfs)) {
                mutex_lock(&nfs_version_mutex);
-                request_module("nfs%d", version);
+                request_module("nfsv%d", version);
                nfs = find_nfs_version(version);
                mutex_unlock(&nfs_version_mutex);
        }
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 75d6d0a3d32e..6a7fcab7ecb3 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -287,10 +287,12 @@ nfs_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
        struct inode *inode = file->f_path.dentry->d_inode;
        ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
+        if (ret != 0)
+                goto out;
        mutex_lock(&inode->i_mutex);
        ret = nfs_file_fsync_commit(file, start, end, datasync);
        mutex_unlock(&inode->i_mutex);
+out:
        return ret;
 }
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index b701358c39c3..a850079467d8 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -61,6 +61,12 @@ struct idmap {
        struct mutex            idmap_mutex;
 };
+struct idmap_legacy_upcalldata {
+        struct rpc_pipe_msg pipe_msg;
+        struct idmap_msg idmap_msg;
+        struct idmap *idmap;
+};
 /**
 * nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
 * @fattr: fully initialised struct nfs_fattr
@@ -324,6 +330,7 @@ static ssize_t nfs_idmap_get_key(const char *name, size_t namelen,
                ret = nfs_idmap_request_key(&key_type_id_resolver_legacy,
                                            name, namelen, type, data,
                                            data_size, idmap);
+                idmap->idmap_key_cons = NULL;
                mutex_unlock(&idmap->idmap_mutex);
        }
        return ret;
@@ -380,11 +387,13 @@ static const match_table_t nfs_idmap_tokens = {
 static int nfs_idmap_legacy_upcall(struct key_construction *, const char *, void *);
 static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
                                   size_t);
+static void idmap_release_pipe(struct inode *);
 static void idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
 static const struct rpc_pipe_ops idmap_upcall_ops = {
        .upcall         = rpc_pipe_generic_upcall,
        .downcall       = idmap_pipe_downcall,
+        .release_pipe   = idmap_release_pipe,
        .destroy_msg    = idmap_pipe_destroy_msg,
 };
@@ -616,7 +625,8 @@ void nfs_idmap_quit(void)
        nfs_idmap_quit_keyring();
 }
-static int nfs_idmap_prepare_message(char *desc, struct idmap_msg *im,
+static int nfs_idmap_prepare_message(char *desc, struct idmap *idmap,
+                                     struct idmap_msg *im,
                                     struct rpc_pipe_msg *msg)
 {
        substring_t substr;
@@ -659,6 +669,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
                                   const char *op,
                                   void *aux)
 {
+        struct idmap_legacy_upcalldata *data;
        struct rpc_pipe_msg *msg;
        struct idmap_msg *im;
        struct idmap *idmap = (struct idmap *)aux;
@@ -666,15 +677,15 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
        int ret = -ENOMEM;
        /* msg and im are freed in idmap_pipe_destroy_msg */
-        msg = kmalloc(sizeof(*msg), GFP_KERNEL);
+        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (!msg)
+        if (!data)
-                goto out0;
-        im = kmalloc(sizeof(*im), GFP_KERNEL);
-        if (!im)
                goto out1;
-        ret = nfs_idmap_prepare_message(key->description, im, msg);
+        msg = &data->pipe_msg;
+        im = &data->idmap_msg;
+        data->idmap = idmap;
+        ret = nfs_idmap_prepare_message(key->description, idmap, im, msg);
        if (ret < 0)
                goto out2;
@@ -683,15 +694,15 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
        ret = rpc_queue_upcall(idmap->idmap_pipe, msg);
        if (ret < 0)
-                goto out2;
+                goto out3;
        return ret;
+out3:
+        idmap->idmap_key_cons = NULL;
 out2:
-        kfree(im);
+        kfree(data);
 out1:
-        kfree(msg);
-out0:
        complete_request_key(cons, ret);
        return ret;
 }
@@ -749,9 +760,8 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
        }
        if (!(im.im_status & IDMAP_STATUS_SUCCESS)) {
-                ret = mlen;
+                ret = -ENOKEY;
-                complete_request_key(cons, -ENOKEY);
+                goto out;
-                goto out_incomplete;
        }
        namelen_in = strnlen(im.im_name, IDMAP_NAMESZ);
@@ -768,16 +778,32 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 out:
        complete_request_key(cons, ret);
-out_incomplete:
        return ret;
 }
 static void
 idmap_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 {
+        struct idmap_legacy_upcalldata *data = container_of(msg,
+                        struct idmap_legacy_upcalldata,
+                        pipe_msg);
+        struct idmap *idmap = data->idmap;
+        struct key_construction *cons;
+        if (msg->errno) {
+                cons = ACCESS_ONCE(idmap->idmap_key_cons);
+                idmap->idmap_key_cons = NULL;
+                complete_request_key(cons, msg->errno);
+        }
        /* Free memory allocated in nfs_idmap_legacy_upcall() */
-        kfree(msg->data);
+        kfree(data);
-        kfree(msg);
+}
+static void
+idmap_release_pipe(struct inode *inode)
+{
+        struct rpc_inode *rpci = RPC_I(inode);
+        struct idmap *idmap = (struct idmap *)rpci->private;
+        idmap->idmap_key_cons = NULL;
 }
 int nfs_map_name_to_uid(const struct nfs_server *server, const char *name, size_t namelen, __u32 *uid)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index c6e895f0fbf3..9b47610338f5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -154,7 +154,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
        nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
        nfsi->attrtimeo_timestamp = jiffies;
-        memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
+        memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
        if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
                nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
        else
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 0952c791df36..69322096c325 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -69,7 +69,7 @@ do_proc_get_root(struct rpc_clnt *client, struct nfs_fh *fhandle,
        nfs_fattr_init(info->fattr);
        status = rpc_call_sync(client, &msg, 0);
        dprintk("%s: reply fsinfo: %d\n", __func__, status);
-        if (!(info->fattr->valid & NFS_ATTR_FATTR)) {
+        if (status == 0 && !(info->fattr->valid & NFS_ATTR_FATTR)) {
                msg.rpc_proc = &nfs3_procedures[NFS3PROC_GETATTR];
                msg.rpc_resp = info->fattr;
                status = rpc_call_sync(client, &msg, 0);
@@ -643,7 +643,7 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                  u64 cookie, struct page **pages, unsigned int count, int plus)
 {
        struct inode            *dir = dentry->d_inode;
-        __be32                  *verf = NFS_COOKIEVERF(dir);
+        __be32                  *verf = NFS_I(dir)->cookieverf;
        struct nfs3_readdirargs arg = {
                .fh             = NFS_FH(dir),
                .cookie         = cookie,
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 3b950dd81e81..da0618aeeadb 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -205,6 +205,9 @@ extern const struct dentry_operations nfs4_dentry_operations;
 int nfs_atomic_open(struct inode *, struct dentry *, struct file *,
                    unsigned, umode_t, int *);
+/* super.c */
+extern struct file_system_type nfs4_fs_type;
 /* nfs4namespace.c */
 rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *);
 struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *, struct inode *, struct qstr *);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index cbcdfaf32505..24eb663f8ed5 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -74,7 +74,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
        return clp;
 error:
-        kfree(clp);
+        nfs_free_client(clp);
        return ERR_PTR(err);
 }
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index acb65e7887f8..eb5eb8eef4d3 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -96,13 +96,15 @@ nfs4_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
        struct inode *inode = file->f_path.dentry->d_inode;
        ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
+        if (ret != 0)
+                goto out;
        mutex_lock(&inode->i_mutex);
        ret = nfs_file_fsync_commit(file, start, end, datasync);
        if (!ret && !datasync)
                /* application has asked for meta-data sync */
                ret = pnfs_layoutcommit_inode(inode, true);
        mutex_unlock(&inode->i_mutex);
+out:
        return ret;
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a99a8d948721..1e50326d00dd 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3215,11 +3215,11 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                        dentry->d_parent->d_name.name,
                        dentry->d_name.name,
                        (unsigned long long)cookie);
-        nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args);
+        nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
        res.pgbase = args.pgbase;
        status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
        if (status >= 0) {
-                memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE);
+                memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
                status += args.pgbase;
        }
@@ -3653,11 +3653,11 @@ static inline int nfs4_server_supports_acls(struct nfs_server *server)
                && (server->acl_bitmask & ACL4_SUPPORT_DENY_ACL);
 }
-/* Assuming that XATTR_SIZE_MAX is a multiple of PAGE_CACHE_SIZE, and that
+/* Assuming that XATTR_SIZE_MAX is a multiple of PAGE_SIZE, and that
- * it's OK to put sizeof(void) * (XATTR_SIZE_MAX/PAGE_CACHE_SIZE) bytes on
+ * it's OK to put sizeof(void) * (XATTR_SIZE_MAX/PAGE_SIZE) bytes on
 * the stack.
 */
-#define NFS4ACL_MAXPAGES (XATTR_SIZE_MAX >> PAGE_CACHE_SHIFT)
+#define NFS4ACL_MAXPAGES DIV_ROUND_UP(XATTR_SIZE_MAX, PAGE_SIZE)
 static int buf_to_pages_noslab(const void *buf, size_t buflen,
                struct page **pages, unsigned int *pgbase)
@@ -3668,7 +3668,7 @@ static int buf_to_pages_noslab(const void *buf, size_t buflen,
        spages = pages;
        do {
-                len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
+                len = min_t(size_t, PAGE_SIZE, buflen);
                newpage = alloc_page(GFP_KERNEL);
                if (newpage == NULL)
@@ -3737,9 +3737,10 @@ out:
 static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size_t pgbase, size_t acl_len)
 {
        struct nfs4_cached_acl *acl;
+        size_t buflen = sizeof(*acl) + acl_len;
-        if (pages && acl_len <= PAGE_SIZE) {
+        if (buflen <= PAGE_SIZE) {
-                acl = kmalloc(sizeof(*acl) + acl_len, GFP_KERNEL);
+                acl = kmalloc(buflen, GFP_KERNEL);
                if (acl == NULL)
                        goto out;
                acl->cached = 1;
@@ -3781,17 +3782,15 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
                .rpc_argp = &args,
                .rpc_resp = &res,
        };
-        int ret = -ENOMEM, npages, i;
+        unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
-        size_t acl_len = 0;
+        int ret = -ENOMEM, i;
-        npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
        /* As long as we're doing a round trip to the server anyway,
         * let's be prepared for a page of acl data. */
        if (npages == 0)
                npages = 1;
+        if (npages > ARRAY_SIZE(pages))
-        /* Add an extra page to handle the bitmap returned */
+                return -ERANGE;
-        npages++;
        for (i = 0; i < npages; i++) {
                pages[i] = alloc_page(GFP_KERNEL);
@@ -3807,11 +3806,6 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
        args.acl_len = npages * PAGE_SIZE;
        args.acl_pgbase = 0;
-        /* Let decode_getfacl know not to fail if the ACL data is larger than
-         * the page we send as a guess */
-        if (buf == NULL)
-                res.acl_flags |= NFS4_ACL_LEN_REQUEST;
        dprintk("%s  buf %p buflen %zu npages %d args.acl_len %zu\n",
                __func__, buf, buflen, npages, args.acl_len);
        ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode),
@@ -3819,20 +3813,19 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
        if (ret)
                goto out_free;
-        acl_len = res.acl_len - res.acl_data_offset;
+        /* Handle the case where the passed-in buffer is too short */
-        if (acl_len > args.acl_len)
+        if (res.acl_flags & NFS4_ACL_TRUNC) {
-                nfs4_write_cached_acl(inode, NULL, 0, acl_len);
+                /* Did the user only issue a request for the acl length? */
-        else
+                if (buf == NULL)
-                nfs4_write_cached_acl(inode, pages, res.acl_data_offset,
+                        goto out_ok;
-                                      acl_len);
-        if (buf) {
                ret = -ERANGE;
-                if (acl_len > buflen)
+                goto out_free;
-                        goto out_free;
-                _copy_from_pages(buf, pages, res.acl_data_offset,
-                                acl_len);
        }
-        ret = acl_len;
+        nfs4_write_cached_acl(inode, pages, res.acl_data_offset, res.acl_len);
+        if (buf)
+                _copy_from_pages(buf, pages, res.acl_data_offset, res.acl_len);
+out_ok:
+        ret = res.acl_len;
 out_free:
        for (i = 0; i < npages; i++)
                if (pages[i])
@@ -3890,10 +3883,13 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
                .rpc_argp       = &arg,
                .rpc_resp       = &res,
        };
+        unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
        int ret, i;
        if (!nfs4_server_supports_acls(server))
                return -EOPNOTSUPP;
+        if (npages > ARRAY_SIZE(pages))
+                return -ERANGE;
        i = buf_to_pages_noslab(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
        if (i < 0)
                return i;
@@ -6223,11 +6219,58 @@ static void nfs4_layoutget_done(struct rpc_task *task, void *calldata)
        dprintk("<-- %s\n", __func__);
 }
+static size_t max_response_pages(struct nfs_server *server)
+{
+        u32 max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
+        return nfs_page_array_len(0, max_resp_sz);
+}
+static void nfs4_free_pages(struct page **pages, size_t size)
+{
+        int i;
+        if (!pages)
+                return;
+        for (i = 0; i < size; i++) {
+                if (!pages[i])
+                        break;
+                __free_page(pages[i]);
+        }
+        kfree(pages);
+}
+static struct page **nfs4_alloc_pages(size_t size, gfp_t gfp_flags)
+{
+        struct page **pages;
+        int i;
+        pages = kcalloc(size, sizeof(struct page *), gfp_flags);
+        if (!pages) {
+                dprintk("%s: can't alloc array of %zu pages\n", __func__, size);
+                return NULL;
+        }
+        for (i = 0; i < size; i++) {
+                pages[i] = alloc_page(gfp_flags);
+                if (!pages[i]) {
+                        dprintk("%s: failed to allocate page\n", __func__);
+                        nfs4_free_pages(pages, size);
+                        return NULL;
+                }
+        }
+        return pages;
+}
 static void nfs4_layoutget_release(void *calldata)
 {
        struct nfs4_layoutget *lgp = calldata;
+        struct nfs_server *server = NFS_SERVER(lgp->args.inode);
+        size_t max_pages = max_response_pages(server);
        dprintk("--> %s\n", __func__);
+        nfs4_free_pages(lgp->args.layout.pages, max_pages);
        put_nfs_open_context(lgp->args.ctx);
        kfree(calldata);
        dprintk("<-- %s\n", __func__);
@@ -6239,9 +6282,10 @@ static const struct rpc_call_ops nfs4_layoutget_call_ops = {
        .rpc_release = nfs4_layoutget_release,
 };
-int nfs4_proc_layoutget(struct nfs4_layoutget *lgp)
+void nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags)
 {
        struct nfs_server *server = NFS_SERVER(lgp->args.inode);
+        size_t max_pages = max_response_pages(server);
        struct rpc_task *task;
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_LAYOUTGET],
@@ -6259,12 +6303,19 @@ int nfs4_proc_layoutget(struct nfs4_layoutget *lgp)
        dprintk("--> %s\n", __func__);
+        lgp->args.layout.pages = nfs4_alloc_pages(max_pages, gfp_flags);
+        if (!lgp->args.layout.pages) {
+                nfs4_layoutget_release(lgp);
+                return;
+        }
+        lgp->args.layout.pglen = max_pages * PAGE_SIZE;
        lgp->res.layoutp = &lgp->args.layout;
        lgp->res.seq_res.sr_slot = NULL;
        nfs41_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0);
        task = rpc_run_task(&task_setup_data);
        if (IS_ERR(task))
-                return PTR_ERR(task);
+                return;
        status = nfs4_wait_for_completion_rpc_task(task);
        if (status == 0)
                status = task->tk_status;
@@ -6272,7 +6323,7 @@ int nfs4_proc_layoutget(struct nfs4_layoutget *lgp)
                status = pnfs_layout_process(lgp);
        rpc_put_task(task);
        dprintk("<-- %s status=%d\n", __func__, status);
-        return status;
+        return;
 }
 static void
@@ -6304,12 +6355,8 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
                return;
        }
        spin_lock(&lo->plh_inode->i_lock);
-        if (task->tk_status == 0) {
+        if (task->tk_status == 0 && lrp->res.lrs_present)
-                if (lrp->res.lrs_present) {
+                pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
-                        pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
-                } else
-                        BUG_ON(!list_empty(&lo->plh_segs));
-        }
        lo->plh_block_lgets--;
        spin_unlock(&lo->plh_inode->i_lock);
        dprintk("<-- %s\n", __func__);
diff --git a/fs/nfs/nfs4super.c b/fs/nfs/nfs4super.c
index 12a31a9dbcdd..bd61221ad2c5 100644
--- a/fs/nfs/nfs4super.c
+++ b/fs/nfs/nfs4super.c
@@ -23,14 +23,6 @@ static struct dentry *nfs4_referral_mount(struct file_system_type *fs_type,
 static struct dentry *nfs4_remote_referral_mount(struct file_system_type *fs_type,
        int flags, const char *dev_name, void *raw_data);
-static struct file_system_type nfs4_fs_type = {
-        .owner          = THIS_MODULE,
-        .name           = "nfs4",
-        .mount          = nfs_fs_mount,
-        .kill_sb        = nfs_kill_super,
-        .fs_flags       = FS_RENAME_DOES_D_MOVE|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
-};
 static struct file_system_type nfs4_remote_fs_type = {
        .owner          = THIS_MODULE,
        .name           = "nfs4",
@@ -344,14 +336,8 @@ static int __init init_nfs_v4(void)
        if (err)
                goto out1;
-        err = register_filesystem(&nfs4_fs_type);
-        if (err < 0)
-                goto out2;
        register_nfs_version(&nfs_v4);
        return 0;
-out2:
-        nfs4_unregister_sysctl();
 out1:
        nfs_idmap_quit();
 out:
@@ -361,7 +347,6 @@ out:
 static void __exit exit_nfs_v4(void)
 {
        unregister_nfs_version(&nfs_v4);
-        unregister_filesystem(&nfs4_fs_type);
        nfs4_unregister_sysctl();
        nfs_idmap_quit();
 }
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index ca13483edd60..8dba6bd48557 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -5045,22 +5045,19 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                         struct nfs_getaclres *res)
 {
        unsigned int savep;
-        __be32 *bm_p;
        uint32_t attrlen,
                 bitmap[3] = {0};
        int status;
-        size_t page_len = xdr->buf->page_len;
+        unsigned int pg_offset;
        res->acl_len = 0;
        if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
                goto out;
-        bm_p = xdr->p;
+        xdr_enter_page(xdr, xdr->buf->page_len);
-        res->acl_data_offset = be32_to_cpup(bm_p) + 2;
-        res->acl_data_offset <<= 2;
+        /* Calculate the offset of the page data */
-        /* Check if the acl data starts beyond the allocated buffer */
+        pg_offset = xdr->buf->head[0].iov_len;
-        if (res->acl_data_offset > page_len)
-                return -ERANGE;
        if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
                goto out;
@@ -5074,23 +5071,16 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                /* The bitmap (xdr len + bitmaps) and the attr xdr len words
                 * are stored with the acl data to handle the problem of
                 * variable length bitmaps.*/
-                xdr->p = bm_p;
+                res->acl_data_offset = xdr_stream_pos(xdr) - pg_offset;
-                /* We ignore &savep and don't do consistency checks on
-                 * the attr length.  Let userspace figure it out.... */
-                attrlen += res->acl_data_offset;
-                if (attrlen > page_len) {
-                        if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
-                                /* getxattr interface called with a NULL buf */
-                                res->acl_len = attrlen;
-                                goto out;
-                        }
-                        dprintk("NFS: acl reply: attrlen %u > page_len %zu\n",
-                                        attrlen, page_len);
-                        return -EINVAL;
-                }
-                xdr_read_pages(xdr, attrlen);
                res->acl_len = attrlen;
+                /* Check for receive buffer overflow */
+                if (res->acl_len > (xdr->nwords << 2) ||
+                    res->acl_len + res->acl_data_offset > xdr->buf->page_len) {
+                        res->acl_flags |= NFS4_ACL_TRUNC;
+                        dprintk("NFS: acl reply: attrlen %u > page_len %u\n",
+                                        attrlen, xdr->nwords << 2);
+                }
        } else
                status = -EOPNOTSUPP;
@@ -6235,7 +6225,8 @@ static int nfs4_xdr_dec_open(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
        status = decode_open(xdr, res);
        if (status)
                goto out;
-        if (decode_getfh(xdr, &res->fh) != 0)
+        status = decode_getfh(xdr, &res->fh);
+        if (status)
                goto out;
        decode_getfattr(xdr, res->f_attr, res->server);
 out:
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index f50d3e8d6f22..ea6d111b03e9 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -570,17 +570,66 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
                return false;
        return pgio->pg_count + req->wb_bytes <=
-                        OBJIO_LSEG(pgio->pg_lseg)->layout.max_io_length;
+                        (unsigned long)pgio->pg_layout_private;
+}
+void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+{
+        pnfs_generic_pg_init_read(pgio, req);
+        if (unlikely(pgio->pg_lseg == NULL))
+                return; /* Not pNFS */
+        pgio->pg_layout_private = (void *)
+                                OBJIO_LSEG(pgio->pg_lseg)->layout.max_io_length;
+}
+static bool aligned_on_raid_stripe(u64 offset, struct ore_layout *layout,
+                                   unsigned long *stripe_end)
+{
+        u32 stripe_off;
+        unsigned stripe_size;
+        if (layout->raid_algorithm == PNFS_OSD_RAID_0)
+                return true;
+        stripe_size = layout->stripe_unit *
+                                (layout->group_width - layout->parity);
+        div_u64_rem(offset, stripe_size, &stripe_off);
+        if (!stripe_off)
+                return true;
+        *stripe_end = stripe_size - stripe_off;
+        return false;
+}
+void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+{
+        unsigned long stripe_end = 0;
+        pnfs_generic_pg_init_write(pgio, req);
+        if (unlikely(pgio->pg_lseg == NULL))
+                return; /* Not pNFS */
+        if (req->wb_offset ||
+            !aligned_on_raid_stripe(req->wb_index * PAGE_SIZE,
+                               &OBJIO_LSEG(pgio->pg_lseg)->layout,
+                               &stripe_end)) {
+                pgio->pg_layout_private = (void *)stripe_end;
+        } else {
+                pgio->pg_layout_private = (void *)
+                                OBJIO_LSEG(pgio->pg_lseg)->layout.max_io_length;
+        }
 }
 static const struct nfs_pageio_ops objio_pg_read_ops = {
-        .pg_init = pnfs_generic_pg_init_read,
+        .pg_init = objio_init_read,
        .pg_test = objio_pg_test,
        .pg_doio = pnfs_generic_pg_readpages,
 };
 static const struct nfs_pageio_ops objio_pg_write_ops = {
-        .pg_init = pnfs_generic_pg_init_write,
+        .pg_init = objio_init_write,
        .pg_test = objio_pg_test,
        .pg_doio = pnfs_generic_pg_writepages,
 };
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 1a6732ed04a4..311a79681e2b 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -49,6 +49,7 @@ void nfs_pgheader_init(struct nfs_pageio_descriptor *desc,
        hdr->io_start = req_offset(hdr->req);
        hdr->good_bytes = desc->pg_count;
        hdr->dreq = desc->pg_dreq;
+        hdr->layout_private = desc->pg_layout_private;
        hdr->release = release;
        hdr->completion_ops = desc->pg_completion_ops;
        if (hdr->completion_ops->init_hdr)
@@ -268,6 +269,7 @@ void nfs_pageio_init(struct nfs_pageio_descriptor *desc,
        desc->pg_error = 0;
        desc->pg_lseg = NULL;
        desc->pg_dreq = NULL;
+        desc->pg_layout_private = NULL;
 }
 EXPORT_SYMBOL_GPL(nfs_pageio_init);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 76875bfcf19c..2e00feacd4be 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -583,9 +583,6 @@ send_layoutget(struct pnfs_layout_hdr *lo,
        struct nfs_server *server = NFS_SERVER(ino);
        struct nfs4_layoutget *lgp;
        struct pnfs_layout_segment *lseg = NULL;
-        struct page **pages = NULL;
-        int i;
-        u32 max_resp_sz, max_pages;
        dprintk("--> %s\n", __func__);
@@ -594,20 +591,6 @@ send_layoutget(struct pnfs_layout_hdr *lo,
        if (lgp == NULL)
                return NULL;
-        /* allocate pages for xdr post processing */
-        max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = nfs_page_array_len(0, max_resp_sz);
-        pages = kcalloc(max_pages, sizeof(struct page *), gfp_flags);
-        if (!pages)
-                goto out_err_free;
-        for (i = 0; i < max_pages; i++) {
-                pages[i] = alloc_page(gfp_flags);
-                if (!pages[i])
-                        goto out_err_free;
-        }
        lgp->args.minlength = PAGE_CACHE_SIZE;
        if (lgp->args.minlength > range->length)
                lgp->args.minlength = range->length;
@@ -616,39 +599,19 @@ send_layoutget(struct pnfs_layout_hdr *lo,
        lgp->args.type = server->pnfs_curr_ld->id;
        lgp->args.inode = ino;
        lgp->args.ctx = get_nfs_open_context(ctx);
-        lgp->args.layout.pages = pages;
-        lgp->args.layout.pglen = max_pages * PAGE_SIZE;
        lgp->lsegpp = &lseg;
        lgp->gfp_flags = gfp_flags;
        /* Synchronously retrieve layout information from server and
         * store in lseg.
         */
-        nfs4_proc_layoutget(lgp);
+        nfs4_proc_layoutget(lgp, gfp_flags);
        if (!lseg) {
                /* remember that LAYOUTGET failed and suspend trying */
                set_bit(lo_fail_bit(range->iomode), &lo->plh_flags);
        }
-        /* free xdr pages */
-        for (i = 0; i < max_pages; i++)
-                __free_page(pages[i]);
-        kfree(pages);
        return lseg;
-out_err_free:
-        /* free any allocated xdr pages, lgp as it's not used */
-        if (pages) {
-                for (i = 0; i < max_pages; i++) {
-                        if (!pages[i])
-                                break;
-                        __free_page(pages[i]);
-                }
-                kfree(pages);
-        }
-        kfree(lgp);
-        return NULL;
 }
 /*
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 2c6c80503ba4..745aa1b39e7c 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -172,7 +172,7 @@ extern int nfs4_proc_getdevicelist(struct nfs_server *server,
                                   struct pnfs_devicelist *devlist);
 extern int nfs4_proc_getdeviceinfo(struct nfs_server *server,
                                   struct pnfs_device *dev);
-extern int nfs4_proc_layoutget(struct nfs4_layoutget *lgp);
+extern void nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags);
 extern int nfs4_proc_layoutreturn(struct nfs4_layoutreturn *lrp);
 /* pnfs.c */
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ac6a3c55dce4..b8eda700584b 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -319,6 +319,34 @@ EXPORT_SYMBOL_GPL(nfs_sops);
 static void nfs4_validate_mount_flags(struct nfs_parsed_mount_data *);
 static int nfs4_validate_mount_data(void *options,
        struct nfs_parsed_mount_data *args, const char *dev_name);
+struct file_system_type nfs4_fs_type = {
+        .owner          = THIS_MODULE,
+        .name           = "nfs4",
+        .mount          = nfs_fs_mount,
+        .kill_sb        = nfs_kill_super,
+        .fs_flags       = FS_RENAME_DOES_D_MOVE|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
+};
+EXPORT_SYMBOL_GPL(nfs4_fs_type);
+static int __init register_nfs4_fs(void)
+{
+        return register_filesystem(&nfs4_fs_type);
+}
+static void unregister_nfs4_fs(void)
+{
+        unregister_filesystem(&nfs4_fs_type);
+}
+#else
+static int __init register_nfs4_fs(void)
+{
+        return 0;
+}
+static void unregister_nfs4_fs(void)
+{
+}
 #endif
 static struct shrinker acl_shrinker = {
@@ -337,12 +365,18 @@ int __init register_nfs_fs(void)
        if (ret < 0)
                goto error_0;
-        ret = nfs_register_sysctl();
+        ret = register_nfs4_fs();
        if (ret < 0)
                goto error_1;
+        ret = nfs_register_sysctl();
+        if (ret < 0)
+                goto error_2;
        register_shrinker(&acl_shrinker);
        return 0;
+error_2:
+        unregister_nfs4_fs();
 error_1:
        unregister_filesystem(&nfs_fs_type);
 error_0:
@@ -356,6 +390,7 @@ void __exit unregister_nfs_fs(void)
 {
        unregister_shrinker(&acl_shrinker);
        nfs_unregister_sysctl();
+        unregister_nfs4_fs();
        unregister_filesystem(&nfs_fs_type);
 }
@@ -1832,6 +1867,7 @@ static int nfs23_validate_mount_data(void *options,
                memcpy(sap, &data->addr, sizeof(data->addr));
                args->nfs_server.addrlen = sizeof(data->addr);
+                args->nfs_server.port = ntohs(data->addr.sin_port);
                if (!nfs_verify_server_address(sap))
                        goto out_no_address;
@@ -2529,6 +2565,7 @@ static int nfs4_validate_mount_data(void *options,
                        return -EFAULT;
                if (!nfs_verify_server_address(sap))
                        goto out_no_address;
+                args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port);
                if (data->auth_flavourlen) {
                        if (data->auth_flavourlen > 1)
@@ -2645,4 +2682,6 @@ MODULE_PARM_DESC(max_session_slots, "Maximum number of outstanding NFSv4.1 "
 module_param(send_implementation_id, ushort, 0644);
 MODULE_PARM_DESC(send_implementation_id,
                "Send implementation ID with NFSv4.1 exchange_id");
+MODULE_ALIAS("nfs4");
 #endif /* CONFIG_NFS_V4 */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5829d0ce7cfb..e3b55372726c 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1814,19 +1814,19 @@ int __init nfs_init_writepagecache(void)
        nfs_wdata_mempool = mempool_create_slab_pool(MIN_POOL_WRITE,
                                                     nfs_wdata_cachep);
        if (nfs_wdata_mempool == NULL)
-                return -ENOMEM;
+                goto out_destroy_write_cache;
        nfs_cdata_cachep = kmem_cache_create("nfs_commit_data",
                                             sizeof(struct nfs_commit_data),
                                             0, SLAB_HWCACHE_ALIGN,
                                             NULL);
        if (nfs_cdata_cachep == NULL)
-                return -ENOMEM;
+                goto out_destroy_write_mempool;
        nfs_commit_mempool = mempool_create_slab_pool(MIN_POOL_COMMIT,
                                                      nfs_wdata_cachep);
        if (nfs_commit_mempool == NULL)
-                return -ENOMEM;
+                goto out_destroy_commit_cache;
        /*
         * NFS congestion size, scale with available memory.
@@ -1849,11 +1849,20 @@ int __init nfs_init_writepagecache(void)
                nfs_congestion_kb = 256*1024;
        return 0;
+out_destroy_commit_cache:
+        kmem_cache_destroy(nfs_cdata_cachep);
+out_destroy_write_mempool:
+        mempool_destroy(nfs_wdata_mempool);
+out_destroy_write_cache:
+        kmem_cache_destroy(nfs_wdata_cachep);
+        return -ENOMEM;
 }
 void nfs_destroy_writepagecache(void)
 {
        mempool_destroy(nfs_commit_mempool);
+        kmem_cache_destroy(nfs_cdata_cachep);
        mempool_destroy(nfs_wdata_mempool);
        kmem_cache_destroy(nfs_wdata_cachep);
 }
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index cbaf4f8bb7b7..4c7bd35b1876 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -651,12 +651,12 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
        if (clp->cl_minorversion == 0) {
                if (!clp->cl_cred.cr_principal &&
-                                (clp->cl_flavor >= RPC_AUTH_GSS_KRB5))
+                                (clp->cl_cred.cr_flavor >= RPC_AUTH_GSS_KRB5))
                        return -EINVAL;
                args.client_name = clp->cl_cred.cr_principal;
                args.prognumber = conn->cb_prog,
                args.protocol = XPRT_TRANSPORT_TCP;
-                args.authflavor = clp->cl_flavor;
+                args.authflavor = clp->cl_cred.cr_flavor;
                clp->cl_cb_ident = conn->cb_ident;
        } else {
                if (!conn->cb_xprt)
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index e6173147f982..22bd0a66c356 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -231,7 +231,6 @@ struct nfs4_client {
        nfs4_verifier           cl_verifier;    /* generated by client */
        time_t                  cl_time;        /* time of last lease renewal */
        struct sockaddr_storage cl_addr;        /* client ipaddress */
-        u32                     cl_flavor;      /* setclientid pseudoflavor */
        struct svc_cred         cl_cred;        /* setclientid principal */
        clientid_t              cl_clientid;    /* generated by server */
        nfs4_verifier           cl_confirm;     /* generated by server */
diff --git a/fs/open.c b/fs/open.c
index bc132e167d2d..e1f2cdb91a4d 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -852,9 +852,10 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
        int lookup_flags = 0;
        int acc_mode;
-        if (!(flags & O_CREAT))
+        if (flags & O_CREAT)
-                mode = 0;
+                op->mode = (mode & S_IALLUGO) | S_IFREG;
-        op->mode = mode;
+        else
+                op->mode = 0;
        /* Must never be set by userspace */
        flags &= ~FMODE_NONOTIFY;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 36a29b753c79..c495a3055e2a 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1589,10 +1589,10 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
                goto out;
        }
-        down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
        for (cnt = 0; cnt < MAXQUOTAS; cnt++)
                warn[cnt].w_type = QUOTA_NL_NOWARN;
+        down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
        spin_lock(&dq_data_lock);
        for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                if (!dquots[cnt])
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index 4c0c7d163d15..a98b7740a0fc 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -1334,9 +1334,7 @@ struct buffer_head *reiserfs_read_bitmap_block(struct super_block *sb,
        else if (bitmap == 0)
                block = (REISERFS_DISK_OFFSET_IN_BYTES >> sb->s_blocksize_bits) + 1;
-        reiserfs_write_unlock(sb);
        bh = sb_bread(sb, block);
-        reiserfs_write_lock(sb);
        if (bh == NULL)
                reiserfs_warning(sb, "sh-2029: %s: bitmap block (#%u) "
                                 "reading failed", __func__, block);
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index a6d4268fb6c1..855da58db145 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -76,10 +76,10 @@ void reiserfs_evict_inode(struct inode *inode)
                ;
        }
      out:
+        reiserfs_write_unlock_once(inode->i_sb, depth);
        clear_inode(inode);     /* note this must go after the journal_end to prevent deadlock */
        dquot_drop(inode);
        inode->i_blocks = 0;
-        reiserfs_write_unlock_once(inode->i_sb, depth);
        return;
 no_delete:
diff --git a/fs/stat.c b/fs/stat.c
index b6ff11825fc8..40780229a032 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -58,7 +58,7 @@ EXPORT_SYMBOL(vfs_getattr);
 int vfs_fstat(unsigned int fd, struct kstat *stat)
 {
        int fput_needed;
-        struct file *f = fget_light(fd, &fput_needed);
+        struct file *f = fget_raw_light(fd, &fput_needed);
        int error = -EBADF;
        if (f) {
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 8b8cc4e945f4..760de723dadb 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -167,7 +167,7 @@ struct ubifs_global_debug_info {
 #define ubifs_dbg_msg(type, fmt, ...) \
        pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
-#define DBG_KEY_BUF_LEN 32
+#define DBG_KEY_BUF_LEN 48
 #define ubifs_dbg_msg_key(type, key, fmt, ...) do {                            \
        char __tmp_key_buf[DBG_KEY_BUF_LEN];                                   \
        pr_debug("UBIFS DBG " type ": " fmt "%s\n", ##__VA_ARGS__,             \
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index ce33b2beb151..8640920766ed 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1749,7 +1749,10 @@ int ubifs_lpt_init(struct ubifs_info *c, int rd, int wr)
        return 0;
 out_err:
-        ubifs_lpt_free(c, 0);
+        if (wr)
+                ubifs_lpt_free(c, 1);
+        if (rd)
+                ubifs_lpt_free(c, 0);
        return err;
 }
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index c30d976b4be8..edeec499c048 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -788,7 +788,7 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
 corrupted_rescan:
        /* Re-scan the corrupted data with verbose messages */
-        ubifs_err("corruptio %d", ret);
+        ubifs_err("corruption %d", ret);
        ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
 corrupted:
        ubifs_scanned_corruption(c, lnum, offs, buf);
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index eba46d4a7619..94d78fc5d4e0 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -1026,7 +1026,6 @@ int ubifs_replay_journal(struct ubifs_info *c)
        c->replaying = 1;
        lnum = c->ltail_lnum = c->lhead_lnum;
-        lnum = UBIFS_LOG_LNUM;
        do {
                err = replay_log_leb(c, lnum, 0, c->sbuf);
                if (err == 1)
@@ -1035,7 +1034,7 @@ int ubifs_replay_journal(struct ubifs_info *c)
                if (err)
                        goto out;
                lnum = ubifs_next_log_lnum(c, lnum);
-        } while (lnum != UBIFS_LOG_LNUM);
+        } while (lnum != c->ltail_lnum);
        err = replay_buds(c);
        if (err)
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index c3fa6c5327a3..71a197f0f93d 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1157,9 +1157,6 @@ static int check_free_space(struct ubifs_info *c)
 *
 * This function mounts UBIFS file system. Returns zero in case of success and
 * a negative error code in case of failure.
- *
- * Note, the function does not de-allocate resources it it fails half way
- * through, and the caller has to do this instead.
 */
 static int mount_ubifs(struct ubifs_info *c)
 {
diff --git a/fs/udf/file.c b/fs/udf/file.c
index 7f3f7ba3df6e..d1c6093fd3d3 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -39,20 +39,24 @@
 #include "udf_i.h"
 #include "udf_sb.h"
-static int udf_adinicb_readpage(struct file *file, struct page *page)
+static void __udf_adinicb_readpage(struct page *page)
 {
        struct inode *inode = page->mapping->host;
        char *kaddr;
        struct udf_inode_info *iinfo = UDF_I(inode);
-        BUG_ON(!PageLocked(page));
        kaddr = kmap(page);
-        memset(kaddr, 0, PAGE_CACHE_SIZE);
        memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, inode->i_size);
+        memset(kaddr + inode->i_size, 0, PAGE_CACHE_SIZE - inode->i_size);
        flush_dcache_page(page);
        SetPageUptodate(page);
        kunmap(page);
+}
+static int udf_adinicb_readpage(struct file *file, struct page *page)
+{
+        BUG_ON(!PageLocked(page));
+        __udf_adinicb_readpage(page);
        unlock_page(page);
        return 0;
@@ -77,6 +81,25 @@ static int udf_adinicb_writepage(struct page *page,
        return 0;
 }
+static int udf_adinicb_write_begin(struct file *file,
+                        struct address_space *mapping, loff_t pos,
+                        unsigned len, unsigned flags, struct page **pagep,
+                        void **fsdata)
+{
+        struct page *page;
+        if (WARN_ON_ONCE(pos >= PAGE_CACHE_SIZE))
+                return -EIO;
+        page = grab_cache_page_write_begin(mapping, 0, flags);
+        if (!page)
+                return -ENOMEM;
+        *pagep = page;
+        if (!PageUptodate(page) && len != PAGE_CACHE_SIZE)
+                __udf_adinicb_readpage(page);
+        return 0;
+}
 static int udf_adinicb_write_end(struct file *file,
                        struct address_space *mapping,
                        loff_t pos, unsigned len, unsigned copied,
@@ -98,8 +121,8 @@ static int udf_adinicb_write_end(struct file *file,
 const struct address_space_operations udf_adinicb_aops = {
        .readpage       = udf_adinicb_readpage,
        .writepage      = udf_adinicb_writepage,
-        .write_begin = simple_write_begin,
+        .write_begin    = udf_adinicb_write_begin,
-        .write_end = udf_adinicb_write_end,
+        .write_end      = udf_adinicb_write_end,
 };
 static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index fafaad795cd6..aa233469b3c1 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1124,14 +1124,17 @@ int udf_setsize(struct inode *inode, loff_t newsize)
                                if (err)
                                        return err;
                                down_write(&iinfo->i_data_sem);
-                        } else
+                        } else {
                                iinfo->i_lenAlloc = newsize;
+                                goto set_size;
+                        }
                }
                err = udf_extend_file(inode, newsize);
                if (err) {
                        up_write(&iinfo->i_data_sem);
                        return err;
                }
+set_size:
                truncate_setsize(inode, newsize);
                up_write(&iinfo->i_data_sem);
        } else {
diff --git a/fs/udf/super.c b/fs/udf/super.c
index dcbf98722afc..18fc038a438d 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1344,6 +1344,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                udf_err(sb, "error loading logical volume descriptor: "
                        "Partition table too long (%u > %lu)\n", table_len,
                        sb->s_blocksize - sizeof(*lvd));
+                ret = 1;
                goto out_bh;
        }
@@ -1388,8 +1389,10 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                                                UDF_ID_SPARABLE,
                                                strlen(UDF_ID_SPARABLE))) {
                                if (udf_load_sparable_map(sb, map,
-                                    (struct sparablePartitionMap *)gpm) < 0)
+                                    (struct sparablePartitionMap *)gpm) < 0) {
+                                        ret = 1;
                                        goto out_bh;
+                                }
                        } else if (!strncmp(upm2->partIdent.ident,
                                                UDF_ID_METADATA,
                                                strlen(UDF_ID_METADATA))) {
@@ -2000,6 +2003,8 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
                        if (!silent)
                                pr_notice("Rescanning with blocksize %d\n",
                                          UDF_DEFAULT_BLOCKSIZE);
+                        brelse(sbi->s_lvid_bh);
+                        sbi->s_lvid_bh = NULL;
                        uopt.blocksize = UDF_DEFAULT_BLOCKSIZE;
                        ret = udf_load_vrs(sb, &uopt, silent, &fileset);
                }
diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
index f9c3fe304a17..69cf4fcde03e 100644
--- a/fs/xfs/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
@@ -179,12 +179,14 @@ xfs_ioc_trim(
         * used by the fstrim application.  In the end it really doesn't
         * matter as trimming blocks is an advisory interface.
         */
+        if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
+            range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)))
+                return -XFS_ERROR(EINVAL);
        start = BTOBB(range.start);
        end = start + BTOBBT(range.len) - 1;
        minlen = BTOBB(max_t(u64, granularity, range.minlen));
-        if (XFS_BB_TO_FSB(mp, start) >= mp->m_sb.sb_dblocks)
-                return -XFS_ERROR(EINVAL);
        if (end > XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1)
                end = XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks)- 1;
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 21e37b55f7e5..5aceb3f8ecd6 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -962,23 +962,22 @@ xfs_dialloc(
                if (!pag->pagi_freecount && !okalloc)
                        goto nextag;
+                /*
+                 * Then read in the AGI buffer and recheck with the AGI buffer
+                 * lock held.
+                 */
                error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
                if (error)
                        goto out_error;
-                /*
-                 * Once the AGI has been read in we have to recheck
-                 * pagi_freecount with the AGI buffer lock held.
-                 */
                if (pag->pagi_freecount) {
                        xfs_perag_put(pag);
                        goto out_alloc;
                }
-                if (!okalloc) {
+                if (!okalloc)
-                        xfs_trans_brelse(tp, agbp);
+                        goto nextag_relse_buffer;
-                        goto nextag;
-                }
                error = xfs_ialloc_ag_alloc(tp, agbp, &ialloced);
                if (error) {
@@ -1007,6 +1006,8 @@ xfs_dialloc(
                        return 0;
                }
+nextag_relse_buffer:
+                xfs_trans_brelse(tp, agbp);
 nextag:
                xfs_perag_put(pag);
                if (++agno == mp->m_sb.sb_agcount)
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 92d4331cd4f1..ca28a4ba4b54 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -857,7 +857,7 @@ xfs_rtbuf_get(
        xfs_buf_t       *bp;            /* block buffer, result */
        xfs_inode_t     *ip;            /* bitmap or summary inode */
        xfs_bmbt_irec_t map;
-        int             nmap;
+        int             nmap = 1;
        int             error;          /* error value */
        ip = issum ? mp->m_rsumip : mp->m_rbmip;
diff --git a/include/asm-generic/mutex-xchg.h b/include/asm-generic/mutex-xchg.h
index 580a6d35c700..c04e0db8a2d6 100644
--- a/include/asm-generic/mutex-xchg.h
+++ b/include/asm-generic/mutex-xchg.h
@@ -26,7 +26,13 @@ static inline void
 __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *))
 {
        if (unlikely(atomic_xchg(count, 0) != 1))
-                fail_fn(count);
+                /*
+                 * We failed to acquire the lock, so mark it contended
+                 * to ensure that any waiting tasks are woken up by the
+                 * unlock slow path.
+                 */
+                if (likely(atomic_xchg(count, -1) != 1))
+                        fail_fn(count);
 }
 /**
@@ -43,7 +49,8 @@ static inline int
 __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
 {
        if (unlikely(atomic_xchg(count, 0) != 1))
-                return fail_fn(count);
+                if (likely(atomic_xchg(count, -1) != 1))
+                        return fail_fn(count);
        return 0;
 }
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index a1a0386e0160..bfacf0d5a225 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -118,7 +118,8 @@ enum drm_mode_status {
        .hdisplay = (hd), .hsync_start = (hss), .hsync_end = (hse), \
        .htotal = (ht), .hskew = (hsk), .vdisplay = (vd), \
        .vsync_start = (vss), .vsync_end = (vse), .vtotal = (vt), \
-        .vscan = (vs), .flags = (f), .vrefresh = 0
+        .vscan = (vs), .flags = (f), .vrefresh = 0, \
+        .base.type = DRM_MODE_OBJECT_MODE
 #define CRTC_INTERLACE_HALVE_V 0x1 /* halve V values for interlacing */
@@ -166,8 +167,6 @@ struct drm_display_mode {
        int crtc_vsync_start;
        int crtc_vsync_end;
        int crtc_vtotal;
-        int crtc_hadjusted;
-        int crtc_vadjusted;
        /* Driver private mode info */
        int private_size;
diff --git a/include/drm/drm_fourcc.h b/include/drm/drm_fourcc.h
index bdf0152cbbe9..f4621184a9b4 100644
--- a/include/drm/drm_fourcc.h
+++ b/include/drm/drm_fourcc.h
@@ -107,8 +107,7 @@
 #define DRM_FORMAT_NV16         fourcc_code('N', 'V', '1', '6') /* 2x1 subsampled Cr:Cb plane */
 #define DRM_FORMAT_NV61         fourcc_code('N', 'V', '6', '1') /* 2x1 subsampled Cb:Cr plane */
-/* 2 non contiguous plane YCbCr */
+/* special NV12 tiled format */
-#define DRM_FORMAT_NV12M        fourcc_code('N', 'M', '1', '2') /* 2x2 subsampled Cr:Cb plane */
 #define DRM_FORMAT_NV12MT       fourcc_code('T', 'M', '1', '2') /* 2x2 subsampled Cr:Cb plane 64x32 macroblocks */
 /*
@@ -131,7 +130,4 @@
 #define DRM_FORMAT_YUV444       fourcc_code('Y', 'U', '2', '4') /* non-subsampled Cb (1) and Cr (2) planes */
 #define DRM_FORMAT_YVU444       fourcc_code('Y', 'V', '2', '4') /* non-subsampled Cr (1) and Cb (2) planes */
-/* 3 non contiguous plane YCbCr */
-#define DRM_FORMAT_YUV420M      fourcc_code('Y', 'M', '1', '2') /* 2x2 subsampled Cb (1) and Cr (2) planes */
 #endif /* DRM_FOURCC_H */
diff --git a/include/drm/drm_mode.h b/include/drm/drm_mode.h
index 5581980b14f6..3d6301b6ec16 100644
--- a/include/drm/drm_mode.h
+++ b/include/drm/drm_mode.h
@@ -359,8 +359,9 @@ struct drm_mode_mode_cmd {
        struct drm_mode_modeinfo mode;
 };
-#define DRM_MODE_CURSOR_BO      (1<<0)
+#define DRM_MODE_CURSOR_BO      0x01
-#define DRM_MODE_CURSOR_MOVE    (1<<1)
+#define DRM_MODE_CURSOR_MOVE    0x02
+#define DRM_MODE_CURSOR_FLAGS   0x03
 /*
 * depending on the value in flags different members are used.
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4e72a9d48232..4a2ab7c85393 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -601,7 +601,7 @@ static inline void blk_clear_rl_full(struct request_list *rl, bool sync)
 * it already be started by driver.
 */
 #define RQ_NOMERGE_FLAGS        \
-        (REQ_NOMERGE | REQ_STARTED | REQ_SOFTBARRIER | REQ_FLUSH | REQ_FUA)
+        (REQ_NOMERGE | REQ_STARTED | REQ_SOFTBARRIER | REQ_FLUSH | REQ_FUA | REQ_DISCARD)
 #define rq_mergeable(rq)        \
        (!((rq)->cmd_flags & RQ_NOMERGE_FLAGS) && \
         (((rq)->cmd_flags & REQ_DISCARD) || \
@@ -894,6 +894,8 @@ extern void blk_queue_flush_queueable(struct request_queue *q, bool queueable);
 extern struct backing_dev_info *blk_get_backing_dev_info(struct block_device *bdev);
 extern int blk_rq_map_sg(struct request_queue *, struct request *, struct scatterlist *);
+extern int blk_bio_map_sg(struct request_queue *q, struct bio *bio,
+                          struct scatterlist *sglist);
 extern void blk_dump_rq_flags(struct request *, char *);
 extern long nr_blockdev_pages(void);
@@ -1139,6 +1141,16 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector
                & (lim->discard_granularity - 1);
 }
+static inline int bdev_discard_alignment(struct block_device *bdev)
+{
+        struct request_queue *q = bdev_get_queue(bdev);
+        if (bdev != bdev->bd_contains)
+                return bdev->bd_part->discard_alignment;
+        return q->limits.discard_alignment;
+}
 static inline unsigned int queue_discard_zeroes_data(struct request_queue *q)
 {
        if (q->limits.max_discard_sectors && q->limits.discard_zeroes_data == 1)
diff --git a/include/linux/compaction.h b/include/linux/compaction.h
index 133ddcf83397..ef658147e4e8 100644
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
@@ -22,7 +22,7 @@ extern int sysctl_extfrag_handler(struct ctl_table *table, int write,
 extern int fragmentation_index(struct zone *zone, unsigned int order);
 extern unsigned long try_to_compact_pages(struct zonelist *zonelist,
                        int order, gfp_t gfp_mask, nodemask_t *mask,
-                        bool sync);
+                        bool sync, bool *contended);
 extern int compact_pgdat(pg_data_t *pgdat, int order);
 extern unsigned long compaction_suitable(struct zone *zone, int order);
@@ -64,7 +64,7 @@ static inline bool compaction_deferred(struct zone *zone, int order)
 #else
 static inline unsigned long try_to_compact_pages(struct zonelist *zonelist,
                        int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        bool sync)
+                        bool sync, bool *contended)
 {
        return COMPACT_CONTINUE;
 }
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 040b13b5c14a..279b1eaa8b73 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -194,6 +194,10 @@ static inline int cpuidle_play_dead(void) {return -ENODEV; }
 #ifdef CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED
 void cpuidle_coupled_parallel_barrier(struct cpuidle_device *dev, atomic_t *a);
+#else
+static inline void cpuidle_coupled_parallel_barrier(struct cpuidle_device *dev, atomic_t *a)
+{
+}
 #endif
 /******************************
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 103adc6d7e3a..ec45ccd8708a 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -503,6 +503,8 @@ extern u64 efi_mem_attribute (unsigned long phys_addr, unsigned long size);
 extern int __init efi_uart_console_only (void);
 extern void efi_initialize_iomem_resources(struct resource *code_resource,
                struct resource *data_resource, struct resource *bss_resource);
+extern unsigned long efi_get_time(void);
+extern int efi_set_rtc_mmss(unsigned long nowtime);
 extern void efi_reserve_boot_services(void);
 extern struct efi_memory_map memmap;
diff --git a/include/linux/i2c-pnx.h b/include/linux/i2c-pnx.h
index 1bc74afe7a35..49ed17fdf055 100644
--- a/include/linux/i2c-pnx.h
+++ b/include/linux/i2c-pnx.h
@@ -22,6 +22,7 @@ struct i2c_pnx_mif {
        struct timer_list       timer;          /* Timeout */
        u8 *                    buf;            /* Data buffer */
        int                     len;            /* Length of data buffer */
+        int                     order;          /* RX Bytes to order via TX */
 };
 struct i2c_pnx_algo_data {
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 6960fc1841a7..aa2e167e1ef4 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -96,21 +96,6 @@ static inline void team_netpoll_send_skb(struct team_port *port,
 }
 #endif
-static inline int team_dev_queue_xmit(struct team *team, struct team_port *port,
-                                      struct sk_buff *skb)
-{
-        BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
-                     sizeof(qdisc_skb_cb(skb)->slave_dev_queue_mapping));
-        skb_set_queue_mapping(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping);
-        skb->dev = port->dev;
-        if (unlikely(netpoll_tx_running(port->dev))) {
-                team_netpoll_send_skb(port, skb);
-                return 0;
-        }
-        return dev_queue_xmit(skb);
-}
 struct team_mode_ops {
        int (*init)(struct team *team);
        void (*exit)(struct team *team);
@@ -200,6 +185,21 @@ struct team {
        long mode_priv[TEAM_MODE_PRIV_LONGS];
 };
+static inline int team_dev_queue_xmit(struct team *team, struct team_port *port,
+                                      struct sk_buff *skb)
+{
+        BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
+                     sizeof(qdisc_skb_cb(skb)->slave_dev_queue_mapping));
+        skb_set_queue_mapping(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping);
+        skb->dev = port->dev;
+        if (unlikely(netpoll_tx_running(team->dev))) {
+                team_netpoll_send_skb(port, skb);
+                return 0;
+        }
+        return dev_queue_xmit(skb);
+}
 static inline struct hlist_head *team_port_index_hash(struct team *team,
                                                      int port_index)
 {
diff --git a/include/linux/iio/frequency/adf4350.h b/include/linux/iio/frequency/adf4350.h
index b76b4a87065e..be91f344d5fc 100644
--- a/include/linux/iio/frequency/adf4350.h
+++ b/include/linux/iio/frequency/adf4350.h
@@ -87,6 +87,8 @@
 #define ADF4350_MAX_BANDSEL_CLK         125000 /* Hz */
 #define ADF4350_MAX_FREQ_REFIN          250000000 /* Hz */
 #define ADF4350_MAX_MODULUS             4095
+#define ADF4350_MAX_R_CNT               1023
 /**
 * struct adf4350_platform_data - platform specific information
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index f334c7fab967..3efc43f3f162 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1125,6 +1125,7 @@ extern int	   jbd2_journal_destroy    (journal_t *);
 extern int         jbd2_journal_recover    (journal_t *journal);
 extern int         jbd2_journal_wipe       (journal_t *, int);
 extern int         jbd2_journal_skip_recovery   (journal_t *);
+extern void        jbd2_journal_update_sb_errno(journal_t *);
 extern void        jbd2_journal_update_sb_log_tail      (journal_t *, tid_t,
                                unsigned long, int);
 extern void        __jbd2_journal_abort_hard    (journal_t *);
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 604382143bcf..594b419b7d20 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -82,10 +82,18 @@
        __x - (__x % (y));                              \
 }                                                       \
 )
+/*
+ * Divide positive or negative dividend by positive divisor and round
+ * to closest integer. Result is undefined for negative divisors.
+ */
 #define DIV_ROUND_CLOSEST(x, divisor)(                  \
 {                                                       \
-        typeof(divisor) __divisor = divisor;            \
+        typeof(x) __x = x;                              \
-        (((x) + ((__divisor) / 2)) / (__divisor));      \
+        typeof(divisor) __d = divisor;                  \
+        (((typeof(x))-1) >= 0 || (__x) >= 0) ?          \
+                (((__x) + ((__d) / 2)) / (__d)) :       \
+                (((__x) - ((__d) / 2)) / (__d));        \
 }                                                       \
 )
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index fc615a97e2d3..1e57449395b1 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -224,7 +224,7 @@ static inline int kobject_uevent_env(struct kobject *kobj,
 static inline __printf(2, 3)
 int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...)
-{ return 0; }
+{ return -ENOMEM; }
 static inline int kobject_action_type(const char *buf, size_t count,
                                      enum kobject_action *type)
diff --git a/include/linux/kref.h b/include/linux/kref.h
index 9c07dcebded7..65af6887872f 100644
--- a/include/linux/kref.h
+++ b/include/linux/kref.h
@@ -18,6 +18,7 @@
 #include <linux/bug.h>
 #include <linux/atomic.h>
 #include <linux/kernel.h>
+#include <linux/mutex.h>
 struct kref {
        atomic_t refcount;
@@ -93,4 +94,21 @@ static inline int kref_put(struct kref *kref, void (*release)(struct kref *kref)
 {
        return kref_sub(kref, 1, release);
 }
+static inline int kref_put_mutex(struct kref *kref,
+                                 void (*release)(struct kref *kref),
+                                 struct mutex *lock)
+{
+        WARN_ON(release == NULL);
+        if (unlikely(!atomic_add_unless(&kref->refcount, -1, 1))) {
+                mutex_lock(lock);
+                if (unlikely(!atomic_dec_and_test(&kref->refcount))) {
+                        mutex_unlock(lock);
+                        return 0;
+                }
+                release(kref);
+                return 1;
+        }
+        return 0;
+}
 #endif /* _KREF_H_ */
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index 603bec2913b0..06177ba10a16 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -58,13 +58,6 @@ union ktime {
 typedef union ktime ktime_t;            /* Kill this */
-#define KTIME_MAX                       ((s64)~((u64)1 << 63))
-#if (BITS_PER_LONG == 64)
-# define KTIME_SEC_MAX                  (KTIME_MAX / NSEC_PER_SEC)
-#else
-# define KTIME_SEC_MAX                  LONG_MAX
-#endif
 /*
 * ktime_t definitions when using the 64-bit scalar representation:
 */
diff --git a/include/linux/mISDNhw.h b/include/linux/mISDNhw.h
index d0752eca9b44..9d96d5d4dfed 100644
--- a/include/linux/mISDNhw.h
+++ b/include/linux/mISDNhw.h
@@ -183,7 +183,7 @@ extern int	mISDN_initbchannel(struct bchannel *, unsigned short,
                                   unsigned short);
 extern int      mISDN_freedchannel(struct dchannel *);
 extern void     mISDN_clear_bchannel(struct bchannel *);
-extern int      mISDN_freebchannel(struct bchannel *);
+extern void     mISDN_freebchannel(struct bchannel *);
 extern int      mISDN_ctrl_bchannel(struct bchannel *, struct mISDN_ctrl_req *);
 extern void     queue_ch_frame(struct mISDNchannel *, u_int,
                        int, struct sk_buff *);
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index bd6c9fcdf2dd..6e1b0f973a03 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -796,6 +796,19 @@ enum mlx4_net_trans_rule_id {
        MLX4_NET_TRANS_RULE_NUM, /* should be last */
 };
+extern const u16 __sw_id_hw[];
+static inline int map_hw_to_sw_id(u16 header_id)
+{
+        int i;
+        for (i = 0; i < MLX4_NET_TRANS_RULE_NUM; i++) {
+                if (header_id == __sw_id_hw[i])
+                        return i;
+        }
+        return -EINVAL;
+}
 enum mlx4_net_trans_promisc_mode {
        MLX4_FS_PROMISC_NONE = 0,
        MLX4_FS_PROMISC_UPLINK,
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index 111aca5e97f3..4b27f9f503e4 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -239,6 +239,7 @@ struct mmc_card {
 #define MMC_QUIRK_BLK_NO_CMD23  (1<<7)          /* Avoid CMD23 for regular multiblock */
 #define MMC_QUIRK_BROKEN_BYTE_MODE_512 (1<<8)   /* Avoid sending 512 bytes in */
 #define MMC_QUIRK_LONG_READ_TIME (1<<9)         /* Data read time > CSD says */
+#define MMC_QUIRK_SEC_ERASE_TRIM_BROKEN (1<<10) /* Skip secure for erase/trim */
                                                /* byte mode */
        unsigned int    poweroff_notify_state;  /* eMMC4.5 notify feature */
 #define MMC_NO_POWER_NOTIFICATION       0
diff --git a/include/linux/mv643xx_eth.h b/include/linux/mv643xx_eth.h
index 51bf8ada6dc0..49258e0ed1c6 100644
--- a/include/linux/mv643xx_eth.h
+++ b/include/linux/mv643xx_eth.h
@@ -15,6 +15,8 @@
 #define MV643XX_ETH_SIZE_REG_4          0x2224
 #define MV643XX_ETH_BASE_ADDR_ENABLE_REG        0x2290
+#define MV643XX_TX_CSUM_DEFAULT_LIMIT   0
 struct mv643xx_eth_shared_platform_data {
        struct mbus_dram_target_info    *dram;
        struct platform_device  *shared_smi;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index a9db4f33407f..59dc05f38247 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -953,7 +953,8 @@ struct net_device_ops {
 #ifdef CONFIG_NET_POLL_CONTROLLER
        void                    (*ndo_poll_controller)(struct net_device *dev);
        int                     (*ndo_netpoll_setup)(struct net_device *dev,
-                                                     struct netpoll_info *info);
+                                                     struct netpoll_info *info,
+                                                     gfp_t gfp);
        void                    (*ndo_netpoll_cleanup)(struct net_device *dev);
 #endif
        int                     (*ndo_set_vf_mac)(struct net_device *dev,
@@ -1521,6 +1522,8 @@ struct packet_type {
        struct sk_buff          **(*gro_receive)(struct sk_buff **head,
                                               struct sk_buff *skb);
        int                     (*gro_complete)(struct sk_buff *skb);
+        bool                    (*id_match)(struct packet_type *ptype,
+                                            struct sock *sk);
        void                    *af_packet_priv;
        struct list_head        list;
 };
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index 0dfc8b7210a3..89f2a627f3f0 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -164,7 +164,7 @@ extern int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr
                                      unsigned int dataoff, unsigned int datalen,
                                      const char *name,
                                      unsigned int *matchoff, unsigned int *matchlen,
-                                      union nf_inet_addr *addr);
+                                      union nf_inet_addr *addr, bool delim);
 extern int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
                                        unsigned int off, unsigned int datalen,
                                        const char *name,
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 28f5389c924b..66d5379c305e 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -23,6 +23,7 @@ struct netpoll {
        u8 remote_mac[ETH_ALEN];
        struct list_head rx; /* rx_np list element */
+        struct rcu_head rcu;
 };
 struct netpoll_info {
@@ -38,28 +39,40 @@ struct netpoll_info {
        struct delayed_work tx_work;
        struct netpoll *netpoll;
+        struct rcu_head rcu;
 };
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len);
 void netpoll_print_options(struct netpoll *np);
 int netpoll_parse_options(struct netpoll *np, char *opt);
-int __netpoll_setup(struct netpoll *np, struct net_device *ndev);
+int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp);
 int netpoll_setup(struct netpoll *np);
 int netpoll_trap(void);
 void netpoll_set_trap(int trap);
 void __netpoll_cleanup(struct netpoll *np);
+void __netpoll_free_rcu(struct netpoll *np);
 void netpoll_cleanup(struct netpoll *np);
-int __netpoll_rx(struct sk_buff *skb);
+int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo);
 void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                             struct net_device *dev);
 static inline void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
 {
+        unsigned long flags;
+        local_irq_save(flags);
        netpoll_send_skb_on_dev(np, skb, np->dev);
+        local_irq_restore(flags);
 }
 #ifdef CONFIG_NETPOLL
+static inline bool netpoll_rx_on(struct sk_buff *skb)
+{
+        struct netpoll_info *npinfo = rcu_dereference_bh(skb->dev->npinfo);
+        return npinfo && (!list_empty(&npinfo->rx_np) || npinfo->rx_flags);
+}
 static inline bool netpoll_rx(struct sk_buff *skb)
 {
        struct netpoll_info *npinfo;
@@ -67,14 +80,14 @@ static inline bool netpoll_rx(struct sk_buff *skb)
        bool ret = false;
        local_irq_save(flags);
-        npinfo = rcu_dereference_bh(skb->dev->npinfo);
-        if (!npinfo || (list_empty(&npinfo->rx_np) && !npinfo->rx_flags))
+        if (!netpoll_rx_on(skb))
                goto out;
+        npinfo = rcu_dereference_bh(skb->dev->npinfo);
        spin_lock(&npinfo->rx_lock);
        /* check rx_flags again with the lock held */
-        if (npinfo->rx_flags && __netpoll_rx(skb))
+        if (npinfo->rx_flags && __netpoll_rx(skb, npinfo))
                ret = true;
        spin_unlock(&npinfo->rx_lock);
@@ -83,13 +96,6 @@ out:
        return ret;
 }
-static inline int netpoll_rx_on(struct sk_buff *skb)
-{
-        struct netpoll_info *npinfo = rcu_dereference_bh(skb->dev->npinfo);
-        return npinfo && (!list_empty(&npinfo->rx_np) || npinfo->rx_flags);
-}
 static inline int netpoll_receive_skb(struct sk_buff *skb)
 {
        if (!list_empty(&skb->dev->napi_list))
@@ -119,7 +125,7 @@ static inline void netpoll_poll_unlock(void *have)
        }
 }
-static inline int netpoll_tx_running(struct net_device *dev)
+static inline bool netpoll_tx_running(struct net_device *dev)
 {
        return irqs_disabled();
 }
@@ -127,11 +133,11 @@ static inline int netpoll_tx_running(struct net_device *dev)
 #else
 static inline bool netpoll_rx(struct sk_buff *skb)
 {
-        return 0;
+        return false;
 }
-static inline int netpoll_rx_on(struct sk_buff *skb)
+static inline bool netpoll_rx_on(struct sk_buff *skb)
 {
-        return 0;
+        return false;
 }
 static inline int netpoll_receive_skb(struct sk_buff *skb)
 {
@@ -147,9 +153,9 @@ static inline void netpoll_poll_unlock(void *have)
 static inline void netpoll_netdev_init(struct net_device *dev)
 {
 }
-static inline int netpoll_tx_running(struct net_device *dev)
+static inline bool netpoll_tx_running(struct net_device *dev)
 {
-        return 0;
+        return false;
 }
 #endif
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 1f8fc7f9bcd8..4b03f56e280e 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -265,11 +265,6 @@ static inline const struct nfs_rpc_ops *NFS_PROTO(const struct inode *inode)
        return NFS_SERVER(inode)->nfs_client->rpc_ops;
 }
-static inline __be32 *NFS_COOKIEVERF(const struct inode *inode)
-{
-        return NFS_I(inode)->cookieverf;
-}
 static inline unsigned NFS_MINATTRTIMEO(const struct inode *inode)
 {
        struct nfs_server *nfss = NFS_SERVER(inode);
diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
index 880805774f9f..92ce5783b707 100644
--- a/include/linux/nfs_page.h
+++ b/include/linux/nfs_page.h
@@ -69,6 +69,7 @@ struct nfs_pageio_descriptor {
        const struct nfs_pgio_completion_ops *pg_completion_ops;
        struct pnfs_layout_segment *pg_lseg;
        struct nfs_direct_req   *pg_dreq;
+        void                    *pg_layout_private;
 };
 #define NFS_WBACK_BUSY(req)     (test_bit(PG_BUSY,&(req)->wb_flags))
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 00485e084394..be9cf3c7e79e 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -652,7 +652,7 @@ struct nfs_getaclargs {
 };
 /* getxattr ACL interface flags */
-#define NFS4_ACL_LEN_REQUEST    0x0001  /* zero length getxattr buffer */
+#define NFS4_ACL_TRUNC          0x0001  /* ACL was truncated */
 struct nfs_getaclres {
        size_t                          acl_len;
        size_t                          acl_data_offset;
@@ -1248,6 +1248,7 @@ struct nfs_pgio_header {
        void (*release) (struct nfs_pgio_header *hdr);
        const struct nfs_pgio_completion_ops *completion_ops;
        struct nfs_direct_req   *dreq;
+        void                    *layout_private;
        spinlock_t              lock;
        /* fields protected by lock */
        int                     pnfs_error;
diff --git a/include/linux/of.h b/include/linux/of.h
index 5919ee33f2b7..1b1163225f3b 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -190,10 +190,17 @@ extern struct device_node *of_get_parent(const struct device_node *node);
 extern struct device_node *of_get_next_parent(struct device_node *node);
 extern struct device_node *of_get_next_child(const struct device_node *node,
                                             struct device_node *prev);
+extern struct device_node *of_get_next_available_child(
+        const struct device_node *node, struct device_node *prev);
 #define for_each_child_of_node(parent, child) \
        for (child = of_get_next_child(parent, NULL); child != NULL; \
             child = of_get_next_child(parent, child))
+#define for_each_available_child_of_node(parent, child) \
+        for (child = of_get_next_available_child(parent, NULL); child != NULL; \
+             child = of_get_next_available_child(parent, child))
 static inline int of_get_child_count(const struct device_node *np)
 {
        struct device_node *child;
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index fc3526077348..6b4565c440c8 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2149,7 +2149,7 @@
 #define PCI_DEVICE_ID_TIGON3_5704S      0x16a8
 #define PCI_DEVICE_ID_NX2_57800_VF      0x16a9
 #define PCI_DEVICE_ID_NX2_5706S         0x16aa
-#define PCI_DEVICE_ID_NX2_57840_MF      0x16ab
+#define PCI_DEVICE_ID_NX2_57840_MF      0x16a4
 #define PCI_DEVICE_ID_NX2_5708S         0x16ac
 #define PCI_DEVICE_ID_NX2_57840_VF      0x16ad
 #define PCI_DEVICE_ID_NX2_57810_MF      0x16ae
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 7602ccb3f40e..33ed9d605f91 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -926,7 +926,7 @@ struct perf_event {
        struct hw_perf_event            hw;
        struct perf_event_context       *ctx;
-        struct file                     *filp;
+        atomic_long_t                   refcount;
        /*
         * These accumulate total time (in nanoseconds) that children
@@ -1296,6 +1296,7 @@ extern int perf_swevent_get_recursion_context(void);
 extern void perf_swevent_put_recursion_context(int rctx);
 extern void perf_event_enable(struct perf_event *event);
 extern void perf_event_disable(struct perf_event *event);
+extern int __perf_event_disable(void *info);
 extern void perf_event_task_tick(void);
 #else
 static inline void
@@ -1334,6 +1335,7 @@ static inline int  perf_swevent_get_recursion_context(void)		{ return -1; }
 static inline void perf_swevent_put_recursion_context(int rctx)         { }
 static inline void perf_event_enable(struct perf_event *event)          { }
 static inline void perf_event_disable(struct perf_event *event)         { }
+static inline int __perf_event_disable(void *info)                      { return -1; }
 static inline void perf_event_task_tick(void)                           { }
 #endif
diff --git a/include/linux/pinctrl/consumer.h b/include/linux/pinctrl/consumer.h
index 6dd96fb45482..e9b7f4350844 100644
--- a/include/linux/pinctrl/consumer.h
+++ b/include/linux/pinctrl/consumer.h
@@ -20,6 +20,7 @@
 /* This struct is private to the core and should be regarded as a cookie */
 struct pinctrl;
 struct pinctrl_state;
+struct device;
 #ifdef CONFIG_PINCTRL
diff --git a/include/linux/sched.h b/include/linux/sched.h
index b8c86648a2f9..23bddac4bad8 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -954,7 +954,6 @@ struct sched_domain {
        unsigned int smt_gain;
        int flags;                      /* See SD_* */
        int level;
-        int idle_buddy;                 /* cpu assigned to select_idle_sibling() */
        /* Runtime fields. */
        unsigned long last_balance;     /* init to jiffies. units in jiffies */
diff --git a/include/linux/string.h b/include/linux/string.h
index ffe0442e18d2..b9178812d9df 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -144,8 +144,8 @@ static inline bool strstarts(const char *str, const char *prefix)
 {
        return strncmp(str, prefix, strlen(prefix)) == 0;
 }
-#endif
 extern size_t memweight(const void *ptr, size_t bytes);
+#endif /* __KERNEL__ */
 #endif /* _LINUX_STRING_H_ */
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index cff40aa7db62..bf8c49ff7530 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -114,6 +114,7 @@ struct rpc_xprt_ops {
        void            (*set_buffer_size)(struct rpc_xprt *xprt, size_t sndsize, size_t rcvsize);
        int             (*reserve_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
        void            (*release_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
+        void            (*alloc_slot)(struct rpc_xprt *xprt, struct rpc_task *task);
        void            (*rpcbind)(struct rpc_task *task);
        void            (*set_port)(struct rpc_xprt *xprt, unsigned short port);
        void            (*connect)(struct rpc_task *task);
@@ -281,6 +282,8 @@ void			xprt_connect(struct rpc_task *task);
 void                    xprt_reserve(struct rpc_task *task);
 int                     xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
 int                     xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
+void                    xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
+void                    xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
 int                     xprt_prepare_transmit(struct rpc_task *task);
 void                    xprt_transmit(struct rpc_task *task);
 void                    xprt_end_transmit(struct rpc_task *task);
diff --git a/include/linux/time.h b/include/linux/time.h
index c81c5e40fcb5..b51e664c83e7 100644
--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -107,11 +107,36 @@ static inline struct timespec timespec_sub(struct timespec lhs,
        return ts_delta;
 }
+#define KTIME_MAX                       ((s64)~((u64)1 << 63))
+#if (BITS_PER_LONG == 64)
+# define KTIME_SEC_MAX                  (KTIME_MAX / NSEC_PER_SEC)
+#else
+# define KTIME_SEC_MAX                  LONG_MAX
+#endif
 /*
 * Returns true if the timespec is norm, false if denorm:
 */
-#define timespec_valid(ts) \
+static inline bool timespec_valid(const struct timespec *ts)
-        (((ts)->tv_sec >= 0) && (((unsigned long) (ts)->tv_nsec) < NSEC_PER_SEC))
+{
+        /* Dates before 1970 are bogus */
+        if (ts->tv_sec < 0)
+                return false;
+        /* Can't have more nanoseconds then a second */
+        if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
+                return false;
+        return true;
+}
+static inline bool timespec_valid_strict(const struct timespec *ts)
+{
+        if (!timespec_valid(ts))
+                return false;
+        /* Disallow values that could overflow ktime_t */
+        if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
+                return false;
+        return true;
+}
 extern void read_persistent_clock(struct timespec *ts);
 extern void read_boot_clock(struct timespec *ts);
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index ca356a734920..8b27927b2a55 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -136,7 +136,7 @@ struct smp_chan {
 };
 /* SMP Commands */
-int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
 int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
 int smp_user_confirm_reply(struct hci_conn *conn, u16 mgmt_op, __le32 passkey);
diff --git a/include/net/llc.h b/include/net/llc.h
index 226c846cab08..f2d0fc570527 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -133,7 +133,7 @@ extern int llc_build_and_send_ui_pkt(struct llc_sap *sap, struct sk_buff *skb,
 extern void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb);
 extern void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb);
-extern int llc_station_init(void);
+extern void llc_station_init(void);
 extern void llc_station_exit(void);
 #ifdef CONFIG_PROC_FS
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index e1ce1048fe5f..4a045cda9c60 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -18,6 +18,7 @@ struct nf_conntrack_ecache {
        u16 ctmask;             /* bitmask of ct events to be delivered */
        u16 expmask;            /* bitmask of expect events to be delivered */
        u32 pid;                /* netlink pid of destroyer */
+        struct timer_list timeout;
 };
 static inline struct nf_conntrack_ecache *
diff --git a/include/net/scm.h b/include/net/scm.h
index 079d7887dac1..7dc0854f0b38 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -70,9 +70,11 @@ static __inline__ void scm_destroy(struct scm_cookie *scm)
 }
 static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
-                               struct scm_cookie *scm)
+                               struct scm_cookie *scm, bool forcecreds)
 {
        memset(scm, 0, sizeof(*scm));
+        if (forcecreds)
+                scm_set_cred(scm, task_tgid(current), current_cred());
        unix_get_peersec_dgram(sock, scm);
        if (msg->msg_controllen <= 0)
                return 0;
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 62b619e82a90..639dd1316d37 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -273,6 +273,9 @@ struct xfrm_replay {
        int     (*check)(struct xfrm_state *x,
                         struct sk_buff *skb,
                         __be32 net_seq);
+        int     (*recheck)(struct xfrm_state *x,
+                           struct sk_buff *skb,
+                           __be32 net_seq);
        void    (*notify)(struct xfrm_state *x, int event);
        int     (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
 };
@@ -292,6 +295,8 @@ struct xfrm_policy_afinfo {
                                                  struct flowi *fl,
                                                  int reverse);
        int                     (*get_tos)(const struct flowi *fl);
+        void                    (*init_dst)(struct net *net,
+                                            struct xfrm_dst *dst);
        int                     (*init_path)(struct xfrm_dst *path,
                                             struct dst_entry *dst,
                                             int nfheader_len);
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 128ce46fa48a..015cea01ae39 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -503,8 +503,6 @@ struct se_cmd {
        u32                     se_ordered_id;
        /* Total size in bytes associated with command */
        u32                     data_length;
-        /* SCSI Presented Data Transfer Length */
-        u32                     cmd_spdtl;
        u32                     residual_count;
        u32                     orig_fe_lun;
        /* Persistent Reservation key */
diff --git a/include/xen/events.h b/include/xen/events.h
index 9c641deb65d2..04399b28e821 100644
--- a/include/xen/events.h
+++ b/include/xen/events.h
@@ -58,8 +58,6 @@ void notify_remote_via_irq(int irq);
 void xen_irq_resume(void);
-void xen_hvm_prepare_kexec(struct shared_info *sip, unsigned long pfn);
 /* Clear an irq's pending state, in preparation for polling on it */
 void xen_clear_irq_pending(int irq);
 void xen_set_irq_pending(int irq);
diff --git a/init/main.c b/init/main.c
index e60679de61c3..b28673087ac0 100644
--- a/init/main.c
+++ b/init/main.c
@@ -461,10 +461,6 @@ static void __init mm_init(void)
        percpu_init_late();
        pgtable_cache_init();
        vmalloc_init();
-#ifdef CONFIG_X86
-        if (efi_enabled)
-                efi_enter_virtual_mode();
-#endif
 }
 asmlinkage void __init start_kernel(void)
@@ -606,6 +602,10 @@ asmlinkage void __init start_kernel(void)
        calibrate_delay();
        pidmap_init();
        anon_vma_init();
+#ifdef CONFIG_X86
+        if (efi_enabled)
+                efi_enter_virtual_mode();
+#endif
        thread_info_cache_init();
        cred_init();
        fork_init(totalram_pages);
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index f8e54f5b9080..9a08acc9e649 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -726,7 +726,6 @@ static struct file *do_create(struct ipc_namespace *ipc_ns, struct inode *dir,
                        struct mq_attr *attr)
 {
        const struct cred *cred = current_cred();
-        struct file *result;
        int ret;
        if (attr) {
@@ -748,21 +747,11 @@ static struct file *do_create(struct ipc_namespace *ipc_ns, struct inode *dir,
        }
        mode &= ~current_umask();
-        ret = mnt_want_write(path->mnt);
-        if (ret)
-                return ERR_PTR(ret);
        ret = vfs_create(dir, path->dentry, mode, true);
        path->dentry->d_fsdata = NULL;
-        if (!ret)
+        if (ret)
-                result = dentry_open(path, oflag, cred);
+                return ERR_PTR(ret);
-        else
+        return dentry_open(path, oflag, cred);
-                result = ERR_PTR(ret);
-        /*
-         * dentry_open() took a persistent mnt_want_write(),
-         * so we can now drop this one.
-         */
-        mnt_drop_write(path->mnt);
-        return result;
 }
 /* Opens existing queue */
@@ -788,7 +777,9 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
        struct mq_attr attr;
        int fd, error;
        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
-        struct dentry *root = ipc_ns->mq_mnt->mnt_root;
+        struct vfsmount *mnt = ipc_ns->mq_mnt;
+        struct dentry *root = mnt->mnt_root;
+        int ro;
        if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
                return -EFAULT;
@@ -802,6 +793,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
        if (fd < 0)
                goto out_putname;
+        ro = mnt_want_write(mnt);       /* we'll drop it in any case */
        error = 0;
        mutex_lock(&root->d_inode->i_mutex);
        path.dentry = lookup_one_len(name, root, strlen(name));
@@ -809,7 +801,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
                error = PTR_ERR(path.dentry);
                goto out_putfd;
        }
-        path.mnt = mntget(ipc_ns->mq_mnt);
+        path.mnt = mntget(mnt);
        if (oflag & O_CREAT) {
                if (path.dentry->d_inode) {     /* entry already exists */
@@ -820,6 +812,10 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
                        }
                        filp = do_open(&path, oflag);
                } else {
+                        if (ro) {
+                                error = ro;
+                                goto out;
+                        }
                        filp = do_create(ipc_ns, root->d_inode,
                                                &path, oflag, mode,
                                                u_attr ? &attr : NULL);
@@ -845,6 +841,7 @@ out_putfd:
                fd = error;
        }
        mutex_unlock(&root->d_inode->i_mutex);
+        mnt_drop_write(mnt);
 out_putname:
        putname(name);
        return fd;
@@ -857,40 +854,38 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
        struct dentry *dentry;
        struct inode *inode = NULL;
        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
+        struct vfsmount *mnt = ipc_ns->mq_mnt;
        name = getname(u_name);
        if (IS_ERR(name))
                return PTR_ERR(name);
-        mutex_lock_nested(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex,
+        err = mnt_want_write(mnt);
-                        I_MUTEX_PARENT);
+        if (err)
-        dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
+                goto out_name;
+        mutex_lock_nested(&mnt->mnt_root->d_inode->i_mutex, I_MUTEX_PARENT);
+        dentry = lookup_one_len(name, mnt->mnt_root, strlen(name));
        if (IS_ERR(dentry)) {
                err = PTR_ERR(dentry);
                goto out_unlock;
        }
-        if (!dentry->d_inode) {
-                err = -ENOENT;
-                goto out_err;
-        }
        inode = dentry->d_inode;
-        if (inode)
+        if (!inode) {
+                err = -ENOENT;
+        } else {
                ihold(inode);
-        err = mnt_want_write(ipc_ns->mq_mnt);
+                err = vfs_unlink(dentry->d_parent->d_inode, dentry);
-        if (err)
+        }
-                goto out_err;
-        err = vfs_unlink(dentry->d_parent->d_inode, dentry);
-        mnt_drop_write(ipc_ns->mq_mnt);
-out_err:
        dput(dentry);
 out_unlock:
-        mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
+        mutex_unlock(&mnt->mnt_root->d_inode->i_mutex);
-        putname(name);
        if (inode)
                iput(inode);
+        mnt_drop_write(mnt);
+out_name:
+        putname(name);
        return err;
 }
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 3a5ca582ba1e..ed206fd88cca 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -250,7 +250,6 @@ static void untag_chunk(struct node *p)
                spin_unlock(&hash_lock);
                spin_unlock(&entry->lock);
                fsnotify_destroy_mark(entry);
-                fsnotify_put_mark(entry);
                goto out;
        }
@@ -259,7 +258,7 @@ static void untag_chunk(struct node *p)
        fsnotify_duplicate_mark(&new->mark, entry);
        if (fsnotify_add_mark(&new->mark, new->mark.group, new->mark.i.inode, NULL, 1)) {
-                free_chunk(new);
+                fsnotify_put_mark(&new->mark);
                goto Fallback;
        }
@@ -293,7 +292,7 @@ static void untag_chunk(struct node *p)
        spin_unlock(&hash_lock);
        spin_unlock(&entry->lock);
        fsnotify_destroy_mark(entry);
-        fsnotify_put_mark(entry);
+        fsnotify_put_mark(&new->mark);  /* drop initial reference */
        goto out;
 Fallback:
@@ -322,7 +321,7 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree)
        entry = &chunk->mark;
        if (fsnotify_add_mark(entry, audit_tree_group, inode, NULL, 0)) {
-                free_chunk(chunk);
+                fsnotify_put_mark(entry);
                return -ENOSPC;
        }
@@ -347,6 +346,7 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree)
        insert_hash(chunk);
        spin_unlock(&hash_lock);
        spin_unlock(&entry->lock);
+        fsnotify_put_mark(entry);       /* drop initial reference */
        return 0;
 }
@@ -396,7 +396,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
        fsnotify_duplicate_mark(chunk_entry, old_entry);
        if (fsnotify_add_mark(chunk_entry, chunk_entry->group, chunk_entry->i.inode, NULL, 1)) {
                spin_unlock(&old_entry->lock);
-                free_chunk(chunk);
+                fsnotify_put_mark(chunk_entry);
                fsnotify_put_mark(old_entry);
                return -ENOSPC;
        }
@@ -444,8 +444,8 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
        spin_unlock(&chunk_entry->lock);
        spin_unlock(&old_entry->lock);
        fsnotify_destroy_mark(old_entry);
+        fsnotify_put_mark(chunk_entry); /* drop initial reference */
        fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
-        fsnotify_put_mark(old_entry); /* and kill it */
        return 0;
 }
@@ -916,7 +916,12 @@ static void audit_tree_freeing_mark(struct fsnotify_mark *entry, struct fsnotify
        struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
        evict_chunk(chunk);
-        fsnotify_put_mark(entry);
+        /*
+         * We are guaranteed to have at least one reference to the mark from
+         * either the inode or the caller of fsnotify_destroy_mark().
+         */
+        BUG_ON(atomic_read(&entry->refcnt) < 1);
 }
 static bool audit_tree_send_event(struct fsnotify_group *group, struct inode *inode,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b7935fcec7d9..7fee567153f0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1253,7 +1253,7 @@ retry:
 /*
 * Cross CPU call to disable a performance event
 */
-static int __perf_event_disable(void *info)
+int __perf_event_disable(void *info)
 {
        struct perf_event *event = info;
        struct perf_event_context *ctx = event->ctx;
@@ -2935,12 +2935,12 @@ EXPORT_SYMBOL_GPL(perf_event_release_kernel);
 /*
 * Called when the last reference to the file is gone.
 */
-static int perf_release(struct inode *inode, struct file *file)
+static void put_event(struct perf_event *event)
 {
-        struct perf_event *event = file->private_data;
        struct task_struct *owner;
-        file->private_data = NULL;
+        if (!atomic_long_dec_and_test(&event->refcount))
+                return;
        rcu_read_lock();
        owner = ACCESS_ONCE(event->owner);
@@ -2975,7 +2975,13 @@ static int perf_release(struct inode *inode, struct file *file)
                put_task_struct(owner);
        }
-        return perf_event_release_kernel(event);
+        perf_event_release_kernel(event);
+}
+static int perf_release(struct inode *inode, struct file *file)
+{
+        put_event(file->private_data);
+        return 0;
 }
 u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
@@ -3227,7 +3233,7 @@ unlock:
 static const struct file_operations perf_fops;
-static struct perf_event *perf_fget_light(int fd, int *fput_needed)
+static struct file *perf_fget_light(int fd, int *fput_needed)
 {
        struct file *file;
@@ -3241,7 +3247,7 @@ static struct perf_event *perf_fget_light(int fd, int *fput_needed)
                return ERR_PTR(-EBADF);
        }
-        return file->private_data;
+        return file;
 }
 static int perf_event_set_output(struct perf_event *event,
@@ -3273,19 +3279,21 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case PERF_EVENT_IOC_SET_OUTPUT:
        {
+                struct file *output_file = NULL;
                struct perf_event *output_event = NULL;
                int fput_needed = 0;
                int ret;
                if (arg != -1) {
-                        output_event = perf_fget_light(arg, &fput_needed);
+                        output_file = perf_fget_light(arg, &fput_needed);
-                        if (IS_ERR(output_event))
+                        if (IS_ERR(output_file))
-                                return PTR_ERR(output_event);
+                                return PTR_ERR(output_file);
+                        output_event = output_file->private_data;
                }
                ret = perf_event_set_output(event, output_event);
                if (output_event)
-                        fput_light(output_event->filp, fput_needed);
+                        fput_light(output_file, fput_needed);
                return ret;
        }
@@ -5950,6 +5958,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
        mutex_init(&event->mmap_mutex);
+        atomic_long_set(&event->refcount, 1);
        event->cpu              = cpu;
        event->attr             = *attr;
        event->group_leader     = group_leader;
@@ -6260,12 +6269,12 @@ SYSCALL_DEFINE5(perf_event_open,
                return event_fd;
        if (group_fd != -1) {
-                group_leader = perf_fget_light(group_fd, &fput_needed);
+                group_file = perf_fget_light(group_fd, &fput_needed);
-                if (IS_ERR(group_leader)) {
+                if (IS_ERR(group_file)) {
-                        err = PTR_ERR(group_leader);
+                        err = PTR_ERR(group_file);
                        goto err_fd;
                }
-                group_file = group_leader->filp;
+                group_leader = group_file->private_data;
                if (flags & PERF_FLAG_FD_OUTPUT)
                        output_event = group_leader;
                if (flags & PERF_FLAG_FD_NO_GROUP)
@@ -6402,7 +6411,6 @@ SYSCALL_DEFINE5(perf_event_open,
                put_ctx(gctx);
        }
-        event->filp = event_file;
        WARN_ON_ONCE(ctx->parent_ctx);
        mutex_lock(&ctx->mutex);
@@ -6496,7 +6504,6 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
                goto err_free;
        }
-        event->filp = NULL;
        WARN_ON_ONCE(ctx->parent_ctx);
        mutex_lock(&ctx->mutex);
        perf_install_in_context(ctx, event, cpu);
@@ -6578,7 +6585,7 @@ static void sync_child_event(struct perf_event *child_event,
         * Release the parent event, if this was the last
         * reference to it.
         */
-        fput(parent_event->filp);
+        put_event(parent_event);
 }
 static void
@@ -6654,9 +6661,8 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
         *
         *   __perf_event_exit_task()
         *     sync_child_event()
-         *       fput(parent_event->filp)
+         *       put_event()
-         *         perf_release()
+         *         mutex_lock(&ctx->mutex)
-         *           mutex_lock(&ctx->mutex)
         *
         * But since its the parent context it won't be the same instance.
         */
@@ -6724,7 +6730,7 @@ static void perf_free_event(struct perf_event *event,
        list_del_init(&event->child_list);
        mutex_unlock(&parent->child_mutex);
-        fput(parent->filp);
+        put_event(parent);
        perf_group_detach(event);
        list_del_event(event, ctx);
@@ -6804,6 +6810,12 @@ inherit_event(struct perf_event *parent_event,
                                           NULL, NULL);
        if (IS_ERR(child_event))
                return child_event;
+        if (!atomic_long_inc_not_zero(&parent_event->refcount)) {
+                free_event(child_event);
+                return NULL;
+        }
        get_ctx(child_ctx);
        /*
@@ -6845,14 +6857,6 @@ inherit_event(struct perf_event *parent_event,
        raw_spin_unlock_irqrestore(&child_ctx->lock, flags);
        /*
-         * Get a reference to the parent filp - we will fput it
-         * when the child event exits. This is safe to do because
-         * we are in the parent and we know that the filp still
-         * exists and has a nonzero count:
-         */
-        atomic_long_inc(&parent_event->filp->f_count);
-        /*
         * Link this into the parent event's child list
         */
        WARN_ON_ONCE(parent_event->ctx->parent_ctx);
diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index bb38c4d3ee12..9a7b487c6fe2 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -453,7 +453,16 @@ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *att
        int old_type = bp->attr.bp_type;
        int err = 0;
-        perf_event_disable(bp);
+        /*
+         * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it
+         * will not be possible to raise IPIs that invoke __perf_event_disable.
+         * So call the function directly after making sure we are targeting the
+         * current task.
+         */
+        if (irqs_disabled() && bp->ctx && bp->ctx->task == current)
+                __perf_event_disable(bp);
+        else
+                perf_event_disable(bp);
        bp->attr.bp_addr = attr->bp_addr;
        bp->attr.bp_type = attr->bp_type;
diff --git a/kernel/fork.c b/kernel/fork.c
index 3bd2280d79f6..2c8857e12855 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -455,8 +455,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                if (retval)
                        goto out;
-                if (file && uprobe_mmap(tmp))
+                if (file)
-                        goto out;
+                        uprobe_mmap(tmp);
        }
        /* a new mm has just been created */
        arch_dup_mmap(oldmm, mm);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 82ad284f823b..649c9f876cb1 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3142,6 +3142,20 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
 # define nsecs_to_cputime(__nsecs)      nsecs_to_jiffies(__nsecs)
 #endif
+static cputime_t scale_utime(cputime_t utime, cputime_t rtime, cputime_t total)
+{
+        u64 temp = (__force u64) rtime;
+        temp *= (__force u64) utime;
+        if (sizeof(cputime_t) == 4)
+                temp = div_u64(temp, (__force u32) total);
+        else
+                temp = div64_u64(temp, (__force u64) total);
+        return (__force cputime_t) temp;
+}
 void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
 {
        cputime_t rtime, utime = p->utime, total = utime + p->stime;
@@ -3151,13 +3165,9 @@ void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
         */
        rtime = nsecs_to_cputime(p->se.sum_exec_runtime);
-        if (total) {
+        if (total)
-                u64 temp = (__force u64) rtime;
+                utime = scale_utime(utime, rtime, total);
+        else
-                temp *= (__force u64) utime;
-                do_div(temp, (__force u32) total);
-                utime = (__force cputime_t) temp;
-        } else
                utime = rtime;
        /*
@@ -3184,13 +3194,9 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
        total = cputime.utime + cputime.stime;
        rtime = nsecs_to_cputime(cputime.sum_exec_runtime);
-        if (total) {
+        if (total)
-                u64 temp = (__force u64) rtime;
+                utime = scale_utime(cputime.utime, rtime, total);
+        else
-                temp *= (__force u64) cputime.utime;
-                do_div(temp, (__force u32) total);
-                utime = (__force cputime_t) temp;
-        } else
                utime = rtime;
        sig->prev_utime = max(sig->prev_utime, utime);
@@ -5298,27 +5304,17 @@ void idle_task_exit(void)
 }
 /*
- * While a dead CPU has no uninterruptible tasks queued at this point,
+ * Since this CPU is going 'away' for a while, fold any nr_active delta
- * it might still have a nonzero ->nr_uninterruptible counter, because
+ * we might have. Assumes we're called after migrate_tasks() so that the
- * for performance reasons the counter is not stricly tracking tasks to
+ * nr_active count is stable.
- * their home CPUs. So we just add the counter to another CPU's counter,
+ *
- * to keep the global sum constant after CPU-down:
+ * Also see the comment "Global load-average calculations".
- */
-static void migrate_nr_uninterruptible(struct rq *rq_src)
-{
-        struct rq *rq_dest = cpu_rq(cpumask_any(cpu_active_mask));
-        rq_dest->nr_uninterruptible += rq_src->nr_uninterruptible;
-        rq_src->nr_uninterruptible = 0;
-}
-/*
- * remove the tasks which were accounted by rq from calc_load_tasks.
 */
-static void calc_global_load_remove(struct rq *rq)
+static void calc_load_migrate(struct rq *rq)
 {
-        atomic_long_sub(rq->calc_load_active, &calc_load_tasks);
+        long delta = calc_load_fold_active(rq);
-        rq->calc_load_active = 0;
+        if (delta)
+                atomic_long_add(delta, &calc_load_tasks);
 }
 /*
@@ -5346,9 +5342,6 @@ static void migrate_tasks(unsigned int dead_cpu)
         */
        rq->stop = NULL;
-        /* Ensure any throttled groups are reachable by pick_next_task */
-        unthrottle_offline_cfs_rqs(rq);
        for ( ; ; ) {
                /*
                 * There's this thread running, bail when that's the only
@@ -5612,8 +5605,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
                BUG_ON(rq->nr_running != 1); /* the migration thread */
                raw_spin_unlock_irqrestore(&rq->lock, flags);
-                migrate_nr_uninterruptible(rq);
+                calc_load_migrate(rq);
-                calc_global_load_remove(rq);
                break;
 #endif
        }
@@ -6022,11 +6014,6 @@ static void destroy_sched_domains(struct sched_domain *sd, int cpu)
 * SD_SHARE_PKG_RESOURCE set (Last Level Cache Domain) for this
 * allows us to avoid some pointer chasing select_idle_sibling().
 *
- * Iterate domains and sched_groups downward, assigning CPUs to be
- * select_idle_sibling() hw buddy.  Cross-wiring hw makes bouncing
- * due to random perturbation self canceling, ie sw buddies pull
- * their counterpart to their CPU's hw counterpart.
- *
 * Also keep a unique ID per domain (we use the first cpu number in
 * the cpumask of the domain), this allows us to quickly tell if
 * two cpus are in the same cache domain, see cpus_share_cache().
@@ -6040,40 +6027,8 @@ static void update_top_cache_domain(int cpu)
        int id = cpu;
        sd = highest_flag_domain(cpu, SD_SHARE_PKG_RESOURCES);
-        if (sd) {
+        if (sd)
-                struct sched_domain *tmp = sd;
-                struct sched_group *sg, *prev;
-                bool right;
-                /*
-                 * Traverse to first CPU in group, and count hops
-                 * to cpu from there, switching direction on each
-                 * hop, never ever pointing the last CPU rightward.
-                 */
-                do {
-                        id = cpumask_first(sched_domain_span(tmp));
-                        prev = sg = tmp->groups;
-                        right = 1;
-                        while (cpumask_first(sched_group_cpus(sg)) != id)
-                                sg = sg->next;
-                        while (!cpumask_test_cpu(cpu, sched_group_cpus(sg))) {
-                                prev = sg;
-                                sg = sg->next;
-                                right = !right;
-                        }
-                        /* A CPU went down, never point back to domain start. */
-                        if (right && cpumask_first(sched_group_cpus(sg->next)) == id)
-                                right = false;
-                        sg = right ? sg->next : prev;
-                        tmp->idle_buddy = cpumask_first(sched_group_cpus(sg));
-                } while ((tmp = tmp->child));
                id = cpumask_first(sched_domain_span(sd));
-        }
        rcu_assign_pointer(per_cpu(sd_llc, cpu), sd);
        per_cpu(sd_llc_id, cpu) = id;
@@ -7246,6 +7201,7 @@ int in_sched_functions(unsigned long addr)
 #ifdef CONFIG_CGROUP_SCHED
 struct task_group root_task_group;
+LIST_HEAD(task_groups);
 #endif
 DECLARE_PER_CPU(cpumask_var_t, load_balance_tmpmask);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index d0cc03b3e70b..96e2b18b6283 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2052,7 +2052,7 @@ static void destroy_cfs_bandwidth(struct cfs_bandwidth *cfs_b)
        hrtimer_cancel(&cfs_b->slack_timer);
 }
-void unthrottle_offline_cfs_rqs(struct rq *rq)
+static void unthrottle_offline_cfs_rqs(struct rq *rq)
 {
        struct cfs_rq *cfs_rq;
@@ -2106,7 +2106,7 @@ static inline struct cfs_bandwidth *tg_cfs_bandwidth(struct task_group *tg)
        return NULL;
 }
 static inline void destroy_cfs_bandwidth(struct cfs_bandwidth *cfs_b) {}
-void unthrottle_offline_cfs_rqs(struct rq *rq) {}
+static inline void unthrottle_offline_cfs_rqs(struct rq *rq) {}
 #endif /* CONFIG_CFS_BANDWIDTH */
@@ -2637,6 +2637,8 @@ static int select_idle_sibling(struct task_struct *p, int target)
        int cpu = smp_processor_id();
        int prev_cpu = task_cpu(p);
        struct sched_domain *sd;
+        struct sched_group *sg;
+        int i;
        /*
         * If the task is going to be woken-up on this cpu and if it is
@@ -2653,17 +2655,29 @@ static int select_idle_sibling(struct task_struct *p, int target)
                return prev_cpu;
        /*
-         * Otherwise, check assigned siblings to find an elegible idle cpu.
+         * Otherwise, iterate the domains and find an elegible idle cpu.
         */
        sd = rcu_dereference(per_cpu(sd_llc, target));
        for_each_lower_domain(sd) {
-                if (!cpumask_test_cpu(sd->idle_buddy, tsk_cpus_allowed(p)))
+                sg = sd->groups;
-                        continue;
+                do {
-                if (idle_cpu(sd->idle_buddy))
+                        if (!cpumask_intersects(sched_group_cpus(sg),
-                        return sd->idle_buddy;
+                                                tsk_cpus_allowed(p)))
-        }
+                                goto next;
+                        for_each_cpu(i, sched_group_cpus(sg)) {
+                                if (!idle_cpu(i))
+                                        goto next;
+                        }
+                        target = cpumask_first_and(sched_group_cpus(sg),
+                                        tsk_cpus_allowed(p));
+                        goto done;
+next:
+                        sg = sg->next;
+                } while (sg != sd->groups);
+        }
+done:
        return target;
 }
@@ -3387,6 +3401,14 @@ static int tg_load_down(struct task_group *tg, void *data)
 static void update_h_load(long cpu)
 {
+        struct rq *rq = cpu_rq(cpu);
+        unsigned long now = jiffies;
+        if (rq->h_load_throttle == now)
+                return;
+        rq->h_load_throttle = now;
        rcu_read_lock();
        walk_tg_tree(tg_load_down, tg_nop, (void *)cpu);
        rcu_read_unlock();
@@ -3650,7 +3672,6 @@ fix_small_capacity(struct sched_domain *sd, struct sched_group *group)
 * @group: sched_group whose statistics are to be updated.
 * @load_idx: Load index of sched_domain of this_cpu for load calc.
 * @local_group: Does group contain this_cpu.
- * @cpus: Set of cpus considered for load balancing.
 * @balance: Should we balance.
 * @sgs: variable to hold the statistics for this group.
 */
@@ -3797,7 +3818,6 @@ static bool update_sd_pick_busiest(struct lb_env *env,
 /**
 * update_sd_lb_stats - Update sched_domain's statistics for load balancing.
 * @env: The load balancing environment.
- * @cpus: Set of cpus considered for load balancing.
 * @balance: Should we balance.
 * @sds: variable to hold the statistics for this sched_domain.
 */
@@ -4293,11 +4313,10 @@ redo:
                env.src_rq    = busiest;
                env.loop_max  = min(sysctl_sched_nr_migrate, busiest->nr_running);
+                update_h_load(env.src_cpu);
 more_balance:
                local_irq_save(flags);
                double_rq_lock(this_rq, busiest);
-                if (!env.loop)
-                        update_h_load(env.src_cpu);
                /*
                 * cur_ld_moved - load moved in current iteration
@@ -4949,6 +4968,9 @@ static void rq_online_fair(struct rq *rq)
 static void rq_offline_fair(struct rq *rq)
 {
        update_sysctl();
+        /* Ensure any throttled groups are reachable by pick_next_task */
+        unthrottle_offline_cfs_rqs(rq);
 }
 #endif /* CONFIG_SMP */
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 573e1ca01102..e0b7ba9c040f 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -691,6 +691,7 @@ balanced:
                 * runtime - in which case borrowing doesn't make sense.
                 */
                rt_rq->rt_runtime = RUNTIME_INF;
+                rt_rq->rt_throttled = 0;
                raw_spin_unlock(&rt_rq->rt_runtime_lock);
                raw_spin_unlock(&rt_b->rt_runtime_lock);
        }
@@ -788,6 +789,19 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
        const struct cpumask *span;
        span = sched_rt_period_mask();
+#ifdef CONFIG_RT_GROUP_SCHED
+        /*
+         * FIXME: isolated CPUs should really leave the root task group,
+         * whether they are isolcpus or were isolated via cpusets, lest
+         * the timer run on a CPU which does not service all runqueues,
+         * potentially leaving other CPUs indefinitely throttled.  If
+         * isolation is really required, the user will turn the throttle
+         * off to kill the perturbations it causes anyway.  Meanwhile,
+         * this maintains functionality for boot and/or troubleshooting.
+         */
+        if (rt_b == &root_task_group.rt_bandwidth)
+                span = cpu_online_mask;
+#endif
        for_each_cpu(i, span) {
                int enqueue = 0;
                struct rt_rq *rt_rq = sched_rt_period_rt_rq(rt_b, i);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index c35a1a7dd4d6..0848fa36c383 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -80,7 +80,7 @@ extern struct mutex sched_domains_mutex;
 struct cfs_rq;
 struct rt_rq;
-static LIST_HEAD(task_groups);
+extern struct list_head task_groups;
 struct cfs_bandwidth {
 #ifdef CONFIG_CFS_BANDWIDTH
@@ -374,7 +374,11 @@ struct rq {
 #ifdef CONFIG_FAIR_GROUP_SCHED
        /* list of leaf cfs_rq on this cpu: */
        struct list_head leaf_cfs_rq_list;
-#endif
+#ifdef CONFIG_SMP
+        unsigned long h_load_throttle;
+#endif /* CONFIG_SMP */
+#endif /* CONFIG_FAIR_GROUP_SCHED */
 #ifdef CONFIG_RT_GROUP_SCHED
        struct list_head leaf_rt_rq_list;
 #endif
@@ -1140,7 +1144,6 @@ extern void print_rt_stats(struct seq_file *m, int cpu);
 extern void init_cfs_rq(struct cfs_rq *cfs_rq);
 extern void init_rt_rq(struct rt_rq *rt_rq, struct rq *rq);
-extern void unthrottle_offline_cfs_rqs(struct rq *rq);
 extern void account_cfs_bandwidth_used(int enabled, int was_enabled);
diff --git a/kernel/sched/stop_task.c b/kernel/sched/stop_task.c
index 7b386e86fd23..da5eb5bed84a 100644
--- a/kernel/sched/stop_task.c
+++ b/kernel/sched/stop_task.c
@@ -27,8 +27,10 @@ static struct task_struct *pick_next_task_stop(struct rq *rq)
 {
        struct task_struct *stop = rq->stop;
-        if (stop && stop->on_rq)
+        if (stop && stop->on_rq) {
+                stop->se.exec_start = rq->clock_task;
                return stop;
+        }
        return NULL;
 }
@@ -52,6 +54,21 @@ static void yield_task_stop(struct rq *rq)
 static void put_prev_task_stop(struct rq *rq, struct task_struct *prev)
 {
+        struct task_struct *curr = rq->curr;
+        u64 delta_exec;
+        delta_exec = rq->clock_task - curr->se.exec_start;
+        if (unlikely((s64)delta_exec < 0))
+                delta_exec = 0;
+        schedstat_set(curr->se.statistics.exec_max,
+                        max(curr->se.statistics.exec_max, delta_exec));
+        curr->se.sum_exec_runtime += delta_exec;
+        account_group_exec_runtime(curr, delta_exec);
+        curr->se.exec_start = rq->clock_task;
+        cpuacct_charge(curr, delta_exec);
 }
 static void task_tick_stop(struct rq *rq, struct task_struct *curr, int queued)
@@ -60,6 +77,9 @@ static void task_tick_stop(struct rq *rq, struct task_struct *curr, int queued)
 static void set_curr_task_stop(struct rq *rq)
 {
+        struct task_struct *stop = rq->stop;
+        stop->se.exec_start = rq->clock_task;
 }
 static void switched_to_stop(struct rq *rq, struct task_struct *p)
diff --git a/kernel/task_work.c b/kernel/task_work.c
index 91d4e1742a0c..d320d44903bd 100644
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -75,6 +75,7 @@ void task_work_run(void)
                        p = q->next;
                        q->func(q);
                        q = p;
+                        cond_resched();
                }
        }
 }
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 024540f97f74..3a9e5d5c1091 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -573,6 +573,7 @@ static void tick_nohz_restart_sched_tick(struct tick_sched *ts, ktime_t now)
        tick_do_update_jiffies64(now);
        update_cpu_load_nohz();
+        calc_load_exit_idle();
        touch_softlockup_watchdog();
        /*
         * Cancel the scheduled timer and restore the tick
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index e16af197a2bc..34e5eac81424 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -115,6 +115,7 @@ static void tk_xtime_add(struct timekeeper *tk, const struct timespec *ts)
 {
        tk->xtime_sec += ts->tv_sec;
        tk->xtime_nsec += (u64)ts->tv_nsec << tk->shift;
+        tk_normalize_xtime(tk);
 }
 static void tk_set_wall_to_mono(struct timekeeper *tk, struct timespec wtm)
@@ -276,7 +277,7 @@ static void timekeeping_forward_now(struct timekeeper *tk)
        tk->xtime_nsec += cycle_delta * tk->mult;
        /* If arch requires, add in gettimeoffset() */
-        tk->xtime_nsec += arch_gettimeoffset() << tk->shift;
+        tk->xtime_nsec += (u64)arch_gettimeoffset() << tk->shift;
        tk_normalize_xtime(tk);
@@ -427,7 +428,7 @@ int do_settimeofday(const struct timespec *tv)
        struct timespec ts_delta, xt;
        unsigned long flags;
-        if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+        if (!timespec_valid_strict(tv))
                return -EINVAL;
        write_seqlock_irqsave(&tk->lock, flags);
@@ -463,6 +464,8 @@ int timekeeping_inject_offset(struct timespec *ts)
 {
        struct timekeeper *tk = &timekeeper;
        unsigned long flags;
+        struct timespec tmp;
+        int ret = 0;
        if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
                return -EINVAL;
@@ -471,10 +474,17 @@ int timekeeping_inject_offset(struct timespec *ts)
        timekeeping_forward_now(tk);
+        /* Make sure the proposed value is valid */
+        tmp = timespec_add(tk_xtime(tk),  *ts);
+        if (!timespec_valid_strict(&tmp)) {
+                ret = -EINVAL;
+                goto error;
+        }
        tk_xtime_add(tk, ts);
        tk_set_wall_to_mono(tk, timespec_sub(tk->wall_to_monotonic, *ts));
+error: /* even if we error out, we forwarded the time, so call update */
        timekeeping_update(tk, true);
        write_sequnlock_irqrestore(&tk->lock, flags);
@@ -482,7 +492,7 @@ int timekeeping_inject_offset(struct timespec *ts)
        /* signal hrtimers about time change */
        clock_was_set();
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(timekeeping_inject_offset);
@@ -649,7 +659,20 @@ void __init timekeeping_init(void)
        struct timespec now, boot, tmp;
        read_persistent_clock(&now);
+        if (!timespec_valid_strict(&now)) {
+                pr_warn("WARNING: Persistent clock returned invalid value!\n"
+                        "         Check your CMOS/BIOS settings.\n");
+                now.tv_sec = 0;
+                now.tv_nsec = 0;
+        }
        read_boot_clock(&boot);
+        if (!timespec_valid_strict(&boot)) {
+                pr_warn("WARNING: Boot clock returned invalid value!\n"
+                        "         Check your CMOS/BIOS settings.\n");
+                boot.tv_sec = 0;
+                boot.tv_nsec = 0;
+        }
        seqlock_init(&tk->lock);
@@ -690,7 +713,7 @@ static struct timespec timekeeping_suspend_time;
 static void __timekeeping_inject_sleeptime(struct timekeeper *tk,
                                                        struct timespec *delta)
 {
-        if (!timespec_valid(delta)) {
+        if (!timespec_valid_strict(delta)) {
                printk(KERN_WARNING "__timekeeping_inject_sleeptime: Invalid "
                                        "sleep delta value!\n");
                return;
@@ -1129,6 +1152,10 @@ static void update_wall_time(void)
        offset = (clock->read(clock) - clock->cycle_last) & clock->mask;
 #endif
+        /* Check if there's really nothing to do */
+        if (offset < tk->cycle_interval)
+                goto out;
        /*
         * With NO_HZ we may have to accumulate many cycle_intervals
         * (think "ticks") worth of time at once. To do this efficiently,
@@ -1161,9 +1188,9 @@ static void update_wall_time(void)
        * the vsyscall implementations are converted to use xtime_nsec
        * (shifted nanoseconds), this can be killed.
        */
-        remainder = tk->xtime_nsec & ((1 << tk->shift) - 1);
+        remainder = tk->xtime_nsec & ((1ULL << tk->shift) - 1);
        tk->xtime_nsec -= remainder;
-        tk->xtime_nsec += 1 << tk->shift;
+        tk->xtime_nsec += 1ULL << tk->shift;
        tk->ntp_error += remainder << tk->ntp_error_shift;
        /*
diff --git a/kernel/timer.c b/kernel/timer.c
index a61c09374eba..8c5e7b908c68 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1407,13 +1407,6 @@ SYSCALL_DEFINE1(alarm, unsigned int, seconds)
 #endif
-#ifndef __alpha__
-/*
- * The Alpha uses getxpid, getxuid, and getxgid instead.  Maybe this
- * should be moved into arch/i386 instead?
- */
 /**
 * sys_getpid - return the thread group id of the current process
 *
@@ -1469,8 +1462,6 @@ SYSCALL_DEFINE0(getegid)
        return from_kgid_munged(current_user_ns(), current_egid());
 }
-#endif
 static void process_timeout(unsigned long __data)
 {
        wake_up_process((struct task_struct *)__data);
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 60e4d7875672..6b245f64c8dd 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -506,6 +506,8 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
        int size;
        syscall_nr = syscall_get_nr(current, regs);
+        if (syscall_nr < 0)
+                return;
        if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
                return;
@@ -580,6 +582,8 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
        int size;
        syscall_nr = syscall_get_nr(current, regs);
+        if (syscall_nr < 0)
+                return;
        if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
                return;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 692d97628a10..1e1373bcb3e3 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -66,6 +66,7 @@ enum {
        /* pool flags */
        POOL_MANAGE_WORKERS     = 1 << 0,       /* need to manage workers */
+        POOL_MANAGING_WORKERS   = 1 << 1,       /* managing workers */
        /* worker flags */
        WORKER_STARTED          = 1 << 0,       /* started */
@@ -652,7 +653,7 @@ static bool need_to_manage_workers(struct worker_pool *pool)
 /* Do we have too many workers and should some go away? */
 static bool too_many_workers(struct worker_pool *pool)
 {
-        bool managing = mutex_is_locked(&pool->manager_mutex);
+        bool managing = pool->flags & POOL_MANAGING_WORKERS;
        int nr_idle = pool->nr_idle + managing; /* manager is considered idle */
        int nr_busy = pool->nr_workers - nr_idle;
@@ -1326,6 +1327,15 @@ static void idle_worker_rebind(struct worker *worker)
        /* we did our part, wait for rebind_workers() to finish up */
        wait_event(gcwq->rebind_hold, !(worker->flags & WORKER_REBIND));
+        /*
+         * rebind_workers() shouldn't finish until all workers passed the
+         * above WORKER_REBIND wait.  Tell it when done.
+         */
+        spin_lock_irq(&worker->pool->gcwq->lock);
+        if (!--worker->idle_rebind->cnt)
+                complete(&worker->idle_rebind->done);
+        spin_unlock_irq(&worker->pool->gcwq->lock);
 }
 /*
@@ -1396,12 +1406,15 @@ retry:
        /* set REBIND and kick idle ones, we'll wait for these later */
        for_each_worker_pool(pool, gcwq) {
                list_for_each_entry(worker, &pool->idle_list, entry) {
+                        unsigned long worker_flags = worker->flags;
                        if (worker->flags & WORKER_REBIND)
                                continue;
-                        /* morph UNBOUND to REBIND */
+                        /* morph UNBOUND to REBIND atomically */
-                        worker->flags &= ~WORKER_UNBOUND;
+                        worker_flags &= ~WORKER_UNBOUND;
-                        worker->flags |= WORKER_REBIND;
+                        worker_flags |= WORKER_REBIND;
+                        ACCESS_ONCE(worker->flags) = worker_flags;
                        idle_rebind.cnt++;
                        worker->idle_rebind = &idle_rebind;
@@ -1419,25 +1432,15 @@ retry:
                goto retry;
        }
-        /*
+        /* all idle workers are rebound, rebind busy workers */
-         * All idle workers are rebound and waiting for %WORKER_REBIND to
-         * be cleared inside idle_worker_rebind().  Clear and release.
-         * Clearing %WORKER_REBIND from this foreign context is safe
-         * because these workers are still guaranteed to be idle.
-         */
-        for_each_worker_pool(pool, gcwq)
-                list_for_each_entry(worker, &pool->idle_list, entry)
-                        worker->flags &= ~WORKER_REBIND;
-        wake_up_all(&gcwq->rebind_hold);
-        /* rebind busy workers */
        for_each_busy_worker(worker, i, pos, gcwq) {
                struct work_struct *rebind_work = &worker->rebind_work;
+                unsigned long worker_flags = worker->flags;
-                /* morph UNBOUND to REBIND */
+                /* morph UNBOUND to REBIND atomically */
-                worker->flags &= ~WORKER_UNBOUND;
+                worker_flags &= ~WORKER_UNBOUND;
-                worker->flags |= WORKER_REBIND;
+                worker_flags |= WORKER_REBIND;
+                ACCESS_ONCE(worker->flags) = worker_flags;
                if (test_and_set_bit(WORK_STRUCT_PENDING_BIT,
                                     work_data_bits(rebind_work)))
@@ -1449,6 +1452,34 @@ retry:
                            worker->scheduled.next,
                            work_color_to_flags(WORK_NO_COLOR));
        }
+        /*
+         * All idle workers are rebound and waiting for %WORKER_REBIND to
+         * be cleared inside idle_worker_rebind().  Clear and release.
+         * Clearing %WORKER_REBIND from this foreign context is safe
+         * because these workers are still guaranteed to be idle.
+         *
+         * We need to make sure all idle workers passed WORKER_REBIND wait
+         * in idle_worker_rebind() before returning; otherwise, workers can
+         * get stuck at the wait if hotplug cycle repeats.
+         */
+        idle_rebind.cnt = 1;
+        INIT_COMPLETION(idle_rebind.done);
+        for_each_worker_pool(pool, gcwq) {
+                list_for_each_entry(worker, &pool->idle_list, entry) {
+                        worker->flags &= ~WORKER_REBIND;
+                        idle_rebind.cnt++;
+                }
+        }
+        wake_up_all(&gcwq->rebind_hold);
+        if (--idle_rebind.cnt) {
+                spin_unlock_irq(&gcwq->lock);
+                wait_for_completion(&idle_rebind.done);
+                spin_lock_irq(&gcwq->lock);
+        }
 }
 static struct worker *alloc_worker(void)
@@ -1794,9 +1825,45 @@ static bool manage_workers(struct worker *worker)
        struct worker_pool *pool = worker->pool;
        bool ret = false;
-        if (!mutex_trylock(&pool->manager_mutex))
+        if (pool->flags & POOL_MANAGING_WORKERS)
                return ret;
+        pool->flags |= POOL_MANAGING_WORKERS;
+        /*
+         * To simplify both worker management and CPU hotplug, hold off
+         * management while hotplug is in progress.  CPU hotplug path can't
+         * grab %POOL_MANAGING_WORKERS to achieve this because that can
+         * lead to idle worker depletion (all become busy thinking someone
+         * else is managing) which in turn can result in deadlock under
+         * extreme circumstances.  Use @pool->manager_mutex to synchronize
+         * manager against CPU hotplug.
+         *
+         * manager_mutex would always be free unless CPU hotplug is in
+         * progress.  trylock first without dropping @gcwq->lock.
+         */
+        if (unlikely(!mutex_trylock(&pool->manager_mutex))) {
+                spin_unlock_irq(&pool->gcwq->lock);
+                mutex_lock(&pool->manager_mutex);
+                /*
+                 * CPU hotplug could have happened while we were waiting
+                 * for manager_mutex.  Hotplug itself can't handle us
+                 * because manager isn't either on idle or busy list, and
+                 * @gcwq's state and ours could have deviated.
+                 *
+                 * As hotplug is now excluded via manager_mutex, we can
+                 * simply try to bind.  It will succeed or fail depending
+                 * on @gcwq's current state.  Try it and adjust
+                 * %WORKER_UNBOUND accordingly.
+                 */
+                if (worker_maybe_bind_and_lock(worker))
+                        worker->flags &= ~WORKER_UNBOUND;
+                else
+                        worker->flags |= WORKER_UNBOUND;
+                ret = true;
+        }
        pool->flags &= ~POOL_MANAGE_WORKERS;
        /*
@@ -1806,6 +1873,7 @@ static bool manage_workers(struct worker *worker)
        ret |= maybe_destroy_workers(pool);
        ret |= maybe_create_worker(pool);
+        pool->flags &= ~POOL_MANAGING_WORKERS;
        mutex_unlock(&pool->manager_mutex);
        return ret;
 }
diff --git a/lib/digsig.c b/lib/digsig.c
index 286d558033e2..8c0e62975c88 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -163,9 +163,11 @@ static int digsig_verify_rsa(struct key *key,
        memcpy(out1 + head, p, l);
        err = pkcs_1_v1_5_decode_emsa(out1, len, mblen, out2, &len);
+        if (err)
+                goto err;
-        if (!err && len == hlen)
+        if (len != hlen || memcmp(out2, h, hlen))
-                err = memcmp(out2, h, hlen);
+                err = -EINVAL;
 err:
        mpi_free(in);
diff --git a/mm/compaction.c b/mm/compaction.c
index e78cb9688421..7fcd3a52e68d 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -51,6 +51,47 @@ static inline bool migrate_async_suitable(int migratetype)
 }
 /*
+ * Compaction requires the taking of some coarse locks that are potentially
+ * very heavily contended. Check if the process needs to be scheduled or
+ * if the lock is contended. For async compaction, back out in the event
+ * if contention is severe. For sync compaction, schedule.
+ *
+ * Returns true if the lock is held.
+ * Returns false if the lock is released and compaction should abort
+ */
+static bool compact_checklock_irqsave(spinlock_t *lock, unsigned long *flags,
+                                      bool locked, struct compact_control *cc)
+{
+        if (need_resched() || spin_is_contended(lock)) {
+                if (locked) {
+                        spin_unlock_irqrestore(lock, *flags);
+                        locked = false;
+                }
+                /* async aborts if taking too long or contended */
+                if (!cc->sync) {
+                        if (cc->contended)
+                                *cc->contended = true;
+                        return false;
+                }
+                cond_resched();
+                if (fatal_signal_pending(current))
+                        return false;
+        }
+        if (!locked)
+                spin_lock_irqsave(lock, *flags);
+        return true;
+}
+static inline bool compact_trylock_irqsave(spinlock_t *lock,
+                        unsigned long *flags, struct compact_control *cc)
+{
+        return compact_checklock_irqsave(lock, flags, false, cc);
+}
+/*
 * Isolate free pages onto a private freelist. Caller must hold zone->lock.
 * If @strict is true, will abort returning 0 on any invalid PFNs or non-free
 * pages inside of the pageblock (even though it may still end up isolating
@@ -173,7 +214,7 @@ isolate_freepages_range(unsigned long start_pfn, unsigned long end_pfn)
 }
 /* Update the number of anon and file isolated pages in the zone */
-static void acct_isolated(struct zone *zone, struct compact_control *cc)
+static void acct_isolated(struct zone *zone, bool locked, struct compact_control *cc)
 {
        struct page *page;
        unsigned int count[2] = { 0, };
@@ -181,8 +222,14 @@ static void acct_isolated(struct zone *zone, struct compact_control *cc)
        list_for_each_entry(page, &cc->migratepages, lru)
                count[!!page_is_file_cache(page)]++;
-        __mod_zone_page_state(zone, NR_ISOLATED_ANON, count[0]);
+        /* If locked we can use the interrupt unsafe versions */
-        __mod_zone_page_state(zone, NR_ISOLATED_FILE, count[1]);
+        if (locked) {
+                __mod_zone_page_state(zone, NR_ISOLATED_ANON, count[0]);
+                __mod_zone_page_state(zone, NR_ISOLATED_FILE, count[1]);
+        } else {
+                mod_zone_page_state(zone, NR_ISOLATED_ANON, count[0]);
+                mod_zone_page_state(zone, NR_ISOLATED_FILE, count[1]);
+        }
 }
 /* Similar to reclaim, but different enough that they don't share logic */
@@ -228,6 +275,8 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
        struct list_head *migratelist = &cc->migratepages;
        isolate_mode_t mode = 0;
        struct lruvec *lruvec;
+        unsigned long flags;
+        bool locked;
        /*
         * Ensure that there are not too many pages isolated from the LRU
@@ -247,25 +296,22 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
        /* Time to isolate some pages for migration */
        cond_resched();
-        spin_lock_irq(&zone->lru_lock);
+        spin_lock_irqsave(&zone->lru_lock, flags);
+        locked = true;
        for (; low_pfn < end_pfn; low_pfn++) {
                struct page *page;
-                bool locked = true;
                /* give a chance to irqs before checking need_resched() */
                if (!((low_pfn+1) % SWAP_CLUSTER_MAX)) {
-                        spin_unlock_irq(&zone->lru_lock);
+                        spin_unlock_irqrestore(&zone->lru_lock, flags);
                        locked = false;
                }
-                if (need_resched() || spin_is_contended(&zone->lru_lock)) {
-                        if (locked)
+                /* Check if it is ok to still hold the lock */
-                                spin_unlock_irq(&zone->lru_lock);
+                locked = compact_checklock_irqsave(&zone->lru_lock, &flags,
-                        cond_resched();
+                                                                locked, cc);
-                        spin_lock_irq(&zone->lru_lock);
+                if (!locked)
-                        if (fatal_signal_pending(current))
+                        break;
-                                break;
-                } else if (!locked)
-                        spin_lock_irq(&zone->lru_lock);
                /*
                 * migrate_pfn does not necessarily start aligned to a
@@ -349,9 +395,10 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                }
        }
-        acct_isolated(zone, cc);
+        acct_isolated(zone, locked, cc);
-        spin_unlock_irq(&zone->lru_lock);
+        if (locked)
+                spin_unlock_irqrestore(&zone->lru_lock, flags);
        trace_mm_compaction_isolate_migratepages(nr_scanned, nr_isolated);
@@ -384,6 +431,20 @@ static bool suitable_migration_target(struct page *page)
 }
 /*
+ * Returns the start pfn of the last page block in a zone.  This is the starting
+ * point for full compaction of a zone.  Compaction searches for free pages from
+ * the end of each zone, while isolate_freepages_block scans forward inside each
+ * page block.
+ */
+static unsigned long start_free_pfn(struct zone *zone)
+{
+        unsigned long free_pfn;
+        free_pfn = zone->zone_start_pfn + zone->spanned_pages;
+        free_pfn &= ~(pageblock_nr_pages-1);
+        return free_pfn;
+}
+/*
 * Based on information in the current compact_control, find blocks
 * suitable for isolating free pages from and then isolate them.
 */
@@ -422,17 +483,6 @@ static void isolate_freepages(struct zone *zone,
                                        pfn -= pageblock_nr_pages) {
                unsigned long isolated;
-                /*
-                 * Skip ahead if another thread is compacting in the area
-                 * simultaneously. If we wrapped around, we can only skip
-                 * ahead if zone->compact_cached_free_pfn also wrapped to
-                 * above our starting point.
-                 */
-                if (cc->order > 0 && (!cc->wrapped ||
-                                      zone->compact_cached_free_pfn >
-                                      cc->start_free_pfn))
-                        pfn = min(pfn, zone->compact_cached_free_pfn);
                if (!pfn_valid(pfn))
                        continue;
@@ -458,7 +508,16 @@ static void isolate_freepages(struct zone *zone,
                 * are disabled
                 */
                isolated = 0;
-                spin_lock_irqsave(&zone->lock, flags);
+                /*
+                 * The zone lock must be held to isolate freepages. This
+                 * unfortunately this is a very coarse lock and can be
+                 * heavily contended if there are parallel allocations
+                 * or parallel compactions. For async compaction do not
+                 * spin on the lock
+                 */
+                if (!compact_trylock_irqsave(&zone->lock, &flags, cc))
+                        break;
                if (suitable_migration_target(page)) {
                        end_pfn = min(pfn + pageblock_nr_pages, zone_end_pfn);
                        isolated = isolate_freepages_block(pfn, end_pfn,
@@ -474,7 +533,15 @@ static void isolate_freepages(struct zone *zone,
                 */
                if (isolated) {
                        high_pfn = max(high_pfn, pfn);
-                        if (cc->order > 0)
+                        /*
+                         * If the free scanner has wrapped, update
+                         * compact_cached_free_pfn to point to the highest
+                         * pageblock with free pages. This reduces excessive
+                         * scanning of full pageblocks near the end of the
+                         * zone
+                         */
+                        if (cc->order > 0 && cc->wrapped)
                                zone->compact_cached_free_pfn = high_pfn;
                }
        }
@@ -484,6 +551,11 @@ static void isolate_freepages(struct zone *zone,
        cc->free_pfn = high_pfn;
        cc->nr_freepages = nr_freepages;
+        /* If compact_cached_free_pfn is reset then set it now */
+        if (cc->order > 0 && !cc->wrapped &&
+                        zone->compact_cached_free_pfn == start_free_pfn(zone))
+                zone->compact_cached_free_pfn = high_pfn;
 }
 /*
@@ -570,20 +642,6 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
        return ISOLATE_SUCCESS;
 }
-/*
- * Returns the start pfn of the last page block in a zone.  This is the starting
- * point for full compaction of a zone.  Compaction searches for free pages from
- * the end of each zone, while isolate_freepages_block scans forward inside each
- * page block.
- */
-static unsigned long start_free_pfn(struct zone *zone)
-{
-        unsigned long free_pfn;
-        free_pfn = zone->zone_start_pfn + zone->spanned_pages;
-        free_pfn &= ~(pageblock_nr_pages-1);
-        return free_pfn;
-}
 static int compact_finished(struct zone *zone,
                            struct compact_control *cc)
 {
@@ -771,7 +829,7 @@ out:
 static unsigned long compact_zone_order(struct zone *zone,
                                 int order, gfp_t gfp_mask,
-                                 bool sync)
+                                 bool sync, bool *contended)
 {
        struct compact_control cc = {
                .nr_freepages = 0,
@@ -780,6 +838,7 @@ static unsigned long compact_zone_order(struct zone *zone,
                .migratetype = allocflags_to_migratetype(gfp_mask),
                .zone = zone,
                .sync = sync,
+                .contended = contended,
        };
        INIT_LIST_HEAD(&cc.freepages);
        INIT_LIST_HEAD(&cc.migratepages);
@@ -801,7 +860,7 @@ int sysctl_extfrag_threshold = 500;
 */
 unsigned long try_to_compact_pages(struct zonelist *zonelist,
                        int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        bool sync)
+                        bool sync, bool *contended)
 {
        enum zone_type high_zoneidx = gfp_zone(gfp_mask);
        int may_enter_fs = gfp_mask & __GFP_FS;
@@ -825,7 +884,8 @@ unsigned long try_to_compact_pages(struct zonelist *zonelist,
                                                                nodemask) {
                int status;
-                status = compact_zone_order(zone, order, gfp_mask, sync);
+                status = compact_zone_order(zone, order, gfp_mask, sync,
+                                                contended);
                rc = max(status, rc);
                /* If a normal allocation would succeed, stop compacting */
@@ -861,7 +921,7 @@ static int __compact_pgdat(pg_data_t *pgdat, struct compact_control *cc)
                if (cc->order > 0) {
                        int ok = zone_watermark_ok(zone, cc->order,
                                                low_wmark_pages(zone), 0, 0);
-                        if (ok && cc->order > zone->compact_order_failed)
+                        if (ok && cc->order >= zone->compact_order_failed)
                                zone->compact_order_failed = cc->order + 1;
                        /* Currently async compaction is never deferred. */
                        else if (!ok && cc->sync)
diff --git a/mm/filemap.c b/mm/filemap.c
index fa5ca304148e..384344575c37 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1412,12 +1412,8 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
                        retval = filemap_write_and_wait_range(mapping, pos,
                                        pos + iov_length(iov, nr_segs) - 1);
                        if (!retval) {
-                                struct blk_plug plug;
-                                blk_start_plug(&plug);
                                retval = mapping->a_ops->direct_IO(READ, iocb,
                                                        iov, pos, nr_segs);
-                                blk_finish_plug(&plug);
                        }
                        if (retval > 0) {
                                *ppos = pos + retval;
@@ -2527,14 +2523,12 @@ ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 {
        struct file *file = iocb->ki_filp;
        struct inode *inode = file->f_mapping->host;
-        struct blk_plug plug;
        ssize_t ret;
        BUG_ON(iocb->ki_pos != pos);
        sb_start_write(inode->i_sb);
        mutex_lock(&inode->i_mutex);
-        blk_start_plug(&plug);
        ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
        mutex_unlock(&inode->i_mutex);
@@ -2545,7 +2539,6 @@ ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                if (err < 0 && ret > 0)
                        ret = err;
        }
-        blk_finish_plug(&plug);
        sb_end_write(inode->i_sb);
        return ret;
 }
diff --git a/mm/internal.h b/mm/internal.h
index 3314f79d775a..b8c91b342e24 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -130,6 +130,7 @@ struct compact_control {
        int order;                      /* order a direct compactor needs */
        int migratetype;                /* MOVABLE, RECLAIMABLE etc */
        struct zone *zone;
+        bool *contended;                /* True if a lock was contended */
 };
 unsigned long
diff --git a/mm/memblock.c b/mm/memblock.c
index 4d9393c7edc9..82aa349d2f7a 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -246,7 +246,7 @@ static int __init_memblock memblock_double_array(struct memblock_type *type,
                                min(new_area_start, memblock.current_limit),
                                new_alloc_size, PAGE_SIZE);
-                new_array = addr ? __va(addr) : 0;
+                new_array = addr ? __va(addr) : NULL;
        }
        if (!addr) {
                pr_err("memblock: Failed to double %s array from %ld to %ld entries !\n",
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index bd92431d4c49..4ada3be6e252 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2562,7 +2562,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
                break;
        default:
-                BUG();
+                return -EINVAL;
        }
        l = strlen(policy_modes[mode]);
diff --git a/mm/mmap.c b/mm/mmap.c
index e3e86914f11a..ae18a48e7e4e 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1356,9 +1356,8 @@ out:
        } else if ((flags & MAP_POPULATE) && !(flags & MAP_NONBLOCK))
                make_pages_present(addr, addr + len);
-        if (file && uprobe_mmap(vma))
+        if (file)
-                /* matching probes but cannot insert */
+                uprobe_mmap(vma);
-                goto unmap_and_free_vma;
        return addr;
@@ -2309,7 +2308,7 @@ void exit_mmap(struct mm_struct *mm)
        }
        vm_unacct_memory(nr_accounted);
-        BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
+        WARN_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
 }
 /* Insert vm structure into process list sorted by address
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 009ac285fea7..c66fb875104a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1928,6 +1928,17 @@ this_zone_full:
                zlc_active = 0;
                goto zonelist_scan;
        }
+        if (page)
+                /*
+                 * page->pfmemalloc is set when ALLOC_NO_WATERMARKS was
+                 * necessary to allocate the page. The expectation is
+                 * that the caller is taking steps that will free more
+                 * memory. The caller should avoid the page being used
+                 * for !PFMEMALLOC purposes.
+                 */
+                page->pfmemalloc = !!(alloc_flags & ALLOC_NO_WATERMARKS);
        return page;
 }
@@ -2091,7 +2102,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
        struct zonelist *zonelist, enum zone_type high_zoneidx,
        nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
        int migratetype, bool sync_migration,
-        bool *deferred_compaction,
+        bool *contended_compaction, bool *deferred_compaction,
        unsigned long *did_some_progress)
 {
        struct page *page;
@@ -2106,7 +2117,8 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
        current->flags |= PF_MEMALLOC;
        *did_some_progress = try_to_compact_pages(zonelist, order, gfp_mask,
-                                                nodemask, sync_migration);
+                                                nodemask, sync_migration,
+                                                contended_compaction);
        current->flags &= ~PF_MEMALLOC;
        if (*did_some_progress != COMPACT_SKIPPED) {
@@ -2152,7 +2164,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
        struct zonelist *zonelist, enum zone_type high_zoneidx,
        nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone,
        int migratetype, bool sync_migration,
-        bool *deferred_compaction,
+        bool *contended_compaction, bool *deferred_compaction,
        unsigned long *did_some_progress)
 {
        return NULL;
@@ -2325,6 +2337,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
        unsigned long did_some_progress;
        bool sync_migration = false;
        bool deferred_compaction = false;
+        bool contended_compaction = false;
        /*
         * In the slowpath, we sanity check order to avoid ever trying to
@@ -2389,14 +2402,6 @@ rebalance:
                                zonelist, high_zoneidx, nodemask,
                                preferred_zone, migratetype);
                if (page) {
-                        /*
-                         * page->pfmemalloc is set when ALLOC_NO_WATERMARKS was
-                         * necessary to allocate the page. The expectation is
-                         * that the caller is taking steps that will free more
-                         * memory. The caller should avoid the page being used
-                         * for !PFMEMALLOC purposes.
-                         */
-                        page->pfmemalloc = true;
                        goto got_pg;
                }
        }
@@ -2422,6 +2427,7 @@ rebalance:
                                        nodemask,
                                        alloc_flags, preferred_zone,
                                        migratetype, sync_migration,
+                                        &contended_compaction,
                                        &deferred_compaction,
                                        &did_some_progress);
        if (page)
@@ -2431,10 +2437,11 @@ rebalance:
        /*
         * If compaction is deferred for high-order allocations, it is because
         * sync compaction recently failed. In this is the case and the caller
-         * has requested the system not be heavily disrupted, fail the
+         * requested a movable allocation that does not heavily disrupt the
-         * allocation now instead of entering direct reclaim
+         * system then fail the allocation instead of entering direct reclaim.
         */
-        if (deferred_compaction && (gfp_mask & __GFP_NO_KSWAPD))
+        if ((deferred_compaction || contended_compaction) &&
+                                                (gfp_mask & __GFP_NO_KSWAPD))
                goto nopage;
        /* Try direct reclaim and then allocating */
@@ -2505,6 +2512,7 @@ rebalance:
                                        nodemask,
                                        alloc_flags, preferred_zone,
                                        migratetype, sync_migration,
+                                        &contended_compaction,
                                        &deferred_compaction,
                                        &did_some_progress);
                if (page)
@@ -2569,8 +2577,6 @@ retry_cpuset:
                page = __alloc_pages_slowpath(gfp_mask, order,
                                zonelist, high_zoneidx, nodemask,
                                preferred_zone, migratetype);
-        else
-                page->pfmemalloc = false;
        trace_mm_page_alloc(page, order, gfp_mask, migratetype);
diff --git a/mm/slab.c b/mm/slab.c
index f8b0d539b482..811af03a14ef 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3260,6 +3260,7 @@ force_grow:
                /* cache_grow can reenable interrupts, then ac could change. */
                ac = cpu_cache_get(cachep);
+                node = numa_mem_id();
                /* no objects in sight? abort */
                if (!x && (ac->avail == 0 || force_refill))
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 73a2a83ee2da..402442402af7 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -137,9 +137,21 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
        return rc;
 }
+static inline netdev_tx_t vlan_netpoll_send_skb(struct vlan_dev_priv *vlan, struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (vlan->netpoll)
+                netpoll_send_skb(vlan->netpoll, skb);
+#else
+        BUG();
+#endif
+        return NETDEV_TX_OK;
+}
 static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
                                            struct net_device *dev)
 {
+        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
        struct vlan_ethhdr *veth = (struct vlan_ethhdr *)(skb->data);
        unsigned int len;
        int ret;
@@ -150,29 +162,30 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
         * OTHER THINGS LIKE FDDI/TokenRing/802.3 SNAPs...
         */
        if (veth->h_vlan_proto != htons(ETH_P_8021Q) ||
-            vlan_dev_priv(dev)->flags & VLAN_FLAG_REORDER_HDR) {
+            vlan->flags & VLAN_FLAG_REORDER_HDR) {
                u16 vlan_tci;
-                vlan_tci = vlan_dev_priv(dev)->vlan_id;
+                vlan_tci = vlan->vlan_id;
                vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
                skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
        }
-        skb->dev = vlan_dev_priv(dev)->real_dev;
+        skb->dev = vlan->real_dev;
        len = skb->len;
-        if (netpoll_tx_running(dev))
+        if (unlikely(netpoll_tx_running(dev)))
-                return skb->dev->netdev_ops->ndo_start_xmit(skb, skb->dev);
+                return vlan_netpoll_send_skb(vlan, skb);
        ret = dev_queue_xmit(skb);
        if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
                struct vlan_pcpu_stats *stats;
-                stats = this_cpu_ptr(vlan_dev_priv(dev)->vlan_pcpu_stats);
+                stats = this_cpu_ptr(vlan->vlan_pcpu_stats);
                u64_stats_update_begin(&stats->syncp);
                stats->tx_packets++;
                stats->tx_bytes += len;
                u64_stats_update_end(&stats->syncp);
        } else {
-                this_cpu_inc(vlan_dev_priv(dev)->vlan_pcpu_stats->tx_dropped);
+                this_cpu_inc(vlan->vlan_pcpu_stats->tx_dropped);
        }
        return ret;
@@ -669,25 +682,26 @@ static void vlan_dev_poll_controller(struct net_device *dev)
        return;
 }
-static int vlan_dev_netpoll_setup(struct net_device *dev, struct netpoll_info *npinfo)
+static int vlan_dev_netpoll_setup(struct net_device *dev, struct netpoll_info *npinfo,
+                                  gfp_t gfp)
 {
-        struct vlan_dev_priv *info = vlan_dev_priv(dev);
+        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
-        struct net_device *real_dev = info->real_dev;
+        struct net_device *real_dev = vlan->real_dev;
        struct netpoll *netpoll;
        int err = 0;
-        netpoll = kzalloc(sizeof(*netpoll), GFP_KERNEL);
+        netpoll = kzalloc(sizeof(*netpoll), gfp);
        err = -ENOMEM;
        if (!netpoll)
                goto out;
-        err = __netpoll_setup(netpoll, real_dev);
+        err = __netpoll_setup(netpoll, real_dev, gfp);
        if (err) {
                kfree(netpoll);
                goto out;
        }
-        info->netpoll = netpoll;
+        vlan->netpoll = netpoll;
 out:
        return err;
@@ -695,19 +709,15 @@ out:
 static void vlan_dev_netpoll_cleanup(struct net_device *dev)
 {
-        struct vlan_dev_priv *info = vlan_dev_priv(dev);
+        struct vlan_dev_priv *vlan= vlan_dev_priv(dev);
-        struct netpoll *netpoll = info->netpoll;
+        struct netpoll *netpoll = vlan->netpoll;
        if (!netpoll)
                return;
-        info->netpoll = NULL;
+        vlan->netpoll = NULL;
-        /* Wait for transmitting packets to finish before freeing. */
-        synchronize_rcu_bh();
-        __netpoll_cleanup(netpoll);
+        __netpoll_free_rcu(netpoll);
-        kfree(netpoll);
 }
 #endif /* CONFIG_NET_POLL_CONTROLLER */
diff --git a/net/atm/common.c b/net/atm/common.c
index b4b44dbed645..0c0ad930a632 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -812,6 +812,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
                if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
                        return -ENOTCONN;
+                memset(&pvc, 0, sizeof(pvc));
                pvc.sap_family = AF_ATMPVC;
                pvc.sap_addr.itf = vcc->dev->number;
                pvc.sap_addr.vpi = vcc->vpi;
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index 3a734919c36c..ae0324021407 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -95,6 +95,7 @@ static int pvc_getname(struct socket *sock, struct sockaddr *sockaddr,
                return -ENOTCONN;
        *sockaddr_len = sizeof(struct sockaddr_atmpvc);
        addr = (struct sockaddr_atmpvc *)sockaddr;
+        memset(addr, 0, sizeof(*addr));
        addr->sap_family = AF_ATMPVC;
        addr->sap_addr.itf = vcc->dev->number;
        addr->sap_addr.vpi = vcc->vpi;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5ad7da217474..3c094e78dde9 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -29,6 +29,7 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/a2mp.h>
+#include <net/bluetooth/smp.h>
 static void hci_le_connect(struct hci_conn *conn)
 {
@@ -619,6 +620,9 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
        BT_DBG("hcon %p", conn);
+        if (conn->type == LE_LINK)
+                return smp_conn_security(conn, sec_level);
        /* For sdp we don't need the link key. */
        if (sec_level == BT_SECURITY_SDP)
                return 1;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 41ff978a33f9..715d7e33fba0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1365,6 +1365,9 @@ static bool hci_resolve_next_name(struct hci_dev *hdev)
                return false;
        e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
+        if (!e)
+                return false;
        if (hci_resolve_name(hdev, e) == 0) {
                e->name_state = NAME_PENDING;
                return true;
@@ -1393,12 +1396,20 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
                return;
        e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
-        if (e) {
+        /* If the device was not found in a list of found devices names of which
+         * are pending. there is no need to continue resolving a next name as it
+         * will be done upon receiving another Remote Name Request Complete
+         * Event */
+        if (!e)
+                return;
+        list_del(&e->list);
+        if (name) {
                e->name_state = NAME_KNOWN;
-                list_del(&e->list);
+                mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
-                if (name)
+                                 e->data.rssi, name, name_len);
-                        mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
+        } else {
-                                         e->data.rssi, name, name_len);
+                e->name_state = NAME_NOT_KNOWN;
        }
        if (hci_resolve_next_name(hdev))
@@ -1762,7 +1773,12 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                if (conn->type == ACL_LINK) {
                        conn->state = BT_CONFIG;
                        hci_conn_hold(conn);
-                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                        if (!conn->out && !hci_conn_ssp_enabled(conn) &&
+                            !hci_find_link_key(hdev, &ev->bdaddr))
+                                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
+                        else
+                                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                } else
                        conn->state = BT_CONNECTED;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index a7f04de03d79..19fdac78e555 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -694,6 +694,7 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
        *addr_len = sizeof(*haddr);
        haddr->hci_family = AF_BLUETOOTH;
        haddr->hci_dev    = hdev->id;
+        haddr->hci_channel= 0;
        release_sock(sk);
        return 0;
@@ -1009,6 +1010,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
                {
                        struct hci_filter *f = &hci_pi(sk)->filter;
+                        memset(&uf, 0, sizeof(uf));
                        uf.type_mask = f->type_mask;
                        uf.opcode    = f->opcode;
                        uf.event_mask[0] = *((u32 *) f->event_mask + 0);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a8964db04bfb..4ea1710a4783 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1181,6 +1181,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
        sk = chan->sk;
        hci_conn_hold(conn->hcon);
+        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
        bacpy(&bt_sk(sk)->src, conn->src);
        bacpy(&bt_sk(sk)->dst, conn->dst);
@@ -1198,14 +1199,15 @@ clean:
 static void l2cap_conn_ready(struct l2cap_conn *conn)
 {
        struct l2cap_chan *chan;
+        struct hci_conn *hcon = conn->hcon;
        BT_DBG("conn %p", conn);
-        if (!conn->hcon->out && conn->hcon->type == LE_LINK)
+        if (!hcon->out && hcon->type == LE_LINK)
                l2cap_le_conn_ready(conn);
-        if (conn->hcon->out && conn->hcon->type == LE_LINK)
+        if (hcon->out && hcon->type == LE_LINK)
-                smp_conn_security(conn, conn->hcon->pending_sec_level);
+                smp_conn_security(hcon, hcon->pending_sec_level);
        mutex_lock(&conn->chan_lock);
@@ -1218,8 +1220,8 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
                        continue;
                }
-                if (conn->hcon->type == LE_LINK) {
+                if (hcon->type == LE_LINK) {
-                        if (smp_conn_security(conn, chan->sec_level))
+                        if (smp_conn_security(hcon, chan->sec_level))
                                l2cap_chan_ready(chan);
                } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index a4bb27e8427e..34bbe1c5e389 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -245,6 +245,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
        BT_DBG("sock %p, sk %p", sock, sk);
+        memset(la, 0, sizeof(struct sockaddr_l2));
        addr->sa_family = AF_BLUETOOTH;
        *len = sizeof(struct sockaddr_l2);
@@ -615,7 +616,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                                break;
                        }
-                        if (smp_conn_security(conn, sec.level))
+                        if (smp_conn_security(conn->hcon, sec.level))
                                break;
                        sk->sk_state = BT_CONFIG;
                        chan->state = BT_CONFIG;
@@ -1174,7 +1175,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
        chan = l2cap_chan_create();
        if (!chan) {
-                l2cap_sock_kill(sk);
+                sk_free(sk);
                return NULL;
        }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7e1e59645c05..1a17850d093c 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -528,6 +528,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
        BT_DBG("sock %p, sk %p", sock, sk);
+        memset(sa, 0, sizeof(*sa));
        sa->rc_family  = AF_BLUETOOTH;
        sa->rc_channel = rfcomm_pi(sk)->channel;
        if (peer)
@@ -822,6 +823,7 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
                }
                sec.level = rfcomm_pi(sk)->sec_level;
+                sec.key_size = 0;
                len = min_t(unsigned int, len, sizeof(sec));
                if (copy_to_user(optval, (char *) &sec, len))
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index cb960773c002..56f182393c4c 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -456,7 +456,7 @@ static int rfcomm_get_dev_list(void __user *arg)
        size = sizeof(*dl) + dev_num * sizeof(*di);
-        dl = kmalloc(size, GFP_KERNEL);
+        dl = kzalloc(size, GFP_KERNEL);
        if (!dl)
                return -ENOMEM;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 40bbe25dcff7..3589e21edb09 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -131,6 +131,15 @@ static int sco_conn_del(struct hci_conn *hcon, int err)
                sco_sock_clear_timer(sk);
                sco_chan_del(sk, err);
                bh_unlock_sock(sk);
+                sco_conn_lock(conn);
+                conn->sk = NULL;
+                sco_pi(sk)->conn = NULL;
+                sco_conn_unlock(conn);
+                if (conn->hcon)
+                        hci_conn_put(conn->hcon);
                sco_sock_kill(sk);
        }
@@ -821,16 +830,6 @@ static void sco_chan_del(struct sock *sk, int err)
        BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
-        if (conn) {
-                sco_conn_lock(conn);
-                conn->sk = NULL;
-                sco_pi(sk)->conn = NULL;
-                sco_conn_unlock(conn);
-                if (conn->hcon)
-                        hci_conn_put(conn->hcon);
-        }
        sk->sk_state = BT_CLOSED;
        sk->sk_err   = err;
        sk->sk_state_change(sk);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 16ef0dc85a0a..8c225ef349cd 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -267,10 +267,10 @@ static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
        mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
                         hcon->dst_type, reason);
-        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
+        cancel_delayed_work_sync(&conn->security_timer);
-                cancel_delayed_work_sync(&conn->security_timer);
+        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
                smp_chan_destroy(conn);
-        }
 }
 #define JUST_WORKS      0x00
@@ -579,8 +579,11 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
        if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
                smp = smp_chan_create(conn);
+        else
+                smp = conn->smp_chan;
-        smp = conn->smp_chan;
+        if (!smp)
+                return SMP_UNSPECIFIED;
        smp->preq[0] = SMP_CMD_PAIRING_REQ;
        memcpy(&smp->preq[1], req, sizeof(*req));
@@ -757,9 +760,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
        return 0;
 }
-int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 {
-        struct hci_conn *hcon = conn->hcon;
+        struct l2cap_conn *conn = hcon->l2cap_data;
        struct smp_chan *smp = conn->smp_chan;
        __u8 authreq;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 333484537600..070e8a68cfc6 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -31,9 +31,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
        struct net_bridge_mdb_entry *mdst;
        struct br_cpu_netstats *brstats = this_cpu_ptr(br->stats);
+        rcu_read_lock();
 #ifdef CONFIG_BRIDGE_NETFILTER
        if (skb->nf_bridge && (skb->nf_bridge->mask & BRNF_BRIDGED_DNAT)) {
                br_nf_pre_routing_finish_bridge_slow(skb);
+                rcu_read_unlock();
                return NETDEV_TX_OK;
        }
 #endif
@@ -48,7 +50,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
        skb_reset_mac_header(skb);
        skb_pull(skb, ETH_HLEN);
-        rcu_read_lock();
        if (is_broadcast_ether_addr(dest))
                br_flood_deliver(br, skb);
        else if (is_multicast_ether_addr(dest)) {
@@ -206,24 +207,23 @@ static void br_poll_controller(struct net_device *br_dev)
 static void br_netpoll_cleanup(struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
-        struct net_bridge_port *p, *n;
+        struct net_bridge_port *p;
-        list_for_each_entry_safe(p, n, &br->port_list, list) {
+        list_for_each_entry(p, &br->port_list, list)
                br_netpoll_disable(p);
-        }
 }
-static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni)
+static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
+                            gfp_t gfp)
 {
        struct net_bridge *br = netdev_priv(dev);
-        struct net_bridge_port *p, *n;
+        struct net_bridge_port *p;
        int err = 0;
-        list_for_each_entry_safe(p, n, &br->port_list, list) {
+        list_for_each_entry(p, &br->port_list, list) {
                if (!p->dev)
                        continue;
+                err = br_netpoll_enable(p, gfp);
-                err = br_netpoll_enable(p);
                if (err)
                        goto fail;
        }
@@ -236,17 +236,17 @@ fail:
        goto out;
 }
-int br_netpoll_enable(struct net_bridge_port *p)
+int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
 {
        struct netpoll *np;
        int err = 0;
-        np = kzalloc(sizeof(*p->np), GFP_KERNEL);
+        np = kzalloc(sizeof(*p->np), gfp);
        err = -ENOMEM;
        if (!np)
                goto out;
-        err = __netpoll_setup(np, p->dev);
+        err = __netpoll_setup(np, p->dev, gfp);
        if (err) {
                kfree(np);
                goto out;
@@ -267,11 +267,7 @@ void br_netpoll_disable(struct net_bridge_port *p)
        p->np = NULL;
-        /* Wait for transmitting packets to finish before freeing. */
+        __netpoll_free_rcu(np);
-        synchronize_rcu_bh();
-        __netpoll_cleanup(np);
-        kfree(np);
 }
 #endif
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index e9466d412707..02015a505d2a 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -65,7 +65,7 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
        skb->dev = to->dev;
-        if (unlikely(netpoll_tx_running(to->dev))) {
+        if (unlikely(netpoll_tx_running(to->br->dev))) {
                if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
                        kfree_skb(skb);
                else {
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index e1144e1617be..1c8fdc3558cd 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -361,7 +361,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        if (err)
                goto err2;
-        if (br_netpoll_info(br) && ((err = br_netpoll_enable(p))))
+        if (br_netpoll_info(br) && ((err = br_netpoll_enable(p, GFP_KERNEL))))
                goto err3;
        err = netdev_set_master(dev, br->dev);
@@ -427,6 +427,10 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
        if (!p || p->br != br)
                return -EINVAL;
+        /* Since more than one interface can be attached to a bridge,
+         * there still maybe an alternate path for netconsole to use;
+         * therefore there is no reason for a NETDEV_RELEASE event.
+         */
        del_nbp(p);
        spin_lock_bh(&br->lock);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index a768b2408edf..f507d2af9646 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -316,7 +316,7 @@ static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
                netpoll_send_skb(np, skb);
 }
-extern int br_netpoll_enable(struct net_bridge_port *p);
+extern int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp);
 extern void br_netpoll_disable(struct net_bridge_port *p);
 #else
 static inline struct netpoll_info *br_netpoll_info(struct net_bridge *br)
@@ -329,7 +329,7 @@ static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
 {
 }
-static inline int br_netpoll_enable(struct net_bridge_port *p)
+static inline int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
 {
        return 0;
 }
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index f88ee537fb2b..92de5e5f9db2 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -80,7 +80,7 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum,
        unsigned int bitmask;
        spin_lock_bh(&ebt_log_lock);
-        printk("<%c>%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x",
+        printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x",
               '0' + loginfo->u.log.level, prefix,
               in ? in->name : "", out ? out->name : "",
               eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index dd485f6128e8..ba217e90765e 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -211,9 +211,10 @@ void caif_client_register_refcnt(struct cflayer *adapt_layer,
                                        void (*put)(struct cflayer *lyr))
 {
        struct cfsrvl *service;
-        service = container_of(adapt_layer->dn, struct cfsrvl, layer);
-        WARN_ON(adapt_layer == NULL || adapt_layer->dn == NULL);
+        if (WARN_ON(adapt_layer == NULL || adapt_layer->dn == NULL))
+                return;
+        service = container_of(adapt_layer->dn, struct cfsrvl, layer);
        service->hold = hold;
        service->put = put;
 }
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 69771c04ba8f..e597733affb8 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -94,6 +94,10 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
        /* check the version of IP */
        ip_version = skb_header_pointer(skb, 0, 1, &buf);
+        if (!ip_version) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
        switch (*ip_version >> 4) {
        case 4:
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 69e38db28e5f..a8020293f342 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -84,7 +84,6 @@ int ceph_check_fsid(struct ceph_client *client, struct ceph_fsid *fsid)
                        return -1;
                }
        } else {
-                pr_info("client%lld fsid %pU\n", ceph_client_id(client), fsid);
                memcpy(&client->fsid, fsid, sizeof(*fsid));
        }
        return 0;
diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
index 54b531a01121..38b5dc1823d4 100644
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -189,6 +189,9 @@ int ceph_debugfs_client_init(struct ceph_client *client)
        snprintf(name, sizeof(name), "%pU.client%lld", &client->fsid,
                 client->monc.auth->global_id);
+        dout("ceph_debugfs_client_init %p %s\n", client, name);
+        BUG_ON(client->debugfs_dir);
        client->debugfs_dir = debugfs_create_dir(name, ceph_debugfs_dir);
        if (!client->debugfs_dir)
                goto out;
@@ -234,6 +237,7 @@ out:
 void ceph_debugfs_client_cleanup(struct ceph_client *client)
 {
+        dout("ceph_debugfs_client_cleanup %p\n", client);
        debugfs_remove(client->debugfs_osdmap);
        debugfs_remove(client->debugfs_monmap);
        debugfs_remove(client->osdc.debugfs_file);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index b9796750034a..24c5eea8c45b 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -915,7 +915,6 @@ static int prepare_write_connect(struct ceph_connection *con)
        con->out_connect.authorizer_len = auth ?
                cpu_to_le32(auth->authorizer_buf_len) : 0;
-        con_out_kvec_reset(con);
        con_out_kvec_add(con, sizeof (con->out_connect),
                                        &con->out_connect);
        if (auth && auth->authorizer_buf_len)
@@ -1557,6 +1556,7 @@ static int process_connect(struct ceph_connection *con)
                        return -1;
                }
                con->auth_retry = 1;
+                con_out_kvec_reset(con);
                ret = prepare_write_connect(con);
                if (ret < 0)
                        return ret;
@@ -1577,6 +1577,7 @@ static int process_connect(struct ceph_connection *con)
                       ENTITY_NAME(con->peer_name),
                       ceph_pr_addr(&con->peer_addr.in_addr));
                reset_connection(con);
+                con_out_kvec_reset(con);
                ret = prepare_write_connect(con);
                if (ret < 0)
                        return ret;
@@ -1601,6 +1602,7 @@ static int process_connect(struct ceph_connection *con)
                     le32_to_cpu(con->out_connect.connect_seq),
                     le32_to_cpu(con->in_reply.connect_seq));
                con->connect_seq = le32_to_cpu(con->in_reply.connect_seq);
+                con_out_kvec_reset(con);
                ret = prepare_write_connect(con);
                if (ret < 0)
                        return ret;
@@ -1617,6 +1619,7 @@ static int process_connect(struct ceph_connection *con)
                     le32_to_cpu(con->in_reply.global_seq));
                get_global_seq(con->msgr,
                               le32_to_cpu(con->in_reply.global_seq));
+                con_out_kvec_reset(con);
                ret = prepare_write_connect(con);
                if (ret < 0)
                        return ret;
@@ -2135,7 +2138,11 @@ more:
                BUG_ON(con->state != CON_STATE_CONNECTING);
                con->state = CON_STATE_NEGOTIATING;
-                /* Banner is good, exchange connection info */
+                /*
+                 * Received banner is good, exchange connection info.
+                 * Do not reset out_kvec, as sending our banner raced
+                 * with receiving peer banner after connect completed.
+                 */
                ret = prepare_write_connect(con);
                if (ret < 0)
                        goto out;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 105d533b55f3..900ea0f043fc 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -311,6 +311,17 @@ int ceph_monc_open_session(struct ceph_mon_client *monc)
 EXPORT_SYMBOL(ceph_monc_open_session);
 /*
+ * We require the fsid and global_id in order to initialize our
+ * debugfs dir.
+ */
+static bool have_debugfs_info(struct ceph_mon_client *monc)
+{
+        dout("have_debugfs_info fsid %d globalid %lld\n",
+             (int)monc->client->have_fsid, monc->auth->global_id);
+        return monc->client->have_fsid && monc->auth->global_id > 0;
+}
+/*
 * The monitor responds with mount ack indicate mount success.  The
 * included client ticket allows the client to talk to MDSs and OSDs.
 */
@@ -320,9 +331,12 @@ static void ceph_monc_handle_map(struct ceph_mon_client *monc,
        struct ceph_client *client = monc->client;
        struct ceph_monmap *monmap = NULL, *old = monc->monmap;
        void *p, *end;
+        int had_debugfs_info, init_debugfs = 0;
        mutex_lock(&monc->mutex);
+        had_debugfs_info = have_debugfs_info(monc);
        dout("handle_monmap\n");
        p = msg->front.iov_base;
        end = p + msg->front.iov_len;
@@ -344,12 +358,22 @@ static void ceph_monc_handle_map(struct ceph_mon_client *monc,
        if (!client->have_fsid) {
                client->have_fsid = true;
+                if (!had_debugfs_info && have_debugfs_info(monc)) {
+                        pr_info("client%lld fsid %pU\n",
+                                ceph_client_id(monc->client),
+                                &monc->client->fsid);
+                        init_debugfs = 1;
+                }
                mutex_unlock(&monc->mutex);
-                /*
-                 * do debugfs initialization without mutex to avoid
+                if (init_debugfs) {
-                 * creating a locking dependency
+                        /*
-                 */
+                         * do debugfs initialization without mutex to avoid
-                ceph_debugfs_client_init(client);
+                         * creating a locking dependency
+                         */
+                        ceph_debugfs_client_init(monc->client);
+                }
                goto out_unlocked;
        }
 out:
@@ -865,8 +889,10 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
 {
        int ret;
        int was_auth = 0;
+        int had_debugfs_info, init_debugfs = 0;
        mutex_lock(&monc->mutex);
+        had_debugfs_info = have_debugfs_info(monc);
        if (monc->auth->ops)
                was_auth = monc->auth->ops->is_authenticated(monc->auth);
        monc->pending_auth = 0;
@@ -889,7 +915,22 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
                __send_subscribe(monc);
                __resend_generic_request(monc);
        }
+        if (!had_debugfs_info && have_debugfs_info(monc)) {
+                pr_info("client%lld fsid %pU\n",
+                        ceph_client_id(monc->client),
+                        &monc->client->fsid);
+                init_debugfs = 1;
+        }
        mutex_unlock(&monc->mutex);
+        if (init_debugfs) {
+                /*
+                 * do debugfs initialization without mutex to avoid
+                 * creating a locking dependency
+                 */
+                ceph_debugfs_client_init(monc->client);
+        }
 }
 static int __validate_auth(struct ceph_mon_client *monc)
diff --git a/net/core/dev.c b/net/core/dev.c
index a39354ee1432..d7fe32c946c1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1642,6 +1642,19 @@ static inline int deliver_skb(struct sk_buff *skb,
        return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
 }
+static inline bool skb_loop_sk(struct packet_type *ptype, struct sk_buff *skb)
+{
+        if (ptype->af_packet_priv == NULL)
+                return false;
+        if (ptype->id_match)
+                return ptype->id_match(ptype, skb->sk);
+        else if ((struct sock *)ptype->af_packet_priv == skb->sk)
+                return true;
+        return false;
+}
 /*
 *      Support routine. Sends outgoing frames to any network
 *      taps currently in use.
@@ -1659,8 +1672,7 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
                 * they originated from - MvS (miquels@drinkel.ow.org)
                 */
                if ((ptype->dev == dev || !ptype->dev) &&
-                    (ptype->af_packet_priv == NULL ||
+                    (!skb_loop_sk(ptype, skb))) {
-                     (struct sock *)ptype->af_packet_priv != skb->sk)) {
                        if (pt_prev) {
                                deliver_skb(skb2, pt_prev, skb->dev);
                                pt_prev = ptype;
@@ -2635,15 +2647,16 @@ void __skb_get_rxhash(struct sk_buff *skb)
        if (!skb_flow_dissect(skb, &keys))
                return;
-        if (keys.ports) {
+        if (keys.ports)
-                if ((__force u16)keys.port16[1] < (__force u16)keys.port16[0])
-                        swap(keys.port16[0], keys.port16[1]);
                skb->l4_rxhash = 1;
-        }
        /* get a consistent hash (same value on both flow directions) */
-        if ((__force u32)keys.dst < (__force u32)keys.src)
+        if (((__force u32)keys.dst < (__force u32)keys.src) ||
+            (((__force u32)keys.dst == (__force u32)keys.src) &&
+             ((__force u16)keys.port16[1] < (__force u16)keys.port16[0]))) {
                swap(keys.dst, keys.src);
+                swap(keys.port16[0], keys.port16[1]);
+        }
        hash = jhash_3words((__force u32)keys.dst,
                            (__force u32)keys.src,
@@ -5732,6 +5745,7 @@ EXPORT_SYMBOL(netdev_refcnt_read);
 /**
 * netdev_wait_allrefs - wait until all references are gone.
+ * @dev: target net_device
 *
 * This is called when unregistering network devices.
 *
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index b4c90e42b443..e4ba3e70c174 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -26,6 +26,7 @@
 #include <linux/workqueue.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/if_vlan.h>
 #include <net/tcp.h>
 #include <net/udp.h>
 #include <asm/unaligned.h>
@@ -54,7 +55,7 @@ static atomic_t trapped;
         MAX_UDP_CHUNK)
 static void zap_completion_queue(void);
-static void arp_reply(struct sk_buff *skb);
+static void netpoll_arp_reply(struct sk_buff *skb, struct netpoll_info *npinfo);
 static unsigned int carrier_timeout = 4;
 module_param(carrier_timeout, uint, 0644);
@@ -170,7 +171,8 @@ static void poll_napi(struct net_device *dev)
        list_for_each_entry(napi, &dev->napi_list, dev_list) {
                if (napi->poll_owner != smp_processor_id() &&
                    spin_trylock(&napi->poll_lock)) {
-                        budget = poll_one_napi(dev->npinfo, napi, budget);
+                        budget = poll_one_napi(rcu_dereference_bh(dev->npinfo),
+                                               napi, budget);
                        spin_unlock(&napi->poll_lock);
                        if (!budget)
@@ -185,13 +187,14 @@ static void service_arp_queue(struct netpoll_info *npi)
                struct sk_buff *skb;
                while ((skb = skb_dequeue(&npi->arp_tx)))
-                        arp_reply(skb);
+                        netpoll_arp_reply(skb, npi);
        }
 }
 static void netpoll_poll_dev(struct net_device *dev)
 {
        const struct net_device_ops *ops;
+        struct netpoll_info *ni = rcu_dereference_bh(dev->npinfo);
        if (!dev || !netif_running(dev))
                return;
@@ -206,17 +209,18 @@ static void netpoll_poll_dev(struct net_device *dev)
        poll_napi(dev);
        if (dev->flags & IFF_SLAVE) {
-                if (dev->npinfo) {
+                if (ni) {
                        struct net_device *bond_dev = dev->master;
                        struct sk_buff *skb;
-                        while ((skb = skb_dequeue(&dev->npinfo->arp_tx))) {
+                        struct netpoll_info *bond_ni = rcu_dereference_bh(bond_dev->npinfo);
+                        while ((skb = skb_dequeue(&ni->arp_tx))) {
                                skb->dev = bond_dev;
-                                skb_queue_tail(&bond_dev->npinfo->arp_tx, skb);
+                                skb_queue_tail(&bond_ni->arp_tx, skb);
                        }
                }
        }
-        service_arp_queue(dev->npinfo);
+        service_arp_queue(ni);
        zap_completion_queue();
 }
@@ -302,6 +306,7 @@ static int netpoll_owner_active(struct net_device *dev)
        return 0;
 }
+/* call with IRQ disabled */
 void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                             struct net_device *dev)
 {
@@ -309,8 +314,11 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
        unsigned long tries;
        const struct net_device_ops *ops = dev->netdev_ops;
        /* It is up to the caller to keep npinfo alive. */
-        struct netpoll_info *npinfo = np->dev->npinfo;
+        struct netpoll_info *npinfo;
+        WARN_ON_ONCE(!irqs_disabled());
+        npinfo = rcu_dereference_bh(np->dev->npinfo);
        if (!npinfo || !netif_running(dev) || !netif_device_present(dev)) {
                __kfree_skb(skb);
                return;
@@ -319,16 +327,22 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
        /* don't get messages out of order, and no recursion */
        if (skb_queue_len(&npinfo->txq) == 0 && !netpoll_owner_active(dev)) {
                struct netdev_queue *txq;
-                unsigned long flags;
                txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
-                local_irq_save(flags);
                /* try until next clock tick */
                for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
                     tries > 0; --tries) {
                        if (__netif_tx_trylock(txq)) {
                                if (!netif_xmit_stopped(txq)) {
+                                        if (vlan_tx_tag_present(skb) &&
+                                            !(netif_skb_features(skb) & NETIF_F_HW_VLAN_TX)) {
+                                                skb = __vlan_put_tag(skb, vlan_tx_tag_get(skb));
+                                                if (unlikely(!skb))
+                                                        break;
+                                                skb->vlan_tci = 0;
+                                        }
                                        status = ops->ndo_start_xmit(skb, dev);
                                        if (status == NETDEV_TX_OK)
                                                txq_trans_update(txq);
@@ -347,10 +361,9 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                }
                WARN_ONCE(!irqs_disabled(),
-                        "netpoll_send_skb(): %s enabled interrupts in poll (%pF)\n",
+                        "netpoll_send_skb_on_dev(): %s enabled interrupts in poll (%pF)\n",
                        dev->name, ops->ndo_start_xmit);
-                local_irq_restore(flags);
        }
        if (status != NETDEV_TX_OK) {
@@ -423,9 +436,8 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
 }
 EXPORT_SYMBOL(netpoll_send_udp);
-static void arp_reply(struct sk_buff *skb)
+static void netpoll_arp_reply(struct sk_buff *skb, struct netpoll_info *npinfo)
 {
-        struct netpoll_info *npinfo = skb->dev->npinfo;
        struct arphdr *arp;
        unsigned char *arp_ptr;
        int size, type = ARPOP_REPLY, ptype = ETH_P_ARP;
@@ -543,13 +555,12 @@ static void arp_reply(struct sk_buff *skb)
        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 }
-int __netpoll_rx(struct sk_buff *skb)
+int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
 {
        int proto, len, ulen;
        int hits = 0;
        const struct iphdr *iph;
        struct udphdr *uh;
-        struct netpoll_info *npinfo = skb->dev->npinfo;
        struct netpoll *np, *tmp;
        if (list_empty(&npinfo->rx_np))
@@ -565,6 +576,12 @@ int __netpoll_rx(struct sk_buff *skb)
                return 1;
        }
+        if (skb->protocol == cpu_to_be16(ETH_P_8021Q)) {
+                skb = vlan_untag(skb);
+                if (unlikely(!skb))
+                        goto out;
+        }
        proto = ntohs(eth_hdr(skb)->h_proto);
        if (proto != ETH_P_IP)
                goto out;
@@ -715,7 +732,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
 }
 EXPORT_SYMBOL(netpoll_parse_options);
-int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
+int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
 {
        struct netpoll_info *npinfo;
        const struct net_device_ops *ops;
@@ -734,7 +751,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
        }
        if (!ndev->npinfo) {
-                npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
+                npinfo = kmalloc(sizeof(*npinfo), gfp);
                if (!npinfo) {
                        err = -ENOMEM;
                        goto out;
@@ -752,7 +769,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
                ops = np->dev->netdev_ops;
                if (ops->ndo_netpoll_setup) {
-                        err = ops->ndo_netpoll_setup(ndev, npinfo);
+                        err = ops->ndo_netpoll_setup(ndev, npinfo, gfp);
                        if (err)
                                goto free_npinfo;
                }
@@ -857,7 +874,7 @@ int netpoll_setup(struct netpoll *np)
        refill_skbs();
        rtnl_lock();
-        err = __netpoll_setup(np, ndev);
+        err = __netpoll_setup(np, ndev, GFP_KERNEL);
        rtnl_unlock();
        if (err)
@@ -878,6 +895,24 @@ static int __init netpoll_init(void)
 }
 core_initcall(netpoll_init);
+static void rcu_cleanup_netpoll_info(struct rcu_head *rcu_head)
+{
+        struct netpoll_info *npinfo =
+                        container_of(rcu_head, struct netpoll_info, rcu);
+        skb_queue_purge(&npinfo->arp_tx);
+        skb_queue_purge(&npinfo->txq);
+        /* we can't call cancel_delayed_work_sync here, as we are in softirq */
+        cancel_delayed_work(&npinfo->tx_work);
+        /* clean after last, unfinished work */
+        __skb_queue_purge(&npinfo->txq);
+        /* now cancel it again */
+        cancel_delayed_work(&npinfo->tx_work);
+        kfree(npinfo);
+}
 void __netpoll_cleanup(struct netpoll *np)
 {
        struct netpoll_info *npinfo;
@@ -903,20 +938,24 @@ void __netpoll_cleanup(struct netpoll *np)
                        ops->ndo_netpoll_cleanup(np->dev);
                RCU_INIT_POINTER(np->dev->npinfo, NULL);
+                call_rcu_bh(&npinfo->rcu, rcu_cleanup_netpoll_info);
+        }
+}
+EXPORT_SYMBOL_GPL(__netpoll_cleanup);
-                /* avoid racing with NAPI reading npinfo */
+static void rcu_cleanup_netpoll(struct rcu_head *rcu_head)
-                synchronize_rcu_bh();
+{
+        struct netpoll *np = container_of(rcu_head, struct netpoll, rcu);
-                skb_queue_purge(&npinfo->arp_tx);
+        __netpoll_cleanup(np);
-                skb_queue_purge(&npinfo->txq);
+        kfree(np);
-                cancel_delayed_work_sync(&npinfo->tx_work);
+}
-                /* clean after last, unfinished work */
+void __netpoll_free_rcu(struct netpoll *np)
-                __skb_queue_purge(&npinfo->txq);
+{
-                kfree(npinfo);
+        call_rcu_bh(&np->rcu, rcu_cleanup_netpoll);
-        }
 }
-EXPORT_SYMBOL_GPL(__netpoll_cleanup);
+EXPORT_SYMBOL_GPL(__netpoll_free_rcu);
 void netpoll_cleanup(struct netpoll *np)
 {
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index ed0c0431fcd8..c75e3f9d060f 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -101,12 +101,10 @@ static int write_update_netdev_table(struct net_device *dev)
        u32 max_len;
        struct netprio_map *map;
-        rtnl_lock();
        max_len = atomic_read(&max_prioidx) + 1;
        map = rtnl_dereference(dev->priomap);
        if (!map || map->priomap_len < max_len)
                ret = extend_netdev_table(dev, max_len);
-        rtnl_unlock();
        return ret;
 }
@@ -256,17 +254,17 @@ static int write_priomap(struct cgroup *cgrp, struct cftype *cft,
        if (!dev)
                goto out_free_devname;
+        rtnl_lock();
        ret = write_update_netdev_table(dev);
        if (ret < 0)
                goto out_put_dev;
-        rcu_read_lock();
+        map = rtnl_dereference(dev->priomap);
-        map = rcu_dereference(dev->priomap);
        if (map)
                map->priomap[prioidx] = priority;
-        rcu_read_unlock();
 out_put_dev:
+        rtnl_unlock();
        dev_put(dev);
 out_free_devname:
@@ -277,12 +275,6 @@ out_free_devname:
 void net_prio_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
 {
        struct task_struct *p;
-        char *tmp = kzalloc(sizeof(char) * PATH_MAX, GFP_KERNEL);
-        if (!tmp) {
-                pr_warn("Unable to attach cgrp due to alloc failure!\n");
-                return;
-        }
        cgroup_taskset_for_each(p, cgrp, tset) {
                unsigned int fd;
@@ -296,32 +288,24 @@ void net_prio_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
                        continue;
                }
-                rcu_read_lock();
+                spin_lock(&files->file_lock);
                fdt = files_fdtable(files);
                for (fd = 0; fd < fdt->max_fds; fd++) {
-                        char *path;
                        struct file *file;
                        struct socket *sock;
-                        unsigned long s;
+                        int err;
-                        int rv, err = 0;
                        file = fcheck_files(files, fd);
                        if (!file)
                                continue;
-                        path = d_path(&file->f_path, tmp, PAGE_SIZE);
-                        rv = sscanf(path, "socket:[%lu]", &s);
-                        if (rv <= 0)
-                                continue;
                        sock = sock_from_file(file, &err);
-                        if (!err)
+                        if (sock)
                                sock_update_netprioidx(sock->sk, p);
                }
-                rcu_read_unlock();
+                spin_unlock(&files->file_lock);
                task_unlock(p);
        }
-        kfree(tmp);
 }
 static struct cftype ss_files[] = {
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index cce9e53528b1..148e73d2c451 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2721,7 +2721,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
        /* Eth + IPh + UDPh + mpls */
        datalen = pkt_dev->cur_pkt_size - 14 - 20 - 8 -
                  pkt_dev->pkt_overhead;
-        if (datalen < sizeof(struct pktgen_hdr))
+        if (datalen < 0 || datalen < sizeof(struct pktgen_hdr))
                datalen = sizeof(struct pktgen_hdr);
        udph->source = htons(pkt_dev->cur_udp_src);
diff --git a/net/core/scm.c b/net/core/scm.c
index 8f6ccfd68ef4..040cebeed45b 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -265,6 +265,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
        for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
             i++, cmfptr++)
        {
+                struct socket *sock;
                int new_fd;
                err = security_file_receive(fp[i]);
                if (err)
@@ -281,6 +282,9 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
                }
                /* Bump the usage count and install the file. */
                get_file(fp[i]);
+                sock = sock_from_file(fp[i], &err);
+                if (sock)
+                        sock_update_netprioidx(sock->sk, current);
                fd_install(new_fd, fp[i]);
        }
diff --git a/net/core/sock.c b/net/core/sock.c
index 8f67ced8d6a8..305792076121 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1523,7 +1523,14 @@ EXPORT_SYMBOL(sock_rfree);
 void sock_edemux(struct sk_buff *skb)
 {
-        sock_put(skb->sk);
+        struct sock *sk = skb->sk;
+#ifdef CONFIG_INET
+        if (sk->sk_state == TCP_TIME_WAIT)
+                inet_twsk_put(inet_twsk(sk));
+        else
+#endif
+                sock_put(sk);
 }
 EXPORT_SYMBOL(sock_edemux);
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 75c3582a7678..fb85d371a8de 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
                                        u32 __user *optval, int __user *optlen)
 {
        int rc = -ENOPROTOOPT;
-        if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
+        if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
                rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
                                                 optval, optlen);
        return rc;
@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
                                        u32 __user *optval, int __user *optlen)
 {
        int rc = -ENOPROTOOPT;
-        if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
+        if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
                rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
                                                 optval, optlen);
        return rc;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index d65e98798eca..119c04317d48 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -535,6 +535,7 @@ static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
        case DCCP_SOCKOPT_CCID_TX_INFO:
                if (len < sizeof(tfrc))
                        return -EINVAL;
+                memset(&tfrc, 0, sizeof(tfrc));
                tfrc.tfrctx_x      = hc->tx_x;
                tfrc.tfrctx_x_recv = hc->tx_x_recv;
                tfrc.tfrctx_x_calc = hc->tx_x_calc;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index db0cf17c00f7..7f75f21d7b83 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -404,12 +404,15 @@ struct dst_entry *inet_csk_route_child_sock(struct sock *sk,
 {
        const struct inet_request_sock *ireq = inet_rsk(req);
        struct inet_sock *newinet = inet_sk(newsk);
-        struct ip_options_rcu *opt = ireq->opt;
+        struct ip_options_rcu *opt;
        struct net *net = sock_net(sk);
        struct flowi4 *fl4;
        struct rtable *rt;
        fl4 = &newinet->cork.fl.u.ip4;
+        rcu_read_lock();
+        opt = rcu_dereference(newinet->inet_opt);
        flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
                           RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
                           sk->sk_protocol, inet_sk_flowi_flags(sk),
@@ -421,11 +424,13 @@ struct dst_entry *inet_csk_route_child_sock(struct sock *sk,
                goto no_route;
        if (opt && opt->opt.is_strictroute && rt->rt_gateway)
                goto route_err;
+        rcu_read_unlock();
        return &rt->dst;
 route_err:
        ip_rt_put(rt);
 no_route:
+        rcu_read_unlock();
        IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
        return NULL;
 }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 147ccc3e93db..c196d749daf2 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1338,10 +1338,10 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
        iph->ihl = 5;
        iph->tos = inet->tos;
        iph->frag_off = df;
-        ip_select_ident(iph, &rt->dst, sk);
        iph->ttl = ttl;
        iph->protocol = sk->sk_protocol;
        ip_copy_addrs(iph, fl4);
+        ip_select_ident(iph, &rt->dst, sk);
        if (opt) {
                iph->ihl += opt->optlen>>2;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 8eec8f4a0536..ebdf06f938bf 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -124,6 +124,8 @@ static DEFINE_SPINLOCK(mfc_unres_lock);
 static struct kmem_cache *mrt_cachep __read_mostly;
 static struct mr_table *ipmr_new_table(struct net *net, u32 id);
+static void ipmr_free_table(struct mr_table *mrt);
 static int ip_mr_forward(struct net *net, struct mr_table *mrt,
                         struct sk_buff *skb, struct mfc_cache *cache,
                         int local);
@@ -131,6 +133,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
                             struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
                              struct mfc_cache *c, struct rtmsg *rtm);
+static void mroute_clean_tables(struct mr_table *mrt);
 static void ipmr_expire_process(unsigned long arg);
 #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
@@ -271,7 +274,7 @@ static void __net_exit ipmr_rules_exit(struct net *net)
        list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
                list_del(&mrt->list);
-                kfree(mrt);
+                ipmr_free_table(mrt);
        }
        fib_rules_unregister(net->ipv4.mr_rules_ops);
 }
@@ -299,7 +302,7 @@ static int __net_init ipmr_rules_init(struct net *net)
 static void __net_exit ipmr_rules_exit(struct net *net)
 {
-        kfree(net->ipv4.mrt);
+        ipmr_free_table(net->ipv4.mrt);
 }
 #endif
@@ -336,6 +339,13 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
        return mrt;
 }
+static void ipmr_free_table(struct mr_table *mrt)
+{
+        del_timer_sync(&mrt->ipmr_expire_timer);
+        mroute_clean_tables(mrt);
+        kfree(mrt);
+}
 /* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
 static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index ea4a23813d26..9c87cde28ff8 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -148,7 +148,7 @@ static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
        if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
                                    hdr, NULL, &matchoff, &matchlen,
                                    &addr, &port) > 0) {
-                unsigned int matchend, poff, plen, buflen, n;
+                unsigned int olen, matchend, poff, plen, buflen, n;
                char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
                /* We're only interested in headers related to this
@@ -163,17 +163,18 @@ static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
                                goto next;
                }
+                olen = *datalen;
                if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
                              &addr, port))
                        return NF_DROP;
-                matchend = matchoff + matchlen;
+                matchend = matchoff + matchlen + *datalen - olen;
                /* The maddr= parameter (RFC 2361) specifies where to send
                 * the reply. */
                if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
                                               "maddr=", &poff, &plen,
-                                               &addr) > 0 &&
+                                               &addr, true) > 0 &&
                    addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
                    addr.ip != ct->tuplehash[!dir].tuple.dst.u3.ip) {
                        buflen = sprintf(buffer, "%pI4",
@@ -187,7 +188,7 @@ static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
                 * from which the server received the request. */
                if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
                                               "received=", &poff, &plen,
-                                               &addr) > 0 &&
+                                               &addr, false) > 0 &&
                    addr.ip == ct->tuplehash[dir].tuple.dst.u3.ip &&
                    addr.ip != ct->tuplehash[!dir].tuple.src.u3.ip) {
                        buflen = sprintf(buffer, "%pI4",
@@ -501,7 +502,10 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
                ret = nf_ct_expect_related(rtcp_exp);
                if (ret == 0)
                        break;
-                else if (ret != -EBUSY) {
+                else if (ret == -EBUSY) {
+                        nf_ct_unexpect_related(rtp_exp);
+                        continue;
+                } else if (ret < 0) {
                        nf_ct_unexpect_related(rtp_exp);
                        port = 0;
                        break;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e4ba974f143c..82cf2a722b23 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -934,12 +934,14 @@ static u32 __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
        if (mtu < ip_rt_min_pmtu)
                mtu = ip_rt_min_pmtu;
+        rcu_read_lock();
        if (fib_lookup(dev_net(rt->dst.dev), fl4, &res) == 0) {
                struct fib_nh *nh = &FIB_RES_NH(res);
                update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
                                      jiffies + ip_rt_mtu_expires);
        }
+        rcu_read_unlock();
        return mtu;
 }
@@ -956,7 +958,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                dst->obsolete = DST_OBSOLETE_KILL;
        } else {
                rt->rt_pmtu = mtu;
-                dst_set_expires(&rt->dst, ip_rt_mtu_expires);
+                rt->dst.expires = max(1UL, jiffies + ip_rt_mtu_expires);
        }
 }
@@ -1263,7 +1265,7 @@ static void ipv4_dst_destroy(struct dst_entry *dst)
 {
        struct rtable *rt = (struct rtable *) dst;
-        if (dst->flags & DST_NOCACHE) {
+        if (!list_empty(&rt->rt_uncached)) {
                spin_lock_bh(&rt_uncached_lock);
                list_del(&rt->rt_uncached);
                spin_unlock_bh(&rt_uncached_lock);
@@ -2028,7 +2030,6 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                }
                dev_out = net->loopback_dev;
                fl4->flowi4_oif = dev_out->ifindex;
-                res.fi = NULL;
                flags |= RTCF_LOCAL;
                goto make_route;
        }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 85308b90df80..6e38c6c23caa 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2926,13 +2926,14 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
 * tcp_xmit_retransmit_queue().
 */
 static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
-                                  int newly_acked_sacked, bool is_dupack,
+                                  int prior_sacked, bool is_dupack,
                                  int flag)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
                                    (tcp_fackets_out(tp) > tp->reordering));
+        int newly_acked_sacked = 0;
        int fast_rexmit = 0;
        if (WARN_ON(!tp->packets_out && tp->sacked_out))
@@ -2992,6 +2993,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                                tcp_add_reno_sack(sk);
                } else
                        do_lost = tcp_try_undo_partial(sk, pkts_acked);
+                newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
                break;
        case TCP_CA_Loss:
                if (flag & FLAG_DATA_ACKED)
@@ -3013,6 +3015,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                        if (is_dupack)
                                tcp_add_reno_sack(sk);
                }
+                newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
                if (icsk->icsk_ca_state <= TCP_CA_Disorder)
                        tcp_try_undo_dsack(sk);
@@ -3590,7 +3593,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
        int prior_packets;
        int prior_sacked = tp->sacked_out;
        int pkts_acked = 0;
-        int newly_acked_sacked = 0;
        bool frto_cwnd = false;
        /* If the ack is older than previous acks
@@ -3666,8 +3668,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
        pkts_acked = prior_packets - tp->packets_out;
-        newly_acked_sacked = (prior_packets - prior_sacked) -
-                             (tp->packets_out - tp->sacked_out);
        if (tp->frto_counter)
                frto_cwnd = tcp_process_frto(sk, flag);
@@ -3681,7 +3681,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                    tcp_may_raise_cwnd(sk, flag))
                        tcp_cong_avoid(sk, ack, prior_in_flight);
                is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
-                tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                      is_dupack, flag);
        } else {
                if ((flag & FLAG_DATA_ACKED) && !frto_cwnd)
@@ -3698,7 +3698,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 no_queue:
        /* If data was DSACKed, see if we can undo a cwnd reduction. */
        if (flag & FLAG_DSACKING_ACK)
-                tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                      is_dupack, flag);
        /* If this ack opens up a zero window, clear backoff.  It was
         * being used to time the probes, and is probably far higher than
@@ -3718,8 +3718,7 @@ old_ack:
         */
        if (TCP_SKB_CB(skb)->sacked) {
                flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
-                newly_acked_sacked = tp->sacked_out - prior_sacked;
+                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
-                tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
                                      is_dupack, flag);
        }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 767823764016..00a748d14062 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -417,10 +417,12 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
                        tp->mtu_info = info;
-                        if (!sock_owned_by_user(sk))
+                        if (!sock_owned_by_user(sk)) {
                                tcp_v4_mtu_reduced(sk);
-                        else
+                        } else {
-                                set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags);
+                                if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags))
+                                        sock_hold(sk);
+                        }
                        goto out;
                }
@@ -1462,6 +1464,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                goto exit_nonewsk;
        newsk->sk_gso_type = SKB_GSO_TCPV4;
+        inet_sk_rx_dst_set(newsk, skb);
        newtp                 = tcp_sk(newsk);
        newinet               = inet_sk(newsk);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index d9c9dcef2de3..6ff7f10dce9d 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -387,8 +387,6 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                struct tcp_sock *oldtp = tcp_sk(sk);
                struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
-                newicsk->icsk_af_ops->sk_rx_dst_set(newsk, skb);
                /* TCP Cookie Transactions require space for the cookie pair,
                 * as it differs for each connection.  There is no need to
                 * copy any s_data_payload stored at the original socket.
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 20dfd892c86f..d04632673a9e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -910,14 +910,18 @@ void tcp_release_cb(struct sock *sk)
        if (flags & (1UL << TCP_TSQ_DEFERRED))
                tcp_tsq_handler(sk);
-        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED))
+        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
                tcp_write_timer_handler(sk);
+                __sock_put(sk);
-        if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED))
+        }
+        if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED)) {
                tcp_delack_timer_handler(sk);
+                __sock_put(sk);
-        if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED))
+        }
+        if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED)) {
                sk->sk_prot->mtu_reduced(sk);
+                __sock_put(sk);
+        }
 }
 EXPORT_SYMBOL(tcp_release_cb);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 6df36ad55a38..b774a03bd1dc 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -252,7 +252,8 @@ static void tcp_delack_timer(unsigned long data)
                inet_csk(sk)->icsk_ack.blocked = 1;
                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOCKED);
                /* deleguate our work to tcp_release_cb() */
-                set_bit(TCP_WRITE_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags);
+                if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags))
+                        sock_hold(sk);
        }
        bh_unlock_sock(sk);
        sock_put(sk);
@@ -481,7 +482,8 @@ static void tcp_write_timer(unsigned long data)
                tcp_write_timer_handler(sk);
        } else {
                /* deleguate our work to tcp_release_cb() */
-                set_bit(TCP_WRITE_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags);
+                if (!test_and_set_bit(TCP_WRITE_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags))
+                        sock_hold(sk);
        }
        bh_unlock_sock(sk);
        sock_put(sk);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 6f6d1aca3c3d..2814f66dac64 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1226,6 +1226,11 @@ try_again:
        if (unlikely(err)) {
                trace_kfree_skb(skb, udp_recvmsg);
+                if (!peeked) {
+                        atomic_inc(&sk->sk_drops);
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                           UDP_MIB_INERRORS, is_udplite);
+                }
                goto out_free;
        }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 79181819a24f..6bc85f7c31e3 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -494,8 +494,7 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
        struct net_device *dev;
        struct inet6_dev *idev;
-        rcu_read_lock();
+        for_each_netdev(net, dev) {
-        for_each_netdev_rcu(net, dev) {
                idev = __in6_dev_get(dev);
                if (idev) {
                        int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -504,7 +503,6 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
                                dev_forward_change(idev);
                }
        }
-        rcu_read_unlock();
 }
 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 6dc7fd353ef5..282f3723ee19 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -167,8 +167,6 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        struct esp_data *esp = x->data;
        /* skb is pure payload to encrypt */
-        err = -ENOMEM;
        aead = esp->aead;
        alen = crypto_aead_authsize(aead);
@@ -203,8 +201,10 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        }
        tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
-        if (!tmp)
+        if (!tmp) {
+                err = -ENOMEM;
                goto error;
+        }
        seqhi = esp_tmp_seqhi(tmp);
        iv = esp_tmp_iv(aead, tmp, seqhilen);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index da2e92d05c15..745a32042950 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -307,10 +307,10 @@ static int __net_init ipv6_proc_init_net(struct net *net)
                goto proc_dev_snmp6_fail;
        return 0;
+proc_dev_snmp6_fail:
+        proc_net_remove(net, "snmp6");
 proc_snmp6_fail:
        proc_net_remove(net, "sockstat6");
-proc_dev_snmp6_fail:
-        proc_net_remove(net, "dev_snmp6");
        return -ENOMEM;
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index bb9ce2b2f377..acd32e3f1b68 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -94,6 +94,18 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 }
 #endif
+static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        const struct rt6_info *rt = (const struct rt6_info *)dst;
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        if (rt->rt6i_node)
+                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
+}
 static void tcp_v6_hash(struct sock *sk)
 {
        if (sk->sk_state != TCP_CLOSE) {
@@ -391,8 +403,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                tp->mtu_info = ntohl(info);
                if (!sock_owned_by_user(sk))
                        tcp_v6_mtu_reduced(sk);
-                else
+                else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
-                        set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags);
+                                           &tp->tsq_flags))
+                        sock_hold(sk);
                goto out;
        }
@@ -1270,6 +1283,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        newsk->sk_gso_type = SKB_GSO_TCPV6;
        __ip6_dst_store(newsk, dst, NULL, NULL);
+        inet6_sk_rx_dst_set(newsk, skb);
        newtcp6sk = (struct tcp6_sock *)newsk;
        inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
@@ -1729,18 +1743,6 @@ static struct timewait_sock_ops tcp6_timewait_sock_ops = {
        .twsk_destructor= tcp_twsk_destructor,
 };
-static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
-{
-        struct dst_entry *dst = skb_dst(skb);
-        const struct rt6_info *rt = (const struct rt6_info *)dst;
-        dst_hold(dst);
-        sk->sk_rx_dst = dst;
-        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
-        if (rt->rt6i_node)
-                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
-}
 static const struct inet_connection_sock_af_ops ipv6_specific = {
        .queue_xmit        = inet6_csk_xmit,
        .send_check        = tcp_v6_send_check,
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 99d0077b56b8..07e2bfef6845 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -394,6 +394,17 @@ try_again:
        }
        if (unlikely(err)) {
                trace_kfree_skb(skb, udpv6_recvmsg);
+                if (!peeked) {
+                        atomic_inc(&sk->sk_drops);
+                        if (is_udp4)
+                                UDP_INC_STATS_USER(sock_net(sk),
+                                                   UDP_MIB_INERRORS,
+                                                   is_udplite);
+                        else
+                                UDP6_INC_STATS_USER(sock_net(sk),
+                                                    UDP_MIB_INERRORS,
+                                                    is_udplite);
+                }
                goto out_free;
        }
        if (!peeked) {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index ef39812107b1..f8c4c08ffb60 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -73,6 +73,13 @@ static int xfrm6_get_tos(const struct flowi *fl)
        return 0;
 }
+static void xfrm6_init_dst(struct net *net, struct xfrm_dst *xdst)
+{
+        struct rt6_info *rt = (struct rt6_info *)xdst;
+        rt6_init_peer(rt, net->ipv6.peers);
+}
 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
                           int nfheader_len)
 {
@@ -286,6 +293,7 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
        .get_saddr =            xfrm6_get_saddr,
        .decode_session =       _decode_session6,
        .get_tos =              xfrm6_get_tos,
+        .init_dst =             xfrm6_init_dst,
        .init_path =            xfrm6_init_path,
        .fill_dst =             xfrm6_fill_dst,
        .blackhole_route =      ip6_blackhole_route,
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 393355d37b47..1a9f3723c13c 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1347,11 +1347,10 @@ static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
        /* Remove from tunnel list */
        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
        list_del_rcu(&tunnel->list);
+        kfree_rcu(tunnel, rcu);
        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
-        synchronize_rcu();
        atomic_dec(&l2tp_tunnel_count);
-        kfree(tunnel);
 }
 /* Create a socket for the tunnel, if one isn't set up by
@@ -1502,6 +1501,8 @@ out:
        return err;
 }
+static struct lock_class_key l2tp_socket_class;
 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
 {
        struct l2tp_tunnel *tunnel = NULL;
@@ -1606,6 +1607,8 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        tunnel->old_sk_destruct = sk->sk_destruct;
        sk->sk_destruct = &l2tp_tunnel_destruct;
        tunnel->sock = sk;
+        lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
        sk->sk_allocation = GFP_ATOMIC;
        /* Add tunnel to our list */
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a38ec6cdeee1..56d583e083a7 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -163,6 +163,7 @@ struct l2tp_tunnel_cfg {
 struct l2tp_tunnel {
        int                     magic;          /* Should be L2TP_TUNNEL_MAGIC */
+        struct rcu_head rcu;
        rwlock_t                hlist_lock;     /* protect session_hlist */
        struct hlist_head       session_hlist[L2TP_HASH_SIZE];
                                                /* hashed list of sessions,
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index f9ee74deeac2..3bfb34aaee29 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
        }
-        if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
+        if (!pskb_may_pull(skb, ETH_HLEN))
                goto error;
        secpath_reset(skb);
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 35e1e4bde587..927547171bc7 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -410,6 +410,7 @@ static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
        lsa->l2tp_family = AF_INET6;
        lsa->l2tp_flowinfo = 0;
        lsa->l2tp_scope_id = 0;
+        lsa->l2tp_unused = 0;
        if (peer) {
                if (!lsk->peer_conn_id)
                        return -ENOTCONN;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index f6fe4d400502..c2190005a114 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -969,14 +969,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
        struct sockaddr_llc sllc;
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
-        int rc = 0;
+        int rc = -EBADF;
        memset(&sllc, 0, sizeof(sllc));
        lock_sock(sk);
        if (sock_flag(sk, SOCK_ZAPPED))
                goto out;
        *uaddrlen = sizeof(sllc);
-        memset(uaddr, 0, *uaddrlen);
        if (peer) {
                rc = -ENOTCONN;
                if (sk->sk_state != TCP_ESTABLISHED)
@@ -1206,7 +1205,7 @@ static int __init llc2_init(void)
        rc = llc_proc_init();
        if (rc != 0) {
                printk(llc_proc_err_msg);
-                goto out_unregister_llc_proto;
+                goto out_station;
        }
        rc = llc_sysctl_init();
        if (rc) {
@@ -1226,7 +1225,8 @@ out_sysctl:
        llc_sysctl_exit();
 out_proc:
        llc_proc_exit();
-out_unregister_llc_proto:
+out_station:
+        llc_station_exit();
        proto_unregister(&llc_proto);
        goto out;
 }
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index e32cab44ea95..dd3e83328ad5 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -42,6 +42,7 @@ static void (*llc_type_handlers[2])(struct llc_sap *sap,
 void llc_add_pack(int type, void (*handler)(struct llc_sap *sap,
                                            struct sk_buff *skb))
 {
+        smp_wmb(); /* ensure initialisation is complete before it's called */
        if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
                llc_type_handlers[type - 1] = handler;
 }
@@ -50,11 +51,19 @@ void llc_remove_pack(int type)
 {
        if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
                llc_type_handlers[type - 1] = NULL;
+        synchronize_net();
 }
 void llc_set_station_handler(void (*handler)(struct sk_buff *skb))
 {
+        /* Ensure initialisation is complete before it's called */
+        if (handler)
+                smp_wmb();
        llc_station_handler = handler;
+        if (!handler)
+                synchronize_net();
 }
 /**
@@ -150,6 +159,8 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
        int dest;
        int (*rcv)(struct sk_buff *, struct net_device *,
                   struct packet_type *, struct net_device *);
+        void (*sta_handler)(struct sk_buff *skb);
+        void (*sap_handler)(struct llc_sap *sap, struct sk_buff *skb);
        if (!net_eq(dev_net(dev), &init_net))
                goto drop;
@@ -182,7 +193,8 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
         */
        rcv = rcu_dereference(sap->rcv_func);
        dest = llc_pdu_type(skb);
-        if (unlikely(!dest || !llc_type_handlers[dest - 1])) {
+        sap_handler = dest ? ACCESS_ONCE(llc_type_handlers[dest - 1]) : NULL;
+        if (unlikely(!sap_handler)) {
                if (rcv)
                        rcv(skb, dev, pt, orig_dev);
                else
@@ -193,7 +205,7 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
                        if (cskb)
                                rcv(cskb, dev, pt, orig_dev);
                }
-                llc_type_handlers[dest - 1](sap, skb);
+                sap_handler(sap, skb);
        }
        llc_sap_put(sap);
 out:
@@ -202,9 +214,10 @@ drop:
        kfree_skb(skb);
        goto out;
 handle_station:
-        if (!llc_station_handler)
+        sta_handler = ACCESS_ONCE(llc_station_handler);
+        if (!sta_handler)
                goto drop;
-        llc_station_handler(skb);
+        sta_handler(skb);
        goto out;
 }
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 6828e39ec2ec..b2f2bac2c2a2 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -687,12 +687,8 @@ static void llc_station_rcv(struct sk_buff *skb)
        llc_station_state_process(skb);
 }
-int __init llc_station_init(void)
+void __init llc_station_init(void)
 {
-        int rc = -ENOBUFS;
-        struct sk_buff *skb;
-        struct llc_station_state_ev *ev;
        skb_queue_head_init(&llc_main_station.mac_pdu_q);
        skb_queue_head_init(&llc_main_station.ev_q.list);
        spin_lock_init(&llc_main_station.ev_q.lock);
@@ -700,23 +696,12 @@ int __init llc_station_init(void)
                        (unsigned long)&llc_main_station);
        llc_main_station.ack_timer.expires  = jiffies +
                                                sysctl_llc_station_ack_timeout;
-        skb = alloc_skb(0, GFP_ATOMIC);
-        if (!skb)
-                goto out;
-        rc = 0;
-        llc_set_station_handler(llc_station_rcv);
-        ev = llc_station_ev(skb);
-        memset(ev, 0, sizeof(*ev));
        llc_main_station.maximum_retry  = 1;
-        llc_main_station.state          = LLC_STATION_STATE_DOWN;
+        llc_main_station.state          = LLC_STATION_STATE_UP;
-        ev->type        = LLC_STATION_EV_TYPE_SIMPLE;
+        llc_set_station_handler(llc_station_rcv);
-        ev->prim_type   = LLC_STATION_EV_ENABLE_WITHOUT_DUP_ADDR_CHECK;
-        rc = llc_station_next_state(skb);
-out:
-        return rc;
 }
-void __exit llc_station_exit(void)
+void llc_station_exit(void)
 {
        llc_set_station_handler(NULL);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index d41974aacf51..a58c0b649ba1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1378,6 +1378,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
        else
                memset(next_hop, 0, ETH_ALEN);
+        memset(pinfo, 0, sizeof(*pinfo));
        pinfo->generation = mesh_paths_generation;
        pinfo->filled = MPATH_INFO_FRAME_QLEN |
@@ -1396,7 +1398,6 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
        pinfo->discovery_timeout =
                        jiffies_to_msecs(mpath->discovery_timeout);
        pinfo->discovery_retries = mpath->discovery_retries;
-        pinfo->flags = 0;
        if (mpath->flags & MESH_PATH_ACTIVE)
                pinfo->flags |= NL80211_MPATH_FLAG_ACTIVE;
        if (mpath->flags & MESH_PATH_RESOLVING)
@@ -1405,10 +1406,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                pinfo->flags |= NL80211_MPATH_FLAG_SN_VALID;
        if (mpath->flags & MESH_PATH_FIXED)
                pinfo->flags |= NL80211_MPATH_FLAG_FIXED;
-        if (mpath->flags & MESH_PATH_RESOLVING)
+        if (mpath->flags & MESH_PATH_RESOLVED)
-                pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
+                pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
-        pinfo->flags = mpath->flags;
 }
 static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a4a5acdbaa4d..f76b83341cf9 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3248,6 +3248,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
        goto out_unlock;
 err_clear:
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
        ifmgd->auth_data = NULL;
 err_free:
        kfree(auth_data);
@@ -3439,6 +3441,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
        err = 0;
        goto out;
 err_clear:
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
        ifmgd->assoc_data = NULL;
 err_free:
        kfree(assoc_data);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index acf712ffb5e6..c5e8c9c31f76 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1811,37 +1811,31 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
                                        sdata, NULL, NULL);
                } else {
-                        int is_mesh_mcast = 1;
+                        /* DS -> MBSS (802.11-2012 13.11.3.3).
-                        const u8 *mesh_da;
+                         * For unicast with unknown forwarding information,
+                         * destination might be in the MBSS or if that fails
+                         * forwarded to another mesh gate. In either case
+                         * resolution will be handled in ieee80211_xmit(), so
+                         * leave the original DA. This also works for mcast */
+                        const u8 *mesh_da = skb->data;
+                        if (mppath)
+                                mesh_da = mppath->mpp;
+                        else if (mpath)
+                                mesh_da = mpath->dst;
+                        rcu_read_unlock();
-                        if (is_multicast_ether_addr(skb->data))
-                                /* DA TA mSA AE:SA */
-                                mesh_da = skb->data;
-                        else {
-                                static const u8 bcast[ETH_ALEN] =
-                                        { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-                                if (mppath) {
-                                        /* RA TA mDA mSA AE:DA SA */
-                                        mesh_da = mppath->mpp;
-                                        is_mesh_mcast = 0;
-                                } else if (mpath) {
-                                        mesh_da = mpath->dst;
-                                        is_mesh_mcast = 0;
-                                } else {
-                                        /* DA TA mSA AE:SA */
-                                        mesh_da = bcast;
-                                }
-                        }
                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                        mesh_da, sdata->vif.addr);
-                        rcu_read_unlock();
+                        if (is_multicast_ether_addr(mesh_da))
-                        if (is_mesh_mcast)
+                                /* DA TA mSA AE:SA */
                                meshhdrlen =
                                        ieee80211_new_mesh_header(&mesh_hdr,
                                                        sdata,
                                                        skb->data + ETH_ALEN,
                                                        NULL);
                        else
+                                /* RA TA mDA mSA AE:DA SA */
                                meshhdrlen =
                                        ieee80211_new_mesh_header(&mesh_hdr,
                                                        sdata,
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 84444dda194b..f51013c07b9f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1171,8 +1171,10 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
                goto out_err;
        }
        svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
-        if (!svc->stats.cpustats)
+        if (!svc->stats.cpustats) {
+                ret = -ENOMEM;
                goto out_err;
+        }
        /* I'm the first user of the service */
        atomic_set(&svc->usecnt, 0);
@@ -2759,6 +2761,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        {
                struct ip_vs_timeout_user t;
+                memset(&t, 0, sizeof(t));
                __ip_vs_get_timeouts(net, &t);
                if (copy_to_user(user, &t, sizeof(t)) != 0)
                        ret = -EFAULT;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index cf4875565d67..2ceec64b19f9 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -249,12 +249,15 @@ static void death_by_event(unsigned long ul_conntrack)
 {
        struct nf_conn *ct = (void *)ul_conntrack;
        struct net *net = nf_ct_net(ct);
+        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
+        BUG_ON(ecache == NULL);
        if (nf_conntrack_event(IPCT_DESTROY, ct) < 0) {
                /* bad luck, let's retry again */
-                ct->timeout.expires = jiffies +
+                ecache->timeout.expires = jiffies +
                        (random32() % net->ct.sysctl_events_retry_timeout);
-                add_timer(&ct->timeout);
+                add_timer(&ecache->timeout);
                return;
        }
        /* we've got the event delivered, now it's dying */
@@ -268,6 +271,9 @@ static void death_by_event(unsigned long ul_conntrack)
 void nf_ct_insert_dying_list(struct nf_conn *ct)
 {
        struct net *net = nf_ct_net(ct);
+        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
+        BUG_ON(ecache == NULL);
        /* add this conntrack to the dying list */
        spin_lock_bh(&nf_conntrack_lock);
@@ -275,10 +281,10 @@ void nf_ct_insert_dying_list(struct nf_conn *ct)
                             &net->ct.dying);
        spin_unlock_bh(&nf_conntrack_lock);
        /* set a new timer to retry event delivery */
-        setup_timer(&ct->timeout, death_by_event, (unsigned long)ct);
+        setup_timer(&ecache->timeout, death_by_event, (unsigned long)ct);
-        ct->timeout.expires = jiffies +
+        ecache->timeout.expires = jiffies +
                (random32() % net->ct.sysctl_events_retry_timeout);
-        add_timer(&ct->timeout);
+        add_timer(&ecache->timeout);
 }
 EXPORT_SYMBOL_GPL(nf_ct_insert_dying_list);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 45cf602a76bc..527651a53a45 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -361,23 +361,6 @@ static void evict_oldest_expect(struct nf_conn *master,
        }
 }
-static inline int refresh_timer(struct nf_conntrack_expect *i)
-{
-        struct nf_conn_help *master_help = nfct_help(i->master);
-        const struct nf_conntrack_expect_policy *p;
-        if (!del_timer(&i->timeout))
-                return 0;
-        p = &rcu_dereference_protected(
-                master_help->helper,
-                lockdep_is_held(&nf_conntrack_lock)
-                )->expect_policy[i->class];
-        i->timeout.expires = jiffies + p->timeout * HZ;
-        add_timer(&i->timeout);
-        return 1;
-}
 static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
 {
        const struct nf_conntrack_expect_policy *p;
@@ -386,7 +369,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
        struct nf_conn_help *master_help = nfct_help(master);
        struct nf_conntrack_helper *helper;
        struct net *net = nf_ct_exp_net(expect);
-        struct hlist_node *n;
+        struct hlist_node *n, *next;
        unsigned int h;
        int ret = 1;
@@ -395,12 +378,12 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
                goto out;
        }
        h = nf_ct_expect_dst_hash(&expect->tuple);
-        hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry_safe(i, n, next, &net->ct.expect_hash[h], hnode) {
                if (expect_matches(i, expect)) {
-                        /* Refresh timer: if it's dying, ignore.. */
+                        if (del_timer(&i->timeout)) {
-                        if (refresh_timer(i)) {
+                                nf_ct_unlink_expect(i);
-                                ret = 0;
+                                nf_ct_expect_put(i);
-                                goto out;
+                                break;
                        }
                } else if (expect_clash(i, expect)) {
                        ret = -EBUSY;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 14f67a2cbcb5..9807f3278fcb 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1896,10 +1896,15 @@ static int
 ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)
 {
        struct nlattr *cda[CTA_MAX+1];
+        int ret;
        nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);
-        return ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
+        spin_lock_bh(&nf_conntrack_lock);
+        ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
+        spin_unlock_bh(&nf_conntrack_lock);
+        return ret;
 }
 static struct nfq_ct_hook ctnetlink_nfqueue_hook = {
@@ -2785,7 +2790,8 @@ static int __init ctnetlink_init(void)
                goto err_unreg_subsys;
        }
-        if (register_pernet_subsys(&ctnetlink_net_ops)) {
+        ret = register_pernet_subsys(&ctnetlink_net_ops);
+        if (ret < 0) {
                pr_err("ctnetlink_init: cannot register pernet operations\n");
                goto err_unreg_exp_subsys;
        }
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index a5ac11ebef33..e046b3756aab 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -158,21 +158,18 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 *      sCL -> sSS
 */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
-/*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
+/*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
 /*
 *      sNO -> sIV      Too late and no reason to do anything
 *      sSS -> sIV      Client can't send SYN and then SYN/ACK
 *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
- *      sSR -> sIG
+ *      sSR -> sSR      Late retransmitted SYN/ACK in simultaneous open
- *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
+ *      sES -> sIV      Invalid SYN/ACK packets sent by the client
- *                      are errors. Receiver will reply with RST
+ *      sFW -> sIV
- *                      and close the connection.
+ *      sCW -> sIV
- *                      Or we are not in sync and hold a dead connection.
+ *      sLA -> sIV
- *      sFW -> sIG
+ *      sTW -> sIV
- *      sCW -> sIG
+ *      sCL -> sIV
- *      sLA -> sIG
- *      sTW -> sIG
- *      sCL -> sIG
 */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
@@ -633,15 +630,9 @@ static bool tcp_in_window(const struct nf_conn *ct,
                ack = sack = receiver->td_end;
        }
-        if (seq == end
+        if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)
-            && (!tcph->rst
-                || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
                /*
-                 * Packets contains no data: we assume it is valid
+                 * RST sent answering SYN.
-                 * and check the ack value only.
-                 * However RST segments are always validated by their
-                 * SEQ number, except when seq == 0 (reset sent answering
-                 * SYN.
                 */
                seq = end = sender->td_end;
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 758a1bacc126..5c0a112aeee6 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -183,12 +183,12 @@ static int media_len(const struct nf_conn *ct, const char *dptr,
        return len + digits_len(ct, dptr, limit, shift);
 }
-static int parse_addr(const struct nf_conn *ct, const char *cp,
+static int sip_parse_addr(const struct nf_conn *ct, const char *cp,
-                      const char **endp, union nf_inet_addr *addr,
+                          const char **endp, union nf_inet_addr *addr,
-                      const char *limit)
+                          const char *limit, bool delim)
 {
        const char *end;
-        int ret = 0;
+        int ret;
        if (!ct)
                return 0;
@@ -197,16 +197,28 @@ static int parse_addr(const struct nf_conn *ct, const char *cp,
        switch (nf_ct_l3num(ct)) {
        case AF_INET:
                ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
+                if (ret == 0)
+                        return 0;
                break;
        case AF_INET6:
+                if (cp < limit && *cp == '[')
+                        cp++;
+                else if (delim)
+                        return 0;
                ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
+                if (ret == 0)
+                        return 0;
+                if (end < limit && *end == ']')
+                        end++;
+                else if (delim)
+                        return 0;
                break;
        default:
                BUG();
        }
-        if (ret == 0 || end == cp)
-                return 0;
        if (endp)
                *endp = end;
        return 1;
@@ -219,7 +231,7 @@ static int epaddr_len(const struct nf_conn *ct, const char *dptr,
        union nf_inet_addr addr;
        const char *aux = dptr;
-        if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
+        if (!sip_parse_addr(ct, dptr, &dptr, &addr, limit, true)) {
                pr_debug("ip: %s parse failed.!\n", dptr);
                return 0;
        }
@@ -296,7 +308,7 @@ int ct_sip_parse_request(const struct nf_conn *ct,
                return 0;
        dptr += shift;
-        if (!parse_addr(ct, dptr, &end, addr, limit))
+        if (!sip_parse_addr(ct, dptr, &end, addr, limit, true))
                return -1;
        if (end < limit && *end == ':') {
                end++;
@@ -550,7 +562,7 @@ int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr,
        if (ret == 0)
                return ret;
-        if (!parse_addr(ct, dptr + *matchoff, &c, addr, limit))
+        if (!sip_parse_addr(ct, dptr + *matchoff, &c, addr, limit, true))
                return -1;
        if (*c == ':') {
                c++;
@@ -599,7 +611,7 @@ int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
                               unsigned int dataoff, unsigned int datalen,
                               const char *name,
                               unsigned int *matchoff, unsigned int *matchlen,
-                               union nf_inet_addr *addr)
+                               union nf_inet_addr *addr, bool delim)
 {
        const char *limit = dptr + datalen;
        const char *start, *end;
@@ -613,7 +625,7 @@ int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
                return 0;
        start += strlen(name);
-        if (!parse_addr(ct, start, &end, addr, limit))
+        if (!sip_parse_addr(ct, start, &end, addr, limit, delim))
                return 0;
        *matchoff = start - dptr;
        *matchlen = end - start;
@@ -675,6 +687,47 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
        return 1;
 }
+static int sdp_parse_addr(const struct nf_conn *ct, const char *cp,
+                          const char **endp, union nf_inet_addr *addr,
+                          const char *limit)
+{
+        const char *end;
+        int ret;
+        memset(addr, 0, sizeof(*addr));
+        switch (nf_ct_l3num(ct)) {
+        case AF_INET:
+                ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
+                break;
+        case AF_INET6:
+                ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
+                break;
+        default:
+                BUG();
+        }
+        if (ret == 0)
+                return 0;
+        if (endp)
+                *endp = end;
+        return 1;
+}
+/* skip ip address. returns its length. */
+static int sdp_addr_len(const struct nf_conn *ct, const char *dptr,
+                        const char *limit, int *shift)
+{
+        union nf_inet_addr addr;
+        const char *aux = dptr;
+        if (!sdp_parse_addr(ct, dptr, &dptr, &addr, limit)) {
+                pr_debug("ip: %s parse failed.!\n", dptr);
+                return 0;
+        }
+        return dptr - aux;
+}
 /* SDP header parsing: a SDP session description contains an ordered set of
 * headers, starting with a section containing general session parameters,
 * optionally followed by multiple media descriptions.
@@ -686,10 +739,10 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
 */
 static const struct sip_header ct_sdp_hdrs[] = {
        [SDP_HDR_VERSION]               = SDP_HDR("v=", NULL, digits_len),
-        [SDP_HDR_OWNER_IP4]             = SDP_HDR("o=", "IN IP4 ", epaddr_len),
+        [SDP_HDR_OWNER_IP4]             = SDP_HDR("o=", "IN IP4 ", sdp_addr_len),
-        [SDP_HDR_CONNECTION_IP4]        = SDP_HDR("c=", "IN IP4 ", epaddr_len),
+        [SDP_HDR_CONNECTION_IP4]        = SDP_HDR("c=", "IN IP4 ", sdp_addr_len),
-        [SDP_HDR_OWNER_IP6]             = SDP_HDR("o=", "IN IP6 ", epaddr_len),
+        [SDP_HDR_OWNER_IP6]             = SDP_HDR("o=", "IN IP6 ", sdp_addr_len),
-        [SDP_HDR_CONNECTION_IP6]        = SDP_HDR("c=", "IN IP6 ", epaddr_len),
+        [SDP_HDR_CONNECTION_IP6]        = SDP_HDR("c=", "IN IP6 ", sdp_addr_len),
        [SDP_HDR_MEDIA]                 = SDP_HDR("m=", NULL, media_len),
 };
@@ -775,8 +828,8 @@ static int ct_sip_parse_sdp_addr(const struct nf_conn *ct, const char *dptr,
        if (ret <= 0)
                return ret;
-        if (!parse_addr(ct, dptr + *matchoff, NULL, addr,
+        if (!sdp_parse_addr(ct, dptr + *matchoff, NULL, addr,
-                        dptr + *matchoff + *matchlen))
+                            dptr + *matchoff + *matchlen))
                return -1;
        return 1;
 }
@@ -1515,7 +1568,6 @@ static int sip_help_udp(struct sk_buff *skb, unsigned int protoff,
 }
 static struct nf_conntrack_helper sip[MAX_PORTS][4] __read_mostly;
-static char sip_names[MAX_PORTS][4][sizeof("sip-65535")] __read_mostly;
 static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = {
        [SIP_EXPECT_SIGNALLING] = {
@@ -1585,9 +1637,9 @@ static int __init nf_conntrack_sip_init(void)
                        sip[i][j].me = THIS_MODULE;
                        if (ports[i] == SIP_PORT)
-                                sprintf(sip_names[i][j], "sip");
+                                sprintf(sip[i][j].name, "sip");
                        else
-                                sprintf(sip_names[i][j], "sip-%u", i);
+                                sprintf(sip[i][j].name, "sip-%u", i);
                        pr_debug("port #%u: %u\n", i, ports[i]);
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 169ab59ed9d4..5cfb5bedb2b8 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -381,6 +381,7 @@ __build_packet_message(struct nfulnl_instance *inst,
        struct nlmsghdr *nlh;
        struct nfgenmsg *nfmsg;
        sk_buff_data_t old_tail = inst->skb->tail;
+        struct sock *sk;
        nlh = nlmsg_put(inst->skb, 0, 0,
                        NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
@@ -480,7 +481,7 @@ __build_packet_message(struct nfulnl_instance *inst,
        }
        if (indev && skb_mac_header_was_set(skb)) {
-                if (nla_put_be32(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
+                if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
                    nla_put_be16(inst->skb, NFULA_HWLEN,
                                 htons(skb->dev->hard_header_len)) ||
                    nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
@@ -499,18 +500,19 @@ __build_packet_message(struct nfulnl_instance *inst,
        }
        /* UID */
-        if (skb->sk) {
+        sk = skb->sk;
-                read_lock_bh(&skb->sk->sk_callback_lock);
+        if (sk && sk->sk_state != TCP_TIME_WAIT) {
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
+                read_lock_bh(&sk->sk_callback_lock);
-                        struct file *file = skb->sk->sk_socket->file;
+                if (sk->sk_socket && sk->sk_socket->file) {
+                        struct file *file = sk->sk_socket->file;
                        __be32 uid = htonl(file->f_cred->fsuid);
                        __be32 gid = htonl(file->f_cred->fsgid);
-                        read_unlock_bh(&skb->sk->sk_callback_lock);
+                        read_unlock_bh(&sk->sk_callback_lock);
                        if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
                            nla_put_be32(inst->skb, NFULA_GID, gid))
                                goto nla_put_failure;
                } else
-                        read_unlock_bh(&skb->sk->sk_callback_lock);
+                        read_unlock_bh(&sk->sk_callback_lock);
        }
        /* local sequence number */
@@ -996,8 +998,10 @@ static int __init nfnetlink_log_init(void)
 #ifdef CONFIG_PROC_FS
        if (!proc_create("nfnetlink_log", 0440,
-                         proc_net_netfilter, &nful_file_ops))
+                         proc_net_netfilter, &nful_file_ops)) {
+                status = -ENOMEM;
                goto cleanup_logger;
+        }
 #endif
        return status;
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index ff5f75fddb15..91e9af4d1f42 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -145,6 +145,19 @@ static int dump_tcp_header(struct sbuff *m, const struct sk_buff *skb,
        return 0;
 }
+static void dump_sk_uid_gid(struct sbuff *m, struct sock *sk)
+{
+        if (!sk || sk->sk_state == TCP_TIME_WAIT)
+                return;
+        read_lock_bh(&sk->sk_callback_lock);
+        if (sk->sk_socket && sk->sk_socket->file)
+                sb_add(m, "UID=%u GID=%u ",
+                        sk->sk_socket->file->f_cred->fsuid,
+                        sk->sk_socket->file->f_cred->fsgid);
+        read_unlock_bh(&sk->sk_callback_lock);
+}
 /* One level of recursion won't kill us */
 static void dump_ipv4_packet(struct sbuff *m,
                        const struct nf_loginfo *info,
@@ -361,14 +374,8 @@ static void dump_ipv4_packet(struct sbuff *m,
        }
        /* Max length: 15 "UID=4294967295 " */
-        if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {
+        if ((logflags & XT_LOG_UID) && !iphoff)
-                read_lock_bh(&skb->sk->sk_callback_lock);
+                dump_sk_uid_gid(m, skb->sk);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
-                read_unlock_bh(&skb->sk->sk_callback_lock);
-        }
        /* Max length: 16 "MARK=0xFFFFFFFF " */
        if (!iphoff && skb->mark)
@@ -436,8 +443,8 @@ log_packet_common(struct sbuff *m,
                  const struct nf_loginfo *loginfo,
                  const char *prefix)
 {
-        sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
+        sb_add(m, KERN_SOH "%c%sIN=%s OUT=%s ",
-               prefix,
+               '0' + loginfo->u.log.level, prefix,
               in ? in->name : "",
               out ? out->name : "");
 #ifdef CONFIG_BRIDGE_NETFILTER
@@ -717,14 +724,8 @@ static void dump_ipv6_packet(struct sbuff *m,
        }
        /* Max length: 15 "UID=4294967295 " */
-        if ((logflags & XT_LOG_UID) && recurse && skb->sk) {
+        if ((logflags & XT_LOG_UID) && recurse)
-                read_lock_bh(&skb->sk->sk_callback_lock);
+                dump_sk_uid_gid(m, skb->sk);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
-                read_unlock_bh(&skb->sk->sk_callback_lock);
-        }
        /* Max length: 16 "MARK=0xFFFFFFFF " */
        if (!recurse && skb->mark)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 5463969da45b..527023823b5c 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1362,7 +1362,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (NULL == siocb->scm)
                siocb->scm = &scm;
-        err = scm_send(sock, msg, siocb->scm);
+        err = scm_send(sock, msg, siocb->scm, true);
        if (err < 0)
                return err;
@@ -1373,7 +1373,8 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
                dst_pid = addr->nl_pid;
                dst_group = ffs(addr->nl_groups);
                err =  -EPERM;
-                if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
+                if ((dst_group || dst_pid) &&
+                    !netlink_capable(sock, NL_NONROOT_SEND))
                        goto out;
        } else {
                dst_pid = nlk->dst_pid;
@@ -2147,6 +2148,7 @@ static void __init netlink_add_usersock_entry(void)
        rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
        nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
        nl_table[NETLINK_USERSOCK].registered = 1;
+        nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
        netlink_table_ungrab();
 }
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 06592d8b4a2b..1b9024ee963c 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1169,7 +1169,12 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
                msg->msg_flags |= MSG_TRUNC;
        }
-        skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        er = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        if (er < 0) {
+                skb_free_datagram(sk, skb);
+                release_sock(sk);
+                return er;
+        }
        if (sax != NULL) {
                sax->sax25_family = AF_NETROM;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index f3f96badf5aa..954405ceae9e 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -45,7 +45,7 @@ static int make_writable(struct sk_buff *skb, int write_len)
        return pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
 }
-/* remove VLAN header from packet and update csum accrodingly. */
+/* remove VLAN header from packet and update csum accordingly. */
 static int __pop_vlan_tci(struct sk_buff *skb, __be16 *current_tci)
 {
        struct vlan_hdr *vhdr;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index d8277d29e710..cf58cedad083 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -425,10 +425,10 @@ static int validate_sample(const struct nlattr *attr,
 static int validate_tp_port(const struct sw_flow_key *flow_key)
 {
        if (flow_key->eth.type == htons(ETH_P_IP)) {
-                if (flow_key->ipv4.tp.src && flow_key->ipv4.tp.dst)
+                if (flow_key->ipv4.tp.src || flow_key->ipv4.tp.dst)
                        return 0;
        } else if (flow_key->eth.type == htons(ETH_P_IPV6)) {
-                if (flow_key->ipv6.tp.src && flow_key->ipv6.tp.dst)
+                if (flow_key->ipv6.tp.src || flow_key->ipv6.tp.dst)
                        return 0;
        }
@@ -460,7 +460,7 @@ static int validate_set(const struct nlattr *a,
                if (flow_key->eth.type != htons(ETH_P_IP))
                        return -EINVAL;
-                if (!flow_key->ipv4.addr.src || !flow_key->ipv4.addr.dst)
+                if (!flow_key->ip.proto)
                        return -EINVAL;
                ipv4_key = nla_data(ovs_key);
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 9b75617ca4e0..c30df1a10c67 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -145,15 +145,17 @@ u64 ovs_flow_used_time(unsigned long flow_jiffies);
 *  OVS_KEY_ATTR_PRIORITY      4    --     4      8
 *  OVS_KEY_ATTR_IN_PORT       4    --     4      8
 *  OVS_KEY_ATTR_ETHERNET     12    --     4     16
+ *  OVS_KEY_ATTR_ETHERTYPE     2     2     4      8  (outer VLAN ethertype)
 *  OVS_KEY_ATTR_8021Q         4    --     4      8
- *  OVS_KEY_ATTR_ETHERTYPE     2     2     4      8
+ *  OVS_KEY_ATTR_ENCAP         0    --     4      4  (VLAN encapsulation)
+ *  OVS_KEY_ATTR_ETHERTYPE     2     2     4      8  (inner VLAN ethertype)
 *  OVS_KEY_ATTR_IPV6         40    --     4     44
 *  OVS_KEY_ATTR_ICMPV6        2     2     4      8
 *  OVS_KEY_ATTR_ND           28    --     4     32
 *  -------------------------------------------------
- *  total                                       132
+ *  total                                       144
 */
-#define FLOW_BUFSIZE 132
+#define FLOW_BUFSIZE 144
 int ovs_flow_to_nlattrs(const struct sw_flow_key *, struct sk_buff *);
 int ovs_flow_from_nlattrs(struct sw_flow_key *swkey, int *key_lenp,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8ac890a1a4c0..c5c9e2a54218 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1273,6 +1273,14 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)
        spin_unlock(&f->lock);
 }
+static bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
+{
+        if (ptype->af_packet_priv == (void*)((struct packet_sock *)sk)->fanout)
+                return true;
+        return false;
+}
 static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 {
        struct packet_sock *po = pkt_sk(sk);
@@ -1325,6 +1333,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                match->prot_hook.dev = po->prot_hook.dev;
                match->prot_hook.func = packet_rcv_fanout;
                match->prot_hook.af_packet_priv = match;
+                match->prot_hook.id_match = match_fanout_group;
                dev_add_pack(&match->prot_hook);
                list_add(&match->list, &fanout_list);
        }
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index fe81cc18e9e0..9c0fd0c78814 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -200,13 +200,12 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
 out:
        if (err) {
                m->tcf_qstats.overlimits++;
-                /* should we be asking for packet to be dropped?
+                if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
-                 * may make sense for redirect case only
+                        retval = TC_ACT_SHOT;
-                 */
+                else
-                retval = TC_ACT_SHOT;
+                        retval = m->tcf_action;
-        } else {
+        } else
                retval = m->tcf_action;
-        }
        spin_unlock(&m->tcf_lock);
        return retval;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 6aabd77d1cfd..564b9fc8efd3 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -250,10 +250,11 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                        else if ((cl = defmap[res.classid & TC_PRIO_MAX]) == NULL)
                                cl = defmap[TC_PRIO_BESTEFFORT];
-                        if (cl == NULL || cl->level >= head->level)
+                        if (cl == NULL)
                                goto fallback;
                }
+                if (cl->level >= head->level)
+                        goto fallback;
 #ifdef CONFIG_NET_CLS_ACT
                switch (result) {
                case TC_ACT_QUEUED:
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 9fc1c62ec80e..4e606fcb2534 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -191,7 +191,6 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        if (list_empty(&flow->flowchain)) {
                list_add_tail(&flow->flowchain, &q->new_flows);
-                codel_vars_init(&flow->cvars);
                q->new_flow_count++;
                flow->deficit = q->quantum;
                flow->dropped = 0;
@@ -418,6 +417,7 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt)
                        struct fq_codel_flow *flow = q->flows + i;
                        INIT_LIST_HEAD(&flow->flowchain);
+                        codel_vars_init(&flow->cvars);
                }
        }
        if (sch->limit >= 1)
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index e901583e4ea5..d42234c0f13b 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -102,9 +102,8 @@ static inline int gred_wred_mode_check(struct Qdisc *sch)
                if (q == NULL)
                        continue;
-                for (n = 0; n < table->DPs; n++)
+                for (n = i + 1; n < table->DPs; n++)
-                        if (table->tab[n] && table->tab[n] != q &&
+                        if (table->tab[n] && table->tab[n]->prio == q->prio)
-                            table->tab[n]->prio == q->prio)
                                return 1;
        }
@@ -137,6 +136,7 @@ static inline void gred_store_wred_set(struct gred_sched *table,
                                       struct gred_sched_data *q)
 {
        table->wred_set.qavg = q->vars.qavg;
+        table->wred_set.qidlestart = q->vars.qidlestart;
 }
 static inline int gred_use_ecn(struct gred_sched *t)
@@ -176,7 +176,7 @@ static int gred_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                skb->tc_index = (skb->tc_index & ~GRED_VQ_MASK) | dp;
        }
-        /* sum up all the qaves of prios <= to ours to get the new qave */
+        /* sum up all the qaves of prios < ours to get the new qave */
        if (!gred_wred_mode(t) && gred_rio_mode(t)) {
                int i;
@@ -260,16 +260,18 @@ static struct sk_buff *gred_dequeue(struct Qdisc *sch)
                } else {
                        q->backlog -= qdisc_pkt_len(skb);
-                        if (!q->backlog && !gred_wred_mode(t))
+                        if (gred_wred_mode(t)) {
-                                red_start_of_idle_period(&q->vars);
+                                if (!sch->qstats.backlog)
+                                        red_start_of_idle_period(&t->wred_set);
+                        } else {
+                                if (!q->backlog)
+                                        red_start_of_idle_period(&q->vars);
+                        }
                }
                return skb;
        }
-        if (gred_wred_mode(t) && !red_is_idling(&t->wred_set))
-                red_start_of_idle_period(&t->wred_set);
        return NULL;
 }
@@ -291,19 +293,20 @@ static unsigned int gred_drop(struct Qdisc *sch)
                        q->backlog -= len;
                        q->stats.other++;
-                        if (!q->backlog && !gred_wred_mode(t))
+                        if (gred_wred_mode(t)) {
-                                red_start_of_idle_period(&q->vars);
+                                if (!sch->qstats.backlog)
+                                        red_start_of_idle_period(&t->wred_set);
+                        } else {
+                                if (!q->backlog)
+                                        red_start_of_idle_period(&q->vars);
+                        }
                }
                qdisc_drop(skb, sch);
                return len;
        }
-        if (gred_wred_mode(t) && !red_is_idling(&t->wred_set))
-                red_start_of_idle_period(&t->wred_set);
        return 0;
 }
 static void gred_reset(struct Qdisc *sch)
@@ -535,6 +538,7 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
        for (i = 0; i < MAX_DPs; i++) {
                struct gred_sched_data *q = table->tab[i];
                struct tc_gred_qopt opt;
+                unsigned long qavg;
                memset(&opt, 0, sizeof(opt));
@@ -566,7 +570,9 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
                if (gred_wred_mode(table))
                        gred_load_wred_set(table, q);
-                opt.qave = red_calc_qavg(&q->parms, &q->vars, q->vars.qavg);
+                qavg = red_calc_qavg(&q->parms, &q->vars,
+                                     q->vars.qavg >> q->parms.Wlog);
+                opt.qave = qavg >> q->parms.Wlog;
 append_opt:
                if (nla_append(skb, sizeof(opt), &opt) < 0)
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 838e18b4d7ea..be50aa234dcd 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -364,6 +364,25 @@ finish:
        return retval;
 }
+static void sctp_packet_release_owner(struct sk_buff *skb)
+{
+        sk_free(skb->sk);
+}
+static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
+{
+        skb_orphan(skb);
+        skb->sk = sk;
+        skb->destructor = sctp_packet_release_owner;
+        /*
+         * The data chunks have already been accounted for in sctp_sendmsg(),
+         * therefore only reserve a single byte to keep socket around until
+         * the packet has been transmitted.
+         */
+        atomic_inc(&sk->sk_wmem_alloc);
+}
 /* All packets are sent to the network through this function from
 * sctp_outq_tail().
 *
@@ -405,7 +424,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
        /* Set the owning socket so that we know where to get the
         * destination IP address.
         */
-        skb_set_owner_w(nskb, sk);
+        sctp_packet_set_owner_w(nskb, sk);
        if (!sctp_transport_dst_check(tp)) {
                sctp_transport_route(tp, NULL, sctp_sk(sk));
diff --git a/net/socket.c b/net/socket.c
index dfe5b66c97e0..edc3c4af9085 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2604,7 +2604,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
        set_fs(old_fs);
        if (!err)
-                err = compat_put_timeval(up, &ktv);
+                err = compat_put_timeval(&ktv, up);
        return err;
 }
@@ -2620,7 +2620,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
        set_fs(old_fs);
        if (!err)
-                err = compat_put_timespec(up, &kts);
+                err = compat_put_timespec(&kts, up);
        return err;
 }
@@ -2657,6 +2657,7 @@ static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
        if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
                return -EFAULT;
+        memset(&ifc, 0, sizeof(ifc));
        if (ifc32.ifcbuf == 0) {
                ifc32.ifc_len = 0;
                ifc.ifc_len = 0;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 88f2bf671960..bac973a31367 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -316,7 +316,6 @@ static bool svc_xprt_has_something_to_do(struct svc_xprt *xprt)
 */
 void svc_xprt_enqueue(struct svc_xprt *xprt)
 {
-        struct svc_serv *serv = xprt->xpt_server;
        struct svc_pool *pool;
        struct svc_rqst *rqstp;
        int cpu;
@@ -362,8 +361,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
                                rqstp, rqstp->rq_xprt);
                rqstp->rq_xprt = xprt;
                svc_xprt_get(xprt);
-                rqstp->rq_reserved = serv->sv_max_mesg;
-                atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
                pool->sp_stats.threads_woken++;
                wake_up(&rqstp->rq_wait);
        } else {
@@ -640,8 +637,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
        if (xprt) {
                rqstp->rq_xprt = xprt;
                svc_xprt_get(xprt);
-                rqstp->rq_reserved = serv->sv_max_mesg;
-                atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
                /* As there is a shortage of threads and this request
                 * had to be queued, don't allow the thread to wait so
@@ -738,6 +733,8 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                else
                        len = xprt->xpt_ops->xpo_recvfrom(rqstp);
                dprintk("svc: got len=%d\n", len);
+                rqstp->rq_reserved = serv->sv_max_mesg;
+                atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
        }
        svc_xprt_received(xprt);
@@ -794,7 +791,8 @@ int svc_send(struct svc_rqst *rqstp)
        /* Grab mutex to serialize outgoing data. */
        mutex_lock(&xprt->xpt_mutex);
-        if (test_bit(XPT_DEAD, &xprt->xpt_flags))
+        if (test_bit(XPT_DEAD, &xprt->xpt_flags)
+                        || test_bit(XPT_CLOSE, &xprt->xpt_flags))
                len = -ENOTCONN;
        else
                len = xprt->xpt_ops->xpo_sendto(rqstp);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 18bc130255a7..998aa8c1807c 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1129,9 +1129,9 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
        if (len >= 0)
                svsk->sk_tcplen += len;
        if (len != want) {
+                svc_tcp_save_pages(svsk, rqstp);
                if (len < 0 && len != -EAGAIN)
                        goto err_other;
-                svc_tcp_save_pages(svsk, rqstp);
                dprintk("svc: incomplete TCP record (%d of %d)\n",
                        svsk->sk_tcplen, svsk->sk_reclen);
                goto err_noclose;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index a5a402a7d21f..5d7f61d7559c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -969,11 +969,11 @@ static bool xprt_dynamic_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
        return false;
 }
-static void xprt_alloc_slot(struct rpc_task *task)
+void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
 {
-        struct rpc_xprt *xprt = task->tk_xprt;
        struct rpc_rqst *req;
+        spin_lock(&xprt->reserve_lock);
        if (!list_empty(&xprt->free)) {
                req = list_entry(xprt->free.next, struct rpc_rqst, rq_list);
                list_del(&req->rq_list);
@@ -994,12 +994,29 @@ static void xprt_alloc_slot(struct rpc_task *task)
        default:
                task->tk_status = -EAGAIN;
        }
+        spin_unlock(&xprt->reserve_lock);
        return;
 out_init_req:
        task->tk_status = 0;
        task->tk_rqstp = req;
        xprt_request_init(task, xprt);
+        spin_unlock(&xprt->reserve_lock);
+}
+EXPORT_SYMBOL_GPL(xprt_alloc_slot);
+void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
+{
+        /* Note: grabbing the xprt_lock_write() ensures that we throttle
+         * new slot allocation if the transport is congested (i.e. when
+         * reconnecting a stream transport or when out of socket write
+         * buffer space).
+         */
+        if (xprt_lock_write(xprt, task)) {
+                xprt_alloc_slot(xprt, task);
+                xprt_release_write(xprt, task);
+        }
 }
+EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_slot);
 static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
 {
@@ -1083,20 +1100,9 @@ void xprt_reserve(struct rpc_task *task)
        if (task->tk_rqstp != NULL)
                return;
-        /* Note: grabbing the xprt_lock_write() here is not strictly needed,
-         * but ensures that we throttle new slot allocation if the transport
-         * is congested (e.g. if reconnecting or if we're out of socket
-         * write buffer space).
-         */
        task->tk_timeout = 0;
        task->tk_status = -EAGAIN;
-        if (!xprt_lock_write(xprt, task))
+        xprt->ops->alloc_slot(xprt, task);
-                return;
-        spin_lock(&xprt->reserve_lock);
-        xprt_alloc_slot(task);
-        spin_unlock(&xprt->reserve_lock);
-        xprt_release_write(xprt, task);
 }
 static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 06cdbff79e4a..5d9202dc7cb1 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -713,6 +713,7 @@ static void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
 static struct rpc_xprt_ops xprt_rdma_procs = {
        .reserve_xprt           = xprt_rdma_reserve_xprt,
        .release_xprt           = xprt_release_xprt_cong, /* sunrpc/xprt.c */
+        .alloc_slot             = xprt_alloc_slot,
        .release_request        = xprt_release_rqst_cong,       /* ditto */
        .set_retrans_timeout    = xprt_set_retrans_timeout_def, /* ditto */
        .rpcbind                = rpcb_getport_async,   /* sunrpc/rpcb_clnt.c */
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 400567243f84..a35b8e52e551 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2473,6 +2473,7 @@ static void bc_destroy(struct rpc_xprt *xprt)
 static struct rpc_xprt_ops xs_local_ops = {
        .reserve_xprt           = xprt_reserve_xprt,
        .release_xprt           = xs_tcp_release_xprt,
+        .alloc_slot             = xprt_alloc_slot,
        .rpcbind                = xs_local_rpcbind,
        .set_port               = xs_local_set_port,
        .connect                = xs_connect,
@@ -2489,6 +2490,7 @@ static struct rpc_xprt_ops xs_udp_ops = {
        .set_buffer_size        = xs_udp_set_buffer_size,
        .reserve_xprt           = xprt_reserve_xprt_cong,
        .release_xprt           = xprt_release_xprt_cong,
+        .alloc_slot             = xprt_alloc_slot,
        .rpcbind                = rpcb_getport_async,
        .set_port               = xs_set_port,
        .connect                = xs_connect,
@@ -2506,6 +2508,7 @@ static struct rpc_xprt_ops xs_udp_ops = {
 static struct rpc_xprt_ops xs_tcp_ops = {
        .reserve_xprt           = xprt_reserve_xprt,
        .release_xprt           = xs_tcp_release_xprt,
+        .alloc_slot             = xprt_lock_and_alloc_slot,
        .rpcbind                = rpcb_getport_async,
        .set_port               = xs_set_port,
        .connect                = xs_connect,
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e4768c180da2..c5ee4ff61364 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1450,7 +1450,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
        wait_for_unix_gc();
-        err = scm_send(sock, msg, siocb->scm);
+        err = scm_send(sock, msg, siocb->scm, false);
        if (err < 0)
                return err;
@@ -1619,7 +1619,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
        wait_for_unix_gc();
-        err = scm_send(sock, msg, siocb->scm);
+        err = scm_send(sock, msg, siocb->scm, false);
        if (err < 0)
                return err;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 97026f3b215a..1e37dbf00cb3 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5633,8 +5633,10 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                       sizeof(connect.ht_capa_mask));
        if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
-                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
+                        kfree(connkeys);
                        return -EINVAL;
+                }
                memcpy(&connect.ht_capa,
                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
                       sizeof(connect.ht_capa));
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 54a0dc2e2f8d..ab2bb42fe094 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -212,7 +212,7 @@ resume:
                /* only the first xfrm gets the encap type */
                encap_type = 0;
-                if (async && x->repl->check(x, skb, seq)) {
+                if (async && x->repl->recheck(x, skb, seq)) {
                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
                        goto drop_unlock;
                }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index c5a5165a5927..5a2aa17e4d3c 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1357,6 +1357,8 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
                memset(dst + 1, 0, sizeof(*xdst) - sizeof(*dst));
                xdst->flo.ops = &xfrm_bundle_fc_ops;
+                if (afinfo->init_dst)
+                        afinfo->init_dst(net, xdst);
        } else
                xdst = ERR_PTR(-ENOBUFS);
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 2f6d11d04a2b..3efb07d3eb27 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -420,6 +420,18 @@ err:
        return -EINVAL;
 }
+static int xfrm_replay_recheck_esn(struct xfrm_state *x,
+                                   struct sk_buff *skb, __be32 net_seq)
+{
+        if (unlikely(XFRM_SKB_CB(skb)->seq.input.hi !=
+                     htonl(xfrm_replay_seqhi(x, net_seq)))) {
+                        x->stats.replay_window++;
+                        return -EINVAL;
+        }
+        return xfrm_replay_check_esn(x, skb, net_seq);
+}
 static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
 {
        unsigned int bitnr, nr, i;
@@ -479,6 +491,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
 static struct xfrm_replay xfrm_replay_legacy = {
        .advance        = xfrm_replay_advance,
        .check          = xfrm_replay_check,
+        .recheck        = xfrm_replay_check,
        .notify         = xfrm_replay_notify,
        .overflow       = xfrm_replay_overflow,
 };
@@ -486,6 +499,7 @@ static struct xfrm_replay xfrm_replay_legacy = {
 static struct xfrm_replay xfrm_replay_bmp = {
        .advance        = xfrm_replay_advance_bmp,
        .check          = xfrm_replay_check_bmp,
+        .recheck        = xfrm_replay_check_bmp,
        .notify         = xfrm_replay_notify_bmp,
        .overflow       = xfrm_replay_overflow_bmp,
 };
@@ -493,6 +507,7 @@ static struct xfrm_replay xfrm_replay_bmp = {
 static struct xfrm_replay xfrm_replay_esn = {
        .advance        = xfrm_replay_advance_esn,
        .check          = xfrm_replay_check_esn,
+        .recheck        = xfrm_replay_recheck_esn,
        .notify         = xfrm_replay_notify_bmp,
        .overflow       = xfrm_replay_overflow_esn,
 };
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 87cd0e4d4282..210be48d8ae3 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1994,8 +1994,10 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
                goto error;
        x->outer_mode = xfrm_get_mode(x->props.mode, family);
-        if (x->outer_mode == NULL)
+        if (x->outer_mode == NULL) {
+                err = -EPROTONOSUPPORT;
                goto error;
+        }
        if (init_replay) {
                err = xfrm_init_replay(x);
diff --git a/scripts/Makefile.fwinst b/scripts/Makefile.fwinst
index 6bf8e87f1dcf..c3f69ae275d1 100644
--- a/scripts/Makefile.fwinst
+++ b/scripts/Makefile.fwinst
@@ -42,7 +42,7 @@ quiet_cmd_install = INSTALL $(subst $(srctree)/,,$@)
 $(installed-fw-dirs):
        $(call cmd,mkdir)
-$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $(INSTALL_FW_PATH)/$$(dir %)
+$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $$(dir $(INSTALL_FW_PATH)/%)
        $(call cmd,install)
 PHONY +=  __fw_install __fw_modinst FORCE
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 913d6bdfdda3..ca05ba217f5f 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3016,7 +3016,8 @@ sub process {
                                        $herectx .= raw_line($linenr, $n) . "\n";
                                }
-                                if (($stmts =~ tr/;/;/) == 1) {
+                                if (($stmts =~ tr/;/;/) == 1 &&
+                                    $stmts !~ /^\s*(if|while|for|switch)\b/) {
                                        WARN("SINGLE_STATEMENT_DO_WHILE_MACRO",
                                             "Single statement macros should not use a do {} while (0) loop\n" . "$herectx");
                                }
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 9b0c0b8b4ab4..8fd107a3fac4 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1786,6 +1786,7 @@ sub dump_function($$) {
    $prototype =~ s/__init +//;
    $prototype =~ s/__init_or_module +//;
    $prototype =~ s/__must_check +//;
+    $prototype =~ s/__weak +//;
    $prototype =~ s/^#\s*define\s+//; #ak added
    $prototype =~ s/__attribute__\s*\(\([a-z,]*\)\)//;
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 4629038c9e5a..b3d907eb93a9 100644
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -74,8 +74,13 @@ kallsyms()
        info KSYM ${2}
        local kallsymopt;
+        if [ -n "${CONFIG_SYMBOL_PREFIX}" ]; then
+                kallsymopt="${kallsymopt} \
+                            --symbol-prefix=${CONFIG_SYMBOL_PREFIX}"
+        fi
        if [ -n "${CONFIG_KALLSYMS_ALL}" ]; then
-                kallsymopt=--all-symbols
+                kallsymopt="${kallsymopt} --all-symbols"
        fi
        local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}               \
@@ -211,7 +216,7 @@ if [ -n "${CONFIG_KALLSYMS}" ]; then
        if ! cmp -s System.map .tmp_System.map; then
                echo >&2 Inconsistent kallsyms data
-                echo >&2 echo Try "make KALLSYMS_EXTRA_PASS=1" as a workaround
+                echo >&2 Try "make KALLSYMS_EXTRA_PASS=1" as a workaround
                cleanup
                exit 1
        fi
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index d51b7c76c37d..0cc99a3ea42d 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -279,12 +279,9 @@ static int yama_ptrace_access_check(struct task_struct *child,
        }
        if (rc) {
-                char name[sizeof(current->comm)];
                printk_ratelimited(KERN_NOTICE
                        "ptrace of pid %d was attempted by: %s (pid %d)\n",
-                        child->pid,
+                        child->pid, current->comm, current->pid);
-                        get_task_comm(name, current),
-                        current->pid);
        }
        return rc;
@@ -319,12 +316,9 @@ static int yama_ptrace_traceme(struct task_struct *parent)
        }
        if (rc) {
-                char name[sizeof(current->comm)];
                printk_ratelimited(KERN_NOTICE
                        "ptraceme of pid %d was attempted by: %s (pid %d)\n",
-                        current->pid,
+                        current->pid, parent->comm, parent->pid);
-                        get_task_comm(name, parent),
-                        parent->pid);
        }
        return rc;
diff --git a/tools/perf/util/python-ext-sources b/tools/perf/util/python-ext-sources
index 2884e67ee625..213362850abd 100644
--- a/tools/perf/util/python-ext-sources
+++ b/tools/perf/util/python-ext-sources
@@ -10,10 +10,12 @@ util/ctype.c
 util/evlist.c
 util/evsel.c
 util/cpumap.c
+util/hweight.c
 util/thread_map.c
 util/util.c
 util/xyarray.c
 util/cgroup.c
 util/debugfs.c
+util/rblist.c
 util/strlist.c
 ../../lib/rbtree.c
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 246852397e30..d617f69131d7 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1976,9 +1976,10 @@ static long kvm_vcpu_compat_ioctl(struct file *filp,
                        if (copy_from_user(&csigset, sigmask_arg->sigset,
                                           sizeof csigset))
                                goto out;
-                }
+                        sigset_from_compat(&sigset, &csigset);
-                sigset_from_compat(&sigset, &csigset);
+                        r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
-                r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
+                } else
+                        r = kvm_vcpu_ioctl_set_sigmask(vcpu, NULL);
                break;
        }
        default: