114 files changed, 1779 insertions, 1085 deletions

diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index b638e50cf8f6..2f7fd4360848 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -50,7 +50,9 @@
 
      <sect1><title>Delaying, scheduling, and timer routines</title>
 !Iinclude/linux/sched.h
-!Ekernel/sched.c
+!Ekernel/sched/core.c
+!Ikernel/sched/cpupri.c
+!Ikernel/sched/fair.c
 !Iinclude/linux/completion.h
 !Ekernel/timer.c
      </sect1>
@@ -216,7 +218,6 @@ X!Isound/sound_firmware.c
 
   <chapter id="uart16x50">
      <title>16x50 UART Driver</title>
-!Iinclude/linux/serial_core.h
 !Edrivers/tty/serial/serial_core.c
 !Edrivers/tty/serial/8250.c
   </chapter>
diff --git a/Documentation/DocBook/deviceiobook.tmpl b/Documentation/DocBook/deviceiobook.tmpl
index c1ed6a49e598..54199a0dcf9a 100644
--- a/Documentation/DocBook/deviceiobook.tmpl
+++ b/Documentation/DocBook/deviceiobook.tmpl
@@ -317,7 +317,7 @@ CPU B:  spin_unlock_irqrestore(&amp;dev_lock, flags)
   <chapter id="pubfunctions">
      <title>Public Functions Provided</title>
 !Iarch/x86/include/asm/io.h
-!Elib/iomap.c
+!Elib/pci_iomap.c
   </chapter>
 
 </book>
diff --git a/MAINTAINERS b/MAINTAINERS
index 89b70df91f4f..93c68d5f1cf4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2246,6 +2246,17 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/teigland/dlm.git
 S:      Supported
 F:      fs/dlm/
 
+DMA BUFFER SHARING FRAMEWORK
+M:      Sumit Semwal <sumit.semwal@linaro.org>
+S:      Maintained
+L:      linux-media@vger.kernel.org
+L:      dri-devel@lists.freedesktop.org
+L:      linaro-mm-sig@lists.linaro.org
+F:      drivers/base/dma-buf*
+F:      include/linux/dma-buf*
+F:      Documentation/dma-buf-sharing.txt
+T:      git git://git.linaro.org/people/sumitsemwal/linux-dma-buf.git
+
 DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
 M:      Vinod Koul <vinod.koul@intel.com>
 M:      Dan Williams <dan.j.williams@intel.com>
diff --git a/Makefile b/Makefile
index 156ac69c961e..71e6ed21dd15 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
-PATCHLEVEL = 2
+PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION =
+EXTRAVERSION = -rc1
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 40319d91bb7f..1683bfb9166f 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -160,7 +160,6 @@ machine-$(CONFIG_ARCH_MSM)		:= msm
 machine-$(CONFIG_ARCH_MV78XX0)          := mv78xx0
 machine-$(CONFIG_ARCH_IMX_V4_V5)        := imx
 machine-$(CONFIG_ARCH_IMX_V6_V7)        := imx
-machine-$(CONFIG_ARCH_MX5)              := mx5
 machine-$(CONFIG_ARCH_MXS)              := mxs
 machine-$(CONFIG_ARCH_NETX)             := netx
 machine-$(CONFIG_ARCH_NOMADIK)          := nomadik
diff --git a/arch/arm/configs/mx5_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index d0d8dfece37e..3a4fb2e5fc68 100644
--- a/arch/arm/configs/mx5_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -3,6 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_KERNEL_LZO=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=18
+CONFIG_CGROUPS=y
 CONFIG_RELAY=y
 CONFIG_EXPERT=y
 # CONFIG_SLUB_DEBUG is not set
@@ -14,20 +15,31 @@ CONFIG_MODULE_SRCVERSION_ALL=y
 # CONFIG_LBDAF is not set
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_ARCH_MXC=y
-CONFIG_ARCH_MX5=y
-CONFIG_MACH_MX51_BABBAGE=y
+CONFIG_MACH_MX31LILLY=y
+CONFIG_MACH_MX31LITE=y
+CONFIG_MACH_PCM037=y
+CONFIG_MACH_PCM037_EET=y
+CONFIG_MACH_MX31_3DS=y
+CONFIG_MACH_MX31MOBOARD=y
+CONFIG_MACH_QONG=y
+CONFIG_MACH_ARMADILLO5X0=y
+CONFIG_MACH_KZM_ARM11_01=y
+CONFIG_MACH_PCM043=y
+CONFIG_MACH_MX35_3DS=y
+CONFIG_MACH_EUKREA_CPUIMX35=y
+CONFIG_MACH_VPR200=y
+CONFIG_MACH_IMX51_DT=y
 CONFIG_MACH_MX51_3DS=y
 CONFIG_MACH_EUKREA_CPUIMX51=y
 CONFIG_MACH_EUKREA_CPUIMX51SD=y
 CONFIG_MACH_MX51_EFIKAMX=y
 CONFIG_MACH_MX51_EFIKASB=y
-CONFIG_MACH_MX53_EVK=y
-CONFIG_MACH_MX53_SMD=y
-CONFIG_MACH_MX53_LOCO=y
-CONFIG_MACH_MX53_ARD=y
+CONFIG_MACH_IMX53_DT=y
+CONFIG_SOC_IMX6Q=y
 CONFIG_MXC_PWM=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
+CONFIG_SMP=y
 CONFIG_VMSPLIT_2G=y
 CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_AEABI=y
@@ -49,7 +61,7 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
 # CONFIG_INET_LRO is not set
-# CONFIG_IPV6 is not set
+CONFIG_IPV6=y
 # CONFIG_WIRELESS is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
@@ -68,24 +80,20 @@ CONFIG_SCSI_SCAN_ASYNC=y
 CONFIG_ATA=y
 CONFIG_PATA_IMX=y
 CONFIG_NETDEVICES=y
-CONFIG_MII=m
-CONFIG_MARVELL_PHY=y
-CONFIG_DAVICOM_PHY=y
-CONFIG_QSEMI_PHY=y
-CONFIG_LXT_PHY=y
-CONFIG_CICADA_PHY=y
-CONFIG_VITESSE_PHY=y
-CONFIG_SMSC_PHY=y
-CONFIG_BROADCOM_PHY=y
-CONFIG_ICPLUS_PHY=y
-CONFIG_REALTEK_PHY=y
-CONFIG_NATIONAL_PHY=y
-CONFIG_STE10XP=y
-CONFIG_LSI_ET1011C_PHY=y
-CONFIG_MICREL_PHY=y
-CONFIG_NET_ETHERNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_CHELSIO is not set
+# CONFIG_NET_VENDOR_FARADAY is not set
+CONFIG_FEC=y
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROCHIP is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+CONFIG_SMC91X=y
+CONFIG_SMC911X=y
+CONFIG_SMSC911X=y
+# CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_WLAN is not set
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_EVDEV=y
@@ -124,7 +132,6 @@ CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_MXC=y
 CONFIG_USB_STORAGE=y
 CONFIG_MMC=y
-CONFIG_MMC_BLOCK=m
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_ESDHC_IMX=y
@@ -133,6 +140,8 @@ CONFIG_LEDS_CLASS=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_INTF_DEV_UIE_EMUL=y
 CONFIG_RTC_MXC=y
+CONFIG_DMADEVICES=y
+CONFIG_IMX_SDMA=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_XATTR=y
 CONFIG_EXT2_FS_POSIX_ACL=y
diff --git a/arch/arm/configs/mx3_defconfig b/arch/arm/configs/mx3_defconfig
deleted file mode 100644
index cb0717fbb03d..000000000000
--- a/arch/arm/configs/mx3_defconfig
+++ /dev/null
@@ -1,144 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-CONFIG_SYSVIPC=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EXPERT=y
-CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODULE_FORCE_UNLOAD=y
-CONFIG_MODVERSIONS=y
-# CONFIG_BLK_DEV_BSG is not set
-CONFIG_ARCH_MXC=y
-CONFIG_MACH_MX31ADS_WM1133_EV1=y
-CONFIG_MACH_MX31LILLY=y
-CONFIG_MACH_MX31LITE=y
-CONFIG_MACH_PCM037=y
-CONFIG_MACH_PCM037_EET=y
-CONFIG_MACH_MX31_3DS=y
-CONFIG_MACH_MX31MOBOARD=y
-CONFIG_MACH_QONG=y
-CONFIG_MACH_ARMADILLO5X0=y
-CONFIG_MACH_KZM_ARM11_01=y
-CONFIG_MACH_PCM043=y
-CONFIG_MACH_MX35_3DS=y
-CONFIG_MACH_EUKREA_CPUIMX35=y
-CONFIG_MXC_IRQ_PRIOR=y
-CONFIG_MXC_PWM=y
-CONFIG_ARM_ERRATA_411920=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_PREEMPT=y
-CONFIG_AEABI=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="noinitrd console=ttymxc0,115200 root=/dev/mtdblock2 rw ip=off"
-CONFIG_VFP=y
-CONFIG_PM_DEBUG=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET_XFRM_MODE_TUNNEL is not set
-# CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
-# CONFIG_INET_DIAG is not set
-# CONFIG_IPV6 is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_FW_LOADER=m
-CONFIG_MTD=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_NAND=y
-CONFIG_MTD_NAND_MXC=y
-CONFIG_MTD_UBI=y
-# CONFIG_BLK_DEV is not set
-CONFIG_MISC_DEVICES=y
-CONFIG_EEPROM_AT24=y
-CONFIG_NETDEVICES=y
-CONFIG_SMSC_PHY=y
-CONFIG_NET_ETHERNET=y
-CONFIG_SMSC911X=y
-CONFIG_DNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
-# CONFIG_INPUT_MOUSEDEV is not set
-# CONFIG_KEYBOARD_ATKBD is not set
-CONFIG_KEYBOARD_IMX=y
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-# CONFIG_VT is not set
-# CONFIG_LEGACY_PTYS is not set
-CONFIG_SERIAL_8250=m
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-CONFIG_SERIAL_IMX=y
-CONFIG_SERIAL_IMX_CONSOLE=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_IMX=y
-CONFIG_SPI=y
-CONFIG_W1=y
-CONFIG_W1_MASTER_MXC=y
-CONFIG_W1_SLAVE_THERM=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_IMX2_WDT=y
-CONFIG_MFD_WM8350_I2C=y
-CONFIG_REGULATOR=y
-CONFIG_REGULATOR_WM8350=y
-CONFIG_MEDIA_SUPPORT=y
-CONFIG_VIDEO_DEV=y
-# CONFIG_RC_CORE is not set
-# CONFIG_MEDIA_TUNER_CUSTOMISE is not set
-CONFIG_SOC_CAMERA=y
-CONFIG_SOC_CAMERA_MT9M001=y
-CONFIG_SOC_CAMERA_MT9M111=y
-CONFIG_SOC_CAMERA_MT9T031=y
-CONFIG_SOC_CAMERA_MT9V022=y
-CONFIG_SOC_CAMERA_TW9910=y
-CONFIG_SOC_CAMERA_OV772X=y
-CONFIG_VIDEO_MX3=y
-# CONFIG_RADIO_ADAPTERS is not set
-CONFIG_FB=y
-CONFIG_SOUND=y
-CONFIG_SND=y
-# CONFIG_SND_ARM is not set
-# CONFIG_SND_SPI is not set
-CONFIG_SND_SOC=y
-CONFIG_SND_IMX_SOC=y
-CONFIG_SND_MXC_SOC_WM1133_EV1=y
-CONFIG_SND_SOC_PHYCORE_AC97=y
-CONFIG_SND_SOC_EUKREA_TLV320=y
-CONFIG_USB=y
-CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_EHCI_MXC=y
-CONFIG_USB_GADGET=m
-CONFIG_USB_FSL_USB2=m
-CONFIG_USB_G_SERIAL=m
-CONFIG_USB_ULPI=y
-CONFIG_MMC=y
-CONFIG_MMC_MXC=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_MXC=y
-CONFIG_DMADEVICES=y
-# CONFIG_DNOTIFY is not set
-CONFIG_TMPFS=y
-CONFIG_JFFS2_FS=y
-CONFIG_UBIFS_FS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_NFS_V4=y
-CONFIG_ROOT_NFS=y
-# CONFIG_ENABLE_WARN_DEPRECATED is not set
-# CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-# CONFIG_CRYPTO_ANSI_CPRNG is not set
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 0e6de366c648..09f357bcecde 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -22,6 +22,18 @@ config ARCH_MX25
 config MACH_MX27
         bool
 
+config ARCH_MX5
+        bool
+
+config ARCH_MX50
+        bool
+
+config ARCH_MX51
+        bool
+
+config ARCH_MX53
+        bool
+
 config SOC_IMX1
         bool
         select ARCH_MX1
@@ -73,6 +85,32 @@ config SOC_IMX35
         select MXC_AVIC
         select SMP_ON_UP if SMP
 
+config SOC_IMX5
+        select CPU_V7
+        select ARM_L1_CACHE_SHIFT_6
+        select MXC_TZIC
+        select ARCH_MXC_IOMUX_V3
+        select ARCH_MXC_AUDMUX_V2
+        select ARCH_HAS_CPUFREQ
+        select ARCH_MX5
+        bool
+
+config SOC_IMX50
+        bool
+        select SOC_IMX5
+        select ARCH_MX50
+
+config  SOC_IMX51
+        bool
+        select SOC_IMX5
+        select ARCH_MX5
+        select ARCH_MX51
+
+config  SOC_IMX53
+        bool
+        select SOC_IMX5
+        select ARCH_MX5
+        select ARCH_MX53
 
 if ARCH_IMX_V4_V5
 
@@ -592,6 +630,207 @@ config MACH_VPR200
           Include support for VPR200 platform. This includes specific
           configurations for the board and its peripherals.
 
+comment "i.MX5 platforms:"
+
+config MACH_MX50_RDP
+        bool "Support MX50 reference design platform"
+        depends on BROKEN
+        select SOC_IMX50
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select IMX_HAVE_PLATFORM_SPI_IMX
+        help
+          Include support for MX50 reference design platform (RDP) board. This
+          includes specific configurations for the board and its peripherals.
+
+comment "i.MX51 machines:"
+
+config MACH_IMX51_DT
+        bool "Support i.MX51 platforms from device tree"
+        select SOC_IMX51
+        select USE_OF
+        select MACH_MX51_BABBAGE
+        help
+          Include support for Freescale i.MX51 based platforms
+          using the device tree for discovery
+
+config MACH_MX51_BABBAGE
+        bool "Support MX51 BABBAGE platforms"
+        select SOC_IMX51
+        select IMX_HAVE_PLATFORM_FSL_USB2_UDC
+        select IMX_HAVE_PLATFORM_IMX2_WDT
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_MXC_EHCI
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select IMX_HAVE_PLATFORM_SPI_IMX
+        help
+          Include support for MX51 Babbage platform, also known as MX51EVK in
+          u-boot. This includes specific configurations for the board and its
+          peripherals.
+
+config MACH_MX51_3DS
+        bool "Support MX51PDK (3DS)"
+        select SOC_IMX51
+        select IMX_HAVE_PLATFORM_IMX2_WDT
+        select IMX_HAVE_PLATFORM_IMX_KEYPAD
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select IMX_HAVE_PLATFORM_SPI_IMX
+        select MXC_DEBUG_BOARD
+        help
+          Include support for MX51PDK (3DS) platform. This includes specific
+          configurations for the board and its peripherals.
+
+config MACH_EUKREA_CPUIMX51
+        bool "Support Eukrea CPUIMX51 module"
+        select SOC_IMX51
+        select IMX_HAVE_PLATFORM_FSL_USB2_UDC
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_MXC_EHCI
+        select IMX_HAVE_PLATFORM_MXC_NAND
+        select IMX_HAVE_PLATFORM_SPI_IMX
+        help
+          Include support for Eukrea CPUIMX51 platform. This includes
+          specific configurations for the module and its peripherals.
+
+choice
+        prompt "Baseboard"
+        depends on MACH_EUKREA_CPUIMX51
+        default MACH_EUKREA_MBIMX51_BASEBOARD
+
+config MACH_EUKREA_MBIMX51_BASEBOARD
+        prompt "Eukrea MBIMX51 development board"
+        bool
+        select IMX_HAVE_PLATFORM_IMX_KEYPAD
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select LEDS_GPIO_REGISTER
+        help
+          This adds board specific devices that can be found on Eukrea's
+          MBIMX51 evaluation board.
+
+endchoice
+
+config MACH_EUKREA_CPUIMX51SD
+        bool "Support Eukrea CPUIMX51SD module"
+        select SOC_IMX51
+        select IMX_HAVE_PLATFORM_FSL_USB2_UDC
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_MXC_EHCI
+        select IMX_HAVE_PLATFORM_MXC_NAND
+        select IMX_HAVE_PLATFORM_SPI_IMX
+        help
+          Include support for Eukrea CPUIMX51SD platform. This includes
+          specific configurations for the module and its peripherals.
+
+choice
+        prompt "Baseboard"
+        depends on MACH_EUKREA_CPUIMX51SD
+        default MACH_EUKREA_MBIMXSD51_BASEBOARD
+
+config MACH_EUKREA_MBIMXSD51_BASEBOARD
+        prompt "Eukrea MBIMXSD development board"
+        bool
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select LEDS_GPIO_REGISTER
+        help
+          This adds board specific devices that can be found on Eukrea's
+          MBIMXSD evaluation board.
+
+endchoice
+
+config MX51_EFIKA_COMMON
+        bool
+        select SOC_IMX51
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_MXC_EHCI
+        select IMX_HAVE_PLATFORM_PATA_IMX
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select IMX_HAVE_PLATFORM_SPI_IMX
+        select MXC_ULPI if USB_ULPI
+
+config MACH_MX51_EFIKAMX
+        bool "Support MX51 Genesi Efika MX nettop"
+        select LEDS_GPIO_REGISTER
+        select MX51_EFIKA_COMMON
+        help
+          Include support for Genesi Efika MX nettop. This includes specific
+          configurations for the board and its peripherals.
+
+config MACH_MX51_EFIKASB
+        bool "Support MX51 Genesi Efika Smartbook"
+        select LEDS_GPIO_REGISTER
+        select MX51_EFIKA_COMMON
+        help
+          Include support for Genesi Efika Smartbook. This includes specific
+          configurations for the board and its peripherals.
+
+comment "i.MX53 machines:"
+
+config MACH_IMX53_DT
+        bool "Support i.MX53 platforms from device tree"
+        select SOC_IMX53
+        select USE_OF
+        select MACH_MX53_ARD
+        select MACH_MX53_EVK
+        select MACH_MX53_LOCO
+        select MACH_MX53_SMD
+        help
+          Include support for Freescale i.MX53 based platforms
+          using the device tree for discovery
+
+config MACH_MX53_EVK
+        bool "Support MX53 EVK platforms"
+        select SOC_IMX53
+        select IMX_HAVE_PLATFORM_IMX2_WDT
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select IMX_HAVE_PLATFORM_SPI_IMX
+        select LEDS_GPIO_REGISTER
+        help
+          Include support for MX53 EVK platform. This includes specific
+          configurations for the board and its peripherals.
+
+config MACH_MX53_SMD
+        bool "Support MX53 SMD platforms"
+        select SOC_IMX53
+        select IMX_HAVE_PLATFORM_IMX2_WDT
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        help
+          Include support for MX53 SMD platform. This includes specific
+          configurations for the board and its peripherals.
+
+config MACH_MX53_LOCO
+        bool "Support MX53 LOCO platforms"
+        select SOC_IMX53
+        select IMX_HAVE_PLATFORM_IMX2_WDT
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select IMX_HAVE_PLATFORM_GPIO_KEYS
+        select LEDS_GPIO_REGISTER
+        help
+          Include support for MX53 LOCO platform. This includes specific
+          configurations for the board and its peripherals.
+
+config MACH_MX53_ARD
+        bool "Support MX53 ARD platforms"
+        select SOC_IMX53
+        select IMX_HAVE_PLATFORM_IMX2_WDT
+        select IMX_HAVE_PLATFORM_IMX_I2C
+        select IMX_HAVE_PLATFORM_IMX_UART
+        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
+        select IMX_HAVE_PLATFORM_GPIO_KEYS
+        help
+          Include support for MX53 ARD platform. This includes specific
+          configurations for the board and its peripherals.
+
 comment "i.MX6 family:"
 
 config SOC_IMX6Q
diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index f5920c24f7d7..55db9c488f2b 100644
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -11,6 +11,8 @@ obj-$(CONFIG_SOC_IMX27) += clock-imx27.o mm-imx27.o ehci-imx27.o
 obj-$(CONFIG_SOC_IMX31) += mm-imx3.o cpu-imx31.o clock-imx31.o iomux-imx31.o ehci-imx31.o
 obj-$(CONFIG_SOC_IMX35) += mm-imx3.o cpu-imx35.o clock-imx35.o ehci-imx35.o
 
+obj-$(CONFIG_SOC_IMX5) += cpu-imx5.o mm-imx5.o clock-mx51-mx53.o ehci-imx5.o pm-imx5.o cpu_op-mx51.o
+
 # Support for CMOS sensor interface
 obj-$(CONFIG_MX1_VIDEO) += mx1-camera-fiq.o mx1-camera-fiq-ksym.o
 
@@ -75,3 +77,22 @@ obj-$(CONFIG_SOC_IMX6Q) += clock-imx6q.o mach-imx6q.o
 ifeq ($(CONFIG_PM),y)
 obj-$(CONFIG_SOC_IMX6Q) += pm-imx6q.o
 endif
+
+# i.MX5 based machines
+obj-$(CONFIG_MACH_MX51_BABBAGE) += mach-mx51_babbage.o
+obj-$(CONFIG_MACH_MX51_3DS) += mach-mx51_3ds.o
+obj-$(CONFIG_MACH_MX53_EVK) += mach-mx53_evk.o
+obj-$(CONFIG_MACH_MX53_SMD) += mach-mx53_smd.o
+obj-$(CONFIG_MACH_MX53_LOCO) += mach-mx53_loco.o
+obj-$(CONFIG_MACH_MX53_ARD) += mach-mx53_ard.o
+obj-$(CONFIG_MACH_EUKREA_CPUIMX51) += mach-cpuimx51.o
+obj-$(CONFIG_MACH_EUKREA_MBIMX51_BASEBOARD) += eukrea_mbimx51-baseboard.o
+obj-$(CONFIG_MACH_EUKREA_CPUIMX51SD) += mach-cpuimx51sd.o
+obj-$(CONFIG_MACH_EUKREA_MBIMXSD51_BASEBOARD) += eukrea_mbimxsd-baseboard.o
+obj-$(CONFIG_MX51_EFIKA_COMMON) += mx51_efika.o
+obj-$(CONFIG_MACH_MX51_EFIKAMX) += mach-mx51_efikamx.o
+obj-$(CONFIG_MACH_MX51_EFIKASB) += mach-mx51_efikasb.o
+obj-$(CONFIG_MACH_MX50_RDP) += mach-mx50_rdp.o
+
+obj-$(CONFIG_MACH_IMX51_DT) += imx51-dt.o
+obj-$(CONFIG_MACH_IMX53_DT) += imx53-dt.o
diff --git a/arch/arm/mach-imx/Makefile.boot b/arch/arm/mach-imx/Makefile.boot
index 5f4d06af4912..6dfdbcc83afd 100644
--- a/arch/arm/mach-imx/Makefile.boot
+++ b/arch/arm/mach-imx/Makefile.boot
@@ -22,6 +22,18 @@ zreladdr-$(CONFIG_SOC_IMX35)	+= 0x80008000
 params_phys-$(CONFIG_SOC_IMX35) := 0x80000100
 initrd_phys-$(CONFIG_SOC_IMX35) := 0x80800000
 
+zreladdr-$(CONFIG_SOC_IMX50)    += 0x70008000
+params_phys-$(CONFIG_SOC_IMX50) := 0x70000100
+initrd_phys-$(CONFIG_SOC_IMX50) := 0x70800000
+
+zreladdr-$(CONFIG_SOC_IMX51)    += 0x90008000
+params_phys-$(CONFIG_SOC_IMX51) := 0x90000100
+initrd_phys-$(CONFIG_SOC_IMX51) := 0x90800000
+
+zreladdr-$(CONFIG_SOC_IMX53)    += 0x70008000
+params_phys-$(CONFIG_SOC_IMX53) := 0x70000100
+initrd_phys-$(CONFIG_SOC_IMX53) := 0x70800000
+
 zreladdr-$(CONFIG_SOC_IMX6Q)    += 0x10008000
 params_phys-$(CONFIG_SOC_IMX6Q) := 0x10000100
 initrd_phys-$(CONFIG_SOC_IMX6Q) := 0x10800000
diff --git a/arch/arm/mach-mx5/clock-mx51-mx53.c b/arch/arm/mach-imx/clock-mx51-mx53.c
index 4cb276977190..08470504a088 100644
--- a/arch/arm/mach-mx5/clock-mx51-mx53.c
+++ b/arch/arm/mach-imx/clock-mx51-mx53.c
@@ -23,7 +23,7 @@
 #include <mach/common.h>
 #include <mach/clock.h>
 
-#include "crm_regs.h"
+#include "crm-regs-imx5.h"
 
 /* External clock values passed-in by the board code */
 static unsigned long external_high_reference, external_low_reference;
diff --git a/arch/arm/mach-mx5/cpu.c b/arch/arm/mach-imx/cpu-imx5.c
index 5e2e7a843860..5e2e7a843860 100644
--- a/arch/arm/mach-mx5/cpu.c
+++ b/arch/arm/mach-imx/cpu-imx5.c
diff --git a/arch/arm/mach-mx5/cpu_op-mx51.c b/arch/arm/mach-imx/cpu_op-mx51.c
index 9d34c3d4c024..9d34c3d4c024 100644
--- a/arch/arm/mach-mx5/cpu_op-mx51.c
+++ b/arch/arm/mach-imx/cpu_op-mx51.c
diff --git a/arch/arm/mach-mx5/cpu_op-mx51.h b/arch/arm/mach-imx/cpu_op-mx51.h
index 97477fecb469..97477fecb469 100644
--- a/arch/arm/mach-mx5/cpu_op-mx51.h
+++ b/arch/arm/mach-imx/cpu_op-mx51.h
diff --git a/arch/arm/mach-mx5/crm_regs.h b/arch/arm/mach-imx/crm-regs-imx5.h
index 5e11ba7daee2..5e11ba7daee2 100644
--- a/arch/arm/mach-mx5/crm_regs.h
+++ b/arch/arm/mach-imx/crm-regs-imx5.h
diff --git a/arch/arm/mach-mx5/devices-imx50.h b/arch/arm/mach-imx/devices-imx50.h
index 7216667eaafc..7216667eaafc 100644
--- a/arch/arm/mach-mx5/devices-imx50.h
+++ b/arch/arm/mach-imx/devices-imx50.h
diff --git a/arch/arm/mach-mx5/devices-imx51.h b/arch/arm/mach-imx/devices-imx51.h
index af488bc0e225..af488bc0e225 100644
--- a/arch/arm/mach-mx5/devices-imx51.h
+++ b/arch/arm/mach-imx/devices-imx51.h
diff --git a/arch/arm/mach-mx5/devices-imx53.h b/arch/arm/mach-imx/devices-imx53.h
index 6e1e5d1f8c3a..6e1e5d1f8c3a 100644
--- a/arch/arm/mach-mx5/devices-imx53.h
+++ b/arch/arm/mach-imx/devices-imx53.h
diff --git a/arch/arm/mach-mx5/efika.h b/arch/arm/mach-imx/efika.h
index 014aa985faae..014aa985faae 100644
--- a/arch/arm/mach-mx5/efika.h
+++ b/arch/arm/mach-imx/efika.h
diff --git a/arch/arm/mach-mx5/ehci.c b/arch/arm/mach-imx/ehci-imx5.c
index c17fa131728b..c17fa131728b 100644
--- a/arch/arm/mach-mx5/ehci.c
+++ b/arch/arm/mach-imx/ehci-imx5.c
diff --git a/arch/arm/mach-mx5/eukrea_mbimx51-baseboard.c b/arch/arm/mach-imx/eukrea_mbimx51-baseboard.c
index a6a3ab8f1b1c..a6a3ab8f1b1c 100644
--- a/arch/arm/mach-mx5/eukrea_mbimx51-baseboard.c
+++ b/arch/arm/mach-imx/eukrea_mbimx51-baseboard.c
diff --git a/arch/arm/mach-mx5/eukrea_mbimxsd-baseboard.c b/arch/arm/mach-imx/eukrea_mbimxsd-baseboard.c
index d817fc80b986..d817fc80b986 100644
--- a/arch/arm/mach-mx5/eukrea_mbimxsd-baseboard.c
+++ b/arch/arm/mach-imx/eukrea_mbimxsd-baseboard.c
diff --git a/arch/arm/mach-mx5/imx51-dt.c b/arch/arm/mach-imx/imx51-dt.c
index e6bad17b908c..e6bad17b908c 100644
--- a/arch/arm/mach-mx5/imx51-dt.c
+++ b/arch/arm/mach-imx/imx51-dt.c
diff --git a/arch/arm/mach-mx5/imx53-dt.c b/arch/arm/mach-imx/imx53-dt.c
index 05ebb3e68679..05ebb3e68679 100644
--- a/arch/arm/mach-mx5/imx53-dt.c
+++ b/arch/arm/mach-imx/imx53-dt.c
diff --git a/arch/arm/mach-mx5/board-cpuimx51.c b/arch/arm/mach-imx/mach-cpuimx51.c
index 944025da8333..944025da8333 100644
--- a/arch/arm/mach-mx5/board-cpuimx51.c
+++ b/arch/arm/mach-imx/mach-cpuimx51.c
diff --git a/arch/arm/mach-mx5/board-cpuimx51sd.c b/arch/arm/mach-imx/mach-cpuimx51sd.c
index 9fbe923c8b08..9fbe923c8b08 100644
--- a/arch/arm/mach-mx5/board-cpuimx51sd.c
+++ b/arch/arm/mach-imx/mach-cpuimx51sd.c
diff --git a/arch/arm/mach-mx5/board-mx50_rdp.c b/arch/arm/mach-imx/mach-mx50_rdp.c
index 42b66e8d9615..42b66e8d9615 100644
--- a/arch/arm/mach-mx5/board-mx50_rdp.c
+++ b/arch/arm/mach-imx/mach-mx50_rdp.c
diff --git a/arch/arm/mach-mx5/board-mx51_3ds.c b/arch/arm/mach-imx/mach-mx51_3ds.c
index 83eab4176ca4..83eab4176ca4 100644
--- a/arch/arm/mach-mx5/board-mx51_3ds.c
+++ b/arch/arm/mach-imx/mach-mx51_3ds.c
diff --git a/arch/arm/mach-mx5/board-mx51_babbage.c b/arch/arm/mach-imx/mach-mx51_babbage.c
index e4b822e9f719..e4b822e9f719 100644
--- a/arch/arm/mach-mx5/board-mx51_babbage.c
+++ b/arch/arm/mach-imx/mach-mx51_babbage.c
diff --git a/arch/arm/mach-mx5/board-mx51_efikamx.c b/arch/arm/mach-imx/mach-mx51_efikamx.c
index 3a5ed2dd885a..3a5ed2dd885a 100644
--- a/arch/arm/mach-mx5/board-mx51_efikamx.c
+++ b/arch/arm/mach-imx/mach-mx51_efikamx.c
diff --git a/arch/arm/mach-mx5/board-mx51_efikasb.c b/arch/arm/mach-imx/mach-mx51_efikasb.c
index ea5f65b0381a..ea5f65b0381a 100644
--- a/arch/arm/mach-mx5/board-mx51_efikasb.c
+++ b/arch/arm/mach-imx/mach-mx51_efikasb.c
diff --git a/arch/arm/mach-mx5/board-mx53_ard.c b/arch/arm/mach-imx/mach-mx53_ard.c
index 5f224f1c3eb6..08dfb7628d2d 100644
--- a/arch/arm/mach-mx5/board-mx53_ard.c
+++ b/arch/arm/mach-imx/mach-mx53_ard.c
@@ -32,7 +32,6 @@
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
 
-#include "crm_regs.h"
 #include "devices-imx53.h"
 
 #define ARD_ETHERNET_INT_B      IMX_GPIO_NR(2, 31)
diff --git a/arch/arm/mach-mx5/board-mx53_evk.c b/arch/arm/mach-imx/mach-mx53_evk.c
index d6ce137896d6..5a72188b9cdb 100644
--- a/arch/arm/mach-mx5/board-mx53_evk.c
+++ b/arch/arm/mach-imx/mach-mx53_evk.c
@@ -37,7 +37,6 @@
 #define EVK_ECSPI1_CS1          IMX_GPIO_NR(3, 19)
 #define MX53EVK_LED             IMX_GPIO_NR(7, 7)
 
-#include "crm_regs.h"
 #include "devices-imx53.h"
 
 static iomux_v3_cfg_t mx53_evk_pads[] = {
diff --git a/arch/arm/mach-mx5/board-mx53_loco.c b/arch/arm/mach-imx/mach-mx53_loco.c
index fd8b524e1c58..37f67cac15a4 100644
--- a/arch/arm/mach-mx5/board-mx53_loco.c
+++ b/arch/arm/mach-imx/mach-mx53_loco.c
@@ -32,7 +32,6 @@
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
 
-#include "crm_regs.h"
 #include "devices-imx53.h"
 
 #define MX53_LOCO_POWER                 IMX_GPIO_NR(1, 8)
diff --git a/arch/arm/mach-mx5/board-mx53_smd.c b/arch/arm/mach-imx/mach-mx53_smd.c
index 22c53c9b18aa..8e972c5c3e13 100644
--- a/arch/arm/mach-mx5/board-mx53_smd.c
+++ b/arch/arm/mach-imx/mach-mx53_smd.c
@@ -31,7 +31,6 @@
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
 
-#include "crm_regs.h"
 #include "devices-imx53.h"
 
 #define SMD_FEC_PHY_RST         IMX_GPIO_NR(7, 6)
diff --git a/arch/arm/mach-mx5/mm.c b/arch/arm/mach-imx/mm-imx5.c
index bc17dfea3817..bc17dfea3817 100644
--- a/arch/arm/mach-mx5/mm.c
+++ b/arch/arm/mach-imx/mm-imx5.c
diff --git a/arch/arm/mach-mx5/mx51_efika.c b/arch/arm/mach-imx/mx51_efika.c
index ec6ca91b299b..ec6ca91b299b 100644
--- a/arch/arm/mach-mx5/mx51_efika.c
+++ b/arch/arm/mach-imx/mx51_efika.c
diff --git a/arch/arm/mach-mx5/system.c b/arch/arm/mach-imx/pm-imx5.c
index 5eebfaad1226..6dc093448057 100644
--- a/arch/arm/mach-mx5/system.c
+++ b/arch/arm/mach-imx/pm-imx5.c
@@ -1,8 +1,6 @@
 /*
- * Copyright (C) 2011 Freescale Semiconductor, Inc. All Rights Reserved.
- */
-
-/*
+ *  Copyright (C) 2011 Freescale Semiconductor, Inc. All Rights Reserved.
+ *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
  * Version 2 or later at the following locations:
@@ -10,14 +8,22 @@
  * http://www.opensource.org/licenses/gpl-license.html
  * http://www.gnu.org/copyleft/gpl.html
  */
-#include <linux/platform_device.h>
+#include <linux/suspend.h>
+#include <linux/clk.h>
 #include <linux/io.h>
-#include <mach/hardware.h>
+#include <linux/err.h>
+#include <asm/cacheflush.h>
+#include <asm/tlbflush.h>
 #include <mach/common.h>
-#include "crm_regs.h"
+#include <mach/hardware.h>
+#include "crm-regs-imx5.h"
+
+static struct clk *gpc_dvfs_clk;
 
-/* set cpu low power mode before WFI instruction. This function is called
-  * mx5 because it can be used for mx50, mx51, and mx53.*/
+/*
+ * set cpu low power mode before WFI instruction. This function is called
+ * mx5 because it can be used for mx50, mx51, and mx53.
+ */
 void mx5_cpu_lp_set(enum mxc_cpu_pwr_mode mode)
 {
         u32 plat_lpc, arm_srpgcr, ccm_clpcr;
@@ -80,3 +86,68 @@ void mx5_cpu_lp_set(enum mxc_cpu_pwr_mode mode)
                 __raw_writel(empgc1, MXC_SRPG_EMPGC1_SRPGCR);
         }
 }
+
+static int mx5_suspend_prepare(void)
+{
+        return clk_enable(gpc_dvfs_clk);
+}
+
+static int mx5_suspend_enter(suspend_state_t state)
+{
+        switch (state) {
+        case PM_SUSPEND_MEM:
+                mx5_cpu_lp_set(STOP_POWER_OFF);
+                break;
+        case PM_SUSPEND_STANDBY:
+                mx5_cpu_lp_set(WAIT_UNCLOCKED_POWER_OFF);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (state == PM_SUSPEND_MEM) {
+                local_flush_tlb_all();
+                flush_cache_all();
+
+                /*clear the EMPGC0/1 bits */
+                __raw_writel(0, MXC_SRPG_EMPGC0_SRPGCR);
+                __raw_writel(0, MXC_SRPG_EMPGC1_SRPGCR);
+        }
+        cpu_do_idle();
+        return 0;
+}
+
+static void mx5_suspend_finish(void)
+{
+        clk_disable(gpc_dvfs_clk);
+}
+
+static int mx5_pm_valid(suspend_state_t state)
+{
+        return (state > PM_SUSPEND_ON && state <= PM_SUSPEND_MAX);
+}
+
+static const struct platform_suspend_ops mx5_suspend_ops = {
+        .valid = mx5_pm_valid,
+        .prepare = mx5_suspend_prepare,
+        .enter = mx5_suspend_enter,
+        .finish = mx5_suspend_finish,
+};
+
+static int __init mx5_pm_init(void)
+{
+        if (!cpu_is_mx51() && !cpu_is_mx53())
+                return 0;
+
+        if (gpc_dvfs_clk == NULL)
+                gpc_dvfs_clk = clk_get(NULL, "gpc_dvfs");
+
+        if (!IS_ERR(gpc_dvfs_clk)) {
+                if (cpu_is_mx51())
+                        suspend_set_ops(&mx5_suspend_ops);
+        } else
+                return -EPERM;
+
+        return 0;
+}
+device_initcall(mx5_pm_init);
diff --git a/arch/arm/mach-mx5/Kconfig b/arch/arm/mach-mx5/Kconfig
deleted file mode 100644
index af0c212e3c7b..000000000000
--- a/arch/arm/mach-mx5/Kconfig
+++ /dev/null
@@ -1,244 +0,0 @@
-if ARCH_MX5
-
-# ARCH_MX5/50/53 are left to mark places where prevent multi-soc in single
-# image. So for most time, SOC_IMX50/51/53 should be used.
-
-config ARCH_MX51
-        bool
-
-config ARCH_MX50
-        bool
-
-config ARCH_MX53
-        bool
-
-config SOC_IMX50
-        bool
-        select CPU_V7
-        select ARM_L1_CACHE_SHIFT_6
-        select MXC_TZIC
-        select ARCH_MXC_IOMUX_V3
-        select ARCH_MXC_AUDMUX_V2
-        select ARCH_HAS_CPUFREQ
-        select ARCH_MX50
-
-config  SOC_IMX51
-        bool
-        select CPU_V7
-        select ARM_L1_CACHE_SHIFT_6
-        select MXC_TZIC
-        select ARCH_MXC_IOMUX_V3
-        select ARCH_MXC_AUDMUX_V2
-        select ARCH_HAS_CPUFREQ
-        select ARCH_MX51
-
-config  SOC_IMX53
-        bool
-        select CPU_V7
-        select ARM_L1_CACHE_SHIFT_6
-        select MXC_TZIC
-        select ARCH_MXC_IOMUX_V3
-        select ARCH_MX53
-
-#comment "i.MX50 machines:"
-
-config MACH_MX50_RDP
-        bool "Support MX50 reference design platform"
-        depends on BROKEN
-        select SOC_IMX50
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select IMX_HAVE_PLATFORM_SPI_IMX
-        help
-          Include support for MX50 reference design platform (RDP) board. This
-          includes specific configurations for the board and its peripherals.
-
-comment "i.MX51 machines:"
-
-config MACH_IMX51_DT
-        bool "Support i.MX51 platforms from device tree"
-        select SOC_IMX51
-        select USE_OF
-        select MACH_MX51_BABBAGE
-        help
-          Include support for Freescale i.MX51 based platforms
-          using the device tree for discovery
-
-config MACH_MX51_BABBAGE
-        bool "Support MX51 BABBAGE platforms"
-        select SOC_IMX51
-        select IMX_HAVE_PLATFORM_FSL_USB2_UDC
-        select IMX_HAVE_PLATFORM_IMX2_WDT
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_MXC_EHCI
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select IMX_HAVE_PLATFORM_SPI_IMX
-        help
-          Include support for MX51 Babbage platform, also known as MX51EVK in
-          u-boot. This includes specific configurations for the board and its
-          peripherals.
-
-config MACH_MX51_3DS
-        bool "Support MX51PDK (3DS)"
-        select SOC_IMX51
-        select IMX_HAVE_PLATFORM_IMX2_WDT
-        select IMX_HAVE_PLATFORM_IMX_KEYPAD
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select IMX_HAVE_PLATFORM_SPI_IMX
-        select MXC_DEBUG_BOARD
-        help
-          Include support for MX51PDK (3DS) platform. This includes specific
-          configurations for the board and its peripherals.
-
-config MACH_EUKREA_CPUIMX51
-        bool "Support Eukrea CPUIMX51 module"
-        select SOC_IMX51
-        select IMX_HAVE_PLATFORM_FSL_USB2_UDC
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_MXC_EHCI
-        select IMX_HAVE_PLATFORM_MXC_NAND
-        select IMX_HAVE_PLATFORM_SPI_IMX
-        help
-          Include support for Eukrea CPUIMX51 platform. This includes
-          specific configurations for the module and its peripherals.
-
-choice
-        prompt "Baseboard"
-        depends on MACH_EUKREA_CPUIMX51
-        default MACH_EUKREA_MBIMX51_BASEBOARD
-
-config MACH_EUKREA_MBIMX51_BASEBOARD
-        prompt "Eukrea MBIMX51 development board"
-        bool
-        select IMX_HAVE_PLATFORM_IMX_KEYPAD
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select LEDS_GPIO_REGISTER
-        help
-          This adds board specific devices that can be found on Eukrea's
-          MBIMX51 evaluation board.
-
-endchoice
-
-config MACH_EUKREA_CPUIMX51SD
-        bool "Support Eukrea CPUIMX51SD module"
-        select SOC_IMX51
-        select IMX_HAVE_PLATFORM_FSL_USB2_UDC
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_MXC_EHCI
-        select IMX_HAVE_PLATFORM_MXC_NAND
-        select IMX_HAVE_PLATFORM_SPI_IMX
-        help
-          Include support for Eukrea CPUIMX51SD platform. This includes
-          specific configurations for the module and its peripherals.
-
-choice
-        prompt "Baseboard"
-        depends on MACH_EUKREA_CPUIMX51SD
-        default MACH_EUKREA_MBIMXSD51_BASEBOARD
-
-config MACH_EUKREA_MBIMXSD51_BASEBOARD
-        prompt "Eukrea MBIMXSD development board"
-        bool
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select LEDS_GPIO_REGISTER
-        help
-          This adds board specific devices that can be found on Eukrea's
-          MBIMXSD evaluation board.
-
-endchoice
-
-config MX51_EFIKA_COMMON
-        bool
-        select SOC_IMX51
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_MXC_EHCI
-        select IMX_HAVE_PLATFORM_PATA_IMX
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select IMX_HAVE_PLATFORM_SPI_IMX
-        select MXC_ULPI if USB_ULPI
-
-config MACH_MX51_EFIKAMX
-        bool "Support MX51 Genesi Efika MX nettop"
-        select LEDS_GPIO_REGISTER
-        select MX51_EFIKA_COMMON
-        help
-          Include support for Genesi Efika MX nettop. This includes specific
-          configurations for the board and its peripherals.
-
-config MACH_MX51_EFIKASB
-        bool "Support MX51 Genesi Efika Smartbook"
-        select LEDS_GPIO_REGISTER
-        select MX51_EFIKA_COMMON
-        help
-          Include support for Genesi Efika Smartbook. This includes specific
-          configurations for the board and its peripherals.
-
-comment "i.MX53 machines:"
-
-config MACH_IMX53_DT
-        bool "Support i.MX53 platforms from device tree"
-        select SOC_IMX53
-        select USE_OF
-        select MACH_MX53_ARD
-        select MACH_MX53_EVK
-        select MACH_MX53_LOCO
-        select MACH_MX53_SMD
-        help
-          Include support for Freescale i.MX53 based platforms
-          using the device tree for discovery
-
-config MACH_MX53_EVK
-        bool "Support MX53 EVK platforms"
-        select SOC_IMX53
-        select IMX_HAVE_PLATFORM_IMX2_WDT
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select IMX_HAVE_PLATFORM_SPI_IMX
-        select LEDS_GPIO_REGISTER
-        help
-          Include support for MX53 EVK platform. This includes specific
-          configurations for the board and its peripherals.
-
-config MACH_MX53_SMD
-        bool "Support MX53 SMD platforms"
-        select SOC_IMX53
-        select IMX_HAVE_PLATFORM_IMX2_WDT
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        help
-          Include support for MX53 SMD platform. This includes specific
-          configurations for the board and its peripherals.
-
-config MACH_MX53_LOCO
-        bool "Support MX53 LOCO platforms"
-        select SOC_IMX53
-        select IMX_HAVE_PLATFORM_IMX2_WDT
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select IMX_HAVE_PLATFORM_GPIO_KEYS
-        select LEDS_GPIO_REGISTER
-        help
-          Include support for MX53 LOCO platform. This includes specific
-          configurations for the board and its peripherals.
-
-config MACH_MX53_ARD
-        bool "Support MX53 ARD platforms"
-        select SOC_IMX53
-        select IMX_HAVE_PLATFORM_IMX2_WDT
-        select IMX_HAVE_PLATFORM_IMX_I2C
-        select IMX_HAVE_PLATFORM_IMX_UART
-        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-        select IMX_HAVE_PLATFORM_GPIO_KEYS
-        help
-          Include support for MX53 ARD platform. This includes specific
-          configurations for the board and its peripherals.
-
-endif
diff --git a/arch/arm/mach-mx5/Makefile b/arch/arm/mach-mx5/Makefile
deleted file mode 100644
index 0fc60807fa2b..000000000000
--- a/arch/arm/mach-mx5/Makefile
+++ /dev/null
@@ -1,26 +0,0 @@
-#
-# Makefile for the linux kernel.
-#
-
-# Object file lists.
-obj-y   := cpu.o mm.o clock-mx51-mx53.o ehci.o system.o
-
-obj-$(CONFIG_PM) += pm-imx5.o
-obj-$(CONFIG_CPU_FREQ_IMX)    += cpu_op-mx51.o
-obj-$(CONFIG_MACH_MX51_BABBAGE) += board-mx51_babbage.o
-obj-$(CONFIG_MACH_MX51_3DS) += board-mx51_3ds.o
-obj-$(CONFIG_MACH_MX53_EVK) += board-mx53_evk.o
-obj-$(CONFIG_MACH_MX53_SMD) += board-mx53_smd.o
-obj-$(CONFIG_MACH_MX53_LOCO) += board-mx53_loco.o
-obj-$(CONFIG_MACH_MX53_ARD) += board-mx53_ard.o
-obj-$(CONFIG_MACH_EUKREA_CPUIMX51) += board-cpuimx51.o
-obj-$(CONFIG_MACH_EUKREA_MBIMX51_BASEBOARD) += eukrea_mbimx51-baseboard.o
-obj-$(CONFIG_MACH_EUKREA_CPUIMX51SD) += board-cpuimx51sd.o
-obj-$(CONFIG_MACH_EUKREA_MBIMXSD51_BASEBOARD) += eukrea_mbimxsd-baseboard.o
-obj-$(CONFIG_MX51_EFIKA_COMMON) += mx51_efika.o
-obj-$(CONFIG_MACH_MX51_EFIKAMX) += board-mx51_efikamx.o
-obj-$(CONFIG_MACH_MX51_EFIKASB) += board-mx51_efikasb.o
-obj-$(CONFIG_MACH_MX50_RDP) += board-mx50_rdp.o
-
-obj-$(CONFIG_MACH_IMX51_DT) += imx51-dt.o
-obj-$(CONFIG_MACH_IMX53_DT) += imx53-dt.o
diff --git a/arch/arm/mach-mx5/Makefile.boot b/arch/arm/mach-mx5/Makefile.boot
deleted file mode 100644
index ca207ca305ec..000000000000
--- a/arch/arm/mach-mx5/Makefile.boot
+++ /dev/null
@@ -1,9 +0,0 @@
-   zreladdr-$(CONFIG_ARCH_MX50) += 0x70008000
-params_phys-$(CONFIG_ARCH_MX50) := 0x70000100
-initrd_phys-$(CONFIG_ARCH_MX50) := 0x70800000
-   zreladdr-$(CONFIG_ARCH_MX51) += 0x90008000
-params_phys-$(CONFIG_ARCH_MX51) := 0x90000100
-initrd_phys-$(CONFIG_ARCH_MX51) := 0x90800000
-   zreladdr-$(CONFIG_ARCH_MX53) += 0x70008000
-params_phys-$(CONFIG_ARCH_MX53) := 0x70000100
-initrd_phys-$(CONFIG_ARCH_MX53) := 0x70800000
diff --git a/arch/arm/mach-mx5/pm-imx5.c b/arch/arm/mach-mx5/pm-imx5.c
deleted file mode 100644
index 98052fc852c7..000000000000
--- a/arch/arm/mach-mx5/pm-imx5.c
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- *  Copyright (C) 2011 Freescale Semiconductor, Inc. All Rights Reserved.
- *
- * The code contained herein is licensed under the GNU General Public
- * License. You may obtain a copy of the GNU General Public License
- * Version 2 or later at the following locations:
- *
- * http://www.opensource.org/licenses/gpl-license.html
- * http://www.gnu.org/copyleft/gpl.html
- */
-#include <linux/suspend.h>
-#include <linux/clk.h>
-#include <linux/io.h>
-#include <linux/err.h>
-#include <asm/cacheflush.h>
-#include <asm/tlbflush.h>
-#include <mach/common.h>
-#include <mach/hardware.h>
-#include "crm_regs.h"
-
-static struct clk *gpc_dvfs_clk;
-
-static int mx5_suspend_prepare(void)
-{
-        return clk_enable(gpc_dvfs_clk);
-}
-
-static int mx5_suspend_enter(suspend_state_t state)
-{
-        switch (state) {
-        case PM_SUSPEND_MEM:
-                mx5_cpu_lp_set(STOP_POWER_OFF);
-                break;
-        case PM_SUSPEND_STANDBY:
-                mx5_cpu_lp_set(WAIT_UNCLOCKED_POWER_OFF);
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        if (state == PM_SUSPEND_MEM) {
-                local_flush_tlb_all();
-                flush_cache_all();
-
-                /*clear the EMPGC0/1 bits */
-                __raw_writel(0, MXC_SRPG_EMPGC0_SRPGCR);
-                __raw_writel(0, MXC_SRPG_EMPGC1_SRPGCR);
-        }
-        cpu_do_idle();
-        return 0;
-}
-
-static void mx5_suspend_finish(void)
-{
-        clk_disable(gpc_dvfs_clk);
-}
-
-static int mx5_pm_valid(suspend_state_t state)
-{
-        return (state > PM_SUSPEND_ON && state <= PM_SUSPEND_MAX);
-}
-
-static const struct platform_suspend_ops mx5_suspend_ops = {
-        .valid = mx5_pm_valid,
-        .prepare = mx5_suspend_prepare,
-        .enter = mx5_suspend_enter,
-        .finish = mx5_suspend_finish,
-};
-
-static int __init mx5_pm_init(void)
-{
-        if (gpc_dvfs_clk == NULL)
-                gpc_dvfs_clk = clk_get(NULL, "gpc_dvfs");
-
-        if (!IS_ERR(gpc_dvfs_clk)) {
-                if (cpu_is_mx51())
-                        suspend_set_ops(&mx5_suspend_ops);
-        } else
-                return -EPERM;
-
-        return 0;
-}
-device_initcall(mx5_pm_init);
diff --git a/arch/arm/plat-mxc/Kconfig b/arch/arm/plat-mxc/Kconfig
index b30708e28c1d..dcebb1230f7f 100644
--- a/arch/arm/plat-mxc/Kconfig
+++ b/arch/arm/plat-mxc/Kconfig
@@ -17,26 +17,17 @@ config ARCH_IMX_V4_V5
           and ARMv5 SoCs
 
 config ARCH_IMX_V6_V7
-        bool "i.MX3, i.MX6"
+        bool "i.MX3, i.MX5, i.MX6"
         select AUTO_ZRELADDR if !ZBOOT_ROM
         select ARM_PATCH_PHYS_VIRT
         select MIGHT_HAVE_CACHE_L2X0
         help
-          This enables support for systems based on the Freescale i.MX3 and i.MX6
-          family.
-
-config ARCH_MX5
-        bool "i.MX50, i.MX51, i.MX53"
-        select AUTO_ZRELADDR if !ZBOOT_ROM
-        select ARM_PATCH_PHYS_VIRT
-        help
-          This enables support for machines using Freescale's i.MX50 and i.MX53
-          processors.
+          This enables support for systems based on the Freescale i.MX3, i.MX5
+          and i.MX6 family.
 
 endchoice
 
 source "arch/arm/mach-imx/Kconfig"
-source "arch/arm/mach-mx5/Kconfig"
 
 endmenu
 
diff --git a/arch/s390/include/asm/kexec.h b/arch/s390/include/asm/kexec.h
index cf4e47b0948c..3f30dac804ea 100644
--- a/arch/s390/include/asm/kexec.h
+++ b/arch/s390/include/asm/kexec.h
@@ -42,6 +42,24 @@
 /* The native architecture */
 #define KEXEC_ARCH KEXEC_ARCH_S390
 
+/*
+ * Size for s390x ELF notes per CPU
+ *
+ * Seven notes plus zero note at the end: prstatus, fpregset, timer,
+ * tod_cmp, tod_reg, control regs, and prefix
+ */
+#define KEXEC_NOTE_BYTES \
+        (ALIGN(sizeof(struct elf_note), 4) * 8 + \
+         ALIGN(sizeof("CORE"), 4) * 7 + \
+         ALIGN(sizeof(struct elf_prstatus), 4) + \
+         ALIGN(sizeof(elf_fpregset_t), 4) + \
+         ALIGN(sizeof(u64), 4) + \
+         ALIGN(sizeof(u64), 4) + \
+         ALIGN(sizeof(u32), 4) + \
+         ALIGN(sizeof(u64) * 16, 4) + \
+         ALIGN(sizeof(u32), 4) \
+        )
+
 /* Provide a dummy definition to avoid build failures. */
 static inline void crash_setup_regs(struct pt_regs *newregs,
                                         struct pt_regs *oldregs) { }
diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
index 577abba3fac6..83bb96079c43 100644
--- a/arch/score/kernel/entry.S
+++ b/arch/score/kernel/entry.S
@@ -408,7 +408,7 @@ ENTRY(handle_sys)
         sw      r9, [r0, PT_EPC]
 
         cmpi.c  r27, __NR_syscalls      # check syscall number
-        bgtu    illegal_syscall
+        bgeu    illegal_syscall
 
         slli    r8, r27, 2              # get syscall routine
         la      r11, sys_call_table
diff --git a/arch/x86/.gitignore b/arch/x86/.gitignore
index 028079065af6..7cab8c08e6d1 100644
--- a/arch/x86/.gitignore
+++ b/arch/x86/.gitignore
@@ -1,3 +1,4 @@
 boot/compressed/vmlinux
 tools/test_get_len
+tools/insn_sanity
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 6c14ecd851d0..864cc6e6ac8e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -125,16 +125,6 @@ config HAVE_LATENCYTOP_SUPPORT
 config MMU
         def_bool y
 
-config ZONE_DMA
-        bool "DMA memory allocation support" if EXPERT
-        default y
-        help
-          DMA memory allocation support allows devices with less than 32-bit
-          addressing to allocate within the first 16MB of address space.
-          Disable if no such devices will be used.
-
-          If unsure, say Y.
-
 config SBUS
         bool
 
@@ -255,6 +245,16 @@ source "kernel/Kconfig.freezer"
 
 menu "Processor type and features"
 
+config ZONE_DMA
+        bool "DMA memory allocation support" if EXPERT
+        default y
+        help
+          DMA memory allocation support allows devices with less than 32-bit
+          addressing to allocate within the first 16MB of address space.
+          Disable if no such devices will be used.
+
+          If unsure, say Y.
+
 source "kernel/time/Kconfig"
 
 config SMP
diff --git a/arch/x86/include/asm/unistd.h b/arch/x86/include/asm/unistd.h
index b4a3db7ce140..21f77b89e47a 100644
--- a/arch/x86/include/asm/unistd.h
+++ b/arch/x86/include/asm/unistd.h
@@ -7,6 +7,7 @@
 #  include <asm/unistd_32.h>
 #  define __ARCH_WANT_IPC_PARSE_VERSION
 #  define __ARCH_WANT_STAT64
+#  define __ARCH_WANT_SYS_IPC
 #  define __ARCH_WANT_SYS_OLD_MMAP
 #  define __ARCH_WANT_SYS_OLD_SELECT
 
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index 8e862aaf0d90..becf47b81735 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -65,7 +65,7 @@
  * UV2: Bit 19 selects between
  *  (0): 10 microsecond timebase and
  *  (1): 80 microseconds
- *  we're using 655us, similar to UV1: 65 units of 10us
+ *  we're using 560us, similar to UV1: 65 units of 10us
  */
 #define UV1_INTD_SOFT_ACK_TIMEOUT_PERIOD (9UL)
 #define UV2_INTD_SOFT_ACK_TIMEOUT_PERIOD (15UL)
@@ -167,6 +167,7 @@
 #define FLUSH_RETRY_TIMEOUT             2
 #define FLUSH_GIVEUP                    3
 #define FLUSH_COMPLETE                  4
+#define FLUSH_RETRY_BUSYBUG             5
 
 /*
  * tuning the action when the numalink network is extremely delayed
@@ -235,10 +236,10 @@ struct bau_msg_payload {
 
 
 /*
- * Message header:  16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
+ * UV1 Message header:  16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
  * see table 4.2.3.0.1 in broacast_assist spec.
  */
-struct bau_msg_header {
+struct uv1_bau_msg_header {
         unsigned int    dest_subnodeid:6;       /* must be 0x10, for the LB */
         /* bits 5:0 */
         unsigned int    base_dest_nasid:15;     /* nasid of the first bit */
@@ -318,19 +319,87 @@ struct bau_msg_header {
 };
 
 /*
+ * UV2 Message header:  16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
+ * see figure 9-2 of harp_sys.pdf
+ */
+struct uv2_bau_msg_header {
+        unsigned int    base_dest_nasid:15;     /* nasid of the first bit */
+        /* bits 14:0 */                         /* in uvhub map */
+        unsigned int    dest_subnodeid:5;       /* must be 0x10, for the LB */
+        /* bits 19:15 */
+        unsigned int    rsvd_1:1;               /* must be zero */
+        /* bit 20 */
+        /* Address bits 59:21 */
+        /* bits 25:2 of address (44:21) are payload */
+        /* these next 24 bits become bytes 12-14 of msg */
+        /* bits 28:21 land in byte 12 */
+        unsigned int    replied_to:1;           /* sent as 0 by the source to
+                                                   byte 12 */
+        /* bit 21 */
+        unsigned int    msg_type:3;             /* software type of the
+                                                   message */
+        /* bits 24:22 */
+        unsigned int    canceled:1;             /* message canceled, resource
+                                                   is to be freed*/
+        /* bit 25 */
+        unsigned int    payload_1:3;            /* not currently used */
+        /* bits 28:26 */
+
+        /* bits 36:29 land in byte 13 */
+        unsigned int    payload_2a:3;           /* not currently used */
+        unsigned int    payload_2b:5;           /* not currently used */
+        /* bits 36:29 */
+
+        /* bits 44:37 land in byte 14 */
+        unsigned int    payload_3:8;            /* not currently used */
+        /* bits 44:37 */
+
+        unsigned int    rsvd_2:7;               /* reserved */
+        /* bits 51:45 */
+        unsigned int    swack_flag:1;           /* software acknowledge flag */
+        /* bit 52 */
+        unsigned int    rsvd_3a:3;              /* must be zero */
+        unsigned int    rsvd_3b:8;              /* must be zero */
+        unsigned int    rsvd_3c:8;              /* must be zero */
+        unsigned int    rsvd_3d:3;              /* must be zero */
+        /* bits 74:53 */
+        unsigned int    fairness:3;             /* usually zero */
+        /* bits 77:75 */
+
+        unsigned int    sequence:16;            /* message sequence number */
+        /* bits 93:78  Suppl_A  */
+        unsigned int    chaining:1;             /* next descriptor is part of
+                                                   this activation*/
+        /* bit 94 */
+        unsigned int    multilevel:1;           /* multi-level multicast
+                                                   format */
+        /* bit 95 */
+        unsigned int    rsvd_4:24;              /* ordered / source node /
+                                                   source subnode / aging
+                                                   must be zero */
+        /* bits 119:96 */
+        unsigned int    command:8;              /* message type */
+        /* bits 127:120 */
+};
+
+/*
  * The activation descriptor:
  * The format of the message to send, plus all accompanying control
  * Should be 64 bytes
  */
 struct bau_desc {
-        struct pnmask                   distribution;
+        struct pnmask                           distribution;
         /*
          * message template, consisting of header and payload:
          */
-        struct bau_msg_header           header;
-        struct bau_msg_payload          payload;
+        union bau_msg_header {
+                struct uv1_bau_msg_header       uv1_hdr;
+                struct uv2_bau_msg_header       uv2_hdr;
+        } header;
+
+        struct bau_msg_payload                  payload;
 };
-/*
+/* UV1:
  *   -payload--    ---------header------
  *   bytes 0-11    bits 41-56  bits 58-81
  *       A           B  (2)      C (3)
@@ -340,6 +409,16 @@ struct bau_desc {
  *   bytes 0-11  bytes 12-14  bytes 16-17  (byte 15 filled in by hw as vector)
  *   ------------payload queue-----------
  */
+/* UV2:
+ *   -payload--    ---------header------
+ *   bytes 0-11    bits 70-78  bits 21-44
+ *       A           B  (2)      C (3)
+ *
+ *            A/B/C are moved to:
+ *       A            C          B
+ *   bytes 0-11  bytes 12-14  bytes 16-17  (byte 15 filled in by hw as vector)
+ *   ------------payload queue-----------
+ */
 
 /*
  * The payload queue on the destination side is an array of these.
@@ -385,7 +464,6 @@ struct bau_pq_entry {
 struct msg_desc {
         struct bau_pq_entry     *msg;
         int                     msg_slot;
-        int                     swack_slot;
         struct bau_pq_entry     *queue_first;
         struct bau_pq_entry     *queue_last;
 };
@@ -405,6 +483,7 @@ struct ptc_stats {
                                                    requests */
         unsigned long   s_stimeout;             /* source side timeouts */
         unsigned long   s_dtimeout;             /* destination side timeouts */
+        unsigned long   s_strongnacks;          /* number of strong nack's */
         unsigned long   s_time;                 /* time spent in sending side */
         unsigned long   s_retriesok;            /* successful retries */
         unsigned long   s_ntargcpu;             /* total number of cpu's
@@ -439,6 +518,9 @@ struct ptc_stats {
         unsigned long   s_retry_messages;       /* retry broadcasts */
         unsigned long   s_bau_reenabled;        /* for bau enable/disable */
         unsigned long   s_bau_disabled;         /* for bau enable/disable */
+        unsigned long   s_uv2_wars;             /* uv2 workaround, perm. busy */
+        unsigned long   s_uv2_wars_hw;          /* uv2 workaround, hiwater */
+        unsigned long   s_uv2_war_waits;        /* uv2 workaround, long waits */
         /* destination statistics */
         unsigned long   d_alltlb;               /* times all tlb's on this
                                                    cpu were flushed */
@@ -511,9 +593,12 @@ struct bau_control {
         short                   osnode;
         short                   uvhub_cpu;
         short                   uvhub;
+        short                   uvhub_version;
         short                   cpus_in_socket;
         short                   cpus_in_uvhub;
         short                   partition_base_pnode;
+        short                   using_desc; /* an index, like uvhub_cpu */
+        unsigned int            inuse_map;
         unsigned short          message_number;
         unsigned short          uvhub_quiesce;
         short                   socket_acknowledge_count[DEST_Q_SIZE];
@@ -531,6 +616,7 @@ struct bau_control {
         int                     cong_response_us;
         int                     cong_reps;
         int                     cong_period;
+        unsigned long           clocks_per_100_usec;
         cycles_t                period_time;
         long                    period_requests;
         struct hub_and_pnode    *thp;
@@ -591,6 +677,11 @@ static inline void write_mmr_sw_ack(unsigned long mr)
         uv_write_local_mmr(UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE_ALIAS, mr);
 }
 
+static inline void write_gmmr_sw_ack(int pnode, unsigned long mr)
+{
+        write_gmmr(pnode, UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE_ALIAS, mr);
+}
+
 static inline unsigned long read_mmr_sw_ack(void)
 {
         return read_lmmr(UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index c0dd5b603749..a62c201c97ec 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -290,14 +290,15 @@ static inline int pit_verify_msb(unsigned char val)
 static inline int pit_expect_msb(unsigned char val, u64 *tscp, unsigned long *deltap)
 {
         int count;
-        u64 tsc = 0;
+        u64 tsc = 0, prev_tsc = 0;
 
         for (count = 0; count < 50000; count++) {
                 if (!pit_verify_msb(val))
                         break;
+                prev_tsc = tsc;
                 tsc = get_cycles();
         }
-        *deltap = get_cycles() - tsc;
+        *deltap = get_cycles() - prev_tsc;
         *tscp = tsc;
 
         /*
@@ -311,9 +312,9 @@ static inline int pit_expect_msb(unsigned char val, u64 *tscp, unsigned long *de
  * How many MSB values do we want to see? We aim for
  * a maximum error rate of 500ppm (in practice the
  * real error is much smaller), but refuse to spend
- * more than 25ms on it.
+ * more than 50ms on it.
  */
-#define MAX_QUICK_PIT_MS 25
+#define MAX_QUICK_PIT_MS 50
 #define MAX_QUICK_PIT_ITERATIONS (MAX_QUICK_PIT_MS * PIT_TICK_RATE / 1000 / 256)
 
 static unsigned long quick_pit_calibrate(void)
@@ -383,15 +384,12 @@ success:
          *
          * As a result, we can depend on there not being
          * any odd delays anywhere, and the TSC reads are
-         * reliable (within the error). We also adjust the
-         * delta to the middle of the error bars, just
-         * because it looks nicer.
+         * reliable (within the error).
          *
          * kHz = ticks / time-in-seconds / 1000;
          * kHz = (t2 - t1) / (I * 256 / PIT_TICK_RATE) / 1000
          * kHz = ((t2 - t1) * PIT_TICK_RATE) / (I * 256 * 1000)
          */
-        delta += (long)(d2 - d1)/2;
         delta *= PIT_TICK_RATE;
         do_div(delta, i*256*1000);
         printk("Fast TSC calibration using PIT\n");
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 5b83c51c12e0..819137904428 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -219,7 +219,9 @@ ab: STOS/W/D/Q Yv,rAX
 ac: LODS/B AL,Xb
 ad: LODS/W/D/Q rAX,Xv
 ae: SCAS/B AL,Yb
-af: SCAS/W/D/Q rAX,Xv
+# Note: The May 2011 Intel manual shows Xv for the second parameter of the
+# next instruction but Yv is correct
+af: SCAS/W/D/Q rAX,Yv
 # 0xb0 - 0xbf
 b0: MOV AL/R8L,Ib
 b1: MOV CL/R9L,Ib
@@ -729,8 +731,8 @@ de: VAESDEC Vdq,Hdq,Wdq (66),(v1)
 df: VAESDECLAST Vdq,Hdq,Wdq (66),(v1)
 f0: MOVBE Gy,My | MOVBE Gw,Mw (66) | CRC32 Gd,Eb (F2)
 f1: MOVBE My,Gy | MOVBE Mw,Gw (66) | CRC32 Gd,Ey (F2)
-f3: ANDN Gy,By,Ey (v)
-f4: Grp17 (1A)
+f2: ANDN Gy,By,Ey (v)
+f3: Grp17 (1A)
 f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v)
 f6: MULX By,Gy,rDX,Ey (F2),(v)
 f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v)
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 5b552198f774..9be4cff00a2d 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -157,13 +157,14 @@ static int __init uvhub_to_first_apicid(int uvhub)
  * clear of the Timeout bit (as well) will free the resource. No reply will
  * be sent (the hardware will only do one reply per message).
  */
-static void reply_to_message(struct msg_desc *mdp, struct bau_control *bcp)
+static void reply_to_message(struct msg_desc *mdp, struct bau_control *bcp,
+                                                int do_acknowledge)
 {
         unsigned long dw;
         struct bau_pq_entry *msg;
 
         msg = mdp->msg;
-        if (!msg->canceled) {
+        if (!msg->canceled && do_acknowledge) {
                 dw = (msg->swack_vec << UV_SW_ACK_NPENDING) | msg->swack_vec;
                 write_mmr_sw_ack(dw);
         }
@@ -212,8 +213,8 @@ static void bau_process_retry_msg(struct msg_desc *mdp,
                         if (mmr & (msg_res << UV_SW_ACK_NPENDING)) {
                                 unsigned long mr;
                                 /*
-                                 * is the resource timed out?
-                                 * make everyone ignore the cancelled message.
+                                 * Is the resource timed out?
+                                 * Make everyone ignore the cancelled message.
                                  */
                                 msg2->canceled = 1;
                                 stat->d_canceled++;
@@ -231,8 +232,8 @@ static void bau_process_retry_msg(struct msg_desc *mdp,
  * Do all the things a cpu should do for a TLB shootdown message.
  * Other cpu's may come here at the same time for this message.
  */
-static void bau_process_message(struct msg_desc *mdp,
-                                        struct bau_control *bcp)
+static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
+                                                int do_acknowledge)
 {
         short socket_ack_count = 0;
         short *sp;
@@ -284,8 +285,9 @@ static void bau_process_message(struct msg_desc *mdp,
                 if (msg_ack_count == bcp->cpus_in_uvhub) {
                         /*
                          * All cpus in uvhub saw it; reply
+                         * (unless we are in the UV2 workaround)
                          */
-                        reply_to_message(mdp, bcp);
+                        reply_to_message(mdp, bcp, do_acknowledge);
                 }
         }
 
@@ -491,27 +493,138 @@ static int uv1_wait_completion(struct bau_desc *bau_desc,
 /*
  * UV2 has an extra bit of status in the ACTIVATION_STATUS_2 register.
  */
-static unsigned long uv2_read_status(unsigned long offset, int rshft, int cpu)
+static unsigned long uv2_read_status(unsigned long offset, int rshft, int desc)
 {
         unsigned long descriptor_status;
         unsigned long descriptor_status2;
 
         descriptor_status = ((read_lmmr(offset) >> rshft) & UV_ACT_STATUS_MASK);
-        descriptor_status2 = (read_mmr_uv2_status() >> cpu) & 0x1UL;
+        descriptor_status2 = (read_mmr_uv2_status() >> desc) & 0x1UL;
         descriptor_status = (descriptor_status << 1) | descriptor_status2;
         return descriptor_status;
 }
 
+/*
+ * Return whether the status of the descriptor that is normally used for this
+ * cpu (the one indexed by its hub-relative cpu number) is busy.
+ * The status of the original 32 descriptors is always reflected in the 64
+ * bits of UVH_LB_BAU_SB_ACTIVATION_STATUS_0.
+ * The bit provided by the activation_status_2 register is irrelevant to
+ * the status if it is only being tested for busy or not busy.
+ */
+int normal_busy(struct bau_control *bcp)
+{
+        int cpu = bcp->uvhub_cpu;
+        int mmr_offset;
+        int right_shift;
+
+        mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_0;
+        right_shift = cpu * UV_ACT_STATUS_SIZE;
+        return (((((read_lmmr(mmr_offset) >> right_shift) &
+                                UV_ACT_STATUS_MASK)) << 1) == UV2H_DESC_BUSY);
+}
+
+/*
+ * Entered when a bau descriptor has gone into a permanent busy wait because
+ * of a hardware bug.
+ * Workaround the bug.
+ */
+int handle_uv2_busy(struct bau_control *bcp)
+{
+        int busy_one = bcp->using_desc;
+        int normal = bcp->uvhub_cpu;
+        int selected = -1;
+        int i;
+        unsigned long descriptor_status;
+        unsigned long status;
+        int mmr_offset;
+        struct bau_desc *bau_desc_old;
+        struct bau_desc *bau_desc_new;
+        struct bau_control *hmaster = bcp->uvhub_master;
+        struct ptc_stats *stat = bcp->statp;
+        cycles_t ttm;
+
+        stat->s_uv2_wars++;
+        spin_lock(&hmaster->uvhub_lock);
+        /* try for the original first */
+        if (busy_one != normal) {
+                if (!normal_busy(bcp))
+                        selected = normal;
+        }
+        if (selected < 0) {
+                /* can't use the normal, select an alternate */
+                mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_1;
+                descriptor_status = read_lmmr(mmr_offset);
+
+                /* scan available descriptors 32-63 */
+                for (i = 0; i < UV_CPUS_PER_AS; i++) {
+                        if ((hmaster->inuse_map & (1 << i)) == 0) {
+                                status = ((descriptor_status >>
+                                                (i * UV_ACT_STATUS_SIZE)) &
+                                                UV_ACT_STATUS_MASK) << 1;
+                                if (status != UV2H_DESC_BUSY) {
+                                        selected = i + UV_CPUS_PER_AS;
+                                        break;
+                                }
+                        }
+                }
+        }
+
+        if (busy_one != normal)
+                /* mark the busy alternate as not in-use */
+                hmaster->inuse_map &= ~(1 << (busy_one - UV_CPUS_PER_AS));
+
+        if (selected >= 0) {
+                /* switch to the selected descriptor */
+                if (selected != normal) {
+                        /* set the selected alternate as in-use */
+                        hmaster->inuse_map |=
+                                        (1 << (selected - UV_CPUS_PER_AS));
+                        if (selected > stat->s_uv2_wars_hw)
+                                stat->s_uv2_wars_hw = selected;
+                }
+                bau_desc_old = bcp->descriptor_base;
+                bau_desc_old += (ITEMS_PER_DESC * busy_one);
+                bcp->using_desc = selected;
+                bau_desc_new = bcp->descriptor_base;
+                bau_desc_new += (ITEMS_PER_DESC * selected);
+                *bau_desc_new = *bau_desc_old;
+        } else {
+                /*
+                 * All are busy. Wait for the normal one for this cpu to
+                 * free up.
+                 */
+                stat->s_uv2_war_waits++;
+                spin_unlock(&hmaster->uvhub_lock);
+                ttm = get_cycles();
+                do {
+                        cpu_relax();
+                } while (normal_busy(bcp));
+                spin_lock(&hmaster->uvhub_lock);
+                /* switch to the original descriptor */
+                bcp->using_desc = normal;
+                bau_desc_old = bcp->descriptor_base;
+                bau_desc_old += (ITEMS_PER_DESC * bcp->using_desc);
+                bcp->using_desc = (ITEMS_PER_DESC * normal);
+                bau_desc_new = bcp->descriptor_base;
+                bau_desc_new += (ITEMS_PER_DESC * normal);
+                *bau_desc_new = *bau_desc_old; /* copy the entire descriptor */
+        }
+        spin_unlock(&hmaster->uvhub_lock);
+        return FLUSH_RETRY_BUSYBUG;
+}
+
 static int uv2_wait_completion(struct bau_desc *bau_desc,
                                 unsigned long mmr_offset, int right_shift,
                                 struct bau_control *bcp, long try)
 {
         unsigned long descriptor_stat;
         cycles_t ttm;
-        int cpu = bcp->uvhub_cpu;
+        int desc = bcp->using_desc;
+        long busy_reps = 0;
         struct ptc_stats *stat = bcp->statp;
 
-        descriptor_stat = uv2_read_status(mmr_offset, right_shift, cpu);
+        descriptor_stat = uv2_read_status(mmr_offset, right_shift, desc);
 
         /* spin on the status MMR, waiting for it to go idle */
         while (descriptor_stat != UV2H_DESC_IDLE) {
@@ -522,32 +635,35 @@ static int uv2_wait_completion(struct bau_desc *bau_desc,
                  * our message and its state will stay IDLE.
                  */
                 if ((descriptor_stat == UV2H_DESC_SOURCE_TIMEOUT) ||
-                    (descriptor_stat == UV2H_DESC_DEST_STRONG_NACK) ||
                     (descriptor_stat == UV2H_DESC_DEST_PUT_ERR)) {
                         stat->s_stimeout++;
                         return FLUSH_GIVEUP;
+                } else if (descriptor_stat == UV2H_DESC_DEST_STRONG_NACK) {
+                        stat->s_strongnacks++;
+                        bcp->conseccompletes = 0;
+                        return FLUSH_GIVEUP;
                 } else if (descriptor_stat == UV2H_DESC_DEST_TIMEOUT) {
                         stat->s_dtimeout++;
-                        ttm = get_cycles();
-                        /*
-                         * Our retries may be blocked by all destination
-                         * swack resources being consumed, and a timeout
-                         * pending.  In that case hardware returns the
-                         * ERROR that looks like a destination timeout.
-                         */
-                        if (cycles_2_us(ttm - bcp->send_message) < timeout_us) {
-                                bcp->conseccompletes = 0;
-                                return FLUSH_RETRY_PLUGGED;
-                        }
                         bcp->conseccompletes = 0;
                         return FLUSH_RETRY_TIMEOUT;
                 } else {
+                        busy_reps++;
+                        if (busy_reps > 1000000) {
+                                /* not to hammer on the clock */
+                                busy_reps = 0;
+                                ttm = get_cycles();
+                                if ((ttm - bcp->send_message) >
+                                        (bcp->clocks_per_100_usec)) {
+                                        return handle_uv2_busy(bcp);
+                                }
+                        }
                         /*
                          * descriptor_stat is still BUSY
                          */
                         cpu_relax();
                 }
-                descriptor_stat = uv2_read_status(mmr_offset, right_shift, cpu);
+                descriptor_stat = uv2_read_status(mmr_offset, right_shift,
+                                                                        desc);
         }
         bcp->conseccompletes++;
         return FLUSH_COMPLETE;
@@ -563,17 +679,17 @@ static int wait_completion(struct bau_desc *bau_desc,
 {
         int right_shift;
         unsigned long mmr_offset;
-        int cpu = bcp->uvhub_cpu;
+        int desc = bcp->using_desc;
 
-        if (cpu < UV_CPUS_PER_AS) {
+        if (desc < UV_CPUS_PER_AS) {
                 mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_0;
-                right_shift = cpu * UV_ACT_STATUS_SIZE;
+                right_shift = desc * UV_ACT_STATUS_SIZE;
         } else {
                 mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_1;
-                right_shift = ((cpu - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
+                right_shift = ((desc - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
         }
 
-        if (is_uv1_hub())
+        if (bcp->uvhub_version == 1)
                 return uv1_wait_completion(bau_desc, mmr_offset, right_shift,
                                                                 bcp, try);
         else
@@ -752,19 +868,22 @@ static void handle_cmplt(int completion_status, struct bau_desc *bau_desc,
  * Returns 1 if it gives up entirely and the original cpu mask is to be
  * returned to the kernel.
  */
-int uv_flush_send_and_wait(struct bau_desc *bau_desc,
-                        struct cpumask *flush_mask, struct bau_control *bcp)
+int uv_flush_send_and_wait(struct cpumask *flush_mask, struct bau_control *bcp)
 {
         int seq_number = 0;
         int completion_stat = 0;
+        int uv1 = 0;
         long try = 0;
         unsigned long index;
         cycles_t time1;
         cycles_t time2;
         struct ptc_stats *stat = bcp->statp;
         struct bau_control *hmaster = bcp->uvhub_master;
+        struct uv1_bau_msg_header *uv1_hdr = NULL;
+        struct uv2_bau_msg_header *uv2_hdr = NULL;
+        struct bau_desc *bau_desc;
 
-        if (is_uv1_hub())
+        if (bcp->uvhub_version == 1)
                 uv1_throttle(hmaster, stat);
 
         while (hmaster->uvhub_quiesce)
@@ -772,22 +891,39 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
 
         time1 = get_cycles();
         do {
-                if (try == 0) {
-                        bau_desc->header.msg_type = MSG_REGULAR;
+                bau_desc = bcp->descriptor_base;
+                bau_desc += (ITEMS_PER_DESC * bcp->using_desc);
+                if (bcp->uvhub_version == 1) {
+                        uv1 = 1;
+                        uv1_hdr = &bau_desc->header.uv1_hdr;
+                } else
+                        uv2_hdr = &bau_desc->header.uv2_hdr;
+                if ((try == 0) || (completion_stat == FLUSH_RETRY_BUSYBUG)) {
+                        if (uv1)
+                                uv1_hdr->msg_type = MSG_REGULAR;
+                        else
+                                uv2_hdr->msg_type = MSG_REGULAR;
                         seq_number = bcp->message_number++;
                 } else {
-                        bau_desc->header.msg_type = MSG_RETRY;
+                        if (uv1)
+                                uv1_hdr->msg_type = MSG_RETRY;
+                        else
+                                uv2_hdr->msg_type = MSG_RETRY;
                         stat->s_retry_messages++;
                 }
 
-                bau_desc->header.sequence = seq_number;
-                index = (1UL << AS_PUSH_SHIFT) | bcp->uvhub_cpu;
+                if (uv1)
+                        uv1_hdr->sequence = seq_number;
+                else
+                        uv2_hdr->sequence = seq_number;
+                index = (1UL << AS_PUSH_SHIFT) | bcp->using_desc;
                 bcp->send_message = get_cycles();
 
                 write_mmr_activation(index);
 
                 try++;
                 completion_stat = wait_completion(bau_desc, bcp, try);
+                /* UV2: wait_completion() may change the bcp->using_desc */
 
                 handle_cmplt(completion_stat, bau_desc, bcp, hmaster, stat);
 
@@ -798,6 +934,7 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
                 }
                 cpu_relax();
         } while ((completion_stat == FLUSH_RETRY_PLUGGED) ||
+                 (completion_stat == FLUSH_RETRY_BUSYBUG) ||
                  (completion_stat == FLUSH_RETRY_TIMEOUT));
 
         time2 = get_cycles();
@@ -812,6 +949,7 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
         record_send_stats(time1, time2, bcp, stat, completion_stat, try);
 
         if (completion_stat == FLUSH_GIVEUP)
+                /* FLUSH_GIVEUP will fall back to using IPI's for tlb flush */
                 return 1;
         return 0;
 }
@@ -967,7 +1105,7 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
                 stat->s_ntargself++;
 
         bau_desc = bcp->descriptor_base;
-        bau_desc += ITEMS_PER_DESC * bcp->uvhub_cpu;
+        bau_desc += (ITEMS_PER_DESC * bcp->using_desc);
         bau_uvhubs_clear(&bau_desc->distribution, UV_DISTRIBUTION_SIZE);
         if (set_distrib_bits(flush_mask, bcp, bau_desc, &locals, &remotes))
                 return NULL;
@@ -980,13 +1118,86 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
          * uv_flush_send_and_wait returns 0 if all cpu's were messaged,
          * or 1 if it gave up and the original cpumask should be returned.
          */
-        if (!uv_flush_send_and_wait(bau_desc, flush_mask, bcp))
+        if (!uv_flush_send_and_wait(flush_mask, bcp))
                 return NULL;
         else
                 return cpumask;
 }
 
 /*
+ * Search the message queue for any 'other' message with the same software
+ * acknowledge resource bit vector.
+ */
+struct bau_pq_entry *find_another_by_swack(struct bau_pq_entry *msg,
+                        struct bau_control *bcp, unsigned char swack_vec)
+{
+        struct bau_pq_entry *msg_next = msg + 1;
+
+        if (msg_next > bcp->queue_last)
+                msg_next = bcp->queue_first;
+        while ((msg_next->swack_vec != 0) && (msg_next != msg)) {
+                if (msg_next->swack_vec == swack_vec)
+                        return msg_next;
+                msg_next++;
+                if (msg_next > bcp->queue_last)
+                        msg_next = bcp->queue_first;
+        }
+        return NULL;
+}
+
+/*
+ * UV2 needs to work around a bug in which an arriving message has not
+ * set a bit in the UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE register.
+ * Such a message must be ignored.
+ */
+void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
+{
+        unsigned long mmr_image;
+        unsigned char swack_vec;
+        struct bau_pq_entry *msg = mdp->msg;
+        struct bau_pq_entry *other_msg;
+
+        mmr_image = read_mmr_sw_ack();
+        swack_vec = msg->swack_vec;
+
+        if ((swack_vec & mmr_image) == 0) {
+                /*
+                 * This message was assigned a swack resource, but no
+                 * reserved acknowlegment is pending.
+                 * The bug has prevented this message from setting the MMR.
+                 * And no other message has used the same sw_ack resource.
+                 * Do the requested shootdown but do not reply to the msg.
+                 * (the 0 means make no acknowledge)
+                 */
+                bau_process_message(mdp, bcp, 0);
+                return;
+        }
+
+        /*
+         * Some message has set the MMR 'pending' bit; it might have been
+         * another message.  Look for that message.
+         */
+        other_msg = find_another_by_swack(msg, bcp, msg->swack_vec);
+        if (other_msg) {
+                /* There is another.  Do not ack the current one. */
+                bau_process_message(mdp, bcp, 0);
+                /*
+                 * Let the natural processing of that message acknowledge
+                 * it. Don't get the processing of sw_ack's out of order.
+                 */
+                return;
+        }
+
+        /*
+         * There is no other message using this sw_ack, so it is safe to
+         * acknowledge it.
+         */
+        bau_process_message(mdp, bcp, 1);
+
+        return;
+}
+
+/*
  * The BAU message interrupt comes here. (registered by set_intr_gate)
  * See entry_64.S
  *
@@ -1009,6 +1220,7 @@ void uv_bau_message_interrupt(struct pt_regs *regs)
         struct ptc_stats *stat;
         struct msg_desc msgdesc;
 
+        ack_APIC_irq();
         time_start = get_cycles();
 
         bcp = &per_cpu(bau_control, smp_processor_id());
@@ -1022,9 +1234,11 @@ void uv_bau_message_interrupt(struct pt_regs *regs)
                 count++;
 
                 msgdesc.msg_slot = msg - msgdesc.queue_first;
-                msgdesc.swack_slot = ffs(msg->swack_vec) - 1;
                 msgdesc.msg = msg;
-                bau_process_message(&msgdesc, bcp);
+                if (bcp->uvhub_version == 2)
+                        process_uv2_message(&msgdesc, bcp);
+                else
+                        bau_process_message(&msgdesc, bcp, 1);
 
                 msg++;
                 if (msg > msgdesc.queue_last)
@@ -1036,8 +1250,6 @@ void uv_bau_message_interrupt(struct pt_regs *regs)
                 stat->d_nomsg++;
         else if (count > 1)
                 stat->d_multmsg++;
-
-        ack_APIC_irq();
 }
 
 /*
@@ -1083,7 +1295,7 @@ static void __init enable_timeouts(void)
                  */
                 mmr_image |= (1L << SOFTACK_MSHIFT);
                 if (is_uv2_hub()) {
-                        mmr_image |= (1L << UV2_LEG_SHFT);
+                        mmr_image &= ~(1L << UV2_LEG_SHFT);
                         mmr_image |= (1L << UV2_EXT_SHFT);
                 }
                 write_mmr_misc_control(pnode, mmr_image);
@@ -1136,13 +1348,13 @@ static int ptc_seq_show(struct seq_file *file, void *data)
                 seq_printf(file,
                         "remotehub numuvhubs numuvhubs16 numuvhubs8 ");
                 seq_printf(file,
-                        "numuvhubs4 numuvhubs2 numuvhubs1 dto retries rok ");
+                    "numuvhubs4 numuvhubs2 numuvhubs1 dto snacks retries rok ");
                 seq_printf(file,
                         "resetp resett giveup sto bz throt swack recv rtime ");
                 seq_printf(file,
                         "all one mult none retry canc nocan reset rcan ");
                 seq_printf(file,
-                        "disable enable\n");
+                        "disable enable wars warshw warwaits\n");
         }
         if (cpu < num_possible_cpus() && cpu_online(cpu)) {
                 stat = &per_cpu(ptcstats, cpu);
@@ -1154,10 +1366,10 @@ static int ptc_seq_show(struct seq_file *file, void *data)
                            stat->s_ntargremotes, stat->s_ntargcpu,
                            stat->s_ntarglocaluvhub, stat->s_ntargremoteuvhub,
                            stat->s_ntarguvhub, stat->s_ntarguvhub16);
-                seq_printf(file, "%ld %ld %ld %ld %ld ",
+                seq_printf(file, "%ld %ld %ld %ld %ld %ld ",
                            stat->s_ntarguvhub8, stat->s_ntarguvhub4,
                            stat->s_ntarguvhub2, stat->s_ntarguvhub1,
-                           stat->s_dtimeout);
+                           stat->s_dtimeout, stat->s_strongnacks);
                 seq_printf(file, "%ld %ld %ld %ld %ld %ld %ld %ld ",
                            stat->s_retry_messages, stat->s_retriesok,
                            stat->s_resets_plug, stat->s_resets_timeout,
@@ -1173,8 +1385,10 @@ static int ptc_seq_show(struct seq_file *file, void *data)
                            stat->d_nomsg, stat->d_retries, stat->d_canceled,
                            stat->d_nocanceled, stat->d_resets,
                            stat->d_rcanceled);
-                seq_printf(file, "%ld %ld\n",
-                        stat->s_bau_disabled, stat->s_bau_reenabled);
+                seq_printf(file, "%ld %ld %ld %ld %ld\n",
+                        stat->s_bau_disabled, stat->s_bau_reenabled,
+                        stat->s_uv2_wars, stat->s_uv2_wars_hw,
+                        stat->s_uv2_war_waits);
         }
         return 0;
 }
@@ -1432,12 +1646,15 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
 {
         int i;
         int cpu;
+        int uv1 = 0;
         unsigned long gpa;
         unsigned long m;
         unsigned long n;
         size_t dsize;
         struct bau_desc *bau_desc;
         struct bau_desc *bd2;
+        struct uv1_bau_msg_header *uv1_hdr;
+        struct uv2_bau_msg_header *uv2_hdr;
         struct bau_control *bcp;
 
         /*
@@ -1451,6 +1668,8 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
         gpa = uv_gpa(bau_desc);
         n = uv_gpa_to_gnode(gpa);
         m = uv_gpa_to_offset(gpa);
+        if (is_uv1_hub())
+                uv1 = 1;
 
         /* the 14-bit pnode */
         write_mmr_descriptor_base(pnode, (n << UV_DESC_PSHIFT | m));
@@ -1461,21 +1680,33 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
          */
         for (i = 0, bd2 = bau_desc; i < (ADP_SZ * ITEMS_PER_DESC); i++, bd2++) {
                 memset(bd2, 0, sizeof(struct bau_desc));
-                bd2->header.swack_flag =        1;
-                /*
-                 * The base_dest_nasid set in the message header is the nasid
-                 * of the first uvhub in the partition. The bit map will
-                 * indicate destination pnode numbers relative to that base.
-                 * They may not be consecutive if nasid striding is being used.
-                 */
-                bd2->header.base_dest_nasid =   UV_PNODE_TO_NASID(base_pnode);
-                bd2->header.dest_subnodeid =    UV_LB_SUBNODEID;
-                bd2->header.command =           UV_NET_ENDPOINT_INTD;
-                bd2->header.int_both =          1;
-                /*
-                 * all others need to be set to zero:
-                 *   fairness chaining multilevel count replied_to
-                 */
+                if (uv1) {
+                        uv1_hdr = &bd2->header.uv1_hdr;
+                        uv1_hdr->swack_flag =   1;
+                        /*
+                         * The base_dest_nasid set in the message header
+                         * is the nasid of the first uvhub in the partition.
+                         * The bit map will indicate destination pnode numbers
+                         * relative to that base. They may not be consecutive
+                         * if nasid striding is being used.
+                         */
+                        uv1_hdr->base_dest_nasid =
+                                                UV_PNODE_TO_NASID(base_pnode);
+                        uv1_hdr->dest_subnodeid =       UV_LB_SUBNODEID;
+                        uv1_hdr->command =              UV_NET_ENDPOINT_INTD;
+                        uv1_hdr->int_both =             1;
+                        /*
+                         * all others need to be set to zero:
+                         *   fairness chaining multilevel count replied_to
+                         */
+                } else {
+                        uv2_hdr = &bd2->header.uv2_hdr;
+                        uv2_hdr->swack_flag =   1;
+                        uv2_hdr->base_dest_nasid =
+                                                UV_PNODE_TO_NASID(base_pnode);
+                        uv2_hdr->dest_subnodeid =       UV_LB_SUBNODEID;
+                        uv2_hdr->command =              UV_NET_ENDPOINT_INTD;
+                }
         }
         for_each_present_cpu(cpu) {
                 if (pnode != uv_blade_to_pnode(uv_cpu_to_blade_id(cpu)))
@@ -1531,6 +1762,7 @@ static void pq_init(int node, int pnode)
         write_mmr_payload_first(pnode, pn_first);
         write_mmr_payload_tail(pnode, first);
         write_mmr_payload_last(pnode, last);
+        write_gmmr_sw_ack(pnode, 0xffffUL);
 
         /* in effect, all msg_type's are set to MSG_NOOP */
         memset(pqp, 0, sizeof(struct bau_pq_entry) * DEST_Q_SIZE);
@@ -1584,14 +1816,14 @@ static int calculate_destination_timeout(void)
                 ts_ns = base * mult1 * mult2;
                 ret = ts_ns / 1000;
         } else {
-                /* 4 bits  0/1 for 10/80us, 3 bits of multiplier */
-                mmr_image = uv_read_local_mmr(UVH_AGING_PRESCALE_SEL);
+                /* 4 bits  0/1 for 10/80us base, 3 bits of multiplier */
+                mmr_image = uv_read_local_mmr(UVH_LB_BAU_MISC_CONTROL);
                 mmr_image = (mmr_image & UV_SA_MASK) >> UV_SA_SHFT;
                 if (mmr_image & (1L << UV2_ACK_UNITS_SHFT))
-                        mult1 = 80;
+                        base = 80;
                 else
-                        mult1 = 10;
-                base = mmr_image & UV2_ACK_MASK;
+                        base = 10;
+                mult1 = mmr_image & UV2_ACK_MASK;
                 ret = mult1 * base;
         }
         return ret;
@@ -1618,6 +1850,7 @@ static void __init init_per_cpu_tunables(void)
                 bcp->cong_response_us           = congested_respns_us;
                 bcp->cong_reps                  = congested_reps;
                 bcp->cong_period                = congested_period;
+                bcp->clocks_per_100_usec =      usec_2_cycles(100);
         }
 }
 
@@ -1728,8 +1961,17 @@ static int scan_sock(struct socket_desc *sdp, struct uvhub_desc *bdp,
                 bcp->cpus_in_socket = sdp->num_cpus;
                 bcp->socket_master = *smasterp;
                 bcp->uvhub = bdp->uvhub;
+                if (is_uv1_hub())
+                        bcp->uvhub_version = 1;
+                else if (is_uv2_hub())
+                        bcp->uvhub_version = 2;
+                else {
+                        printk(KERN_EMERG "uvhub version not 1 or 2\n");
+                        return 1;
+                }
                 bcp->uvhub_master = *hmasterp;
                 bcp->uvhub_cpu = uv_cpu_hub_info(cpu)->blade_processor_id;
+                bcp->using_desc = bcp->uvhub_cpu;
                 if (bcp->uvhub_cpu >= MAX_CPUS_PER_UVHUB) {
                         printk(KERN_EMERG "%d cpus per uvhub invalid\n",
                                 bcp->uvhub_cpu);
@@ -1845,6 +2087,8 @@ static int __init uv_bau_init(void)
                         uv_base_pnode = uv_blade_to_pnode(uvhub);
         }
 
+        enable_timeouts();
+
         if (init_per_cpu(nuvhubs, uv_base_pnode)) {
                 nobau = 1;
                 return 0;
@@ -1855,7 +2099,6 @@ static int __init uv_bau_init(void)
                 if (uv_blade_nr_possible_cpus(uvhub))
                         init_uvhub(uvhub, vector, uv_base_pnode);
 
-        enable_timeouts();
         alloc_intr_gate(vector, uv_bau_message_intr1);
 
         for_each_possible_blade(uvhub) {
@@ -1867,7 +2110,8 @@ static int __init uv_bau_init(void)
                         val = 1L << 63;
                         write_gmmr_activation(pnode, val);
                         mmr = 1; /* should be 1 to broadcast to both sockets */
-                        write_mmr_data_broadcast(pnode, mmr);
+                        if (!is_uv1_hub())
+                                write_mmr_data_broadcast(pnode, mmr);
                 }
         }
 
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 99dc5921e1dd..40fb12288ce2 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -915,9 +915,10 @@ static BUS_ATTR(uevent, S_IWUSR, NULL, bus_uevent_store);
 
 /**
  * __bus_register - register a driver-core subsystem
- * @bus: bus.
+ * @bus: bus to register
+ * @key: lockdep class key
  *
- * Once we have that, we registered the bus with the kobject
+ * Once we have that, we register the bus with the kobject
  * infrastructure, then register the children subsystems it has:
  * the devices and drivers that belong to the subsystem.
  */
@@ -1220,8 +1221,8 @@ static void system_root_device_release(struct device *dev)
 }
 /**
  * subsys_system_register - register a subsystem at /sys/devices/system/
- * @subsys - system subsystem
- * @groups - default attributes for the root device
+ * @subsys: system subsystem
+ * @groups: default attributes for the root device
  *
  * All 'system' subsystems have a /sys/devices/system/<name> root device
  * with the name of the subsystem. The root device can carry subsystem-
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 37c4bd1cacd5..d0c41188d4e5 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -87,6 +87,7 @@ config GPIO_GENERIC_PLATFORM
 
 config GPIO_IT8761E
         tristate "IT8761E GPIO support"
+        depends on X86  # unconditional access to IO space.
         help
           Say yes here to support GPIO functionality of IT8761E super I/O chip.
 
diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
index 461958fc2264..03d6dd5dcb77 100644
--- a/drivers/gpio/gpio-ml-ioh.c
+++ b/drivers/gpio/gpio-ml-ioh.c
@@ -248,7 +248,7 @@ static void ioh_gpio_setup(struct ioh_gpio *chip, int num_port)
 static int ioh_irq_type(struct irq_data *d, unsigned int type)
 {
         u32 im;
-        u32 *im_reg;
+        void __iomem *im_reg;
         u32 ien;
         u32 im_pos;
         int ch;
@@ -412,7 +412,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev,
         int i, j;
         struct ioh_gpio *chip;
         void __iomem *base;
-        void __iomem *chip_save;
+        void *chip_save;
         int irq_base;
 
         ret = pci_enable_device(pdev);
@@ -428,7 +428,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev,
         }
 
         base = pci_iomap(pdev, 1, 0);
-        if (base == 0) {
+        if (!base) {
                 dev_err(&pdev->dev, "%s : pci_iomap failed", __func__);
                 ret = -ENOMEM;
                 goto err_iomap;
@@ -521,7 +521,7 @@ static void __devexit ioh_gpio_remove(struct pci_dev *pdev)
         int err;
         int i;
         struct ioh_gpio *chip = pci_get_drvdata(pdev);
-        void __iomem *chip_save;
+        void *chip_save;
 
         chip_save = chip;
 
diff --git a/drivers/gpio/gpio-pch.c b/drivers/gpio/gpio-pch.c
index f0603297f829..68fa55e86eb1 100644
--- a/drivers/gpio/gpio-pch.c
+++ b/drivers/gpio/gpio-pch.c
@@ -231,7 +231,7 @@ static void pch_gpio_setup(struct pch_gpio *chip)
 static int pch_irq_type(struct irq_data *d, unsigned int type)
 {
         u32 im;
-        u32 *im_reg;
+        u32 __iomem *im_reg;
         u32 ien;
         u32 im_pos;
         int ch;
@@ -376,7 +376,7 @@ static int __devinit pch_gpio_probe(struct pci_dev *pdev,
         }
 
         chip->base = pci_iomap(pdev, 1, 0);
-        if (chip->base == 0) {
+        if (!chip->base) {
                 dev_err(&pdev->dev, "%s : pci_iomap FAILED", __func__);
                 ret = -ENOMEM;
                 goto err_iomap;
diff --git a/drivers/gpio/gpio-tps65910.c b/drivers/gpio/gpio-tps65910.c
index b9c1c297669e..91f45b965d1e 100644
--- a/drivers/gpio/gpio-tps65910.c
+++ b/drivers/gpio/gpio-tps65910.c
@@ -52,7 +52,7 @@ static int tps65910_gpio_output(struct gpio_chip *gc, unsigned offset,
         struct tps65910 *tps65910 = container_of(gc, struct tps65910, gpio);
 
         /* Set the initial value */
-        tps65910_gpio_set(gc, 0, value);
+        tps65910_gpio_set(gc, offset, value);
 
         return tps65910_set_bits(tps65910, TPS65910_GPIO0 + offset,
                                                 GPIO_CFG_MASK);
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index c957c344233f..9ca28fced2b9 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -403,6 +403,13 @@ config LEDS_MAX8997
           This option enables support for on-chip LED drivers on
           MAXIM MAX8997 PMIC.
 
+config LEDS_OT200
+        tristate "LED support for the Bachmann OT200"
+        depends on LEDS_CLASS && HAS_IOMEM
+        help
+          This option enables support for the LEDs on the Bachmann OT200.
+          Say Y to enable LEDs on the Bachmann OT200.
+
 config LEDS_TRIGGERS
         bool "LED Trigger support"
         depends on LEDS_CLASS
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
index b8a9723477f0..1fc6875a8b20 100644
--- a/drivers/leds/Makefile
+++ b/drivers/leds/Makefile
@@ -28,6 +28,7 @@ obj-$(CONFIG_LEDS_LP5523)		+= leds-lp5523.o
 obj-$(CONFIG_LEDS_TCA6507)              += leds-tca6507.o
 obj-$(CONFIG_LEDS_CLEVO_MAIL)           += leds-clevo-mail.o
 obj-$(CONFIG_LEDS_HP6XX)                += leds-hp6xx.o
+obj-$(CONFIG_LEDS_OT200)                += leds-ot200.o
 obj-$(CONFIG_LEDS_FSG)                  += leds-fsg.o
 obj-$(CONFIG_LEDS_PCA955X)              += leds-pca955x.o
 obj-$(CONFIG_LEDS_DA903X)               += leds-da903x.o
diff --git a/drivers/leds/leds-ot200.c b/drivers/leds/leds-ot200.c
new file mode 100644
index 000000000000..c4646825a620
--- /dev/null
+++ b/drivers/leds/leds-ot200.c
@@ -0,0 +1,171 @@
+/*
+ * Bachmann ot200 leds driver.
+ *
+ * Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+ *         Christian Gmeiner <christian.gmeiner@gmail.com>
+ *
+ * License: GPL as published by the FSF.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/leds.h>
+#include <linux/io.h>
+#include <linux/module.h>
+
+
+struct ot200_led {
+        struct led_classdev cdev;
+        const char *name;
+        unsigned long port;
+        u8 mask;
+};
+
+/*
+ * The device has three leds on the back panel (led_err, led_init and led_run)
+ * and can handle up to seven leds on the front panel.
+ */
+
+static struct ot200_led leds[] = {
+        {
+                .name = "led_run",
+                .port = 0x5a,
+                .mask = BIT(0),
+        },
+        {
+                .name = "led_init",
+                .port = 0x5a,
+                .mask = BIT(1),
+        },
+        {
+                .name = "led_err",
+                .port = 0x5a,
+                .mask = BIT(2),
+        },
+        {
+                .name = "led_1",
+                .port = 0x49,
+                .mask = BIT(7),
+        },
+        {
+                .name = "led_2",
+                .port = 0x49,
+                .mask = BIT(6),
+        },
+        {
+                .name = "led_3",
+                .port = 0x49,
+                .mask = BIT(5),
+        },
+        {
+                .name = "led_4",
+                .port = 0x49,
+                .mask = BIT(4),
+        },
+        {
+                .name = "led_5",
+                .port = 0x49,
+                .mask = BIT(3),
+        },
+        {
+                .name = "led_6",
+                .port = 0x49,
+                .mask = BIT(2),
+        },
+        {
+                .name = "led_7",
+                .port = 0x49,
+                .mask = BIT(1),
+        }
+};
+
+static DEFINE_SPINLOCK(value_lock);
+
+/*
+ * we need to store the current led states, as it is not
+ * possible to read the current led state via inb().
+ */
+static u8 leds_back;
+static u8 leds_front;
+
+static void ot200_led_brightness_set(struct led_classdev *led_cdev,
+                enum led_brightness value)
+{
+        struct ot200_led *led = container_of(led_cdev, struct ot200_led, cdev);
+        u8 *val;
+        unsigned long flags;
+
+        spin_lock_irqsave(&value_lock, flags);
+
+        if (led->port == 0x49)
+                val = &leds_front;
+        else if (led->port == 0x5a)
+                val = &leds_back;
+        else
+                BUG();
+
+        if (value == LED_OFF)
+                *val &= ~led->mask;
+        else
+                *val |= led->mask;
+
+        outb(*val, led->port);
+        spin_unlock_irqrestore(&value_lock, flags);
+}
+
+static int __devinit ot200_led_probe(struct platform_device *pdev)
+{
+        int i;
+        int ret;
+
+        for (i = 0; i < ARRAY_SIZE(leds); i++) {
+
+                leds[i].cdev.name = leds[i].name;
+                leds[i].cdev.brightness_set = ot200_led_brightness_set;
+
+                ret = led_classdev_register(&pdev->dev, &leds[i].cdev);
+                if (ret < 0)
+                        goto err;
+        }
+
+        leds_front = 0;         /* turn off all front leds */
+        leds_back = BIT(1);     /* turn on init led */
+        outb(leds_front, 0x49);
+        outb(leds_back, 0x5a);
+
+        return 0;
+
+err:
+        for (i = i - 1; i >= 0; i--)
+                led_classdev_unregister(&leds[i].cdev);
+
+        return ret;
+}
+
+static int __devexit ot200_led_remove(struct platform_device *pdev)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(leds); i++)
+                led_classdev_unregister(&leds[i].cdev);
+
+        return 0;
+}
+
+static struct platform_driver ot200_led_driver = {
+        .probe          = ot200_led_probe,
+        .remove         = __devexit_p(ot200_led_remove),
+        .driver         = {
+                .name   = "leds-ot200",
+                .owner  = THIS_MODULE,
+        },
+};
+
+module_platform_driver(ot200_led_driver);
+
+MODULE_AUTHOR("Sebastian A. Siewior <bigeasy@linutronix.de>");
+MODULE_DESCRIPTION("ot200 LED driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:leds-ot200");
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 97fff785e97e..af295bb21d62 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2802,7 +2802,7 @@ pci_intx(struct pci_dev *pdev, int enable)
 
 /**
  * pci_intx_mask_supported - probe for INTx masking support
- * @pdev: the PCI device to operate on
+ * @dev: the PCI device to operate on
  *
  * Check if the device dev support INTx masking via the config space
  * command word.
@@ -2884,7 +2884,7 @@ done:
 
 /**
  * pci_check_and_mask_intx - mask INTx on pending interrupt
- * @pdev: the PCI device to operate on
+ * @dev: the PCI device to operate on
  *
  * Check if the device dev has its INTx line asserted, mask it and
  * return true in that case. False is returned if not interrupt was
@@ -2898,7 +2898,7 @@ EXPORT_SYMBOL_GPL(pci_check_and_mask_intx);
 
 /**
  * pci_check_and_mask_intx - unmask INTx of no interrupt is pending
- * @pdev: the PCI device to operate on
+ * @dev: the PCI device to operate on
  *
  * Check if the device dev has its INTx line asserted, unmask it if not
  * and return true. False is returned and the mask remains active if
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index ca86f39a0fdc..b1fa25d6583a 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2731,6 +2731,7 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
  * @dev: struct device for the regulator
  * @init_data: platform provided init data, passed through by driver
  * @driver_data: private regulator data
+ * @of_node: target open firmware device structure (may be NULL)
  *
  * Called by regulator drivers to register a regulator.
  * Returns 0 on success.
diff --git a/drivers/video/backlight/adp8860_bl.c b/drivers/video/backlight/adp8860_bl.c
index 66bc74d9ce2a..378276c9d3cf 100644
--- a/drivers/video/backlight/adp8860_bl.c
+++ b/drivers/video/backlight/adp8860_bl.c
@@ -146,7 +146,7 @@ static int adp8860_set_bits(struct i2c_client *client, int reg, uint8_t bit_mask
 
         ret = adp8860_read(client, reg, &reg_val);
 
-        if (!ret && ((reg_val & bit_mask) == 0)) {
+        if (!ret && ((reg_val & bit_mask) != bit_mask)) {
                 reg_val |= bit_mask;
                 ret = adp8860_write(client, reg, reg_val);
         }
diff --git a/drivers/video/backlight/adp8870_bl.c b/drivers/video/backlight/adp8870_bl.c
index 6c68a6899e87..6735059376d6 100644
--- a/drivers/video/backlight/adp8870_bl.c
+++ b/drivers/video/backlight/adp8870_bl.c
@@ -160,7 +160,7 @@ static int adp8870_set_bits(struct i2c_client *client, int reg, uint8_t bit_mask
 
         ret = adp8870_read(client, reg, &reg_val);
 
-        if (!ret && ((reg_val & bit_mask) == 0)) {
+        if (!ret && ((reg_val & bit_mask) != bit_mask)) {
                 reg_val |= bit_mask;
                 ret = adp8870_write(client, reg, reg_val);
         }
diff --git a/drivers/video/backlight/l4f00242t03.c b/drivers/video/backlight/l4f00242t03.c
index 4f5d1c4cb6ab..27d1d7a29c77 100644
--- a/drivers/video/backlight/l4f00242t03.c
+++ b/drivers/video/backlight/l4f00242t03.c
@@ -190,6 +190,7 @@ static int __devinit l4f00242t03_probe(struct spi_device *spi)
 
         priv->io_reg = regulator_get(&spi->dev, "vdd");
         if (IS_ERR(priv->io_reg)) {
+                ret = PTR_ERR(priv->io_reg);
                 dev_err(&spi->dev, "%s: Unable to get the IO regulator\n",
                        __func__);
                 goto err3;
@@ -197,6 +198,7 @@ static int __devinit l4f00242t03_probe(struct spi_device *spi)
 
         priv->core_reg = regulator_get(&spi->dev, "vcore");
         if (IS_ERR(priv->core_reg)) {
+                ret = PTR_ERR(priv->core_reg);
                 dev_err(&spi->dev, "%s: Unable to get the core regulator\n",
                        __func__);
                 goto err4;
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index f66cc1625150..0554b00a7b33 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -140,7 +140,6 @@ config CIFS_DFS_UPCALL
 
 config CIFS_FSCACHE
           bool "Provide CIFS client caching support (EXPERIMENTAL)"
-          depends on EXPERIMENTAL
           depends on CIFS=m && FSCACHE || CIFS=y && FSCACHE=y
           help
             Makes CIFS FS-Cache capable. Say Y here if you want your CIFS data
@@ -149,7 +148,7 @@ config CIFS_FSCACHE
 
 config CIFS_ACL
           bool "Provide CIFS ACL support (EXPERIMENTAL)"
-          depends on EXPERIMENTAL && CIFS_XATTR && KEYS
+          depends on CIFS_XATTR && KEYS
           help
             Allows to fetch CIFS/NTFS ACL from the server.  The DACL blob
             is handed over to the application/caller.
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 84e8c0724704..24b3dfc05282 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -676,14 +676,23 @@ static ssize_t cifs_multiuser_mount_proc_write(struct file *file,
 {
         char c;
         int rc;
+        static bool warned;
 
         rc = get_user(c, buffer);
         if (rc)
                 return rc;
         if (c == '0' || c == 'n' || c == 'N')
                 multiuser_mount = 0;
-        else if (c == '1' || c == 'y' || c == 'Y')
+        else if (c == '1' || c == 'y' || c == 'Y') {
                 multiuser_mount = 1;
+                if (!warned) {
+                        warned = true;
+                        printk(KERN_WARNING "CIFS VFS: The legacy multiuser "
+                                "mount code is scheduled to be deprecated in "
+                                "3.5. Please switch to using the multiuser "
+                                "mount option.");
+                }
+        }
 
         return count;
 }
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 2272fd5fe5b7..e622863b292f 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -113,9 +113,11 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
                    MAX_MECH_STR_LEN +
                    UID_KEY_LEN + (sizeof(uid_t) * 2) +
                    CREDUID_KEY_LEN + (sizeof(uid_t) * 2) +
-                   USER_KEY_LEN + strlen(sesInfo->user_name) +
                    PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
 
+        if (sesInfo->user_name)
+                desc_len += USER_KEY_LEN + strlen(sesInfo->user_name);
+
         spnego_key = ERR_PTR(-ENOMEM);
         description = kzalloc(desc_len, GFP_KERNEL);
         if (description == NULL)
@@ -152,8 +154,10 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
         dp = description + strlen(description);
         sprintf(dp, ";creduid=0x%x", sesInfo->cred_uid);
 
-        dp = description + strlen(description);
-        sprintf(dp, ";user=%s", sesInfo->user_name);
+        if (sesInfo->user_name) {
+                dp = description + strlen(description);
+                sprintf(dp, ";user=%s", sesInfo->user_name);
+        }
 
         dp = description + strlen(description);
         sprintf(dp, ";pid=0x%x", current->pid);
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 1b2e180b018d..fbb9da951843 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -27,17 +27,17 @@
 #include "cifs_debug.h"
 
 /*
- * cifs_ucs2_bytes - how long will a string be after conversion?
- * @ucs - pointer to input string
+ * cifs_utf16_bytes - how long will a string be after conversion?
+ * @utf16 - pointer to input string
  * @maxbytes - don't go past this many bytes of input string
  * @codepage - destination codepage
  *
- * Walk a ucs2le string and return the number of bytes that the string will
+ * Walk a utf16le string and return the number of bytes that the string will
  * be after being converted to the given charset, not including any null
  * termination required. Don't walk past maxbytes in the source buffer.
  */
 int
-cifs_ucs2_bytes(const __le16 *from, int maxbytes,
+cifs_utf16_bytes(const __le16 *from, int maxbytes,
                 const struct nls_table *codepage)
 {
         int i;
@@ -122,7 +122,7 @@ cp_convert:
 }
 
 /*
- * cifs_from_ucs2 - convert utf16le string to local charset
+ * cifs_from_utf16 - convert utf16le string to local charset
  * @to - destination buffer
  * @from - source buffer
  * @tolen - destination buffer size (in bytes)
@@ -130,7 +130,7 @@ cp_convert:
  * @codepage - codepage to which characters should be converted
  * @mapchar - should characters be remapped according to the mapchars option?
  *
- * Convert a little-endian ucs2le string (as sent by the server) to a string
+ * Convert a little-endian utf16le string (as sent by the server) to a string
  * in the provided codepage. The tolen and fromlen parameters are to ensure
  * that the code doesn't walk off of the end of the buffer (which is always
  * a danger if the alignment of the source buffer is off). The destination
@@ -139,12 +139,12 @@ cp_convert:
  * null terminator).
  *
  * Note that some windows versions actually send multiword UTF-16 characters
- * instead of straight UCS-2. The linux nls routines however aren't able to
+ * instead of straight UTF16-2. The linux nls routines however aren't able to
  * deal with those characters properly. In the event that we get some of
  * those characters, they won't be translated properly.
  */
 int
-cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
+cifs_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
                  const struct nls_table *codepage, bool mapchar)
 {
         int i, charlen, safelen;
@@ -190,13 +190,13 @@ cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
 }
 
 /*
- * NAME:        cifs_strtoUCS()
+ * NAME:        cifs_strtoUTF16()
  *
  * FUNCTION:    Convert character string to unicode string
  *
  */
 int
-cifs_strtoUCS(__le16 *to, const char *from, int len,
+cifs_strtoUTF16(__le16 *to, const char *from, int len,
               const struct nls_table *codepage)
 {
         int charlen;
@@ -206,7 +206,7 @@ cifs_strtoUCS(__le16 *to, const char *from, int len,
         for (i = 0; len && *from; i++, from += charlen, len -= charlen) {
                 charlen = codepage->char2uni(from, len, &wchar_to);
                 if (charlen < 1) {
-                        cERROR(1, "strtoUCS: char2uni of 0x%x returned %d",
+                        cERROR(1, "strtoUTF16: char2uni of 0x%x returned %d",
                                 *from, charlen);
                         /* A question mark */
                         wchar_to = 0x003f;
@@ -220,7 +220,8 @@ cifs_strtoUCS(__le16 *to, const char *from, int len,
 }
 
 /*
- * cifs_strndup_from_ucs - copy a string from wire format to the local codepage
+ * cifs_strndup_from_utf16 - copy a string from wire format to the local
+ * codepage
  * @src - source string
  * @maxlen - don't walk past this many bytes in the source string
  * @is_unicode - is this a unicode string?
@@ -231,19 +232,19 @@ cifs_strtoUCS(__le16 *to, const char *from, int len,
  * error.
  */
 char *
-cifs_strndup_from_ucs(const char *src, const int maxlen, const bool is_unicode,
-             const struct nls_table *codepage)
+cifs_strndup_from_utf16(const char *src, const int maxlen,
+                        const bool is_unicode, const struct nls_table *codepage)
 {
         int len;
         char *dst;
 
         if (is_unicode) {
-                len = cifs_ucs2_bytes((__le16 *) src, maxlen, codepage);
+                len = cifs_utf16_bytes((__le16 *) src, maxlen, codepage);
                 len += nls_nullsize(codepage);
                 dst = kmalloc(len, GFP_KERNEL);
                 if (!dst)
                         return NULL;
-                cifs_from_ucs2(dst, (__le16 *) src, len, maxlen, codepage,
+                cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
                                false);
         } else {
                 len = strnlen(src, maxlen);
@@ -264,7 +265,7 @@ cifs_strndup_from_ucs(const char *src, const int maxlen, const bool is_unicode,
  * names are little endian 16 bit Unicode on the wire
  */
 int
-cifsConvertToUCS(__le16 *target, const char *source, int srclen,
+cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                  const struct nls_table *cp, int mapChars)
 {
         int i, j, charlen;
@@ -273,7 +274,7 @@ cifsConvertToUCS(__le16 *target, const char *source, int srclen,
         wchar_t tmp;
 
         if (!mapChars)
-                return cifs_strtoUCS(target, source, PATH_MAX, cp);
+                return cifs_strtoUTF16(target, source, PATH_MAX, cp);
 
         for (i = 0, j = 0; i < srclen; j++) {
                 src_char = source[i];
@@ -281,7 +282,7 @@ cifsConvertToUCS(__le16 *target, const char *source, int srclen,
                 switch (src_char) {
                 case 0:
                         put_unaligned(0, &target[j]);
-                        goto ctoUCS_out;
+                        goto ctoUTF16_out;
                 case ':':
                         dst_char = cpu_to_le16(UNI_COLON);
                         break;
@@ -326,7 +327,7 @@ cifsConvertToUCS(__le16 *target, const char *source, int srclen,
                 put_unaligned(dst_char, &target[j]);
         }
 
-ctoUCS_out:
+ctoUTF16_out:
         return i;
 }
 
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 6d02fd560566..a513a546700b 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -74,16 +74,16 @@ extern const struct UniCaseRange CifsUniLowerRange[];
 #endif                          /* UNIUPR_NOLOWER */
 
 #ifdef __KERNEL__
-int cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
-                   const struct nls_table *codepage, bool mapchar);
-int cifs_ucs2_bytes(const __le16 *from, int maxbytes,
-                    const struct nls_table *codepage);
-int cifs_strtoUCS(__le16 *, const char *, int, const struct nls_table *);
-char *cifs_strndup_from_ucs(const char *src, const int maxlen,
-                            const bool is_unicode,
-                            const struct nls_table *codepage);
-extern int cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
-                        const struct nls_table *cp, int mapChars);
+int cifs_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
+                    const struct nls_table *codepage, bool mapchar);
+int cifs_utf16_bytes(const __le16 *from, int maxbytes,
+                     const struct nls_table *codepage);
+int cifs_strtoUTF16(__le16 *, const char *, int, const struct nls_table *);
+char *cifs_strndup_from_utf16(const char *src, const int maxlen,
+                              const bool is_unicode,
+                              const struct nls_table *codepage);
+extern int cifsConvertToUTF16(__le16 *target, const char *source, int maxlen,
+                              const struct nls_table *cp, int mapChars);
 
 #endif
 
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 72ddf23ef6f7..c1b254487388 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -909,6 +909,8 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
                 umode_t group_mask = S_IRWXG;
                 umode_t other_mask = S_IRWXU | S_IRWXG | S_IRWXO;
 
+                if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
+                        return;
                 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
                                 GFP_KERNEL);
                 if (!ppace) {
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 5d9b9acc5fce..63c460e503b6 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -327,7 +327,7 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
         attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME);
         attrptr->length = cpu_to_le16(2 * dlen);
         blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
+        cifs_strtoUTF16((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
 
         return 0;
 }
@@ -376,7 +376,7 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
                                         kmalloc(attrsize + 1, GFP_KERNEL);
                                 if (!ses->domainName)
                                                 return -ENOMEM;
-                                cifs_from_ucs2(ses->domainName,
+                                cifs_from_utf16(ses->domainName,
                                         (__le16 *)blobptr, attrsize, attrsize,
                                         nls_cp, false);
                                 break;
@@ -420,15 +420,20 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
         }
 
         /* convert ses->user_name to unicode and uppercase */
-        len = strlen(ses->user_name);
+        len = ses->user_name ? strlen(ses->user_name) : 0;
         user = kmalloc(2 + (len * 2), GFP_KERNEL);
         if (user == NULL) {
                 cERROR(1, "calc_ntlmv2_hash: user mem alloc failure\n");
                 rc = -ENOMEM;
                 return rc;
         }
-        len = cifs_strtoUCS((__le16 *)user, ses->user_name, len, nls_cp);
-        UniStrupr(user);
+
+        if (len) {
+                len = cifs_strtoUTF16((__le16 *)user, ses->user_name, len, nls_cp);
+                UniStrupr(user);
+        } else {
+                memset(user, '\0', 2);
+        }
 
         rc = crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
                                 (char *)user, 2 * len);
@@ -448,8 +453,8 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
                         rc = -ENOMEM;
                         return rc;
                 }
-                len = cifs_strtoUCS((__le16 *)domain, ses->domainName, len,
-                                        nls_cp);
+                len = cifs_strtoUTF16((__le16 *)domain, ses->domainName, len,
+                                      nls_cp);
                 rc =
                 crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
                                         (char *)domain, 2 * len);
@@ -468,7 +473,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
                         rc = -ENOMEM;
                         return rc;
                 }
-                len = cifs_strtoUCS((__le16 *)server, ses->serverName, len,
+                len = cifs_strtoUTF16((__le16 *)server, ses->serverName, len,
                                         nls_cp);
                 rc =
                 crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index ba53c1c6c6cc..76e7d8b6da17 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -879,6 +879,8 @@ require use of the stronger protocol */
 #define   CIFSSEC_MASK          0xB70B7 /* current flags supported if weak */
 #endif /* UPCALL */
 #else /* do not allow weak pw hash */
+#define   CIFSSEC_MUST_LANMAN   0
+#define   CIFSSEC_MUST_PLNTXT   0
 #ifdef CONFIG_CIFS_UPCALL
 #define   CIFSSEC_MASK          0x8F08F /* flags supported if no weak allowed */
 #else
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 6600aa2d2ef3..8b7794c31591 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -821,8 +821,8 @@ PsxDelete:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else { /* BB add path length overrun check */
@@ -893,8 +893,8 @@ DelFileRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->fileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->fileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -938,8 +938,8 @@ RmDirRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->DirName, dirName,
-                                         PATH_MAX, nls_codepage, remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->DirName, dirName,
+                                              PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -981,8 +981,8 @@ MkDirRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->DirName, name,
-                                            PATH_MAX, nls_codepage, remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->DirName, name,
+                                              PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -1030,8 +1030,8 @@ PsxCreat:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, name,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, name,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -1197,8 +1197,8 @@ OldOpenRetry:
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 count = 1;      /* account for one byte pad to word boundary */
                 name_len =
-                   cifsConvertToUCS((__le16 *) (pSMB->fileName + 1),
-                                    fileName, PATH_MAX, nls_codepage, remap);
+                   cifsConvertToUTF16((__le16 *) (pSMB->fileName + 1),
+                                      fileName, PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -1304,8 +1304,8 @@ openRetry:
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 count = 1;      /* account for one byte pad to word boundary */
                 name_len =
-                    cifsConvertToUCS((__le16 *) (pSMB->fileName + 1),
-                                     fileName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) (pSMB->fileName + 1),
+                                       fileName, PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->NameLength = cpu_to_le16(name_len);
@@ -2649,16 +2649,16 @@ renameRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->OldFileName, fromName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->OldFileName, fromName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->OldFileName[name_len] = 0x04;     /* pad */
         /* protocol requires ASCII signature byte on Unicode string */
                 pSMB->OldFileName[name_len + 1] = 0x00;
                 name_len2 =
-                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
-                                     toName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *)&pSMB->OldFileName[name_len+2],
+                                       toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {        /* BB improve the check for buffer overruns BB */
@@ -2738,10 +2738,12 @@ int CIFSSMBRenameOpenFile(const int xid, struct cifs_tcon *pTcon,
         /* unicode only call */
         if (target_name == NULL) {
                 sprintf(dummy_string, "cifs%x", pSMB->hdr.Mid);
-                len_of_str = cifsConvertToUCS((__le16 *)rename_info->target_name,
+                len_of_str =
+                        cifsConvertToUTF16((__le16 *)rename_info->target_name,
                                         dummy_string, 24, nls_codepage, remap);
         } else {
-                len_of_str = cifsConvertToUCS((__le16 *)rename_info->target_name,
+                len_of_str =
+                        cifsConvertToUTF16((__le16 *)rename_info->target_name,
                                         target_name, PATH_MAX, nls_codepage,
                                         remap);
         }
@@ -2795,17 +2797,17 @@ copyRetry:
         pSMB->Flags = cpu_to_le16(flags & COPY_TREE);
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->OldFileName,
-                                            fromName, PATH_MAX, nls_codepage,
-                                            remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->OldFileName,
+                                              fromName, PATH_MAX, nls_codepage,
+                                              remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->OldFileName[name_len] = 0x04;     /* pad */
                 /* protocol requires ASCII signature byte on Unicode string */
                 pSMB->OldFileName[name_len + 1] = 0x00;
                 name_len2 =
-                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
-                                toName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *)&pSMB->OldFileName[name_len+2],
+                                       toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {        /* BB improve the check for buffer overruns BB */
@@ -2861,9 +2863,9 @@ createSymLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((__le16 *) pSMB->FileName, fromName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifs_strtoUTF16((__le16 *) pSMB->FileName, fromName,
+                                    /* find define for this maxpathcomponent */
+                                    PATH_MAX, nls_codepage);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -2885,9 +2887,9 @@ createSymLinkRetry:
         data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len_target =
-                    cifs_strtoUCS((__le16 *) data_offset, toName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifs_strtoUTF16((__le16 *) data_offset, toName, PATH_MAX
+                                    /* find define for this maxpathcomponent */
+                                    , nls_codepage);
                 name_len_target++;      /* trailing null */
                 name_len_target *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -2949,8 +2951,8 @@ createHardLinkRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->FileName, toName,
-                                            PATH_MAX, nls_codepage, remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->FileName, toName,
+                                              PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -2972,8 +2974,8 @@ createHardLinkRetry:
         data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len_target =
-                    cifsConvertToUCS((__le16 *) data_offset, fromName, PATH_MAX,
-                                     nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) data_offset, fromName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len_target++;      /* trailing null */
                 name_len_target *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3042,8 +3044,8 @@ winCreateHardLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->OldFileName, fromName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->OldFileName, fromName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -3051,8 +3053,8 @@ winCreateHardLinkRetry:
                 pSMB->OldFileName[name_len] = 0x04;
                 pSMB->OldFileName[name_len + 1] = 0x00; /* pad */
                 name_len2 =
-                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
-                                     toName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *)&pSMB->OldFileName[name_len+2],
+                                       toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3108,8 +3110,8 @@ querySymLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((__le16 *) pSMB->FileName, searchName,
-                                  PATH_MAX, nls_codepage);
+                        cifs_strtoUTF16((__le16 *) pSMB->FileName, searchName,
+                                        PATH_MAX, nls_codepage);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3166,8 +3168,8 @@ querySymLinkRetry:
                                 is_unicode = false;
 
                         /* BB FIXME investigate remapping reserved chars here */
-                        *symlinkinfo = cifs_strndup_from_ucs(data_start, count,
-                                                    is_unicode, nls_codepage);
+                        *symlinkinfo = cifs_strndup_from_utf16(data_start,
+                                        count, is_unicode, nls_codepage);
                         if (!*symlinkinfo)
                                 rc = -ENOMEM;
                 }
@@ -3450,8 +3452,9 @@ queryAclRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                         PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName,
+                                           searchName, PATH_MAX, nls_codepage,
+                                           remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->FileName[name_len] = 0;
@@ -3537,8 +3540,8 @@ setAclRetry:
                 return rc;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                      PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                           PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3948,8 +3951,9 @@ QInfRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                        PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName,
+                                           searchName, PATH_MAX, nls_codepage,
+                                           remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {
@@ -4086,8 +4090,8 @@ QPathInfoRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4255,8 +4259,8 @@ UnixQPathInfoRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                  PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4344,8 +4348,8 @@ findFirstRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                 PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 /* We can not add the asterik earlier in case
                 it got remapped to 0xF03A as if it were part of the
                 directory name instead of a wildcard */
@@ -4656,8 +4660,9 @@ GetInodeNumberRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                         PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName,
+                                           searchName, PATH_MAX, nls_codepage,
+                                           remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4794,9 +4799,9 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                                 rc = -ENOMEM;
                                 goto parse_DFS_referrals_exit;
                         }
-                        cifsConvertToUCS((__le16 *) tmp, searchName,
-                                        PATH_MAX, nls_codepage, remap);
-                        node->path_consumed = cifs_ucs2_bytes(tmp,
+                        cifsConvertToUTF16((__le16 *) tmp, searchName,
+                                           PATH_MAX, nls_codepage, remap);
+                        node->path_consumed = cifs_utf16_bytes(tmp,
                                         le16_to_cpu(pSMBr->PathConsumed),
                                         nls_codepage);
                         kfree(tmp);
@@ -4809,8 +4814,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 /* copy DfsPath */
                 temp = (char *)ref + le16_to_cpu(ref->DfsPathOffset);
                 max_len = data_end - temp;
-                node->path_name = cifs_strndup_from_ucs(temp, max_len,
-                                                      is_unicode, nls_codepage);
+                node->path_name = cifs_strndup_from_utf16(temp, max_len,
+                                                is_unicode, nls_codepage);
                 if (!node->path_name) {
                         rc = -ENOMEM;
                         goto parse_DFS_referrals_exit;
@@ -4819,8 +4824,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 /* copy link target UNC */
                 temp = (char *)ref + le16_to_cpu(ref->NetworkAddressOffset);
                 max_len = data_end - temp;
-                node->node_name = cifs_strndup_from_ucs(temp, max_len,
-                                                      is_unicode, nls_codepage);
+                node->node_name = cifs_strndup_from_utf16(temp, max_len,
+                                                is_unicode, nls_codepage);
                 if (!node->node_name)
                         rc = -ENOMEM;
         }
@@ -4873,8 +4878,9 @@ getDFSRetry:
         if (ses->capabilities & CAP_UNICODE) {
                 pSMB->hdr.Flags2 |= SMBFLG2_UNICODE;
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->RequestFileName,
-                                     searchName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->RequestFileName,
+                                       searchName, PATH_MAX, nls_codepage,
+                                       remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -5506,8 +5512,8 @@ SetEOFRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -5796,8 +5802,8 @@ SetTimesRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -5877,8 +5883,8 @@ SetAttrLgcyRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        ConvertToUCS((__le16 *) pSMB->fileName, fileName,
-                                PATH_MAX, nls_codepage);
+                        ConvertToUTF16((__le16 *) pSMB->fileName, fileName,
+                                       PATH_MAX, nls_codepage);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -6030,8 +6036,8 @@ setPermsRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -6123,8 +6129,8 @@ QAllEAsRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 list_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 list_len++;     /* trailing null */
                 list_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -6301,8 +6307,8 @@ SetEARetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 4666780f315d..986709a8d903 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -38,6 +38,7 @@
 #include <asm/processor.h>
 #include <linux/inet.h>
 #include <linux/module.h>
+#include <keys/user-type.h>
 #include <net/ipv6.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
@@ -225,74 +226,90 @@ static int check2ndT2(struct smb_hdr *pSMB)
 
 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 {
-        struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
+        struct smb_t2_rsp *pSMBs = (struct smb_t2_rsp *)psecond;
         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
-        char *data_area_of_target;
-        char *data_area_of_buf2;
+        char *data_area_of_tgt;
+        char *data_area_of_src;
         int remaining;
-        unsigned int byte_count, total_in_buf;
-        __u16 total_data_size, total_in_buf2;
+        unsigned int byte_count, total_in_tgt;
+        __u16 tgt_total_cnt, src_total_cnt, total_in_src;
 
-        total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
+        src_total_cnt = get_unaligned_le16(&pSMBs->t2_rsp.TotalDataCount);
+        tgt_total_cnt = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 
-        if (total_data_size !=
-            get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
-                cFYI(1, "total data size of primary and secondary t2 differ");
+        if (tgt_total_cnt != src_total_cnt)
+                cFYI(1, "total data count of primary and secondary t2 differ "
+                        "source=%hu target=%hu", src_total_cnt, tgt_total_cnt);
 
-        total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
+        total_in_tgt = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 
-        remaining = total_data_size - total_in_buf;
+        remaining = tgt_total_cnt - total_in_tgt;
 
-        if (remaining < 0)
+        if (remaining < 0) {
+                cFYI(1, "Server sent too much data. tgt_total_cnt=%hu "
+                        "total_in_tgt=%hu", tgt_total_cnt, total_in_tgt);
                 return -EPROTO;
+        }
 
-        if (remaining == 0) /* nothing to do, ignore */
+        if (remaining == 0) {
+                /* nothing to do, ignore */
+                cFYI(1, "no more data remains");
                 return 0;
+        }
 
-        total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
-        if (remaining < total_in_buf2) {
+        total_in_src = get_unaligned_le16(&pSMBs->t2_rsp.DataCount);
+        if (remaining < total_in_src)
                 cFYI(1, "transact2 2nd response contains too much data");
-        }
 
         /* find end of first SMB data area */
-        data_area_of_target = (char *)&pSMBt->hdr.Protocol +
+        data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
-        /* validate target area */
 
-        data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
-                                get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
+        /* validate target area */
+        data_area_of_src = (char *)&pSMBs->hdr.Protocol +
+                                get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
 
-        data_area_of_target += total_in_buf;
+        data_area_of_tgt += total_in_tgt;
 
-        /* copy second buffer into end of first buffer */
-        total_in_buf += total_in_buf2;
+        total_in_tgt += total_in_src;
         /* is the result too big for the field? */
-        if (total_in_buf > USHRT_MAX)
+        if (total_in_tgt > USHRT_MAX) {
+                cFYI(1, "coalesced DataCount too large (%u)", total_in_tgt);
                 return -EPROTO;
-        put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
+        }
+        put_unaligned_le16(total_in_tgt, &pSMBt->t2_rsp.DataCount);
 
         /* fix up the BCC */
         byte_count = get_bcc(pTargetSMB);
-        byte_count += total_in_buf2;
+        byte_count += total_in_src;
         /* is the result too big for the field? */
-        if (byte_count > USHRT_MAX)
+        if (byte_count > USHRT_MAX) {
+                cFYI(1, "coalesced BCC too large (%u)", byte_count);
                 return -EPROTO;
+        }
         put_bcc(byte_count, pTargetSMB);
 
         byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
-        byte_count += total_in_buf2;
+        byte_count += total_in_src;
         /* don't allow buffer to overflow */
-        if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
+        if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
+                cFYI(1, "coalesced BCC exceeds buffer size (%u)", byte_count);
                 return -ENOBUFS;
+        }
         pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
 
-        memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
+        /* copy second buffer into end of first buffer */
+        memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
 
-        if (remaining == total_in_buf2) {
-                cFYI(1, "found the last secondary response");
-                return 0; /* we are done */
-        } else /* more responses to go */
+        if (remaining != total_in_src) {
+                /* more responses to go */
+                cFYI(1, "waiting for more secondary responses");
                 return 1;
+        }
+
+        /* we are done */
+        cFYI(1, "found the last secondary response");
+        return 0;
 }
 
 static void
@@ -1578,11 +1595,14 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                 }
         }
 
-        if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
-                cERROR(1, "Multiuser mounts currently require krb5 "
-                          "authentication!");
+#ifndef CONFIG_KEYS
+        /* Muliuser mounts require CONFIG_KEYS support */
+        if (vol->multiuser) {
+                cERROR(1, "Multiuser mounts require kernels with "
+                          "CONFIG_KEYS enabled.");
                 goto cifs_parse_mount_err;
         }
+#endif
 
         if (vol->UNCip == NULL)
                 vol->UNCip = &vol->UNC[2];
@@ -1981,10 +2001,16 @@ static int match_session(struct cifs_ses *ses, struct smb_vol *vol)
                         return 0;
                 break;
         default:
+                /* NULL username means anonymous session */
+                if (ses->user_name == NULL) {
+                        if (!vol->nullauth)
+                                return 0;
+                        break;
+                }
+
                 /* anything else takes username/password */
-                if (ses->user_name == NULL)
-                        return 0;
-                if (strncmp(ses->user_name, vol->username,
+                if (strncmp(ses->user_name,
+                            vol->username ? vol->username : "",
                             MAX_USERNAME_SIZE))
                         return 0;
                 if (strlen(vol->username) != 0 &&
@@ -2039,6 +2065,132 @@ cifs_put_smb_ses(struct cifs_ses *ses)
         cifs_put_tcp_session(server);
 }
 
+#ifdef CONFIG_KEYS
+
+/* strlen("cifs:a:") + INET6_ADDRSTRLEN + 1 */
+#define CIFSCREDS_DESC_SIZE (7 + INET6_ADDRSTRLEN + 1)
+
+/* Populate username and pw fields from keyring if possible */
+static int
+cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
+{
+        int rc = 0;
+        char *desc, *delim, *payload;
+        ssize_t len;
+        struct key *key;
+        struct TCP_Server_Info *server = ses->server;
+        struct sockaddr_in *sa;
+        struct sockaddr_in6 *sa6;
+        struct user_key_payload *upayload;
+
+        desc = kmalloc(CIFSCREDS_DESC_SIZE, GFP_KERNEL);
+        if (!desc)
+                return -ENOMEM;
+
+        /* try to find an address key first */
+        switch (server->dstaddr.ss_family) {
+        case AF_INET:
+                sa = (struct sockaddr_in *)&server->dstaddr;
+                sprintf(desc, "cifs:a:%pI4", &sa->sin_addr.s_addr);
+                break;
+        case AF_INET6:
+                sa6 = (struct sockaddr_in6 *)&server->dstaddr;
+                sprintf(desc, "cifs:a:%pI6c", &sa6->sin6_addr.s6_addr);
+                break;
+        default:
+                cFYI(1, "Bad ss_family (%hu)", server->dstaddr.ss_family);
+                rc = -EINVAL;
+                goto out_err;
+        }
+
+        cFYI(1, "%s: desc=%s", __func__, desc);
+        key = request_key(&key_type_logon, desc, "");
+        if (IS_ERR(key)) {
+                if (!ses->domainName) {
+                        cFYI(1, "domainName is NULL");
+                        rc = PTR_ERR(key);
+                        goto out_err;
+                }
+
+                /* didn't work, try to find a domain key */
+                sprintf(desc, "cifs:d:%s", ses->domainName);
+                cFYI(1, "%s: desc=%s", __func__, desc);
+                key = request_key(&key_type_logon, desc, "");
+                if (IS_ERR(key)) {
+                        rc = PTR_ERR(key);
+                        goto out_err;
+                }
+        }
+
+        down_read(&key->sem);
+        upayload = key->payload.data;
+        if (IS_ERR_OR_NULL(upayload)) {
+                rc = PTR_ERR(key);
+                goto out_key_put;
+        }
+
+        /* find first : in payload */
+        payload = (char *)upayload->data;
+        delim = strnchr(payload, upayload->datalen, ':');
+        cFYI(1, "payload=%s", payload);
+        if (!delim) {
+                cFYI(1, "Unable to find ':' in payload (datalen=%d)",
+                                upayload->datalen);
+                rc = -EINVAL;
+                goto out_key_put;
+        }
+
+        len = delim - payload;
+        if (len > MAX_USERNAME_SIZE || len <= 0) {
+                cFYI(1, "Bad value from username search (len=%ld)", len);
+                rc = -EINVAL;
+                goto out_key_put;
+        }
+
+        vol->username = kstrndup(payload, len, GFP_KERNEL);
+        if (!vol->username) {
+                cFYI(1, "Unable to allocate %ld bytes for username", len);
+                rc = -ENOMEM;
+                goto out_key_put;
+        }
+        cFYI(1, "%s: username=%s", __func__, vol->username);
+
+        len = key->datalen - (len + 1);
+        if (len > MAX_PASSWORD_SIZE || len <= 0) {
+                cFYI(1, "Bad len for password search (len=%ld)", len);
+                rc = -EINVAL;
+                kfree(vol->username);
+                vol->username = NULL;
+                goto out_key_put;
+        }
+
+        ++delim;
+        vol->password = kstrndup(delim, len, GFP_KERNEL);
+        if (!vol->password) {
+                cFYI(1, "Unable to allocate %ld bytes for password", len);
+                rc = -ENOMEM;
+                kfree(vol->username);
+                vol->username = NULL;
+                goto out_key_put;
+        }
+
+out_key_put:
+        up_read(&key->sem);
+        key_put(key);
+out_err:
+        kfree(desc);
+        cFYI(1, "%s: returning %d", __func__, rc);
+        return rc;
+}
+#else /* ! CONFIG_KEYS */
+static inline int
+cifs_set_cifscreds(struct smb_vol *vol __attribute__((unused)),
+                   struct cifs_ses *ses __attribute__((unused)))
+{
+        return -ENOSYS;
+}
+#endif /* CONFIG_KEYS */
+
 static bool warned_on_ntlm;  /* globals init to false automatically */
 
 static struct cifs_ses *
@@ -2914,18 +3066,33 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 #define CIFS_DEFAULT_IOSIZE (1024 * 1024)
 
 /*
- * Windows only supports a max of 60k reads. Default to that when posix
- * extensions aren't in force.
+ * Windows only supports a max of 60kb reads and 65535 byte writes. Default to
+ * those values when posix extensions aren't in force. In actuality here, we
+ * use 65536 to allow for a write that is a multiple of 4k. Most servers seem
+ * to be ok with the extra byte even though Windows doesn't send writes that
+ * are that large.
+ *
+ * Citation:
+ *
+ * http://blogs.msdn.com/b/openspecification/archive/2009/04/10/smb-maximum-transmit-buffer-size-and-performance-tuning.aspx
  */
 #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
+#define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
 
 static unsigned int
 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
 {
         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
         struct TCP_Server_Info *server = tcon->ses->server;
-        unsigned int wsize = pvolume_info->wsize ? pvolume_info->wsize :
-                                CIFS_DEFAULT_IOSIZE;
+        unsigned int wsize;
+
+        /* start with specified wsize, or default */
+        if (pvolume_info->wsize)
+                wsize = pvolume_info->wsize;
+        else if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
+                wsize = CIFS_DEFAULT_IOSIZE;
+        else
+                wsize = CIFS_DEFAULT_NON_POSIX_WSIZE;
 
         /* can server support 24-bit write sizes? (via UNIX extensions) */
         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
@@ -3136,10 +3303,9 @@ cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
                 return -EINVAL;
 
         if (volume_info->nullauth) {
-                cFYI(1, "null user");
-                volume_info->username = kzalloc(1, GFP_KERNEL);
-                if (volume_info->username == NULL)
-                        return -ENOMEM;
+                cFYI(1, "Anonymous login");
+                kfree(volume_info->username);
+                volume_info->username = NULL;
         } else if (volume_info->username) {
                 /* BB fixme parse for domain name here */
                 cFYI(1, "Username: %s", volume_info->username);
@@ -3478,7 +3644,7 @@ CIFSTCon(unsigned int xid, struct cifs_ses *ses,
         if (ses->capabilities & CAP_UNICODE) {
                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
                 length =
-                    cifs_strtoUCS((__le16 *) bcc_ptr, tree,
+                    cifs_strtoUTF16((__le16 *) bcc_ptr, tree,
                         6 /* max utf8 char length in bytes */ *
                         (/* server len*/ + 256 /* share len */), nls_codepage);
                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
@@ -3533,7 +3699,7 @@ CIFSTCon(unsigned int xid, struct cifs_ses *ses,
 
                 /* mostly informational -- no need to fail on error here */
                 kfree(tcon->nativeFileSystem);
-                tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
+                tcon->nativeFileSystem = cifs_strndup_from_utf16(bcc_ptr,
                                                       bytes_left, is_unicode,
                                                       nls_codepage);
 
@@ -3657,16 +3823,38 @@ int cifs_setup_session(unsigned int xid, struct cifs_ses *ses,
         return rc;
 }
 
+static int
+cifs_set_vol_auth(struct smb_vol *vol, struct cifs_ses *ses)
+{
+        switch (ses->server->secType) {
+        case Kerberos:
+                vol->secFlg = CIFSSEC_MUST_KRB5;
+                return 0;
+        case NTLMv2:
+                vol->secFlg = CIFSSEC_MUST_NTLMV2;
+                break;
+        case NTLM:
+                vol->secFlg = CIFSSEC_MUST_NTLM;
+                break;
+        case RawNTLMSSP:
+                vol->secFlg = CIFSSEC_MUST_NTLMSSP;
+                break;
+        case LANMAN:
+                vol->secFlg = CIFSSEC_MUST_LANMAN;
+                break;
+        }
+
+        return cifs_set_cifscreds(vol, ses);
+}
+
 static struct cifs_tcon *
 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
 {
+        int rc;
         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
         struct cifs_ses *ses;
         struct cifs_tcon *tcon = NULL;
         struct smb_vol *vol_info;
-        char username[28]; /* big enough for "krb50x" + hex of ULONG_MAX 6+16 */
-                           /* We used to have this as MAX_USERNAME which is   */
-                           /* way too big now (256 instead of 32) */
 
         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
         if (vol_info == NULL) {
@@ -3674,8 +3862,6 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
                 goto out;
         }
 
-        snprintf(username, sizeof(username), "krb50x%x", fsuid);
-        vol_info->username = username;
         vol_info->local_nls = cifs_sb->local_nls;
         vol_info->linux_uid = fsuid;
         vol_info->cred_uid = fsuid;
@@ -3685,8 +3871,11 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
         vol_info->local_lease = master_tcon->local_lease;
         vol_info->no_linux_ext = !master_tcon->unix_ext;
 
-        /* FIXME: allow for other secFlg settings */
-        vol_info->secFlg = CIFSSEC_MUST_KRB5;
+        rc = cifs_set_vol_auth(vol_info, master_tcon->ses);
+        if (rc) {
+                tcon = ERR_PTR(rc);
+                goto out;
+        }
 
         /* get a reference for the same TCP session */
         spin_lock(&cifs_tcp_ses_lock);
@@ -3709,6 +3898,8 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
         if (ses->capabilities & CAP_UNIX)
                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
 out:
+        kfree(vol_info->username);
+        kfree(vol_info->password);
         kfree(vol_info);
 
         return tcon;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index a090bbe6ee29..e2bbc683e018 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -647,10 +647,11 @@ static int cifs_filldir(char *find_entry, struct file *file, filldir_t filldir,
 
                 name.name = scratch_buf;
                 name.len =
-                        cifs_from_ucs2((char *)name.name, (__le16 *)de.name,
-                                       UNICODE_NAME_MAX,
-                                       min(de.namelen, (size_t)max_len), nlt,
-                                       cifs_sb->mnt_cifs_flags &
+                        cifs_from_utf16((char *)name.name, (__le16 *)de.name,
+                                        UNICODE_NAME_MAX,
+                                        min_t(size_t, de.namelen,
+                                              (size_t)max_len), nlt,
+                                        cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                 name.len -= nls_nullsize(nlt);
         } else {
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 4ec3ee9d72cc..d85efad5765f 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -167,16 +167,16 @@ unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
         int bytes_ret = 0;
 
         /* Copy OS version */
-        bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32,
-                                  nls_cp);
+        bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
+                                    nls_cp);
         bcc_ptr += 2 * bytes_ret;
-        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, init_utsname()->release,
-                                  32, nls_cp);
+        bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
+                                    32, nls_cp);
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* trailing null */
 
-        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
-                                  32, nls_cp);
+        bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
+                                    32, nls_cp);
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* trailing null */
 
@@ -197,8 +197,8 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
                 *(bcc_ptr+1) = 0;
                 bytes_ret = 0;
         } else
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
-                                          256, nls_cp);
+                bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
+                                            256, nls_cp);
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2;  /* account for null terminator */
 
@@ -226,8 +226,8 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
                 *bcc_ptr = 0;
                 *(bcc_ptr+1) = 0;
         } else {
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->user_name,
-                                          MAX_USERNAME_SIZE, nls_cp);
+                bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
+                                            MAX_USERNAME_SIZE, nls_cp);
         }
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* account for null termination */
@@ -287,7 +287,7 @@ decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
         cFYI(1, "bleft %d", bleft);
 
         kfree(ses->serverOS);
-        ses->serverOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
+        ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
         cFYI(1, "serverOS=%s", ses->serverOS);
         len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
         data += len;
@@ -296,7 +296,7 @@ decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
                 return;
 
         kfree(ses->serverNOS);
-        ses->serverNOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
+        ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
         cFYI(1, "serverNOS=%s", ses->serverNOS);
         len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
         data += len;
@@ -305,7 +305,7 @@ decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
                 return;
 
         kfree(ses->serverDomain);
-        ses->serverDomain = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
+        ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
         cFYI(1, "serverDomain=%s", ses->serverDomain);
 
         return;
@@ -502,8 +502,8 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 tmp += 2;
         } else {
                 int len;
-                len = cifs_strtoUCS((__le16 *)tmp, ses->domainName,
-                                    MAX_USERNAME_SIZE, nls_cp);
+                len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
+                                      MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
                 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->DomainName.Length = cpu_to_le16(len);
@@ -518,8 +518,8 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 tmp += 2;
         } else {
                 int len;
-                len = cifs_strtoUCS((__le16 *)tmp, ses->user_name,
-                                    MAX_USERNAME_SIZE, nls_cp);
+                len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
+                                      MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
                 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->UserName.Length = cpu_to_le16(len);
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 80d850881938..d5cd9aa7eacc 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -213,7 +213,7 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16,
 
         /* Password cannot be longer than 128 characters */
         if (passwd) /* Password must be converted to NT unicode */
-                len = cifs_strtoUCS(wpwd, passwd, 128, codepage);
+                len = cifs_strtoUTF16(wpwd, passwd, 128, codepage);
         else {
                 len = 0;
                 *wpwd = 0; /* Ensure string is null terminated */
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index f65d4455c5e5..ef023eef0464 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -540,7 +540,7 @@ EXPORT_SYMBOL_GPL(debugfs_create_blob);
  * debugfs_print_regs32 - use seq_print to describe a set of registers
  * @s: the seq_file structure being used to generate output
  * @regs: an array if struct debugfs_reg32 structures
- * @mregs: the length of the above array
+ * @nregs: the length of the above array
  * @base: the base address to be used in reading the registers
  * @prefix: a string to be prefixed to every output line
  *
diff --git a/fs/inode.c b/fs/inode.c
index 4fa4f0916af9..fb10d86ffad7 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -322,9 +322,6 @@ EXPORT_SYMBOL(clear_nlink);
 void set_nlink(struct inode *inode, unsigned int nlink)
 {
         if (!nlink) {
-                printk_ratelimited(KERN_INFO
-                        "set_nlink() clearing i_nlink on %s inode %li\n",
-                        inode->i_sb->s_type->name, inode->i_ino);
                 clear_nlink(inode);
         } else {
                 /* Yes, some filesystems do change nlink from zero to one */
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index d76ca6ae2b1b..121f77cfef76 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -77,6 +77,8 @@ static int show_stat(struct seq_file *p, void *v)
                 steal += kcpustat_cpu(i).cpustat[CPUTIME_STEAL];
                 guest += kcpustat_cpu(i).cpustat[CPUTIME_GUEST];
                 guest_nice += kcpustat_cpu(i).cpustat[CPUTIME_GUEST_NICE];
+                sum += kstat_cpu_irqs_sum(i);
+                sum += arch_irq_stat_cpu(i);
 
                 for (j = 0; j < NR_SOFTIRQS; j++) {
                         unsigned int softirq_stat = kstat_softirqs_cpu(j, i);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index e418c5abdb0e..7dcd2a250495 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -518,6 +518,9 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
                 if (!page)
                         continue;
 
+                if (PageReserved(page))
+                        continue;
+
                 /* Clear accessed and referenced bits. */
                 ptep_test_and_clear_young(vma, addr, pte);
                 ClearPageReferenced(page);
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index 2bfd987f4853..6b009548d2e0 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -179,47 +179,33 @@ static const char *qnx4_checkroot(struct super_block *sb)
         struct qnx4_inode_entry *rootdir;
         int rd, rl;
         int i, j;
-        int found = 0;
 
-        if (*(qnx4_sb(sb)->sb->RootDir.di_fname) != '/') {
+        if (*(qnx4_sb(sb)->sb->RootDir.di_fname) != '/')
                 return "no qnx4 filesystem (no root dir).";
-        } else {
-                QNX4DEBUG((KERN_NOTICE "QNX4 filesystem found on dev %s.\n", sb->s_id));
-                rd = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_blk) - 1;
-                rl = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_size);
-                for (j = 0; j < rl; j++) {
-                        bh = sb_bread(sb, rd + j);      /* root dir, first block */
-                        if (bh == NULL) {
-                                return "unable to read root entry.";
-                        }
-                        for (i = 0; i < QNX4_INODES_PER_BLOCK; i++) {
-                                rootdir = (struct qnx4_inode_entry *) (bh->b_data + i * QNX4_DIR_ENTRY_SIZE);
-                                if (rootdir->di_fname != NULL) {
-                                        QNX4DEBUG((KERN_INFO "rootdir entry found : [%s]\n", rootdir->di_fname));
-                                        if (!strcmp(rootdir->di_fname,
-                                                    QNX4_BMNAME)) {
-                                                found = 1;
-                                                qnx4_sb(sb)->BitMap = kmemdup(rootdir,
-                                                                              sizeof(struct qnx4_inode_entry),
-                                                                              GFP_KERNEL);
-                                                if (!qnx4_sb(sb)->BitMap) {
-                                                        brelse (bh);
-                                                        return "not enough memory for bitmap inode";
-                                                }/* keep bitmap inode known */
-                                                break;
-                                        }
-                                }
-                        }
+        QNX4DEBUG((KERN_NOTICE "QNX4 filesystem found on dev %s.\n", sb->s_id));
+        rd = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_blk) - 1;
+        rl = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_size);
+        for (j = 0; j < rl; j++) {
+                bh = sb_bread(sb, rd + j);      /* root dir, first block */
+                if (bh == NULL)
+                        return "unable to read root entry.";
+                rootdir = (struct qnx4_inode_entry *) bh->b_data;
+                for (i = 0; i < QNX4_INODES_PER_BLOCK; i++, rootdir++) {
+                        QNX4DEBUG((KERN_INFO "rootdir entry found : [%s]\n", rootdir->di_fname));
+                        if (strcmp(rootdir->di_fname, QNX4_BMNAME) != 0)
+                                continue;
+                        qnx4_sb(sb)->BitMap = kmemdup(rootdir,
+                                                      sizeof(struct qnx4_inode_entry),
+                                                      GFP_KERNEL);
                         brelse(bh);
-                        if (found != 0) {
-                                break;
-                        }
-                }
-                if (found == 0) {
-                        return "bitmap file not found.";
+                        if (!qnx4_sb(sb)->BitMap)
+                                return "not enough memory for bitmap inode";
+                        /* keep bitmap inode known */
+                        return NULL;
                 }
+                brelse(bh);
         }
-        return NULL;
+        return "bitmap file not found.";
 }
 
 static int qnx4_fill_super(struct super_block *s, void *data, int silent)
@@ -270,7 +256,7 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)
         if (IS_ERR(root)) {
                 printk(KERN_ERR "qnx4: get inode failed\n");
                 ret = PTR_ERR(root);
-                goto out;
+                goto outb;
         }
 
         ret = -ENOMEM;
@@ -283,6 +269,8 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)
 
       outi:
         iput(root);
+      outb:
+        kfree(qs->BitMap);
       out:
         brelse(bh);
       outnobh:
diff --git a/fs/super.c b/fs/super.c
index de41e1e46f09..6015c02296b7 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1186,6 +1186,8 @@ int freeze_super(struct super_block *sb)
                         printk(KERN_ERR
                                 "VFS:Filesystem freeze failed\n");
                         sb->s_frozen = SB_UNFROZEN;
+                        smp_wmb();
+                        wake_up(&sb->s_wait_unfrozen);
                         deactivate_locked_super(sb);
                         return ret;
                 }
diff --git a/include/keys/user-type.h b/include/keys/user-type.h
index c37c34275a44..bc9ec1d7698c 100644
--- a/include/keys/user-type.h
+++ b/include/keys/user-type.h
@@ -17,7 +17,7 @@
 
 /*****************************************************************************/
 /*
- * the payload for a key of type "user"
+ * the payload for a key of type "user" or "logon"
  * - once filled in and attached to a key:
  *   - the payload struct is invariant may not be changed, only replaced
  *   - the payload must be read with RCU procedures or with the key semaphore
@@ -33,6 +33,7 @@ struct user_key_payload {
 };
 
 extern struct key_type key_type_user;
+extern struct key_type key_type_logon;
 
 extern int user_instantiate(struct key *key, const void *data, size_t datalen);
 extern int user_update(struct key *key, const void *data, size_t datalen);
diff --git a/include/linux/device.h b/include/linux/device.h
index 5b3adb8f9588..b63fb393aa58 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -279,11 +279,11 @@ struct device *driver_find_device(struct device_driver *drv,
 
 /**
  * struct subsys_interface - interfaces to device functions
- * @name        name of the device function
- * @subsystem   subsytem of the devices to attach to
- * @node        the list of functions registered at the subsystem
- * @add         device hookup to device function handler
- * @remove      device hookup to device function handler
+ * @name:       name of the device function
+ * @subsys:     subsytem of the devices to attach to
+ * @node:       the list of functions registered at the subsystem
+ * @add_dev:    device hookup to device function handler
+ * @remove_dev: device hookup to device function handler
  *
  * Simple interfaces attached to a subsystem. Multiple interfaces can
  * attach to a subsystem and its devices. Unlike drivers, they do not
@@ -612,6 +612,7 @@ struct device_dma_parameters {
  * @archdata:   For arch-specific additions.
  * @of_node:    Associated device tree node.
  * @devt:       For creating the sysfs "dev".
+ * @id:         device instance
  * @devres_lock: Spinlock to protect the resource of the device.
  * @devres_head: The resources list of the device.
  * @knode_class: The node used to add the device to the class list.
@@ -1003,6 +1004,10 @@ extern long sysfs_deprecated;
  * Each module may only use this macro once, and calling it replaces
  * module_init() and module_exit().
  *
+ * @__driver: driver name
+ * @__register: register function for this driver type
+ * @__unregister: unregister function for this driver type
+ *
  * Use this macro to construct bus specific macros for registering
  * drivers, and do not use it on its own.
  */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 0244082d42c5..4b3a41fe22bf 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -10,6 +10,7 @@
 #include <linux/ioctl.h>
 #include <linux/blk_types.h>
 #include <linux/types.h>
+#include <linux/migrate_mode.h>
 
 /*
  * It's silly to have NR_OPEN bigger than NR_FILE, but you can change
@@ -526,7 +527,6 @@ enum positive_aop_returns {
 struct page;
 struct address_space;
 struct writeback_control;
-enum migrate_mode;
 
 struct iov_iter {
         const struct iovec *iov;
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 2fa0901219d4..0d7d6a1b172f 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -50,9 +50,11 @@
  * note header.  For kdump, the code in vmcore.c runs in the context
  * of the second kernel to combine them into one note.
  */
+#ifndef KEXEC_NOTE_BYTES
 #define KEXEC_NOTE_BYTES ( (KEXEC_NOTE_HEAD_BYTES * 2) +                \
                             KEXEC_CORE_NOTE_NAME_BYTES +                \
                             KEXEC_CORE_NOTE_DESC_BYTES )
+#endif
 
 /*
  * This structure is used to hold the arguments that are used when loading
diff --git a/include/linux/key.h b/include/linux/key.h
index bfc014c57351..5253471cd2ea 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -271,7 +271,7 @@ extern int keyring_add_key(struct key *keyring,
 
 extern struct key *key_lookup(key_serial_t id);
 
-static inline key_serial_t key_serial(struct key *key)
+static inline key_serial_t key_serial(const struct key *key)
 {
         return key ? key->serial : 0;
 }
diff --git a/include/linux/migrate.h b/include/linux/migrate.h
index eaf867412f7a..05ed2828a553 100644
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -3,22 +3,10 @@
 
 #include <linux/mm.h>
 #include <linux/mempolicy.h>
+#include <linux/migrate_mode.h>
 
 typedef struct page *new_page_t(struct page *, unsigned long private, int **);
 
-/*
- * MIGRATE_ASYNC means never block
- * MIGRATE_SYNC_LIGHT in the current implementation means to allow blocking
- *      on most operations but not ->writepage as the potential stall time
- *      is too significant
- * MIGRATE_SYNC will block when migrating pages
- */
-enum migrate_mode {
-        MIGRATE_ASYNC,
-        MIGRATE_SYNC_LIGHT,
-        MIGRATE_SYNC,
-};
-
 #ifdef CONFIG_MIGRATION
 #define PAGE_MIGRATION 1
 
diff --git a/include/linux/migrate_mode.h b/include/linux/migrate_mode.h
new file mode 100644
index 000000000000..ebf3d89a3919
--- /dev/null
+++ b/include/linux/migrate_mode.h
@@ -0,0 +1,16 @@
+#ifndef MIGRATE_MODE_H_INCLUDED
+#define MIGRATE_MODE_H_INCLUDED
+/*
+ * MIGRATE_ASYNC means never block
+ * MIGRATE_SYNC_LIGHT in the current implementation means to allow blocking
+ *      on most operations but not ->writepage as the potential stall time
+ *      is too significant
+ * MIGRATE_SYNC will block when migrating pages
+ */
+enum migrate_mode {
+        MIGRATE_ASYNC,
+        MIGRATE_SYNC_LIGHT,
+        MIGRATE_SYNC,
+};
+
+#endif          /* MIGRATE_MODE_H_INCLUDED */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4032ec1cf836..513f52459872 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -2088,7 +2088,7 @@ extern int sched_setscheduler_nocheck(struct task_struct *, int,
 extern struct task_struct *idle_task(int cpu);
 /**
  * is_idle_task - is the specified task an idle task?
- * @tsk: the task in question.
+ * @p: the task in question.
  */
 static inline bool is_idle_task(struct task_struct *p)
 {
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index e4c711c6f321..79ab2555b3b0 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -48,6 +48,7 @@ extern struct file *shmem_file_setup(const char *name,
                                         loff_t size, unsigned long flags);
 extern int shmem_zero_setup(struct vm_area_struct *);
 extern int shmem_lock(struct file *file, int lock, struct user_struct *user);
+extern void shmem_unlock_mapping(struct address_space *mapping);
 extern struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
                                         pgoff_t index, gfp_t gfp_mask);
 extern void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end);
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 06061a7f8e69..3e60228e7299 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -273,7 +273,7 @@ static inline int zone_reclaim(struct zone *z, gfp_t mask, unsigned int order)
 #endif
 
 extern int page_evictable(struct page *page, struct vm_area_struct *vma);
-extern void scan_mapping_unevictable_pages(struct address_space *);
+extern void check_move_unevictable_pages(struct page **, int nr_pages);
 
 extern unsigned long scan_unevictable_pages;
 extern int scan_unevictable_handler(struct ctl_table *, int,
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 27a4e16d2bf1..69d845739bc2 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1073,6 +1073,7 @@ typedef void (*usb_complete_t)(struct urb *);
  *      which the host controller driver should use in preference to the
  *      transfer_buffer.
  * @sg: scatter gather buffer list
+ * @num_mapped_sgs: (internal) number of mapped sg entries
  * @num_sgs: number of entries in the sg list
  * @transfer_buffer_length: How big is transfer_buffer.  The transfer may
  *      be broken up into chunks according to the current maximum packet
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 15f4be7d768e..a067d30ce73e 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1140,6 +1140,7 @@ struct cfg80211_disassoc_request {
  * @bssid: Fixed BSSID requested, maybe be %NULL, if set do not
  *      search for IBSSs with a different BSSID.
  * @channel: The channel to use if no IBSS can be found to join.
+ * @channel_type: channel type (HT mode)
  * @channel_fixed: The channel should be fixed -- do not search for
  *      IBSSs to join on other channels.
  * @ie: information element(s) to include in the beacon
@@ -1978,6 +1979,11 @@ struct wiphy_wowlan_support {
  *      configured as RX antennas. Antenna configuration commands will be
  *      rejected unless this or @available_antennas_tx is set.
  *
+ * @probe_resp_offload:
+ *       Bitmap of supported protocols for probe response offloading.
+ *       See &enum nl80211_probe_resp_offload_support_attr. Only valid
+ *       when the wiphy flag @WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD is set.
+ *
  * @max_remain_on_channel_duration: Maximum time a remain-on-channel operation
  *      may request, if implemented.
  *
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 9b7c8ab7d75c..86ee272de210 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -128,7 +128,6 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
 
         if (S_ISREG(mode)) {
                 struct mqueue_inode_info *info;
-                struct task_struct *p = current;
                 unsigned long mq_bytes, mq_msg_tblsz;
 
                 inode->i_fop = &mqueue_file_operations;
@@ -159,7 +158,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
 
                 spin_lock(&mq_lock);
                 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
-                    u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) {
+                    u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
                         spin_unlock(&mq_lock);
                         /* mqueue_evict_inode() releases info->messages */
                         ret = -EMFILE;
diff --git a/ipc/shm.c b/ipc/shm.c
index 02ecf2c078fc..b76be5bda6c2 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -870,9 +870,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
         case SHM_LOCK:
         case SHM_UNLOCK:
         {
-                struct file *uninitialized_var(shm_file);
-
-                lru_add_drain_all();  /* drain pagevecs to lru lists */
+                struct file *shm_file;
 
                 shp = shm_lock_check(ns, shmid);
                 if (IS_ERR(shp)) {
@@ -895,22 +893,31 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
                 err = security_shm_shmctl(shp, cmd);
                 if (err)
                         goto out_unlock;
-                
-                if(cmd==SHM_LOCK) {
+
+                shm_file = shp->shm_file;
+                if (is_file_hugepages(shm_file))
+                        goto out_unlock;
+
+                if (cmd == SHM_LOCK) {
                         struct user_struct *user = current_user();
-                        if (!is_file_hugepages(shp->shm_file)) {
-                                err = shmem_lock(shp->shm_file, 1, user);
-                                if (!err && !(shp->shm_perm.mode & SHM_LOCKED)){
-                                        shp->shm_perm.mode |= SHM_LOCKED;
-                                        shp->mlock_user = user;
-                                }
+                        err = shmem_lock(shm_file, 1, user);
+                        if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
+                                shp->shm_perm.mode |= SHM_LOCKED;
+                                shp->mlock_user = user;
                         }
-                } else if (!is_file_hugepages(shp->shm_file)) {
-                        shmem_lock(shp->shm_file, 0, shp->mlock_user);
-                        shp->shm_perm.mode &= ~SHM_LOCKED;
-                        shp->mlock_user = NULL;
+                        goto out_unlock;
                 }
+
+                /* SHM_UNLOCK */
+                if (!(shp->shm_perm.mode & SHM_LOCKED))
+                        goto out_unlock;
+                shmem_lock(shm_file, 0, shp->mlock_user);
+                shp->shm_perm.mode &= ~SHM_LOCKED;
+                shp->mlock_user = NULL;
+                get_file(shm_file);
                 shm_unlock(shp);
+                shmem_unlock_mapping(shm_file->f_mapping);
+                fput(shm_file);
                 goto out;
         }
         case IPC_RMID:
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index caaea6e944f8..af1de0f34eae 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1863,11 +1863,12 @@ void __audit_syscall_entry(int arch, int major,
 
 /**
  * audit_syscall_exit - deallocate audit context after a system call
- * @pt_regs: syscall registers
+ * @success: success value of the syscall
+ * @return_code: return value of the syscall
  *
  * Tear down after system call.  If the audit context has been marked as
  * auditable (either because of the AUDIT_RECORD_CONTEXT state from
- * filtering, or because some other part of the kernel write an audit
+ * filtering, or because some other part of the kernel wrote an audit
  * message), then write out the syscall information.  In call cases,
  * free the names stored from getname().
  */
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 95dd7212e610..29f5b65bee29 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1077,6 +1077,7 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
                 /* Early boot.  kretprobe_table_locks not yet initialized. */
                 return;
 
+        INIT_HLIST_HEAD(&empty_rp);
         hash = hash_ptr(tk, KPROBE_HASH_BITS);
         head = &kretprobe_inst_table[hash];
         kretprobe_table_lock(hash, &flags);
@@ -1085,7 +1086,6 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
                         recycle_rp_inst(ri, &empty_rp);
         }
         kretprobe_table_unlock(hash, &flags);
-        INIT_HLIST_HEAD(&empty_rp);
         hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
diff --git a/kernel/sched/cpupri.c b/kernel/sched/cpupri.c
index b0d798eaf130..d72586fdf660 100644
--- a/kernel/sched/cpupri.c
+++ b/kernel/sched/cpupri.c
@@ -129,7 +129,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p,
  * cpupri_set - update the cpu priority setting
  * @cp: The cpupri context
  * @cpu: The target cpu
- * @pri: The priority (INVALID-RT99) to assign to this CPU
+ * @newpri: The priority (INVALID-RT99) to assign to this CPU
  *
  * Note: Assumes cpu_rq(cpu)->lock is locked
  *
@@ -200,7 +200,6 @@ void cpupri_set(struct cpupri *cp, int cpu, int newpri)
 /**
  * cpupri_init - initialize the cpupri structure
  * @cp: The cpupri context
- * @bootmem: true if allocations need to use bootmem
  *
  * Returns: -ENOMEM if memory fails.
  */
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index db110b8ae030..f1539decd99d 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -634,10 +634,11 @@ static int tracepoint_module_coming(struct module *mod)
         int ret = 0;
 
         /*
-         * We skip modules that tain the kernel, especially those with different
-         * module header (for forced load), to make sure we don't cause a crash.
+         * We skip modules that taint the kernel, especially those with different
+         * module headers (for forced load), to make sure we don't cause a crash.
+         * Staging and out-of-tree GPL modules are fine.
          */
-        if (mod->taints)
+        if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
                 return 0;
         mutex_lock(&tracepoints_mutex);
         tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index fe84bb978e3b..716802b774ea 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -255,6 +255,8 @@ void *mpi_get_buffer(MPI a, unsigned *nbytes, int *sign)
         if (!n)
                 n++;            /* avoid zero length allocation */
         p = buffer = kmalloc(n, GFP_KERNEL);
+        if (!p)
+                return NULL;
 
         for (i = a->nlimbs - 1; i >= 0; i--) {
                 alimb = a->d[i];
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ea8c3a4cd2ae..5f34bd8dda34 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2508,6 +2508,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
 {
         struct hstate *h = hstate_vma(vma);
         int ret = VM_FAULT_SIGBUS;
+        int anon_rmap = 0;
         pgoff_t idx;
         unsigned long size;
         struct page *page;
@@ -2562,14 +2563,13 @@ retry:
                         spin_lock(&inode->i_lock);
                         inode->i_blocks += blocks_per_huge_page(h);
                         spin_unlock(&inode->i_lock);
-                        page_dup_rmap(page);
                 } else {
                         lock_page(page);
                         if (unlikely(anon_vma_prepare(vma))) {
                                 ret = VM_FAULT_OOM;
                                 goto backout_unlocked;
                         }
-                        hugepage_add_new_anon_rmap(page, vma, address);
+                        anon_rmap = 1;
                 }
         } else {
                 /*
@@ -2582,7 +2582,6 @@ retry:
                               VM_FAULT_SET_HINDEX(h - hstates);
                         goto backout_unlocked;
                 }
-                page_dup_rmap(page);
         }
 
         /*
@@ -2606,6 +2605,10 @@ retry:
         if (!huge_pte_none(huge_ptep_get(ptep)))
                 goto backout;
 
+        if (anon_rmap)
+                hugepage_add_new_anon_rmap(page, vma, address);
+        else
+                page_dup_rmap(page);
         new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE)
                                 && (vma->vm_flags & VM_SHARED)));
         set_huge_pte_at(mm, address, ptep, new_pte);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3dbff4dcde35..4baddbae94cc 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3247,7 +3247,7 @@ int mem_cgroup_prepare_migration(struct page *page,
                 ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
         else
                 ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype);
         return ret;
 }
 
diff --git a/mm/memory.c b/mm/memory.c
index 5e30583c2605..fa2f04e0337c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -878,15 +878,24 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                         }
                         if (likely(!non_swap_entry(entry)))
                                 rss[MM_SWAPENTS]++;
-                        else if (is_write_migration_entry(entry) &&
-                                        is_cow_mapping(vm_flags)) {
-                                /*
-                                 * COW mappings require pages in both parent
-                                 * and child to be set to read.
-                                 */
-                                make_migration_entry_read(&entry);
-                                pte = swp_entry_to_pte(entry);
-                                set_pte_at(src_mm, addr, src_pte, pte);
+                        else if (is_migration_entry(entry)) {
+                                page = migration_entry_to_page(entry);
+
+                                if (PageAnon(page))
+                                        rss[MM_ANONPAGES]++;
+                                else
+                                        rss[MM_FILEPAGES]++;
+
+                                if (is_write_migration_entry(entry) &&
+                                    is_cow_mapping(vm_flags)) {
+                                        /*
+                                         * COW mappings require pages in both
+                                         * parent and child to be set to read.
+                                         */
+                                        make_migration_entry_read(&entry);
+                                        pte = swp_entry_to_pte(entry);
+                                        set_pte_at(src_mm, addr, src_pte, pte);
+                                }
                         }
                 }
                 goto out_set_pte;
@@ -1191,6 +1200,16 @@ again:
 
                         if (!non_swap_entry(entry))
                                 rss[MM_SWAPENTS]--;
+                        else if (is_migration_entry(entry)) {
+                                struct page *page;
+
+                                page = migration_entry_to_page(entry);
+
+                                if (PageAnon(page))
+                                        rss[MM_ANONPAGES]--;
+                                else
+                                        rss[MM_FILEPAGES]--;
+                        }
                         if (unlikely(!free_swap_and_cache(entry)))
                                 print_bad_pte(vma, addr, ptent, NULL);
                 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 0027d8f4a1bb..d2186ecb36f7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5413,7 +5413,25 @@ __count_immobile_pages(struct zone *zone, struct page *page, int count)
 
 bool is_pageblock_removable_nolock(struct page *page)
 {
-        struct zone *zone = page_zone(page);
+        struct zone *zone;
+        unsigned long pfn;
+
+        /*
+         * We have to be careful here because we are iterating over memory
+         * sections which are not zone aware so we might end up outside of
+         * the zone but still within the section.
+         * We have to take care about the node as well. If the node is offline
+         * its NODE_DATA will be NULL - see page_zone.
+         */
+        if (!node_online(page_to_nid(page)))
+                return false;
+
+        zone = page_zone(page);
+        pfn = page_to_pfn(page);
+        if (zone->zone_start_pfn > pfn ||
+                        zone->zone_start_pfn + zone->spanned_pages <= pfn)
+                return false;
+
         return __count_immobile_pages(zone, page, 0);
 }
 
diff --git a/mm/shmem.c b/mm/shmem.c
index feead1943d92..269d049294ab 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -379,7 +379,7 @@ static int shmem_free_swap(struct address_space *mapping,
 /*
  * Pagevec may contain swap entries, so shuffle up pages before releasing.
  */
-static void shmem_pagevec_release(struct pagevec *pvec)
+static void shmem_deswap_pagevec(struct pagevec *pvec)
 {
         int i, j;
 
@@ -389,7 +389,36 @@ static void shmem_pagevec_release(struct pagevec *pvec)
                         pvec->pages[j++] = page;
         }
         pvec->nr = j;
-        pagevec_release(pvec);
+}
+
+/*
+ * SysV IPC SHM_UNLOCK restore Unevictable pages to their evictable lists.
+ */
+void shmem_unlock_mapping(struct address_space *mapping)
+{
+        struct pagevec pvec;
+        pgoff_t indices[PAGEVEC_SIZE];
+        pgoff_t index = 0;
+
+        pagevec_init(&pvec, 0);
+        /*
+         * Minor point, but we might as well stop if someone else SHM_LOCKs it.
+         */
+        while (!mapping_unevictable(mapping)) {
+                /*
+                 * Avoid pagevec_lookup(): find_get_pages() returns 0 as if it
+                 * has finished, if it hits a row of PAGEVEC_SIZE swap entries.
+                 */
+                pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
+                                        PAGEVEC_SIZE, pvec.pages, indices);
+                if (!pvec.nr)
+                        break;
+                index = indices[pvec.nr - 1] + 1;
+                shmem_deswap_pagevec(&pvec);
+                check_move_unevictable_pages(pvec.pages, pvec.nr);
+                pagevec_release(&pvec);
+                cond_resched();
+        }
 }
 
 /*
@@ -440,7 +469,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         }
                         unlock_page(page);
                 }
-                shmem_pagevec_release(&pvec);
+                shmem_deswap_pagevec(&pvec);
+                pagevec_release(&pvec);
                 mem_cgroup_uncharge_end();
                 cond_resched();
                 index++;
@@ -470,7 +500,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         continue;
                 }
                 if (index == start && indices[0] > end) {
-                        shmem_pagevec_release(&pvec);
+                        shmem_deswap_pagevec(&pvec);
+                        pagevec_release(&pvec);
                         break;
                 }
                 mem_cgroup_uncharge_start();
@@ -494,7 +525,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         }
                         unlock_page(page);
                 }
-                shmem_pagevec_release(&pvec);
+                shmem_deswap_pagevec(&pvec);
+                pagevec_release(&pvec);
                 mem_cgroup_uncharge_end();
                 index++;
         }
@@ -1068,13 +1100,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
                 user_shm_unlock(inode->i_size, user);
                 info->flags &= ~VM_LOCKED;
                 mapping_clear_unevictable(file->f_mapping);
-                /*
-                 * Ensure that a racing putback_lru_page() can see
-                 * the pages of this mapping are evictable when we
-                 * skip them due to !PageLRU during the scan.
-                 */
-                smp_mb__after_clear_bit();
-                scan_mapping_unevictable_pages(file->f_mapping);
         }
         retval = 0;
 
@@ -2445,6 +2470,10 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
         return 0;
 }
 
+void shmem_unlock_mapping(struct address_space *mapping)
+{
+}
+
 void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
 {
         truncate_inode_pages_range(inode->i_mapping, lstart, lend);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2880396f7953..c52b23552659 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -26,7 +26,6 @@
 #include <linux/buffer_head.h>  /* for try_to_release_page(),
                                         buffer_heads_over_limit */
 #include <linux/mm_inline.h>
-#include <linux/pagevec.h>
 #include <linux/backing-dev.h>
 #include <linux/rmap.h>
 #include <linux/topology.h>
@@ -661,7 +660,7 @@ redo:
                  * When racing with an mlock or AS_UNEVICTABLE clearing
                  * (page is unlocked) make sure that if the other thread
                  * does not observe our setting of PG_lru and fails
-                 * isolation/check_move_unevictable_page,
+                 * isolation/check_move_unevictable_pages,
                  * we see PG_mlocked/AS_UNEVICTABLE cleared below and move
                  * the page back to the evictable list.
                  *
@@ -3499,100 +3498,61 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
         return 1;
 }
 
+#ifdef CONFIG_SHMEM
 /**
- * check_move_unevictable_page - check page for evictability and move to appropriate zone lru list
- * @page: page to check evictability and move to appropriate lru list
- * @zone: zone page is in
+ * check_move_unevictable_pages - check pages for evictability and move to appropriate zone lru list
+ * @pages:      array of pages to check
+ * @nr_pages:   number of pages to check
  *
- * Checks a page for evictability and moves the page to the appropriate
- * zone lru list.
+ * Checks pages for evictability and moves them to the appropriate lru list.
  *
- * Restrictions: zone->lru_lock must be held, page must be on LRU and must
- * have PageUnevictable set.
+ * This function is only used for SysV IPC SHM_UNLOCK.
  */
-static void check_move_unevictable_page(struct page *page, struct zone *zone)
+void check_move_unevictable_pages(struct page **pages, int nr_pages)
 {
         struct lruvec *lruvec;
+        struct zone *zone = NULL;
+        int pgscanned = 0;
+        int pgrescued = 0;
+        int i;
 
-        VM_BUG_ON(PageActive(page));
-retry:
-        ClearPageUnevictable(page);
-        if (page_evictable(page, NULL)) {
-                enum lru_list l = page_lru_base_type(page);
-
-                __dec_zone_state(zone, NR_UNEVICTABLE);
-                lruvec = mem_cgroup_lru_move_lists(zone, page,
-                                                   LRU_UNEVICTABLE, l);
-                list_move(&page->lru, &lruvec->lists[l]);
-                __inc_zone_state(zone, NR_INACTIVE_ANON + l);
-                __count_vm_event(UNEVICTABLE_PGRESCUED);
-        } else {
-                /*
-                 * rotate unevictable list
-                 */
-                SetPageUnevictable(page);
-                lruvec = mem_cgroup_lru_move_lists(zone, page, LRU_UNEVICTABLE,
-                                                   LRU_UNEVICTABLE);
-                list_move(&page->lru, &lruvec->lists[LRU_UNEVICTABLE]);
-                if (page_evictable(page, NULL))
-                        goto retry;
-        }
-}
-
-/**
- * scan_mapping_unevictable_pages - scan an address space for evictable pages
- * @mapping: struct address_space to scan for evictable pages
- *
- * Scan all pages in mapping.  Check unevictable pages for
- * evictability and move them to the appropriate zone lru list.
- */
-void scan_mapping_unevictable_pages(struct address_space *mapping)
-{
-        pgoff_t next = 0;
-        pgoff_t end   = (i_size_read(mapping->host) + PAGE_CACHE_SIZE - 1) >>
-                         PAGE_CACHE_SHIFT;
-        struct zone *zone;
-        struct pagevec pvec;
-
-        if (mapping->nrpages == 0)
-                return;
-
-        pagevec_init(&pvec, 0);
-        while (next < end &&
-                pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)) {
-                int i;
-                int pg_scanned = 0;
-
-                zone = NULL;
-
-                for (i = 0; i < pagevec_count(&pvec); i++) {
-                        struct page *page = pvec.pages[i];
-                        pgoff_t page_index = page->index;
-                        struct zone *pagezone = page_zone(page);
+        for (i = 0; i < nr_pages; i++) {
+                struct page *page = pages[i];
+                struct zone *pagezone;
 
-                        pg_scanned++;
-                        if (page_index > next)
-                                next = page_index;
-                        next++;
+                pgscanned++;
+                pagezone = page_zone(page);
+                if (pagezone != zone) {
+                        if (zone)
+                                spin_unlock_irq(&zone->lru_lock);
+                        zone = pagezone;
+                        spin_lock_irq(&zone->lru_lock);
+                }
 
-                        if (pagezone != zone) {
-                                if (zone)
-                                        spin_unlock_irq(&zone->lru_lock);
-                                zone = pagezone;
-                                spin_lock_irq(&zone->lru_lock);
-                        }
+                if (!PageLRU(page) || !PageUnevictable(page))
+                        continue;
 
-                        if (PageLRU(page) && PageUnevictable(page))
-                                check_move_unevictable_page(page, zone);
+                if (page_evictable(page, NULL)) {
+                        enum lru_list lru = page_lru_base_type(page);
+
+                        VM_BUG_ON(PageActive(page));
+                        ClearPageUnevictable(page);
+                        __dec_zone_state(zone, NR_UNEVICTABLE);
+                        lruvec = mem_cgroup_lru_move_lists(zone, page,
+                                                LRU_UNEVICTABLE, lru);
+                        list_move(&page->lru, &lruvec->lists[lru]);
+                        __inc_zone_state(zone, NR_INACTIVE_ANON + lru);
+                        pgrescued++;
                 }
-                if (zone)
-                        spin_unlock_irq(&zone->lru_lock);
-                pagevec_release(&pvec);
-
-                count_vm_events(UNEVICTABLE_PGSCANNED, pg_scanned);
         }
 
+        if (zone) {
+                __count_vm_events(UNEVICTABLE_PGRESCUED, pgrescued);
+                __count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned);
+                spin_unlock_irq(&zone->lru_lock);
+        }
 }
+#endif /* CONFIG_SHMEM */
 
 static void warn_scan_unevictable_pages(void)
 {
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index d793001929cf..9b0c0b8b4ab4 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -5,7 +5,7 @@ use strict;
 ## Copyright (c) 1998 Michael Zucchi, All Rights Reserved        ##
 ## Copyright (C) 2000, 1  Tim Waugh <twaugh@redhat.com>          ##
 ## Copyright (C) 2001  Simon Huggins                             ##
-## Copyright (C) 2005-2010  Randy Dunlap                         ##
+## Copyright (C) 2005-2012  Randy Dunlap                         ##
 ##                                                               ##
 ## #define enhancements by Armin Kuster <akuster@mvista.com>     ##
 ## Copyright (c) 2000 MontaVista Software, Inc.                  ##
@@ -1785,6 +1785,7 @@ sub dump_function($$) {
     $prototype =~ s/__devinit +//;
     $prototype =~ s/__init +//;
     $prototype =~ s/__init_or_module +//;
+    $prototype =~ s/__must_check +//;
     $prototype =~ s/^#\s*define\s+//; #ak added
     $prototype =~ s/__attribute__\s*\(\([a-z,]*\)\)//;
 
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index d661afbe474c..d45061d02fee 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -99,6 +99,7 @@ static bool ima_match_rules(struct ima_measure_rule_entry *rule,
                             struct inode *inode, enum ima_hooks func, int mask)
 {
         struct task_struct *tsk = current;
+        const struct cred *cred = current_cred();
         int i;
 
         if ((rule->flags & IMA_FUNC) && rule->func != func)
@@ -108,7 +109,7 @@ static bool ima_match_rules(struct ima_measure_rule_entry *rule,
         if ((rule->flags & IMA_FSMAGIC)
             && rule->fsmagic != inode->i_sb->s_magic)
                 return false;
-        if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid)
+        if ((rule->flags & IMA_UID) && rule->uid != cred->uid)
                 return false;
         for (i = 0; i < MAX_LSM_RULES; i++) {
                 int rc = 0;
diff --git a/security/keys/internal.h b/security/keys/internal.h
index c7a7caec4830..65647f825584 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -33,6 +33,7 @@
 
 extern struct key_type key_type_dead;
 extern struct key_type key_type_user;
+extern struct key_type key_type_logon;
 
 /*****************************************************************************/
 /*
diff --git a/security/keys/key.c b/security/keys/key.c
index 4f64c7267afb..7ada8019be1f 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -999,6 +999,7 @@ void __init key_init(void)
         list_add_tail(&key_type_keyring.link, &key_types_list);
         list_add_tail(&key_type_dead.link, &key_types_list);
         list_add_tail(&key_type_user.link, &key_types_list);
+        list_add_tail(&key_type_logon.link, &key_types_list);
 
         /* record the root user tracking */
         rb_link_node(&root_key_user.node,
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 69ff52c08e97..c7660a25a3e4 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -18,6 +18,8 @@
 #include <asm/uaccess.h>
 #include "internal.h"
 
+static int logon_vet_description(const char *desc);
+
 /*
  * user defined keys take an arbitrary string as the description and an
  * arbitrary blob of data as the payload
@@ -36,6 +38,24 @@ struct key_type key_type_user = {
 EXPORT_SYMBOL_GPL(key_type_user);
 
 /*
+ * This key type is essentially the same as key_type_user, but it does
+ * not define a .read op. This is suitable for storing username and
+ * password pairs in the keyring that you do not want to be readable
+ * from userspace.
+ */
+struct key_type key_type_logon = {
+        .name                   = "logon",
+        .instantiate            = user_instantiate,
+        .update                 = user_update,
+        .match                  = user_match,
+        .revoke                 = user_revoke,
+        .destroy                = user_destroy,
+        .describe               = user_describe,
+        .vet_description        = logon_vet_description,
+};
+EXPORT_SYMBOL_GPL(key_type_logon);
+
+/*
  * instantiate a user defined key
  */
 int user_instantiate(struct key *key, const void *data, size_t datalen)
@@ -59,7 +79,7 @@ int user_instantiate(struct key *key, const void *data, size_t datalen)
         /* attach the data */
         upayload->datalen = datalen;
         memcpy(upayload->data, data, datalen);
-        rcu_assign_pointer(key->payload.data, upayload);
+        rcu_assign_keypointer(key, upayload);
         ret = 0;
 
 error:
@@ -98,7 +118,7 @@ int user_update(struct key *key, const void *data, size_t datalen)
         if (ret == 0) {
                 /* attach the new data, displacing the old */
                 zap = key->payload.data;
-                rcu_assign_pointer(key->payload.data, upayload);
+                rcu_assign_keypointer(key, upayload);
                 key->expiry = 0;
         }
 
@@ -133,7 +153,7 @@ void user_revoke(struct key *key)
         key_payload_reserve(key, 0);
 
         if (upayload) {
-                rcu_assign_pointer(key->payload.data, NULL);
+                rcu_assign_keypointer(key, NULL);
                 kfree_rcu(upayload, rcu);
         }
 }
@@ -189,3 +209,20 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
 }
 
 EXPORT_SYMBOL_GPL(user_read);
+
+/* Vet the description for a "logon" key */
+static int logon_vet_description(const char *desc)
+{
+        char *p;
+
+        /* require a "qualified" description string */
+        p = strchr(desc, ':');
+        if (!p)
+                return -EINVAL;
+
+        /* also reject description with ':' as first char */
+        if (p == desc)
+                return -EINVAL;
+
+        return 0;
+}