456 files changed, 4511 insertions, 2724 deletions
diff --git a/Documentation/arm64/memory.txt b/Documentation/arm64/memory.txt
index dbbdcbba75a3..4110cca96bd6 100644
--- a/Documentation/arm64/memory.txt
+++ b/Documentation/arm64/memory.txt
@@ -27,17 +27,17 @@ Start			End			Size		Use
 -----------------------------------------------------------------------
 0000000000000000        0000007fffffffff         512GB          user
-ffffff8000000000        ffffffbbfffcffff        ~240GB          vmalloc
+ffffff8000000000        ffffffbbfffeffff        ~240GB          vmalloc
-ffffffbbfffd0000        ffffffbcfffdffff          64KB          [guard page]
+ffffffbbffff0000        ffffffbbffffffff          64KB          [guard page]
-ffffffbbfffe0000        ffffffbcfffeffff          64KB          PCI I/O space
+ffffffbc00000000        ffffffbdffffffff           8GB          vmemmap
-ffffffbbffff0000        ffffffbcffffffff          64KB          [guard page]
+ffffffbe00000000        ffffffbffbbfffff          ~8GB          [guard, future vmmemap]
-ffffffbc00000000        ffffffbdffffffff           8GB          vmemmap
+ffffffbffbe00000        ffffffbffbe0ffff          64KB          PCI I/O space
-ffffffbe00000000        ffffffbffbffffff          ~8GB          [guard, future vmmemap]
+ffffffbbffff0000        ffffffbcffffffff          ~2MB          [guard]
 ffffffbffc000000        ffffffbfffffffff          64MB          modules
diff --git a/Documentation/devicetree/bindings/arm/atmel-at91.txt b/Documentation/devicetree/bindings/arm/atmel-at91.txt
index ecc81e368715..d187e9f7cf1c 100644
--- a/Documentation/devicetree/bindings/arm/atmel-at91.txt
+++ b/Documentation/devicetree/bindings/arm/atmel-at91.txt
@@ -8,7 +8,7 @@ PIT Timer required properties:
  shared across all System Controller members.
 TC/TCLIB Timer required properties:
- compatible: Should be "atmel,<chip>-pit".
+- compatible: Should be "atmel,<chip>-tcb".
  <chip> can be "at91rm9200" or "at91sam9x5"
 - reg: Should contain registers location and length
 - interrupts: Should contain all interrupts for the TC block
diff --git a/Documentation/devicetree/bindings/input/touchscreen/egalax-ts.txt b/Documentation/devicetree/bindings/input/touchscreen/egalax-ts.txt
new file mode 100644
index 000000000000..df70318a617f
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/touchscreen/egalax-ts.txt
@@ -0,0 +1,19 @@
+* EETI eGalax Multiple Touch Controller
+Required properties:
+- compatible: must be "eeti,egalax_ts"
+- reg: i2c slave address
+- interrupt-parent: the phandle for the interrupt controller
+- interrupts: touch controller interrupt
+- wakeup-gpios: the gpio pin to be used for waking up the controller
+  as well as uased as irq pin
+Example:
+        egalax_ts@04 {
+                compatible = "eeti,egalax_ts";
+                reg = <0x04>;
+                interrupt-parent = <&gpio1>;
+                interrupts = <9 2>;
+                wakeup-gpios = <&gpio1 9 0>;
+        };
diff --git a/Documentation/hwmon/fam15h_power b/Documentation/hwmon/fam15h_power
index a92918e0bd69..80654813d04a 100644
--- a/Documentation/hwmon/fam15h_power
+++ b/Documentation/hwmon/fam15h_power
@@ -10,7 +10,7 @@ Supported chips:
  BIOS and Kernel Developer's Guide (BKDG) For AMD Family 15h Processors
    (not yet published)
-Author: Andreas Herrmann <andreas.herrmann3@amd.com>
+Author: Andreas Herrmann <herrmann.der.user@googlemail.com>
 Description
 -----------
diff --git a/MAINTAINERS b/MAINTAINERS
index f39a82dc0260..59203e77ce9e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -503,7 +503,7 @@ F:	include/linux/altera_uart.h
 F:      include/linux/altera_jtaguart.h
 AMD FAM15H PROCESSOR POWER MONITORING DRIVER
-M:      Andreas Herrmann <andreas.herrmann3@amd.com>
+M:      Andreas Herrmann <herrmann.der.user@googlemail.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/fam15h_power
@@ -637,6 +637,13 @@ W:	http://www.arm.linux.org.uk/
 S:      Maintained
 F:      arch/arm/
+ARM SUB-ARCHITECTURES
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      MAINTAINED
+F:      arch/arm/mach-*/
+F:      arch/arm/plat-*/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc.git
 ARM PRIMECELL AACI PL041 DRIVER
 M:      Russell King <linux@arm.linux.org.uk>
 S:      Maintained
@@ -2500,6 +2507,7 @@ M:	Joonyoung Shim <jy0922.shim@samsung.com>
 M:      Seung-Woo Kim <sw0312.kim@samsung.com>
 M:      Kyungmin Park <kyungmin.park@samsung.com>
 L:      dri-devel@lists.freedesktop.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos.git
 S:      Supported
 F:      drivers/gpu/drm/exynos
 F:      include/drm/exynos*
@@ -5062,7 +5070,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
 S:      Odd Fixes
 F:      drivers/net/
 F:      include/linux/if_*
-F:      include/linux/*device.h
+F:      include/linux/netdevice.h
+F:      include/linux/arcdevice.h
+F:      include/linux/etherdevice.h
+F:      include/linux/fcdevice.h
+F:      include/linux/fddidevice.h
+F:      include/linux/hippidevice.h
+F:      include/linux/inetdevice.h
 NETXEN (1/10) GbE SUPPORT
 M:      Sony Chacko <sony.chacko@qlogic.com>
@@ -5634,7 +5648,7 @@ S:	Maintained
 F:      drivers/pinctrl/spear/
 PKTCDVD DRIVER
-M:      Peter Osterlund <petero2@telia.com>
+M:      Jiri Kosina <jkosina@suse.cz>
 S:      Maintained
 F:      drivers/block/pktcdvd.c
 F:      include/linux/pktcdvd.h
diff --git a/Makefile b/Makefile
index 14c93b39b929..a1ccf225c4e9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 7
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc4
 NAME = Terrified Chipmunk
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
index b06c0db273b1..e6391a4e6649 100644
--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
@@ -126,14 +126,14 @@
                #size-cells = <0>;
                btn3 {
-                        label = "Buttin 3";
+                        label = "Button 3";
                        gpios = <&pioA 30 1>;
                        linux,code = <0x103>;
                        gpio-key,wakeup;
                };
                btn4 {
-                        label = "Buttin 4";
+                        label = "Button 4";
                        gpios = <&pioA 31 1>;
                        linux,code = <0x104>;
                        gpio-key,wakeup;
diff --git a/arch/arm/boot/dts/dbx5x0.dtsi b/arch/arm/boot/dts/dbx5x0.dtsi
index 748ba7aa746c..4b0e0ca08f40 100644
--- a/arch/arm/boot/dts/dbx5x0.dtsi
+++ b/arch/arm/boot/dts/dbx5x0.dtsi
@@ -483,6 +483,8 @@
                        compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                        reg = <0x80004000 0x1000>;
                        interrupts = <0 21 0x4>;
+                        arm,primecell-periphid = <0x180024>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        v-i2c-supply = <&db8500_vape_reg>;
@@ -494,6 +496,8 @@
                        compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                        reg = <0x80122000 0x1000>;
                        interrupts = <0 22 0x4>;
+                        arm,primecell-periphid = <0x180024>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        v-i2c-supply = <&db8500_vape_reg>;
@@ -505,6 +509,8 @@
                        compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                        reg = <0x80128000 0x1000>;
                        interrupts = <0 55 0x4>;
+                        arm,primecell-periphid = <0x180024>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        v-i2c-supply = <&db8500_vape_reg>;
@@ -516,6 +522,8 @@
                        compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                        reg = <0x80110000 0x1000>;
                        interrupts = <0 12 0x4>;
+                        arm,primecell-periphid = <0x180024>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        v-i2c-supply = <&db8500_vape_reg>;
@@ -527,6 +535,8 @@
                        compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                        reg = <0x8012a000 0x1000>;
                        interrupts = <0 51 0x4>;
+                        arm,primecell-periphid = <0x180024>;
                        #address-cells = <1>;
                        #size-cells = <0>;
                        v-i2c-supply = <&db8500_vape_reg>;
@@ -573,33 +583,38 @@
                        interrupts = <0 60 0x4>;
                        status = "disabled";
                };
                sdi@80118000 {
                        compatible = "arm,pl18x", "arm,primecell";
                        reg = <0x80118000 0x1000>;
                        interrupts = <0 50 0x4>;
                        status = "disabled";
                };
                sdi@80005000 {
                        compatible = "arm,pl18x", "arm,primecell";
                        reg = <0x80005000 0x1000>;
                        interrupts = <0 41 0x4>;
                        status = "disabled";
                };
                sdi@80119000 {
                        compatible = "arm,pl18x", "arm,primecell";
                        reg = <0x80119000 0x1000>;
                        interrupts = <0 59 0x4>;
                        status = "disabled";
                };
                sdi@80114000 {
                        compatible = "arm,pl18x", "arm,primecell";
                        reg = <0x80114000 0x1000>;
                        interrupts = <0 99 0x4>;
                        status = "disabled";
                };
                sdi@80008000 {
                        compatible = "arm,pl18x", "arm,primecell";
-                        reg = <0x80114000 0x1000>;
+                        reg = <0x80008000 0x1000>;
                        interrupts = <0 100 0x4>;
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts
index 73567b843e72..a21511c14071 100644
--- a/arch/arm/boot/dts/exynos4210-trats.dts
+++ b/arch/arm/boot/dts/exynos4210-trats.dts
@@ -20,8 +20,10 @@
        compatible = "samsung,trats", "samsung,exynos4210";
        memory {
-                reg =  <0x40000000 0x20000000
+                reg =  <0x40000000 0x10000000
-                        0x60000000 0x20000000>;
+                        0x50000000 0x10000000
+                        0x60000000 0x10000000
+                        0x70000000 0x10000000>;
        };
        chosen {
diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
index 9ca4ca70c1bc..6d31aa383460 100644
--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi
@@ -69,6 +69,7 @@
                                interrupts = <13>, <56>;
                                interrupt-names = "gpmi-dma", "bch";
                                clocks = <&clks 34>;
+                                clock-names = "gpmi_io";
                                fsl,gpmi-dma-channel = <4>;
                                status = "disabled";
                        };
diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
index e16d63155480..55c57ea6169e 100644
--- a/arch/arm/boot/dts/imx28.dtsi
+++ b/arch/arm/boot/dts/imx28.dtsi
@@ -85,6 +85,7 @@
                                interrupts = <88>, <41>;
                                interrupt-names = "gpmi-dma", "bch";
                                clocks = <&clks 50>;
+                                clock-names = "gpmi_io";
                                fsl,gpmi-dma-channel = <4>;
                                status = "disabled";
                        };
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index f38ea8771b44..696e929d0304 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -257,7 +257,7 @@
                        interrupt-names = "common", "tx", "rx", "sidetone";
                        interrupt-parent = <&intc>;
                        ti,buffer-size = <1280>;
-                        ti,hwmods = "mcbsp2";
+                        ti,hwmods = "mcbsp2", "mcbsp2_sidetone";
                };
                mcbsp3: mcbsp@49024000 {
@@ -272,7 +272,7 @@
                        interrupt-names = "common", "tx", "rx", "sidetone";
                        interrupt-parent = <&intc>;
                        ti,buffer-size = <128>;
-                        ti,hwmods = "mcbsp3";
+                        ti,hwmods = "mcbsp3", "mcbsp3_sidetone";
                };
                mcbsp4: mcbsp@49026000 {
diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index 66aa7a6db884..394ded624e37 100644
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -139,6 +139,7 @@ CONFIG_I2C_IMX=y
 CONFIG_SPI=y
 CONFIG_SPI_IMX=y
 CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_MC9S08DZ60=y
 # CONFIG_HWMON is not set
 CONFIG_WATCHDOG=y
 CONFIG_IMX2_WDT=y
@@ -155,6 +156,7 @@ CONFIG_SOC_CAMERA=y
 CONFIG_SOC_CAMERA_OV2640=y
 CONFIG_VIDEO_MX3=y
 CONFIG_FB=y
+CONFIG_LCD_PLATFORM=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_LCD_CLASS_DEVICE=y
 CONFIG_LCD_L4F00242T03=y
diff --git a/arch/arm/configs/mvebu_defconfig b/arch/arm/configs/mvebu_defconfig
index 7bcf850eddcd..3458752c4bb2 100644
--- a/arch/arm/configs/mvebu_defconfig
+++ b/arch/arm/configs/mvebu_defconfig
@@ -1,6 +1,6 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
-CONFIG_NO_HZ=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
@@ -9,10 +9,12 @@ CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_ARCH_MVEBU=y
-CONFIG_MACH_ARMADA_370_XP=y
+CONFIG_MACH_ARMADA_370=y
+CONFIG_MACH_ARMADA_XP=y
+# CONFIG_CACHE_L2X0 is not set
 CONFIG_AEABI=y
 CONFIG_HIGHMEM=y
-CONFIG_USE_OF=y
+# CONFIG_COMPACTION is not set
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
 CONFIG_ARM_APPENDED_DTB=y
@@ -23,6 +25,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_GPIOLIB=y
 CONFIG_GPIO_SYSFS=y
+# CONFIG_USB_SUPPORT is not set
+# CONFIG_IOMMU_SUPPORT is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
diff --git a/arch/arm/configs/versatile_defconfig b/arch/arm/configs/versatile_defconfig
index cdd4d2bd3962..2ba9e63d0f17 100644
--- a/arch/arm/configs/versatile_defconfig
+++ b/arch/arm/configs/versatile_defconfig
@@ -1,3 +1,4 @@
+CONFIG_ARCH_VERSATILE=y
 CONFIG_EXPERIMENTAL=y
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h
index 35c1ed89b936..42f042ee4ada 100644
--- a/arch/arm/include/asm/io.h
+++ b/arch/arm/include/asm/io.h
@@ -64,7 +64,7 @@ extern void __raw_readsl(const void __iomem *addr, void *data, int longlen);
 static inline void __raw_writew(u16 val, volatile void __iomem *addr)
 {
        asm volatile("strh %1, %0"
-                     : "+Qo" (*(volatile u16 __force *)addr)
+                     : "+Q" (*(volatile u16 __force *)addr)
                     : "r" (val));
 }
@@ -72,7 +72,7 @@ static inline u16 __raw_readw(const volatile void __iomem *addr)
 {
        u16 val;
        asm volatile("ldrh %1, %0"
-                     : "+Qo" (*(volatile u16 __force *)addr),
+                     : "+Q" (*(volatile u16 __force *)addr),
                       "=r" (val));
        return val;
 }
diff --git a/arch/arm/include/asm/sched_clock.h b/arch/arm/include/asm/sched_clock.h
index 05b8e82ec9f5..e3f757263438 100644
--- a/arch/arm/include/asm/sched_clock.h
+++ b/arch/arm/include/asm/sched_clock.h
@@ -10,7 +10,5 @@
 extern void sched_clock_postinit(void);
 extern void setup_sched_clock(u32 (*read)(void), int bits, unsigned long rate);
-extern void setup_sched_clock_needs_suspend(u32 (*read)(void), int bits,
-                unsigned long rate);
 #endif
diff --git a/arch/arm/include/asm/vfpmacros.h b/arch/arm/include/asm/vfpmacros.h
index 6a6f1e485f41..301c1db3e99b 100644
--- a/arch/arm/include/asm/vfpmacros.h
+++ b/arch/arm/include/asm/vfpmacros.h
@@ -27,9 +27,9 @@
 #if __LINUX_ARM_ARCH__ <= 6
        ldr     \tmp, =elf_hwcap                    @ may not have MVFR regs
        ldr     \tmp, [\tmp, #0]
-        tst     \tmp, #HWCAP_VFPv3D16
+        tst     \tmp, #HWCAP_VFPD32
-        ldceql  p11, cr0, [\base],#32*4             @ FLDMIAD \base!, {d16-d31}
+        ldcnel  p11, cr0, [\base],#32*4             @ FLDMIAD \base!, {d16-d31}
-        addne   \base, \base, #32*4                 @ step over unused register space
+        addeq   \base, \base, #32*4                 @ step over unused register space
 #else
        VFPFMRX \tmp, MVFR0                         @ Media and VFP Feature Register 0
        and     \tmp, \tmp, #MVFR0_A_SIMD_MASK      @ A_SIMD field
@@ -51,9 +51,9 @@
 #if __LINUX_ARM_ARCH__ <= 6
        ldr     \tmp, =elf_hwcap                    @ may not have MVFR regs
        ldr     \tmp, [\tmp, #0]
-        tst     \tmp, #HWCAP_VFPv3D16
+        tst     \tmp, #HWCAP_VFPD32
-        stceql  p11, cr0, [\base],#32*4             @ FSTMIAD \base!, {d16-d31}
+        stcnel  p11, cr0, [\base],#32*4             @ FSTMIAD \base!, {d16-d31}
-        addne   \base, \base, #32*4                 @ step over unused register space
+        addeq   \base, \base, #32*4                 @ step over unused register space
 #else
        VFPFMRX \tmp, MVFR0                         @ Media and VFP Feature Register 0
        and     \tmp, \tmp, #MVFR0_A_SIMD_MASK      @ A_SIMD field
diff --git a/arch/arm/include/debug/8250_32.S b/arch/arm/include/debug/8250_32.S
new file mode 100644
index 000000000000..8db01eeabbb4
--- /dev/null
+++ b/arch/arm/include/debug/8250_32.S
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2011 Picochip Ltd., Jamie Iles
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Derived from arch/arm/mach-davinci/include/mach/debug-macro.S to use 32-bit
+ * accesses to the 8250.
+ */
+#include <linux/serial_reg.h>
+                .macro  senduart,rd,rx
+                str     \rd, [\rx, #UART_TX << UART_SHIFT]
+                .endm
+                .macro  busyuart,rd,rx
+1002:           ldr     \rd, [\rx, #UART_LSR << UART_SHIFT]
+                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
+                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
+                bne     1002b
+                .endm
+                /* The UART's don't have any flow control IO's wired up. */
+                .macro  waituart,rd,rx
+                .endm
diff --git a/arch/arm/include/debug/picoxcell.S b/arch/arm/include/debug/picoxcell.S
index 7419deb1b948..bc1f07c49cd4 100644
--- a/arch/arm/include/debug/picoxcell.S
+++ b/arch/arm/include/debug/picoxcell.S
@@ -5,10 +5,7 @@
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
- * Derived from arch/arm/mach-davinci/include/mach/debug-macro.S to use 32-bit
- * accesses to the 8250.
 */
-#include <linux/serial_reg.h>
 #define UART_SHIFT 2
 #define PICOXCELL_UART1_BASE            0x80230000
@@ -19,17 +16,4 @@
                ldr     \rp, =PICOXCELL_UART1_BASE
                .endm
-                .macro  senduart,rd,rx
+#include "8250_32.S"
-                str     \rd, [\rx, #UART_TX << UART_SHIFT]
-                .endm
-                .macro  busyuart,rd,rx
-1002:           ldr     \rd, [\rx, #UART_LSR << UART_SHIFT]
-                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                bne     1002b
-                .endm
-                /* The UART's don't have any flow control IO's wired up. */
-                .macro  waituart,rd,rx
-                .endm
diff --git a/arch/arm/include/debug/socfpga.S b/arch/arm/include/debug/socfpga.S
index d6f26d23374f..966b2f994946 100644
--- a/arch/arm/include/debug/socfpga.S
+++ b/arch/arm/include/debug/socfpga.S
@@ -7,6 +7,9 @@
 * published by the Free Software Foundation.
 */
+#define UART_SHIFT 2
+#define DEBUG_LL_UART_OFFSET    0x00002000
                .macro  addruart, rp, rv, tmp
                mov     \rp, #DEBUG_LL_UART_OFFSET
                orr     \rp, \rp, #0x00c00000
@@ -14,3 +17,5 @@
                orr     \rp, \rp, #0xff000000   @ physical base
                .endm
+#include "8250_32.S"
diff --git a/arch/arm/include/uapi/asm/hwcap.h b/arch/arm/include/uapi/asm/hwcap.h
index f254f6503cce..3688fd15a32d 100644
--- a/arch/arm/include/uapi/asm/hwcap.h
+++ b/arch/arm/include/uapi/asm/hwcap.h
@@ -18,11 +18,12 @@
 #define HWCAP_THUMBEE   (1 << 11)
 #define HWCAP_NEON      (1 << 12)
 #define HWCAP_VFPv3     (1 << 13)
-#define HWCAP_VFPv3D16  (1 << 14)
+#define HWCAP_VFPv3D16  (1 << 14)       /* also set for VFPv4-D16 */
 #define HWCAP_TLS       (1 << 15)
 #define HWCAP_VFPv4     (1 << 16)
 #define HWCAP_IDIVA     (1 << 17)
 #define HWCAP_IDIVT     (1 << 18)
+#define HWCAP_VFPD32    (1 << 19)       /* set if VFP has 32 regs (not 16) */
 #define HWCAP_IDIV      (HWCAP_IDIVA | HWCAP_IDIVT)
diff --git a/arch/arm/kernel/sched_clock.c b/arch/arm/kernel/sched_clock.c
index e21bac20d90d..fc6692e2b603 100644
--- a/arch/arm/kernel/sched_clock.c
+++ b/arch/arm/kernel/sched_clock.c
@@ -107,13 +107,6 @@ static void sched_clock_poll(unsigned long wrap_ticks)
        update_sched_clock();
 }
-void __init setup_sched_clock_needs_suspend(u32 (*read)(void), int bits,
-                unsigned long rate)
-{
-        setup_sched_clock(read, bits, rate);
-        cd.needs_suspend = true;
-}
 void __init setup_sched_clock(u32 (*read)(void), int bits, unsigned long rate)
 {
        unsigned long r, w;
@@ -189,18 +182,15 @@ void __init sched_clock_postinit(void)
 static int sched_clock_suspend(void)
 {
        sched_clock_poll(sched_clock_timer.data);
-        if (cd.needs_suspend)
+        cd.suspended = true;
-                cd.suspended = true;
        return 0;
 }
 static void sched_clock_resume(void)
 {
-        if (cd.needs_suspend) {
+        cd.epoch_cyc = read_sched_clock();
-                cd.epoch_cyc = read_sched_clock();
+        cd.epoch_cyc_copy = cd.epoch_cyc;
-                cd.epoch_cyc_copy = cd.epoch_cyc;
+        cd.suspended = false;
-                cd.suspended = false;
-        }
 }
 static struct syscore_ops sched_clock_ops = {
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index b14207101938..043624219b55 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -21,19 +21,13 @@ config SOC_AT91SAM9
        bool
        select CPU_ARM926T
        select GENERIC_CLOCKEVENTS
+        select MULTI_IRQ_HANDLER
+        select SPARSE_IRQ
 menu "Atmel AT91 System-on-Chip"
 comment "Atmel AT91 Processor"
-config SOC_AT91SAM9
-        bool
-        select AT91_SAM9_SMC
-        select AT91_SAM9_TIME
-        select CPU_ARM926T
-        select MULTI_IRQ_HANDLER
-        select SPARSE_IRQ
 config SOC_AT91RM9200
        bool "AT91RM9200"
        select CPU_ARM920T
diff --git a/arch/arm/mach-at91/at91rm9200.c b/arch/arm/mach-at91/at91rm9200.c
index b4f0565aff63..5269825194a8 100644
--- a/arch/arm/mach-at91/at91rm9200.c
+++ b/arch/arm/mach-at91/at91rm9200.c
@@ -187,7 +187,7 @@ static struct clk_lookup periph_clocks_lookups[] = {
        CLKDEV_CON_DEV_ID("pclk", "ssc.0", &ssc0_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.1", &ssc1_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.2", &ssc2_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91rm9200", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91rm9200.0", &twi_clk),
        /* fake hclk clock */
        CLKDEV_CON_DEV_ID("hclk", "at91_ohci", &ohci_clk),
        CLKDEV_CON_ID("pioA", &pioA_clk),
diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
index a563189cdfc3..1e122bcd7845 100644
--- a/arch/arm/mach-at91/at91rm9200_devices.c
+++ b/arch/arm/mach-at91/at91rm9200_devices.c
@@ -479,7 +479,7 @@ static struct i2c_gpio_platform_data pdata = {
 static struct platform_device at91rm9200_twi_device = {
        .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
        .dev.platform_data      = &pdata,
 };
@@ -512,7 +512,7 @@ static struct resource twi_resources[] = {
 static struct platform_device at91rm9200_twi_device = {
        .name           = "i2c-at91rm9200",
-        .id             = -1,
+        .id             = 0,
        .resource       = twi_resources,
        .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9260.c b/arch/arm/mach-at91/at91sam9260.c
index ad29f93f20ca..f8202615f4a8 100644
--- a/arch/arm/mach-at91/at91sam9260.c
+++ b/arch/arm/mach-at91/at91sam9260.c
@@ -211,8 +211,8 @@ static struct clk_lookup periph_clocks_lookups[] = {
        CLKDEV_CON_DEV_ID("t1_clk", "atmel_tcb.1", &tc4_clk),
        CLKDEV_CON_DEV_ID("t2_clk", "atmel_tcb.1", &tc5_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.0", &ssc_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260.0", &twi_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g20", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g20.0", &twi_clk),
        /* more usart lookup table for DT entries */
        CLKDEV_CON_DEV_ID("usart", "fffff200.serial", &mck),
        CLKDEV_CON_DEV_ID("usart", "fffb0000.serial", &usart0_clk),
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index a76b8684f52d..aa1e58729885 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -389,7 +389,7 @@ static struct i2c_gpio_platform_data pdata = {
 static struct platform_device at91sam9260_twi_device = {
        .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
        .dev.platform_data      = &pdata,
 };
@@ -421,7 +421,7 @@ static struct resource twi_resources[] = {
 };
 static struct platform_device at91sam9260_twi_device = {
-        .id             = -1,
+        .id             = 0,
        .resource       = twi_resources,
        .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9261.c b/arch/arm/mach-at91/at91sam9261.c
index 8d999eb1a137..04295c04b3e0 100644
--- a/arch/arm/mach-at91/at91sam9261.c
+++ b/arch/arm/mach-at91/at91sam9261.c
@@ -178,8 +178,8 @@ static struct clk_lookup periph_clocks_lookups[] = {
        CLKDEV_CON_DEV_ID("pclk", "ssc.1", &ssc1_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.2", &ssc2_clk),
        CLKDEV_CON_DEV_ID("hclk", "at91_ohci", &hck0),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9261", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9261.0", &twi_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g10", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g10.0", &twi_clk),
        CLKDEV_CON_ID("pioA", &pioA_clk),
        CLKDEV_CON_ID("pioB", &pioB_clk),
        CLKDEV_CON_ID("pioC", &pioC_clk),
diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
index 9752f17efba9..b9487696b7be 100644
--- a/arch/arm/mach-at91/at91sam9261_devices.c
+++ b/arch/arm/mach-at91/at91sam9261_devices.c
@@ -285,7 +285,7 @@ static struct i2c_gpio_platform_data pdata = {
 static struct platform_device at91sam9261_twi_device = {
        .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
        .dev.platform_data      = &pdata,
 };
@@ -317,7 +317,7 @@ static struct resource twi_resources[] = {
 };
 static struct platform_device at91sam9261_twi_device = {
-        .id             = -1,
+        .id             = 0,
        .resource       = twi_resources,
        .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9263.c b/arch/arm/mach-at91/at91sam9263.c
index 6a01d0360dfb..d6f9c23927c4 100644
--- a/arch/arm/mach-at91/at91sam9263.c
+++ b/arch/arm/mach-at91/at91sam9263.c
@@ -193,7 +193,7 @@ static struct clk_lookup periph_clocks_lookups[] = {
        CLKDEV_CON_DEV_ID("spi_clk", "atmel_spi.0", &spi0_clk),
        CLKDEV_CON_DEV_ID("spi_clk", "atmel_spi.1", &spi1_clk),
        CLKDEV_CON_DEV_ID("t0_clk", "atmel_tcb.0", &tcb_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260.0", &twi_clk),
        /* fake hclk clock */
        CLKDEV_CON_DEV_ID("hclk", "at91_ohci", &ohci_clk),
        CLKDEV_CON_ID("pioA", &pioA_clk),
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index 8dde220b42b6..cb85da2eccea 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -567,7 +567,7 @@ static struct i2c_gpio_platform_data pdata = {
 static struct platform_device at91sam9263_twi_device = {
        .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
        .dev.platform_data      = &pdata,
 };
@@ -600,7 +600,7 @@ static struct resource twi_resources[] = {
 static struct platform_device at91sam9263_twi_device = {
        .name           = "i2c-at91sam9260",
-        .id             = -1,
+        .id             = 0,
        .resource       = twi_resources,
        .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
index d6ca0543ce8d..5047bdc92adf 100644
--- a/arch/arm/mach-at91/at91sam9rl_devices.c
+++ b/arch/arm/mach-at91/at91sam9rl_devices.c
@@ -314,7 +314,7 @@ static struct i2c_gpio_platform_data pdata = {
 static struct platform_device at91sam9rl_twi_device = {
        .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
        .dev.platform_data      = &pdata,
 };
@@ -347,7 +347,7 @@ static struct resource twi_resources[] = {
 static struct platform_device at91sam9rl_twi_device = {
        .name           = "i2c-at91sam9g20",
-        .id             = -1,
+        .id             = 0,
        .resource       = twi_resources,
        .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91x40.c b/arch/arm/mach-at91/at91x40.c
index 6bd7300a2bc5..bb7f54474b92 100644
--- a/arch/arm/mach-at91/at91x40.c
+++ b/arch/arm/mach-at91/at91x40.c
@@ -88,6 +88,6 @@ void __init at91x40_init_interrupts(unsigned int priority[NR_AIC_IRQS])
        if (!priority)
                priority = at91x40_default_irq_priority;
-        at91_aic_init(priority);
+        at91_aic_init(priority, at91_extern_irq);
 }
diff --git a/arch/arm/mach-at91/board-neocore926.c b/arch/arm/mach-at91/board-neocore926.c
index 9cda3fd346ae..6960778af4c2 100644
--- a/arch/arm/mach-at91/board-neocore926.c
+++ b/arch/arm/mach-at91/board-neocore926.c
@@ -129,7 +129,7 @@ static struct spi_board_info neocore926_spi_devices[] = {
                .max_speed_hz   = 125000 * 16,
                .bus_num        = 0,
                .platform_data  = &ads_info,
-                .irq            = AT91SAM9263_ID_IRQ1,
+                .irq            = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
        },
 #endif
 };
diff --git a/arch/arm/mach-at91/board-sam9261ek.c b/arch/arm/mach-at91/board-sam9261ek.c
index 27b3af1a3047..a9167dd45f96 100644
--- a/arch/arm/mach-at91/board-sam9261ek.c
+++ b/arch/arm/mach-at91/board-sam9261ek.c
@@ -309,7 +309,7 @@ static struct spi_board_info ek_spi_devices[] = {
                .max_speed_hz   = 125000 * 26,  /* (max sample rate @ 3V) * (cmd + data + overhead) */
                .bus_num        = 0,
                .platform_data  = &ads_info,
-                .irq            = AT91SAM9261_ID_IRQ0,
+                .irq            = NR_IRQS_LEGACY + AT91SAM9261_ID_IRQ0,
                .controller_data = (void *) AT91_PIN_PA28,      /* CS pin */
        },
 #endif
diff --git a/arch/arm/mach-at91/board-sam9263ek.c b/arch/arm/mach-at91/board-sam9263ek.c
index 073e17403d98..b87dbe2be0d6 100644
--- a/arch/arm/mach-at91/board-sam9263ek.c
+++ b/arch/arm/mach-at91/board-sam9263ek.c
@@ -132,7 +132,7 @@ static struct spi_board_info ek_spi_devices[] = {
                .max_speed_hz   = 125000 * 26,  /* (max sample rate @ 3V) * (cmd + data + overhead) */
                .bus_num        = 0,
                .platform_data  = &ads_info,
-                .irq            = AT91SAM9263_ID_IRQ1,
+                .irq            = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
        },
 #endif
 };
diff --git a/arch/arm/mach-at91/generic.h b/arch/arm/mach-at91/generic.h
index f49650677653..b62f560e6c75 100644
--- a/arch/arm/mach-at91/generic.h
+++ b/arch/arm/mach-at91/generic.h
@@ -26,7 +26,8 @@ extern void __init at91_dt_initialize(void);
 extern void __init at91_init_irq_default(void);
 extern void __init at91_init_interrupts(unsigned int priority[]);
 extern void __init at91x40_init_interrupts(unsigned int priority[]);
-extern void __init at91_aic_init(unsigned int priority[]);
+extern void __init at91_aic_init(unsigned int priority[],
+                                 unsigned int ext_irq_mask);
 extern int  __init at91_aic_of_init(struct device_node *node,
                                    struct device_node *parent);
 extern int  __init at91_aic5_of_init(struct device_node *node,
diff --git a/arch/arm/mach-at91/irq.c b/arch/arm/mach-at91/irq.c
index 1e02c0e49dcc..febc2ee901a5 100644
--- a/arch/arm/mach-at91/irq.c
+++ b/arch/arm/mach-at91/irq.c
@@ -502,14 +502,19 @@ int __init at91_aic5_of_init(struct device_node *node,
 /*
 * Initialize the AIC interrupt controller.
 */
-void __init at91_aic_init(unsigned int *priority)
+void __init at91_aic_init(unsigned int *priority, unsigned int ext_irq_mask)
 {
        unsigned int i;
        int irq_base;
-        if (at91_aic_pm_init())
+        at91_extern_irq = kzalloc(BITS_TO_LONGS(n_irqs)
+                                  * sizeof(*at91_extern_irq), GFP_KERNEL);
+        if (at91_aic_pm_init() || at91_extern_irq == NULL)
                panic("Unable to allocate bit maps\n");
+        *at91_extern_irq = ext_irq_mask;
        at91_aic_base = ioremap(AT91_AIC, 512);
        if (!at91_aic_base)
                panic("Unable to ioremap AIC registers\n");
diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
index da9881b161e1..0b32c81730a5 100644
--- a/arch/arm/mach-at91/setup.c
+++ b/arch/arm/mach-at91/setup.c
@@ -47,7 +47,7 @@ void __init at91_init_irq_default(void)
 void __init at91_init_interrupts(unsigned int *priority)
 {
        /* Initialize the AIC interrupt controller */
-        at91_aic_init(priority);
+        at91_aic_init(priority, at91_extern_irq);
        /* Enable GPIO interrupts */
        at91_gpio_irq_setup();
@@ -151,7 +151,7 @@ static void __init soc_detect(u32 dbgu_base)
        }
        /* at91sam9g10 */
-        if ((cidr & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
+        if ((socid & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
                at91_soc_initdata.type = AT91_SOC_SAM9G10;
                at91_boot_soc = at91sam9261_soc;
        }
diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
index 715b690e5009..1947be8e5f5b 100644
--- a/arch/arm/mach-exynos/common.c
+++ b/arch/arm/mach-exynos/common.c
@@ -47,6 +47,7 @@
 #include <plat/fimc-core.h>
 #include <plat/iic-core.h>
 #include <plat/tv-core.h>
+#include <plat/spi-core.h>
 #include <plat/regs-serial.h>
 #include "common.h"
@@ -346,6 +347,8 @@ static void __init exynos4_map_io(void)
        s5p_fb_setname(0, "exynos4-fb");
        s5p_hdmi_setname("exynos4-hdmi");
+        s3c64xx_spi_setname("exynos4210-spi");
 }
 static void __init exynos5_map_io(void)
@@ -366,6 +369,8 @@ static void __init exynos5_map_io(void)
        s3c_i2c0_setname("s3c2440-i2c");
        s3c_i2c1_setname("s3c2440-i2c");
        s3c_i2c2_setname("s3c2440-i2c");
+        s3c64xx_spi_setname("exynos4210-spi");
 }
 static void __init exynos4_init_clocks(int xtal)
diff --git a/arch/arm/mach-exynos/mach-exynos4-dt.c b/arch/arm/mach-exynos/mach-exynos4-dt.c
index e58d786faf78..eadf4b59e7d2 100644
--- a/arch/arm/mach-exynos/mach-exynos4-dt.c
+++ b/arch/arm/mach-exynos/mach-exynos4-dt.c
@@ -99,6 +99,7 @@ static char const *exynos4_dt_compat[] __initdata = {
 DT_MACHINE_START(EXYNOS4210_DT, "Samsung Exynos4 (Flattened Device Tree)")
        /* Maintainer: Thomas Abraham <thomas.abraham@linaro.org> */
+        .smp            = smp_ops(exynos_smp_ops),
        .init_irq       = exynos4_init_irq,
        .map_io         = exynos4_dt_map_io,
        .handle_irq     = gic_handle_irq,
diff --git a/arch/arm/mach-imx/clk-busy.c b/arch/arm/mach-imx/clk-busy.c
index 1a7a8dd045a1..1ab91b5209e6 100644
--- a/arch/arm/mach-imx/clk-busy.c
+++ b/arch/arm/mach-imx/clk-busy.c
@@ -108,7 +108,7 @@ struct clk *imx_clk_busy_divider(const char *name, const char *parent_name,
        busy->div.hw.init = &init;
        clk = clk_register(NULL, &busy->div.hw);
-        if (!clk)
+        if (IS_ERR(clk))
                kfree(busy);
        return clk;
diff --git a/arch/arm/mach-imx/clk-imx25.c b/arch/arm/mach-imx/clk-imx25.c
index d20d4795f4ea..01e2f843bf2e 100644
--- a/arch/arm/mach-imx/clk-imx25.c
+++ b/arch/arm/mach-imx/clk-imx25.c
@@ -127,8 +127,8 @@ int __init mx25_clocks_init(void)
        clk[esdhc2_ipg_per] = imx_clk_gate("esdhc2_ipg_per", "per4", ccm(CCM_CGCR0),  4);
        clk[gpt_ipg_per] = imx_clk_gate("gpt_ipg_per", "per5", ccm(CCM_CGCR0),  5);
        clk[i2c_ipg_per] = imx_clk_gate("i2c_ipg_per", "per6", ccm(CCM_CGCR0),  6);
-        clk[lcdc_ipg_per] = imx_clk_gate("lcdc_ipg_per", "per8", ccm(CCM_CGCR0),  7);
+        clk[lcdc_ipg_per] = imx_clk_gate("lcdc_ipg_per", "per7", ccm(CCM_CGCR0),  7);
-        clk[nfc_ipg_per] = imx_clk_gate("nfc_ipg_per", "ipg_per", ccm(CCM_CGCR0),  8);
+        clk[nfc_ipg_per] = imx_clk_gate("nfc_ipg_per", "per8", ccm(CCM_CGCR0),  8);
        clk[ssi1_ipg_per] = imx_clk_gate("ssi1_ipg_per", "per13", ccm(CCM_CGCR0), 13);
        clk[ssi2_ipg_per] = imx_clk_gate("ssi2_ipg_per", "per14", ccm(CCM_CGCR0), 14);
        clk[uart_ipg_per] = imx_clk_gate("uart_ipg_per", "per15", ccm(CCM_CGCR0), 15);
diff --git a/arch/arm/mach-imx/clk-imx27.c b/arch/arm/mach-imx/clk-imx27.c
index 3b6b640eed24..366e5d59d886 100644
--- a/arch/arm/mach-imx/clk-imx27.c
+++ b/arch/arm/mach-imx/clk-imx27.c
@@ -109,7 +109,7 @@ int __init mx27_clocks_init(unsigned long fref)
        clk[per3_div] = imx_clk_divider("per3_div", "mpll_main2", CCM_PCDR1, 16, 6);
        clk[per4_div] = imx_clk_divider("per4_div", "mpll_main2", CCM_PCDR1, 24, 6);
        clk[vpu_sel] = imx_clk_mux("vpu_sel", CCM_CSCR, 21, 1, vpu_sel_clks, ARRAY_SIZE(vpu_sel_clks));
-        clk[vpu_div] = imx_clk_divider("vpu_div", "vpu_sel", CCM_PCDR0, 10, 3);
+        clk[vpu_div] = imx_clk_divider("vpu_div", "vpu_sel", CCM_PCDR0, 10, 6);
        clk[usb_div] = imx_clk_divider("usb_div", "spll", CCM_CSCR, 28, 3);
        clk[cpu_sel] = imx_clk_mux("cpu_sel", CCM_CSCR, 15, 1, cpu_sel_clks, ARRAY_SIZE(cpu_sel_clks));
        clk[clko_sel] = imx_clk_mux("clko_sel", CCM_CCSR, 0, 5, clko_sel_clks, ARRAY_SIZE(clko_sel_clks));
@@ -121,7 +121,7 @@ int __init mx27_clocks_init(unsigned long fref)
        clk[ssi1_sel] = imx_clk_mux("ssi1_sel", CCM_CSCR, 22, 1, ssi_sel_clks, ARRAY_SIZE(ssi_sel_clks));
        clk[ssi2_sel] = imx_clk_mux("ssi2_sel", CCM_CSCR, 23, 1, ssi_sel_clks, ARRAY_SIZE(ssi_sel_clks));
        clk[ssi1_div] = imx_clk_divider("ssi1_div", "ssi1_sel", CCM_PCDR0, 16, 6);
-        clk[ssi2_div] = imx_clk_divider("ssi2_div", "ssi2_sel", CCM_PCDR0, 26, 3);
+        clk[ssi2_div] = imx_clk_divider("ssi2_div", "ssi2_sel", CCM_PCDR0, 26, 6);
        clk[clko_en] = imx_clk_gate("clko_en", "clko_div", CCM_PCCR0, 0);
        clk[ssi2_ipg_gate] = imx_clk_gate("ssi2_ipg_gate", "ipg", CCM_PCCR0, 0);
        clk[ssi1_ipg_gate] = imx_clk_gate("ssi1_ipg_gate", "ipg", CCM_PCCR0, 1);
diff --git a/arch/arm/mach-imx/mm-imx3.c b/arch/arm/mach-imx/mm-imx3.c
index 9d2c843bde02..b5deb0554552 100644
--- a/arch/arm/mach-imx/mm-imx3.c
+++ b/arch/arm/mach-imx/mm-imx3.c
@@ -108,9 +108,8 @@ void __init imx3_init_l2x0(void)
        }
        l2x0_base = ioremap(MX3x_L2CC_BASE_ADDR, 4096);
-        if (IS_ERR(l2x0_base)) {
+        if (!l2x0_base) {
-                printk(KERN_ERR "remapping L2 cache area failed with %ld\n",
+                printk(KERN_ERR "remapping L2 cache area failed\n");
-                                PTR_ERR(l2x0_base));
                return;
        }
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 2a1a898c7f90..d669e227e00c 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -11,7 +11,6 @@ config ARCH_OMAP2PLUS_TYPICAL
        select I2C_OMAP
        select MENELAUS if ARCH_OMAP2
        select NEON if ARCH_OMAP3 || ARCH_OMAP4 || SOC_OMAP5
-        select PINCTRL
        select PM_RUNTIME
        select REGULATOR
        select SERIAL_OMAP
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 388c431c745a..d41ab98890ff 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -24,6 +24,7 @@
 #include <linux/input.h>
 #include <linux/gpio_keys.h>
 #include <linux/opp.h>
+#include <linux/cpu.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
@@ -444,27 +445,31 @@ static struct omap_board_mux board_mux[] __initdata = {
 };
 #endif
-static void __init beagle_opp_init(void)
+static int __init beagle_opp_init(void)
 {
        int r = 0;
-        /* Initialize the omap3 opp table */
+        if (!machine_is_omap3_beagle())
-        if (omap3_opp_init()) {
+                return 0;
+        /* Initialize the omap3 opp table if not already created. */
+        r = omap3_opp_init();
+        if (IS_ERR_VALUE(r) && (r != -EEXIST)) {
                pr_err("%s: opp default init failed\n", __func__);
-                return;
+                return r;
        }
        /* Custom OPP enabled for all xM versions */
        if (cpu_is_omap3630()) {
                struct device *mpu_dev, *iva_dev;
-                mpu_dev = omap_device_get_by_hwmod_name("mpu");
+                mpu_dev = get_cpu_device(0);
                iva_dev = omap_device_get_by_hwmod_name("iva");
                if (IS_ERR(mpu_dev) || IS_ERR(iva_dev)) {
                        pr_err("%s: Aiee.. no mpu/dsp devices? %p %p\n",
                                __func__, mpu_dev, iva_dev);
-                        return;
+                        return -ENODEV;
                }
                /* Enable MPU 1GHz and lower opps */
                r = opp_enable(mpu_dev, 800000000);
@@ -484,8 +489,9 @@ static void __init beagle_opp_init(void)
                        opp_disable(iva_dev, 660000000);
                }
        }
-        return;
+        return 0;
 }
+device_initcall(beagle_opp_init);
 static void __init omap3_beagle_init(void)
 {
@@ -522,8 +528,6 @@ static void __init omap3_beagle_init(void)
        /* Ensure SDRC pins are mux'd for self-refresh */
        omap_mux_init_signal("sdrc_cke0", OMAP_PIN_OUTPUT);
        omap_mux_init_signal("sdrc_cke1", OMAP_PIN_OUTPUT);
-        beagle_opp_init();
 }
 MACHINE_START(OMAP3_BEAGLE, "OMAP3 Beagle Board")
diff --git a/arch/arm/mach-omap2/clock33xx_data.c b/arch/arm/mach-omap2/clock33xx_data.c
index 114ab4b8e0e3..1a45d6bd2539 100644
--- a/arch/arm/mach-omap2/clock33xx_data.c
+++ b/arch/arm/mach-omap2/clock33xx_data.c
@@ -1073,6 +1073,8 @@ static struct omap_clk am33xx_clks[] = {
        CLK(NULL,       "gfx_fck_div_ck",       &gfx_fck_div_ck,        CK_AM33XX),
        CLK(NULL,       "sysclkout_pre_ck",     &sysclkout_pre_ck,      CK_AM33XX),
        CLK(NULL,       "clkout2_ck",           &clkout2_ck,    CK_AM33XX),
+        CLK(NULL,       "timer_32k_ck",         &clkdiv32k_ick, CK_AM33XX),
+        CLK(NULL,       "timer_sys_ck",         &sys_clkin_ck,  CK_AM33XX),
 };
 int __init am33xx_clk_init(void)
diff --git a/arch/arm/mach-omap2/mux34xx.c b/arch/arm/mach-omap2/mux34xx.c
index 17f80e4ab162..c47140bbbec4 100644
--- a/arch/arm/mach-omap2/mux34xx.c
+++ b/arch/arm/mach-omap2/mux34xx.c
@@ -614,16 +614,16 @@ static struct omap_mux __initdata omap3_muxmodes[] = {
                "sys_off_mode", NULL, NULL, NULL,
                "gpio_9", NULL, NULL, "safe_mode"),
        _OMAP3_MUXENTRY(UART1_CTS, 150,
-                "uart1_cts", NULL, NULL, NULL,
+                "uart1_cts", "ssi1_rdy_tx", NULL, NULL,
                "gpio_150", "hsusb3_tll_clk", NULL, "safe_mode"),
        _OMAP3_MUXENTRY(UART1_RTS, 149,
-                "uart1_rts", NULL, NULL, NULL,
+                "uart1_rts", "ssi1_flag_tx", NULL, NULL,
                "gpio_149", NULL, NULL, "safe_mode"),
        _OMAP3_MUXENTRY(UART1_RX, 151,
-                "uart1_rx", NULL, "mcbsp1_clkr", "mcspi4_clk",
+                "uart1_rx", "ss1_wake_tx", "mcbsp1_clkr", "mcspi4_clk",
                "gpio_151", NULL, NULL, "safe_mode"),
        _OMAP3_MUXENTRY(UART1_TX, 148,
-                "uart1_tx", NULL, NULL, NULL,
+                "uart1_tx", "ssi1_dat_tx", NULL, NULL,
                "gpio_148", NULL, NULL, "safe_mode"),
        _OMAP3_MUXENTRY(UART2_CTS, 144,
                "uart2_cts", "mcbsp3_dx", "gpt9_pwm_evt", NULL,
diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h
index 686137d164da..67d66131cfa7 100644
--- a/arch/arm/mach-omap2/pm.h
+++ b/arch/arm/mach-omap2/pm.h
@@ -91,6 +91,7 @@ extern void omap3_save_scratchpad_contents(void);
 #define PM_RTA_ERRATUM_i608             (1 << 0)
 #define PM_SDRC_WAKEUP_ERRATUM_i583     (1 << 1)
+#define PM_PER_MEMORIES_ERRATUM_i582    (1 << 2)
 #if defined(CONFIG_PM) && defined(CONFIG_ARCH_OMAP3)
 extern u16 pm34xx_errata;
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index ba670db1fd37..3a904de4313e 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -652,14 +652,17 @@ static void __init pm_errata_configure(void)
                /* Enable the l2 cache toggling in sleep logic */
                enable_omap3630_toggle_l2_on_restore();
                if (omap_rev() < OMAP3630_REV_ES1_2)
-                        pm34xx_errata |= PM_SDRC_WAKEUP_ERRATUM_i583;
+                        pm34xx_errata |= (PM_SDRC_WAKEUP_ERRATUM_i583 |
+                                          PM_PER_MEMORIES_ERRATUM_i582);
+        } else if (cpu_is_omap34xx()) {
+                pm34xx_errata |= PM_PER_MEMORIES_ERRATUM_i582;
        }
 }
 int __init omap3_pm_init(void)
 {
        struct power_state *pwrst, *tmp;
-        struct clockdomain *neon_clkdm, *mpu_clkdm;
+        struct clockdomain *neon_clkdm, *mpu_clkdm, *per_clkdm, *wkup_clkdm;
        int ret;
        if (!omap3_has_io_chain_ctrl())
@@ -711,6 +714,8 @@ int __init omap3_pm_init(void)
        neon_clkdm = clkdm_lookup("neon_clkdm");
        mpu_clkdm = clkdm_lookup("mpu_clkdm");
+        per_clkdm = clkdm_lookup("per_clkdm");
+        wkup_clkdm = clkdm_lookup("wkup_clkdm");
 #ifdef CONFIG_SUSPEND
        omap_pm_suspend = omap3_pm_suspend;
@@ -727,6 +732,27 @@ int __init omap3_pm_init(void)
        if (IS_PM34XX_ERRATUM(PM_RTA_ERRATUM_i608))
                omap3630_ctrl_disable_rta();
+        /*
+         * The UART3/4 FIFO and the sidetone memory in McBSP2/3 are
+         * not correctly reset when the PER powerdomain comes back
+         * from OFF or OSWR when the CORE powerdomain is kept active.
+         * See OMAP36xx Erratum i582 "PER Domain reset issue after
+         * Domain-OFF/OSWR Wakeup".  This wakeup dependency is not a
+         * complete workaround.  The kernel must also prevent the PER
+         * powerdomain from going to OSWR/OFF while the CORE
+         * powerdomain is not going to OSWR/OFF.  And if PER last
+         * power state was off while CORE last power state was ON, the
+         * UART3/4 and McBSP2/3 SIDETONE devices need to run a
+         * self-test using their loopback tests; if that fails, those
+         * devices are unusable until the PER/CORE can complete a transition
+         * from ON to OSWR/OFF and then back to ON.
+         *
+         * XXX Technically this workaround is only needed if off-mode
+         * or OSWR is enabled.
+         */
+        if (IS_PM34XX_ERRATUM(PM_PER_MEMORIES_ERRATUM_i582))
+                clkdm_add_wkdep(per_clkdm, wkup_clkdm);
        clkdm_add_wkdep(neon_clkdm, mpu_clkdm);
        if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
                omap3_secure_ram_storage =
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 0405c8190803..a507cd6cf4f1 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -329,6 +329,11 @@ void __init omap_serial_init_port(struct omap_board_data *bdata,
        oh->mux = omap_hwmod_mux_init(bdata->pads, bdata->pads_cnt);
+        if (console_uart_id == bdata->id) {
+                omap_device_enable(pdev);
+                pm_runtime_set_active(&pdev->dev);
+        }
        oh->dev_attr = uart;
        if (((cpu_is_omap34xx() || cpu_is_omap44xx()) && bdata->pads)
diff --git a/arch/arm/mach-s3c24xx/s3c2416.c b/arch/arm/mach-s3c24xx/s3c2416.c
index ed5a95ece9eb..77ee0b732237 100644
--- a/arch/arm/mach-s3c24xx/s3c2416.c
+++ b/arch/arm/mach-s3c24xx/s3c2416.c
@@ -61,6 +61,7 @@
 #include <plat/nand-core.h>
 #include <plat/adc-core.h>
 #include <plat/rtc-core.h>
+#include <plat/spi-core.h>
 static struct map_desc s3c2416_iodesc[] __initdata = {
        IODESC_ENT(WATCHDOG),
@@ -132,6 +133,7 @@ void __init s3c2416_map_io(void)
        /* initialize device information early */
        s3c2416_default_sdhci0();
        s3c2416_default_sdhci1();
+        s3c64xx_spi_setname("s3c2443-spi");
        iotable_init(s3c2416_iodesc, ARRAY_SIZE(s3c2416_iodesc));
 }
diff --git a/arch/arm/mach-s3c24xx/s3c2443.c b/arch/arm/mach-s3c24xx/s3c2443.c
index ab648ad8fa50..165b6a6b3daa 100644
--- a/arch/arm/mach-s3c24xx/s3c2443.c
+++ b/arch/arm/mach-s3c24xx/s3c2443.c
@@ -43,6 +43,7 @@
 #include <plat/nand-core.h>
 #include <plat/adc-core.h>
 #include <plat/rtc-core.h>
+#include <plat/spi-core.h>
 static struct map_desc s3c2443_iodesc[] __initdata = {
        IODESC_ENT(WATCHDOG),
@@ -100,6 +101,9 @@ void __init s3c2443_map_io(void)
        s3c24xx_gpiocfg_default.set_pull = s3c2443_gpio_setpull;
        s3c24xx_gpiocfg_default.get_pull = s3c2443_gpio_getpull;
+        /* initialize device information early */
+        s3c64xx_spi_setname("s3c2443-spi");
        iotable_init(s3c2443_iodesc, ARRAY_SIZE(s3c2443_iodesc));
 }
diff --git a/arch/arm/mach-s5p64x0/common.c b/arch/arm/mach-s5p64x0/common.c
index 6e6a0a9d6778..111e404a81fd 100644
--- a/arch/arm/mach-s5p64x0/common.c
+++ b/arch/arm/mach-s5p64x0/common.c
@@ -44,6 +44,7 @@
 #include <plat/sdhci.h>
 #include <plat/adc-core.h>
 #include <plat/fb-core.h>
+#include <plat/spi-core.h>
 #include <plat/gpio-cfg.h>
 #include <plat/regs-irqtype.h>
 #include <plat/regs-serial.h>
@@ -179,6 +180,7 @@ void __init s5p6440_map_io(void)
        /* initialize any device information early */
        s3c_adc_setname("s3c64xx-adc");
        s3c_fb_setname("s5p64x0-fb");
+        s3c64xx_spi_setname("s5p64x0-spi");
        s5p64x0_default_sdhci0();
        s5p64x0_default_sdhci1();
@@ -193,6 +195,7 @@ void __init s5p6450_map_io(void)
        /* initialize any device information early */
        s3c_adc_setname("s3c64xx-adc");
        s3c_fb_setname("s5p64x0-fb");
+        s3c64xx_spi_setname("s5p64x0-spi");
        s5p64x0_default_sdhci0();
        s5p64x0_default_sdhci1();
diff --git a/arch/arm/mach-s5pc100/common.c b/arch/arm/mach-s5pc100/common.c
index 621908658861..cc6e561c9958 100644
--- a/arch/arm/mach-s5pc100/common.c
+++ b/arch/arm/mach-s5pc100/common.c
@@ -45,6 +45,7 @@
 #include <plat/fb-core.h>
 #include <plat/iic-core.h>
 #include <plat/onenand-core.h>
+#include <plat/spi-core.h>
 #include <plat/regs-serial.h>
 #include <plat/watchdog-reset.h>
@@ -165,6 +166,8 @@ void __init s5pc100_map_io(void)
        s3c_onenand_setname("s5pc100-onenand");
        s3c_fb_setname("s5pc100-fb");
        s3c_cfcon_setname("s5pc100-pata");
+        s3c64xx_spi_setname("s5pc100-spi");
 }
 void __init s5pc100_init_clocks(int xtal)
diff --git a/arch/arm/mach-s5pv210/common.c b/arch/arm/mach-s5pv210/common.c
index 4c9e9027df9a..a0c50efe8145 100644
--- a/arch/arm/mach-s5pv210/common.c
+++ b/arch/arm/mach-s5pv210/common.c
@@ -43,6 +43,7 @@
 #include <plat/iic-core.h>
 #include <plat/keypad-core.h>
 #include <plat/tv-core.h>
+#include <plat/spi-core.h>
 #include <plat/regs-serial.h>
 #include "common.h"
@@ -196,6 +197,8 @@ void __init s5pv210_map_io(void)
        /* setup TV devices */
        s5p_hdmi_setname("s5pv210-hdmi");
+        s3c64xx_spi_setname("s5pv210-spi");
 }
 void __init s5pv210_init_clocks(int xtal)
diff --git a/arch/arm/mach-shmobile/setup-r8a7779.c b/arch/arm/mach-shmobile/setup-r8a7779.c
index 2917668f0091..ebbffc25f24f 100644
--- a/arch/arm/mach-shmobile/setup-r8a7779.c
+++ b/arch/arm/mach-shmobile/setup-r8a7779.c
@@ -247,7 +247,7 @@ void __init r8a7779_add_standard_devices(void)
 {
 #ifdef CONFIG_CACHE_L2X0
        /* Early BRESP enable, Shared attribute override enable, 64K*16way */
-        l2x0_init((void __iomem __force *)(0xf0100000), 0x40470000, 0x82000fff);
+        l2x0_init(IOMEM(0xf0100000), 0x40470000, 0x82000fff);
 #endif
        r8a7779_pm_init();
diff --git a/arch/arm/mach-spear13xx/include/mach/spear1310_misc_regs.h b/arch/arm/mach-spear13xx/include/mach/spear1310_misc_regs.h
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/arch/arm/mach-spear13xx/include/mach/spear1310_misc_regs.h
+++ /dev/null
diff --git a/arch/arm/mach-spear13xx/include/mach/spear1340_misc_regs.h b/arch/arm/mach-spear13xx/include/mach/spear1340_misc_regs.h
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/arch/arm/mach-spear13xx/include/mach/spear1340_misc_regs.h
+++ /dev/null
diff --git a/arch/arm/mach-ux500/cpu.c b/arch/arm/mach-ux500/cpu.c
index 2236cbd03cd7..1f3fbc2bb776 100644
--- a/arch/arm/mach-ux500/cpu.c
+++ b/arch/arm/mach-ux500/cpu.c
@@ -16,6 +16,7 @@
 #include <linux/stat.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
+#include <linux/irq.h>
 #include <linux/platform_data/clk-ux500.h>
 #include <asm/hardware/gic.h>
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 023f443784ec..b820edaf3184 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -745,7 +745,7 @@ do_alignment_t32_to_handler(unsigned long *pinstr, struct pt_regs *regs,
 static int
 do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 {
-        union offset_union offset;
+        union offset_union uninitialized_var(offset);
        unsigned long instr = 0, instrptr;
        int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
        unsigned int type;
diff --git a/arch/arm/plat-mxc/devices/platform-mxc-mmc.c b/arch/arm/plat-mxc/devices/platform-mxc-mmc.c
index 540d3a7d92df..e7b920b58675 100644
--- a/arch/arm/plat-mxc/devices/platform-mxc-mmc.c
+++ b/arch/arm/plat-mxc/devices/platform-mxc-mmc.c
@@ -55,7 +55,7 @@ struct platform_device *__init imx_add_mxc_mmc(
        struct resource res[] = {
                {
                        .start = data->iobase,
-                        .end = data->iobase + SZ_4K - 1,
+                        .end = data->iobase + data->iosize - 1,
                        .flags = IORESOURCE_MEM,
                }, {
                        .start = data->irq,
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index 7cd56ed5cd94..82fcb206b5b2 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -26,6 +26,7 @@ config ARCH_OMAP2PLUS
        select CLKDEV_LOOKUP
        select GENERIC_IRQ_CHIP
        select OMAP_DM_TIMER
+        select PINCTRL
        select PROC_DEVICETREE if PROC_FS
        select SPARSE_IRQ
        select USE_OF
diff --git a/arch/arm/plat-samsung/include/plat/spi-core.h b/arch/arm/plat-samsung/include/plat/spi-core.h
new file mode 100644
index 000000000000..0b9428ab3fc3
--- /dev/null
+++ b/arch/arm/plat-samsung/include/plat/spi-core.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2012 Heiko Stuebner <heiko@sntech.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __PLAT_S3C_SPI_CORE_H
+#define __PLAT_S3C_SPI_CORE_H
+/* These functions are only for use with the core support code, such as
+ * the cpu specific initialisation code
+ */
+/* re-define device name depending on support. */
+static inline void s3c64xx_spi_setname(char *name)
+{
+#ifdef CONFIG_S3C64XX_DEV_SPI0
+        s3c64xx_device_spi0.name = name;
+#endif
+#ifdef CONFIG_S3C64XX_DEV_SPI1
+        s3c64xx_device_spi1.name = name;
+#endif
+#ifdef CONFIG_S3C64XX_DEV_SPI2
+        s3c64xx_device_spi2.name = name;
+#endif
+}
+#endif /* __PLAT_S3C_SPI_CORE_H */
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index c834b32af275..3b44e0dd0a93 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -701,11 +701,14 @@ static int __init vfp_init(void)
                        elf_hwcap |= HWCAP_VFPv3;
                        /*
-                         * Check for VFPv3 D16. CPUs in this configuration
+                         * Check for VFPv3 D16 and VFPv4 D16.  CPUs in
-                         * only have 16 x 64bit registers.
+                         * this configuration only have 16 x 64bit
+                         * registers.
                         */
                        if (((fmrx(MVFR0) & MVFR0_A_SIMD_MASK)) == 1)
-                                elf_hwcap |= HWCAP_VFPv3D16;
+                                elf_hwcap |= HWCAP_VFPv3D16; /* also v4-D16 */
+                        else
+                                elf_hwcap |= HWCAP_VFPD32;
                }
 #endif
                /*
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 59bcb96ac369..f57609275449 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -166,3 +166,14 @@ void free_xenballooned_pages(int nr_pages, struct page **pages)
        *pages = NULL;
 }
 EXPORT_SYMBOL_GPL(free_xenballooned_pages);
+/* In the hypervisor.S file. */
+EXPORT_SYMBOL_GPL(HYPERVISOR_event_channel_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_grant_table_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_xen_version);
+EXPORT_SYMBOL_GPL(HYPERVISOR_console_io);
+EXPORT_SYMBOL_GPL(HYPERVISOR_sched_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_hvm_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_memory_op);
+EXPORT_SYMBOL_GPL(HYPERVISOR_physdev_op);
+EXPORT_SYMBOL_GPL(privcmd_call);
diff --git a/arch/arm/xen/hypercall.S b/arch/arm/xen/hypercall.S
index 074f5ed101b9..71f723984cbd 100644
--- a/arch/arm/xen/hypercall.S
+++ b/arch/arm/xen/hypercall.S
@@ -48,20 +48,16 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include <asm/opcodes-virt.h>
 #include <xen/interface/xen.h>
-/* HVC 0xEA1 */
+#define XEN_IMM 0xEA1
-#ifdef CONFIG_THUMB2_KERNEL
-#define xen_hvc .word 0xf7e08ea1
-#else
-#define xen_hvc .word 0xe140ea71
-#endif
 #define HYPERCALL_SIMPLE(hypercall)             \
 ENTRY(HYPERVISOR_##hypercall)                   \
        mov r12, #__HYPERVISOR_##hypercall;     \
-        xen_hvc;                                                        \
+        __HVC(XEN_IMM);                                         \
        mov pc, lr;                                                     \
 ENDPROC(HYPERVISOR_##hypercall)
@@ -76,7 +72,7 @@ ENTRY(HYPERVISOR_##hypercall)			\
        stmdb sp!, {r4}                                         \
        ldr r4, [sp, #4]                                        \
        mov r12, #__HYPERVISOR_##hypercall;     \
-        xen_hvc                                                         \
+        __HVC(XEN_IMM);                                         \
        ldm sp!, {r4}                                           \
        mov pc, lr                                                      \
 ENDPROC(HYPERVISOR_##hypercall)
@@ -100,7 +96,7 @@ ENTRY(privcmd_call)
        mov r2, r3
        ldr r3, [sp, #8]
        ldr r4, [sp, #4]
-        xen_hvc
+        __HVC(XEN_IMM)
        ldm sp!, {r4}
        mov pc, lr
 ENDPROC(privcmd_call);
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index ef54a59a9e89..15ac18a56c93 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1,6 +1,7 @@
 config ARM64
        def_bool y
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
        select GENERIC_CLOCKEVENTS
        select GENERIC_HARDIRQS_NO_DEPRECATED
        select GENERIC_IOMAP
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index cf284649dfcb..07fea290d7c1 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -25,12 +25,10 @@
 #include <asm/user.h>
 typedef unsigned long elf_greg_t;
-typedef unsigned long elf_freg_t[3];
 #define ELF_NGREG (sizeof (struct pt_regs) / sizeof(elf_greg_t))
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
+typedef struct user_fpsimd_state elf_fpregset_t;
-typedef struct user_fp elf_fpregset_t;
 #define EM_AARCH64              183
@@ -87,7 +85,6 @@ typedef struct user_fp elf_fpregset_t;
 #define R_AARCH64_MOVW_PREL_G2_NC       292
 #define R_AARCH64_MOVW_PREL_G3          293
 /*
 * These are used to set parameters in the core dumps.
 */
diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h
index b42fab9f62a9..c43b4ac13008 100644
--- a/arch/arm64/include/asm/fpsimd.h
+++ b/arch/arm64/include/asm/fpsimd.h
@@ -25,9 +25,8 @@
 *  - FPSR and FPCR
 *  - 32 128-bit data registers
 *
- * Note that user_fp forms a prefix of this structure, which is relied
+ * Note that user_fpsimd forms a prefix of this structure, which is
- * upon in the ptrace FP/SIMD accessors. struct user_fpsimd_state must
+ * relied upon in the ptrace FP/SIMD accessors.
- * form a prefix of struct fpsimd_state.
 */
 struct fpsimd_state {
        union {
diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index 74a2a7d304a9..54f6116697f7 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -114,7 +114,7 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 *  I/O port access primitives.
 */
 #define IO_SPACE_LIMIT          0xffff
-#define PCI_IOBASE              ((void __iomem *)0xffffffbbfffe0000UL)
+#define PCI_IOBASE              ((void __iomem *)(MODULES_VADDR - SZ_2M))
 static inline u8 inb(unsigned long addr)
 {
@@ -225,9 +225,9 @@ extern void __iounmap(volatile void __iomem *addr);
 #define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_XN | PTE_ATTRINDX(MT_DEVICE_nGnRE))
 #define PROT_NORMAL_NC          (PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL_NC))
-#define ioremap(addr, size)             __ioremap((addr), (size), PROT_DEVICE_nGnRE)
+#define ioremap(addr, size)             __ioremap((addr), (size), __pgprot(PROT_DEVICE_nGnRE))
-#define ioremap_nocache(addr, size)     __ioremap((addr), (size), PROT_DEVICE_nGnRE)
+#define ioremap_nocache(addr, size)     __ioremap((addr), (size), __pgprot(PROT_DEVICE_nGnRE))
-#define ioremap_wc(addr, size)          __ioremap((addr), (size), PROT_NORMAL_NC)
+#define ioremap_wc(addr, size)          __ioremap((addr), (size), __pgprot(PROT_NORMAL_NC))
 #define iounmap                         __iounmap
 #define ARCH_HAS_IOREMAP_WC
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 5d810044feda..77f696c14339 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -43,6 +43,8 @@
 #else
 #define STACK_TOP               STACK_TOP_MAX
 #endif /* CONFIG_COMPAT */
+#define ARCH_LOW_ADDRESS_LIMIT  PHYS_MASK
 #endif /* __KERNEL__ */
 struct debug_info {
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index 63f853f8b718..68aff2816e86 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -14,7 +14,6 @@
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #ifdef CONFIG_COMPAT
-#define __ARCH_WANT_COMPAT_IPC_PARSE_VERSION
 #define __ARCH_WANT_COMPAT_STAT64
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_PAUSE
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index ecbf2d81ec5c..c76c7241125b 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -613,17 +613,11 @@ enum armv8_pmuv3_perf_types {
        ARMV8_PMUV3_PERFCTR_BUS_ACCESS                          = 0x19,
        ARMV8_PMUV3_PERFCTR_MEM_ERROR                           = 0x1A,
        ARMV8_PMUV3_PERFCTR_BUS_CYCLES                          = 0x1D,
-        /*
-         * This isn't an architected event.
-         * We detect this event number and use the cycle counter instead.
-         */
-        ARMV8_PMUV3_PERFCTR_CPU_CYCLES                          = 0xFF,
 };
 /* PMUv3 HW events mapping. */
 static const unsigned armv8_pmuv3_perf_map[PERF_COUNT_HW_MAX] = {
-        [PERF_COUNT_HW_CPU_CYCLES]              = ARMV8_PMUV3_PERFCTR_CPU_CYCLES,
+        [PERF_COUNT_HW_CPU_CYCLES]              = ARMV8_PMUV3_PERFCTR_CLOCK_CYCLES,
        [PERF_COUNT_HW_INSTRUCTIONS]            = ARMV8_PMUV3_PERFCTR_INSTR_EXECUTED,
        [PERF_COUNT_HW_CACHE_REFERENCES]        = ARMV8_PMUV3_PERFCTR_L1_DCACHE_ACCESS,
        [PERF_COUNT_HW_CACHE_MISSES]            = ARMV8_PMUV3_PERFCTR_L1_DCACHE_REFILL,
@@ -1106,7 +1100,7 @@ static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc,
        unsigned long evtype = event->config_base & ARMV8_EVTYPE_EVENT;
        /* Always place a cycle counter into the cycle counter. */
-        if (evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) {
+        if (evtype == ARMV8_PMUV3_PERFCTR_CLOCK_CYCLES) {
                if (test_and_set_bit(ARMV8_IDX_CYCLE_COUNTER, cpuc->used_mask))
                        return -EAGAIN;
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index f22965ea1cfc..e04cebdbb47f 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -310,24 +310,6 @@ struct task_struct *__switch_to(struct task_struct *prev,
 }
 /*
- * Fill in the task's elfregs structure for a core dump.
- */
-int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs)
-{
-        elf_core_copy_regs(elfregs, task_pt_regs(t));
-        return 1;
-}
-/*
- * fill in the fpe structure for a core dump...
- */
-int dump_fpu (struct pt_regs *regs, struct user_fp *fp)
-{
-        return 0;
-}
-EXPORT_SYMBOL(dump_fpu);
-/*
 * Shuffle the argument into the correct register before calling the
 * thread function.  x1 is the thread argument, x2 is the pointer to
 * the thread function, and x3 points to the exit function.
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 226b6bf6e9c2..538300f2273d 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -211,8 +211,7 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
         * before we continue.
         */
        set_cpu_online(cpu, true);
-        while (!cpu_active(cpu))
+        complete(&cpu_running);
-                cpu_relax();
        /*
         * OK, it's off to the idle thread for us
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index efbf7df05d3f..4cd28931dba9 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -80,7 +80,7 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
 #ifdef CONFIG_ZONE_DMA32
        /* 4GB maximum for 32-bit only capable devices */
        max_dma32 = min(max, MAX_DMA32_PFN);
-        zone_size[ZONE_DMA32] = max_dma32 - min;
+        zone_size[ZONE_DMA32] = max(min, max_dma32) - min;
 #endif
        zone_size[ZONE_NORMAL] = max - max_dma32;
diff --git a/arch/frv/Kconfig b/arch/frv/Kconfig
index b7412504f08a..df2eb4bd9fa2 100644
--- a/arch/frv/Kconfig
+++ b/arch/frv/Kconfig
@@ -13,6 +13,7 @@ config FRV
        select GENERIC_CPU_DEVICES
        select ARCH_WANT_IPC_PARSE_VERSION
        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
 config ZONE_DMA
        bool
diff --git a/arch/frv/boot/Makefile b/arch/frv/boot/Makefile
index 6ae3254da019..636d5bbcd53f 100644
--- a/arch/frv/boot/Makefile
+++ b/arch/frv/boot/Makefile
@@ -17,6 +17,8 @@ PARAMS_PHYS	 = 0x0207c000
 INITRD_PHYS      = 0x02180000
 INITRD_VIRT      = 0x02180000
+OBJCOPYFLAGS    :=-O binary -R .note -R .note.gnu.build-id -R .comment
 #
 # If you don't define ZRELADDR above,
 # then it defaults to ZTEXTADDR
@@ -32,18 +34,18 @@ Image: $(obj)/Image
 targets: $(obj)/Image
 $(obj)/Image: vmlinux FORCE
-        $(OBJCOPY) -O binary -R .note -R .comment -S vmlinux $@
+        $(OBJCOPY) $(OBJCOPYFLAGS) -S vmlinux $@
 #$(obj)/Image:  $(CONFIGURE) $(SYSTEM)
-#       $(OBJCOPY) -O binary -R .note -R .comment -g -S $(SYSTEM) $@
+#       $(OBJCOPY) $(OBJCOPYFLAGS) -g -S $(SYSTEM) $@
 bzImage: zImage
 zImage: $(CONFIGURE) compressed/$(LINUX)
-        $(OBJCOPY) -O binary -R .note -R .comment -S compressed/$(LINUX) $@
+        $(OBJCOPY) $(OBJCOPYFLAGS) -S compressed/$(LINUX) $@
 bootpImage: bootp/bootp
-        $(OBJCOPY) -O binary -R .note -R .comment -S bootp/bootp $@
+        $(OBJCOPY) $(OBJCOPYFLAGS) -S bootp/bootp $@
 compressed/$(LINUX): $(LINUX) dep
        @$(MAKE) -C compressed $(LINUX)
diff --git a/arch/frv/include/asm/unistd.h b/arch/frv/include/asm/unistd.h
index 266a5b25a0c1..2358634cacca 100644
--- a/arch/frv/include/asm/unistd.h
+++ b/arch/frv/include/asm/unistd.h
@@ -30,7 +30,6 @@
 #define __ARCH_WANT_SYS_RT_SIGACTION
 #define __ARCH_WANT_SYS_RT_SIGSUSPEND
 #define __ARCH_WANT_SYS_EXECVE
-#define __ARCH_WANT_KERNEL_EXECVE
 /*
 * "Conditional" syscalls
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index ee0beb354e4d..dfcd263c0517 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -869,11 +869,6 @@ ret_from_kernel_thread:
        call            schedule_tail
        calll.p         @(gr21,gr0)
        or              gr20,gr20,gr8
-        bra             sys_exit
-        .globl          ret_from_kernel_execve
-ret_from_kernel_execve:
-        ori             gr28,0,sp
        bra             __syscall_exit
 ###################################################################################################
@@ -1080,27 +1075,10 @@ __entry_return_from_kernel_interrupt:
        subicc          gr5,#0,gr0,icc0
        beq             icc0,#0,__entry_return_direct
-__entry_preempt_need_resched:
+        subcc           gr0,gr0,gr0,icc2                /* set Z and clear C */
-        ldi             @(gr15,#TI_FLAGS),gr4
+        call            preempt_schedule_irq
-        andicc          gr4,#_TIF_NEED_RESCHED,gr0,icc0
-        beq             icc0,#1,__entry_return_direct
-        setlos          #PREEMPT_ACTIVE,gr5
-        sti             gr5,@(gr15,#TI_FLAGS)
-        andi            gr23,#~PSR_PIL,gr23
-        movgs           gr23,psr
-        call            schedule
-        sti             gr0,@(gr15,#TI_PRE_COUNT)
-        movsg           psr,gr23
-        ori             gr23,#PSR_PIL_14,gr23
-        movgs           gr23,psr
-        bra             __entry_preempt_need_resched
-#else
-        bra             __entry_return_direct
 #endif
+        bra             __entry_return_direct
 ###############################################################################
diff --git a/arch/frv/kernel/process.c b/arch/frv/kernel/process.c
index e1e3aa196aa4..7e33215f1d8f 100644
--- a/arch/frv/kernel/process.c
+++ b/arch/frv/kernel/process.c
@@ -181,6 +181,9 @@ int copy_thread(unsigned long clone_flags,
        childregs = (struct pt_regs *)
                (task_stack_page(p) + THREAD_SIZE - FRV_FRAME0_SIZE);
+        /* set up the userspace frame (the only place that the USP is stored) */
+        *childregs = *__kernel_frame0_ptr;
        p->set_child_tid = p->clear_child_tid = NULL;
        p->thread.frame  = childregs;
@@ -191,10 +194,8 @@ int copy_thread(unsigned long clone_flags,
        p->thread.frame0 = childregs;
        if (unlikely(!regs)) {
-                memset(childregs, 0, sizeof(struct pt_regs));
                childregs->gr9 = usp; /* function */
                childregs->gr8 = arg;
-                childregs->psr = PSR_S;
                p->thread.pc = (unsigned long) ret_from_kernel_thread;
                save_user_regs(p->thread.user);
                return 0;
diff --git a/arch/frv/mb93090-mb00/pci-dma-nommu.c b/arch/frv/mb93090-mb00/pci-dma-nommu.c
index e47857f889b6..b99c2a7cc7a4 100644
--- a/arch/frv/mb93090-mb00/pci-dma-nommu.c
+++ b/arch/frv/mb93090-mb00/pci-dma-nommu.c
@@ -11,6 +11,7 @@
 #include <linux/types.h>
 #include <linux/slab.h>
+#include <linux/export.h>
 #include <linux/dma-mapping.h>
 #include <linux/list.h>
 #include <linux/pci.h>
diff --git a/arch/h8300/include/asm/cache.h b/arch/h8300/include/asm/cache.h
index c6350283649d..05887a1d80e5 100644
--- a/arch/h8300/include/asm/cache.h
+++ b/arch/h8300/include/asm/cache.h
@@ -2,7 +2,8 @@
 #define __ARCH_H8300_CACHE_H
 /* bytes per L1 cache line */
-#define        L1_CACHE_BYTES  4
+#define        L1_CACHE_SHIFT  2
+#define        L1_CACHE_BYTES  (1 << L1_CACHE_SHIFT)
 /* m68k-elf-gcc  2.95.2 doesn't like these */
diff --git a/arch/s390/include/asm/cio.h b/arch/s390/include/asm/cio.h
index 55bde6035216..ad2b924167d7 100644
--- a/arch/s390/include/asm/cio.h
+++ b/arch/s390/include/asm/cio.h
@@ -9,6 +9,8 @@
 #define LPM_ANYPATH 0xff
 #define __MAX_CSSID 0
+#define __MAX_SUBCHANNEL 65535
+#define __MAX_SSID 3
 #include <asm/scsw.h>
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index dd647c919a66..2d3b7cb26005 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -506,12 +506,15 @@ static inline int pud_bad(pud_t pud)
 static inline int pmd_present(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _SEGMENT_ENTRY_ORIGIN) != 0UL;
+        unsigned long mask = _SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO;
+        return (pmd_val(pmd) & mask) == _HPAGE_TYPE_NONE ||
+               !(pmd_val(pmd) & _SEGMENT_ENTRY_INV);
 }
 static inline int pmd_none(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _SEGMENT_ENTRY_INV) != 0UL;
+        return (pmd_val(pmd) & _SEGMENT_ENTRY_INV) &&
+               !(pmd_val(pmd) & _SEGMENT_ENTRY_RO);
 }
 static inline int pmd_large(pmd_t pmd)
@@ -1223,6 +1226,11 @@ static inline void __pmd_idte(unsigned long address, pmd_t *pmdp)
 }
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#define SEGMENT_NONE    __pgprot(_HPAGE_TYPE_NONE)
+#define SEGMENT_RO      __pgprot(_HPAGE_TYPE_RO)
+#define SEGMENT_RW      __pgprot(_HPAGE_TYPE_RW)
 #define __HAVE_ARCH_PGTABLE_DEPOSIT
 extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pgtable_t pgtable);
@@ -1242,16 +1250,15 @@ static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
 static inline unsigned long massage_pgprot_pmd(pgprot_t pgprot)
 {
-        unsigned long pgprot_pmd = 0;
+        /*
+         * pgprot is PAGE_NONE, PAGE_RO, or PAGE_RW (see __Pxxx / __Sxxx)
-        if (pgprot_val(pgprot) & _PAGE_INVALID) {
+         * Convert to segment table entry format.
-                if (pgprot_val(pgprot) & _PAGE_SWT)
+         */
-                        pgprot_pmd |= _HPAGE_TYPE_NONE;
+        if (pgprot_val(pgprot) == pgprot_val(PAGE_NONE))
-                pgprot_pmd |= _SEGMENT_ENTRY_INV;
+                return pgprot_val(SEGMENT_NONE);
-        }
+        if (pgprot_val(pgprot) == pgprot_val(PAGE_RO))
-        if (pgprot_val(pgprot) & _PAGE_RO)
+                return pgprot_val(SEGMENT_RO);
-                pgprot_pmd |= _SEGMENT_ENTRY_RO;
+        return pgprot_val(SEGMENT_RW);
-        return pgprot_pmd;
 }
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
@@ -1269,7 +1276,9 @@ static inline pmd_t pmd_mkhuge(pmd_t pmd)
 static inline pmd_t pmd_mkwrite(pmd_t pmd)
 {
-        pmd_val(pmd) &= ~_SEGMENT_ENTRY_RO;
+        /* Do not clobber _HPAGE_TYPE_NONE pages! */
+        if (!(pmd_val(pmd) & _SEGMENT_ENTRY_INV))
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_RO;
        return pmd;
 }
diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
index bf053898630d..b6506ee32a36 100644
--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -44,6 +44,12 @@ _sclp_wait_int:
 #endif
        mvc     .LoldpswS1-.LbaseS1(16,%r13),0(%r8)
        mvc     0(16,%r8),0(%r9)
+#ifdef CONFIG_64BIT
+        epsw    %r6,%r7                         # set current addressing mode
+        nill    %r6,0x1                         # in new psw (31 or 64 bit mode)
+        nilh    %r7,0x8000
+        stm     %r6,%r7,0(%r8)
+#endif
        lhi     %r6,0x0200                      # cr mask for ext int (cr0.54)
        ltr     %r2,%r2
        jz      .LsetctS1
@@ -87,7 +93,7 @@ _sclp_wait_int:
        .long   0x00080000, 0x80000000+.LwaitS1 # PSW to handle ext int
 #ifdef CONFIG_64BIT
 .LextpswS1_64:
-        .quad   0x0000000180000000, .LwaitS1    # PSW to handle ext int, 64 bit
+        .quad   0, .LwaitS1                     # PSW to handle ext int, 64 bit
 #endif
 .LwaitpswS1:
        .long   0x010a0000, 0x00000000+.LloopS1 # PSW to wait for ext int
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 2d37bb861faf..9017a63dda3d 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -39,7 +39,7 @@ static __always_inline unsigned long follow_table(struct mm_struct *mm,
        pmd = pmd_offset(pud, addr);
        if (pmd_none(*pmd))
                return -0x10UL;
-        if (pmd_huge(*pmd)) {
+        if (pmd_large(*pmd)) {
                if (write && (pmd_val(*pmd) & _SEGMENT_ENTRY_RO))
                        return -0x04UL;
                return (pmd_val(*pmd) & HPAGE_MASK) + (addr & ~HPAGE_MASK);
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index 60acb93a4680..8b8285310b5a 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -126,7 +126,7 @@ static inline int gup_pmd_range(pud_t *pudp, pud_t pud, unsigned long addr,
                 */
                if (pmd_none(pmd) || pmd_trans_splitting(pmd))
                        return 0;
-                if (unlikely(pmd_huge(pmd))) {
+                if (unlikely(pmd_large(pmd))) {
                        if (!gup_huge_pmd(pmdp, pmd, addr, next,
                                          write, pages, nr))
                                return 0;
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index 59c226d120cd..c20d1ce62dc6 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -359,18 +359,14 @@ HYPERVISOR_update_va_mapping(unsigned long va, pte_t new_val,
                return _hypercall4(int, update_va_mapping, va,
                                   new_val.pte, new_val.pte >> 32, flags);
 }
+extern int __must_check xen_event_channel_op_compat(int, void *);
 static inline int
 HYPERVISOR_event_channel_op(int cmd, void *arg)
 {
        int rc = _hypercall2(int, event_channel_op, cmd, arg);
-        if (unlikely(rc == -ENOSYS)) {
+        if (unlikely(rc == -ENOSYS))
-                struct evtchn_op op;
+                rc = xen_event_channel_op_compat(cmd, arg);
-                op.cmd = cmd;
-                memcpy(&op.u, arg, sizeof(op.u));
-                rc = _hypercall1(int, event_channel_op_compat, &op);
-                memcpy(arg, &op.u, sizeof(op.u));
-        }
        return rc;
 }
@@ -386,17 +382,14 @@ HYPERVISOR_console_io(int cmd, int count, char *str)
        return _hypercall3(int, console_io, cmd, count, str);
 }
+extern int __must_check HYPERVISOR_physdev_op_compat(int, void *);
 static inline int
 HYPERVISOR_physdev_op(int cmd, void *arg)
 {
        int rc = _hypercall2(int, physdev_op, cmd, arg);
-        if (unlikely(rc == -ENOSYS)) {
+        if (unlikely(rc == -ENOSYS))
-                struct physdev_op op;
+                rc = HYPERVISOR_physdev_op_compat(cmd, arg);
-                op.cmd = cmd;
-                memcpy(&op.u, arg, sizeof(op.u));
-                rc = _hypercall1(int, physdev_op_compat, &op);
-                memcpy(arg, &op.u, sizeof(op.u));
-        }
        return rc;
 }
diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
index 66d0fff1ee84..125f344f06a9 100644
--- a/arch/x86/include/asm/xen/hypervisor.h
+++ b/arch/x86/include/asm/xen/hypervisor.h
@@ -33,7 +33,6 @@
 #ifndef _ASM_X86_XEN_HYPERVISOR_H
 #define _ASM_X86_XEN_HYPERVISOR_H
-/* arch/i386/kernel/setup.c */
 extern struct shared_info *HYPERVISOR_shared_info;
 extern struct start_info *xen_start_info;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1eefebe5d727..224a7e78cb6c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3779,7 +3779,7 @@ static int write_exit_mmio(struct kvm_vcpu *vcpu, gpa_t gpa,
 {
        struct kvm_mmio_fragment *frag = &vcpu->mmio_fragments[0];
-        memcpy(vcpu->run->mmio.data, frag->data, frag->len);
+        memcpy(vcpu->run->mmio.data, frag->data, min(8u, frag->len));
        return X86EMUL_CONTINUE;
 }
@@ -3832,18 +3832,11 @@ mmio:
        bytes -= handled;
        val += handled;
-        while (bytes) {
+        WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
-                unsigned now = min(bytes, 8U);
+        frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
+        frag->gpa = gpa;
-                frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
+        frag->data = val;
-                frag->gpa = gpa;
+        frag->len = bytes;
-                frag->data = val;
-                frag->len = now;
-                gpa += now;
-                val += now;
-                bytes -= now;
-        }
        return X86EMUL_CONTINUE;
 }
@@ -3890,7 +3883,7 @@ int emulator_read_write(struct x86_emulate_ctxt *ctxt, unsigned long addr,
        vcpu->mmio_needed = 1;
        vcpu->mmio_cur_fragment = 0;
-        vcpu->run->mmio.len = vcpu->mmio_fragments[0].len;
+        vcpu->run->mmio.len = min(8u, vcpu->mmio_fragments[0].len);
        vcpu->run->mmio.is_write = vcpu->mmio_is_write = ops->write;
        vcpu->run->exit_reason = KVM_EXIT_MMIO;
        vcpu->run->mmio.phys_addr = gpa;
@@ -5522,28 +5515,44 @@ static int complete_emulated_pio(struct kvm_vcpu *vcpu)
 *
 * read:
 *   for each fragment
- *     write gpa, len
+ *     for each mmio piece in the fragment
- *     exit
+ *       write gpa, len
- *     copy data
+ *       exit
+ *       copy data
 *   execute insn
 *
 * write:
 *   for each fragment
- *      write gpa, len
+ *     for each mmio piece in the fragment
- *      copy data
+ *       write gpa, len
- *      exit
+ *       copy data
+ *       exit
 */
 static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
 {
        struct kvm_run *run = vcpu->run;
        struct kvm_mmio_fragment *frag;
+        unsigned len;
        BUG_ON(!vcpu->mmio_needed);
        /* Complete previous fragment */
-        frag = &vcpu->mmio_fragments[vcpu->mmio_cur_fragment++];
+        frag = &vcpu->mmio_fragments[vcpu->mmio_cur_fragment];
+        len = min(8u, frag->len);
        if (!vcpu->mmio_is_write)
-                memcpy(frag->data, run->mmio.data, frag->len);
+                memcpy(frag->data, run->mmio.data, len);
+        if (frag->len <= 8) {
+                /* Switch to the next fragment. */
+                frag++;
+                vcpu->mmio_cur_fragment++;
+        } else {
+                /* Go forward to the next mmio piece. */
+                frag->data += len;
+                frag->gpa += len;
+                frag->len -= len;
+        }
        if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) {
                vcpu->mmio_needed = 0;
                if (vcpu->mmio_is_write)
@@ -5551,13 +5560,12 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
                vcpu->mmio_read_completed = 1;
                return complete_emulated_io(vcpu);
        }
-        /* Initiate next fragment */
-        ++frag;
        run->exit_reason = KVM_EXIT_MMIO;
        run->mmio.phys_addr = frag->gpa;
        if (vcpu->mmio_is_write)
-                memcpy(run->mmio.data, frag->data, frag->len);
+                memcpy(run->mmio.data, frag->data, min(8u, frag->len));
-        run->mmio.len = frag->len;
+        run->mmio.len = min(8u, frag->len);
        run->mmio.is_write = vcpu->mmio_is_write;
        vcpu->arch.complete_userspace_io = complete_emulated_mmio;
        return 0;
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 6226c99729b9..dcf5f2dd91ec 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1288,6 +1288,25 @@ unsigned long xen_read_cr2_direct(void)
        return this_cpu_read(xen_vcpu_info.arch.cr2);
 }
+void xen_flush_tlb_all(void)
+{
+        struct mmuext_op *op;
+        struct multicall_space mcs;
+        trace_xen_mmu_flush_tlb_all(0);
+        preempt_disable();
+        mcs = xen_mc_entry(sizeof(*op));
+        op = mcs.args;
+        op->cmd = MMUEXT_TLB_FLUSH_ALL;
+        MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+        preempt_enable();
+}
 static void xen_flush_tlb(void)
 {
        struct mmuext_op *op;
@@ -2518,7 +2537,7 @@ int xen_remap_domain_mfn_range(struct vm_area_struct *vma,
        err = 0;
 out:
-        flush_tlb_all();
+        xen_flush_tlb_all();
        return err;
 }
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index cdcb48adee4c..0d1f36a22c98 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -13,6 +13,8 @@ config XTENSA
        select GENERIC_CPU_DEVICES
        select MODULES_USE_ELF_RELA
        select GENERIC_PCI_IOMAP
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        select ARCH_WANT_OPTIONAL_GPIOLIB
        help
          Xtensa processors are 32-bit RISC machines designed by Tensilica
diff --git a/arch/xtensa/include/asm/io.h b/arch/xtensa/include/asm/io.h
index e6be5b9091c2..700c2e6f2d25 100644
--- a/arch/xtensa/include/asm/io.h
+++ b/arch/xtensa/include/asm/io.h
@@ -62,6 +62,10 @@ static inline void __iomem *ioremap(unsigned long offset, unsigned long size)
 static inline void iounmap(volatile void __iomem *addr)
 {
 }
+#define virt_to_bus     virt_to_phys
+#define bus_to_virt     phys_to_virt
 #endif /* CONFIG_MMU */
 /*
diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
index 5c371d8d4528..2d630e7399ca 100644
--- a/arch/xtensa/include/asm/processor.h
+++ b/arch/xtensa/include/asm/processor.h
@@ -152,6 +152,7 @@ struct thread_struct {
 /* Clearing a0 terminates the backtrace. */
 #define start_thread(regs, new_pc, new_sp) \
+        memset(regs, 0, sizeof(*regs)); \
        regs->pc = new_pc; \
        regs->ps = USER_PS_VALUE; \
        regs->areg[1] = new_sp; \
@@ -168,9 +169,6 @@ struct mm_struct;
 /* Free all resources held by a thread. */
 #define release_thread(thread) do { } while(0)
-/* Create a kernel thread without removing it from tasklists */
-extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 /* Copy and release all segment info associated with a VM */
 #define copy_segments(p, mm)    do { } while(0)
 #define release_segments(mm)    do { } while(0)
diff --git a/arch/xtensa/include/asm/syscall.h b/arch/xtensa/include/asm/syscall.h
index c1dacca312f3..124aeee0d381 100644
--- a/arch/xtensa/include/asm/syscall.h
+++ b/arch/xtensa/include/asm/syscall.h
@@ -10,7 +10,7 @@
 struct pt_regs;
 struct sigaction;
-asmlinkage long xtensa_execve(char*, char**, char**, struct pt_regs*);
+asmlinkage long sys_execve(char*, char**, char**, struct pt_regs*);
 asmlinkage long xtensa_clone(unsigned long, unsigned long, struct pt_regs*);
 asmlinkage long xtensa_ptrace(long, long, long, long);
 asmlinkage long xtensa_sigreturn(struct pt_regs*);
diff --git a/arch/xtensa/include/asm/unistd.h b/arch/xtensa/include/asm/unistd.h
index 9ef1c31d2c83..f4e6eaa40d1c 100644
--- a/arch/xtensa/include/asm/unistd.h
+++ b/arch/xtensa/include/asm/unistd.h
@@ -1,16 +1,9 @@
-/*
+#ifndef _XTENSA_UNISTD_H
- * include/asm-xtensa/unistd.h
+#define _XTENSA_UNISTD_H
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2001 - 2005 Tensilica Inc.
- */
+#define __ARCH_WANT_SYS_EXECVE
 #include <uapi/asm/unistd.h>
 /*
 * "Conditional" syscalls
 *
@@ -37,3 +30,5 @@
 #define __IGNORE_mmap                           /* use mmap2 */
 #define __IGNORE_vfork                          /* use clone */
 #define __IGNORE_fadvise64                      /* use fadvise64_64 */
+#endif /* _XTENSA_UNISTD_H */
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index 479abaea5aae..9f36d0e3e0ac 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -1,14 +1,4 @@
-/*
+#if !defined(_UAPI_XTENSA_UNISTD_H) || defined(__SYSCALL)
- * include/asm-xtensa/unistd.h
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2001 - 2012 Tensilica Inc.
- */
-#ifndef _UAPI_XTENSA_UNISTD_H
 #define _UAPI_XTENSA_UNISTD_H
 #ifndef __SYSCALL
@@ -272,7 +262,7 @@ __SYSCALL(115, sys_sendmmsg, 4)
 #define __NR_clone                              116
 __SYSCALL(116, xtensa_clone, 5)
 #define __NR_execve                             117
-__SYSCALL(117, xtensa_execve, 3)
+__SYSCALL(117, sys_execve, 3)
 #define __NR_exit                               118
 __SYSCALL(118, sys_exit, 1)
 #define __NR_exit_group                         119
@@ -759,4 +749,6 @@ __SYSCALL(331, sys_kcmp, 5)
 #define SYS_XTENSA_COUNT                  5     /* count */
+#undef __SYSCALL
 #endif /* _UAPI_XTENSA_UNISTD_H */
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index 18453067c258..90bfc1dbc13d 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1833,50 +1833,6 @@ ENTRY(system_call)
 /*
- * Create a kernel thread
- *
- * int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
- * a2                    a2                 a3             a4
- */
-ENTRY(kernel_thread)
-        entry   a1, 16
-        mov     a5, a2                  # preserve fn over syscall
-        mov     a7, a3                  # preserve args over syscall
-        movi    a3, _CLONE_VM | _CLONE_UNTRACED
-        movi    a2, __NR_clone
-        or      a6, a4, a3              # arg0: flags
-        mov     a3, a1                  # arg1: sp
-        syscall
-        beq     a3, a1, 1f              # branch if parent
-        mov     a6, a7                  # args
-        callx4  a5                      # fn(args)
-        movi    a2, __NR_exit
-        syscall                         # return value of fn(args) still in a6
-1:      retw
-/*
- * Do a system call from kernel instead of calling sys_execve, so we end up
- * with proper pt_regs.
- *
- * int kernel_execve(const char *fname, char *const argv[], charg *const envp[])
- * a2                        a2               a3                  a4
- */
-ENTRY(kernel_execve)
-        entry   a1, 16
-        mov     a6, a2                  # arg0 is in a6
-        movi    a2, __NR_execve
-        syscall
-        retw
-/*
 * Task switch.
 *
 * struct task*  _switch_to (struct task* prev, struct task* next)
@@ -1958,3 +1914,16 @@ ENTRY(ret_from_fork)
        j       common_exception_return
+/*
+ * Kernel thread creation helper
+ * On entry, set up by copy_thread: a2 = thread_fn, a3 = thread_fn arg
+ *           left from _switch_to: a6 = prev
+ */
+ENTRY(ret_from_kernel_thread)
+        call4   schedule_tail
+        mov     a6, a3
+        callx4  a2
+        j       common_exception_return
+ENDPROC(ret_from_kernel_thread)
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 1908f6642d31..09ae7bfab9a7 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -45,6 +45,7 @@
 #include <asm/regs.h>
 extern void ret_from_fork(void);
+extern void ret_from_kernel_thread(void);
 struct task_struct *current_set[NR_CPUS] = {&init_task, };
@@ -158,18 +159,30 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 /*
 * Copy thread.
 *
+ * There are two modes in which this function is called:
+ * 1) Userspace thread creation,
+ *    regs != NULL, usp_thread_fn is userspace stack pointer.
+ *    It is expected to copy parent regs (in case CLONE_VM is not set
+ *    in the clone_flags) and set up passed usp in the childregs.
+ * 2) Kernel thread creation,
+ *    regs == NULL, usp_thread_fn is the function to run in the new thread
+ *    and thread_fn_arg is its parameter.
+ *    childregs are not used for the kernel threads.
+ *
 * The stack layout for the new thread looks like this:
 *
- *      +------------------------+ <- sp in childregs (= tos)
+ *      +------------------------+
 *      |       childregs        |
 *      +------------------------+ <- thread.sp = sp in dummy-frame
 *      |      dummy-frame       |    (saved in dummy-frame spill-area)
 *      +------------------------+
 *
- * We create a dummy frame to return to ret_from_fork:
+ * We create a dummy frame to return to either ret_from_fork or
- *   a0 points to ret_from_fork (simulating a call4)
+ *   ret_from_kernel_thread:
+ *   a0 points to ret_from_fork/ret_from_kernel_thread (simulating a call4)
 *   sp points to itself (thread.sp)
- *   a2, a3 are unused.
+ *   a2, a3 are unused for userspace threads,
+ *   a2 points to thread_fn, a3 holds thread_fn arg for kernel threads.
 *
 * Note: This is a pristine frame, so we don't need any spill region on top of
 *       childregs.
@@ -185,43 +198,63 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 * involved.  Much simpler to just not copy those live frames across.
 */
-int copy_thread(unsigned long clone_flags, unsigned long usp,
+int copy_thread(unsigned long clone_flags, unsigned long usp_thread_fn,
-                unsigned long unused,
+                unsigned long thread_fn_arg,
-                struct task_struct * p, struct pt_regs * regs)
+                struct task_struct *p, struct pt_regs *unused)
 {
-        struct pt_regs *childregs;
+        struct pt_regs *childregs = task_pt_regs(p);
-        unsigned long tos;
-        int user_mode = user_mode(regs);
 #if (XTENSA_HAVE_COPROCESSORS || XTENSA_HAVE_IO_PORTS)
        struct thread_info *ti;
 #endif
-        /* Set up new TSS. */
-        tos = (unsigned long)task_stack_page(p) + THREAD_SIZE;
-        if (user_mode)
-                childregs = (struct pt_regs*)(tos - PT_USER_SIZE);
-        else
-                childregs = (struct pt_regs*)tos - 1;
-        /* This does not copy all the regs.  In a bout of brilliance or madness,
-           ARs beyond a0-a15 exist past the end of the struct. */
-        *childregs = *regs;
        /* Create a call4 dummy-frame: a0 = 0, a1 = childregs. */
        *((int*)childregs - 3) = (unsigned long)childregs;
        *((int*)childregs - 4) = 0;
-        childregs->areg[2] = 0;
-        p->set_child_tid = p->clear_child_tid = NULL;
-        p->thread.ra = MAKE_RA_FOR_CALL((unsigned long)ret_from_fork, 0x1);
        p->thread.sp = (unsigned long)childregs;
-        if (user_mode(regs)) {
+        if (!(p->flags & PF_KTHREAD)) {
+                struct pt_regs *regs = current_pt_regs();
+                unsigned long usp = usp_thread_fn ?
+                        usp_thread_fn : regs->areg[1];
+                p->thread.ra = MAKE_RA_FOR_CALL(
+                                (unsigned long)ret_from_fork, 0x1);
+                /* This does not copy all the regs.
+                 * In a bout of brilliance or madness,
+                 * ARs beyond a0-a15 exist past the end of the struct.
+                 */
+                *childregs = *regs;
                childregs->areg[1] = usp;
+                childregs->areg[2] = 0;
+                /* When sharing memory with the parent thread, the child
+                   usually starts on a pristine stack, so we have to reset
+                   windowbase, windowstart and wmask.
+                   (Note that such a new thread is required to always create
+                   an initial call4 frame)
+                   The exception is vfork, where the new thread continues to
+                   run on the parent's stack until it calls execve. This could
+                   be a call8 or call12, which requires a legal stack frame
+                   of the previous caller for the overflow handlers to work.
+                   (Note that it's always legal to overflow live registers).
+                   In this case, ensure to spill at least the stack pointer
+                   of that frame. */
                if (clone_flags & CLONE_VM) {
-                        childregs->wmask = 1;   /* can't share live windows */
+                        /* check that caller window is live and same stack */
+                        int len = childregs->wmask & ~0xf;
+                        if (regs->areg[1] == usp && len != 0) {
+                                int callinc = (regs->areg[0] >> 30) & 3;
+                                int caller_ars = XCHAL_NUM_AREGS - callinc * 4;
+                                put_user(regs->areg[caller_ars+1],
+                                         (unsigned __user*)(usp - 12));
+                        }
+                        childregs->wmask = 1;
+                        childregs->windowstart = 1;
+                        childregs->windowbase = 0;
                } else {
                        int len = childregs->wmask & ~0xf;
                        memcpy(&childregs->areg[XCHAL_NUM_AREGS - len/4],
@@ -230,11 +263,19 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
 // FIXME: we need to set THREADPTR in thread_info...
                if (clone_flags & CLONE_SETTLS)
                        childregs->areg[2] = childregs->areg[6];
        } else {
-                /* In kernel space, we start a new thread with a new stack. */
+                p->thread.ra = MAKE_RA_FOR_CALL(
-                childregs->wmask = 1;
+                                (unsigned long)ret_from_kernel_thread, 1);
-                childregs->areg[1] = tos;
+                /* pass parameters to ret_from_kernel_thread:
+                 * a2 = thread_fn, a3 = thread_fn arg
+                 */
+                *((int *)childregs - 1) = thread_fn_arg;
+                *((int *)childregs - 2) = usp_thread_fn;
+                /* Childregs are only used when we're going to userspace
+                 * in which case start_thread will set them up.
+                 */
        }
 #if (XTENSA_HAVE_COPROCESSORS || XTENSA_HAVE_IO_PORTS)
@@ -330,32 +371,5 @@ long xtensa_clone(unsigned long clone_flags, unsigned long newsp,
                  void __user *child_tid, long a5,
                  struct pt_regs *regs)
 {
-        if (!newsp)
-                newsp = regs->areg[1];
        return do_fork(clone_flags, newsp, regs, 0, parent_tid, child_tid);
 }
-/*
- * xtensa_execve() executes a new program.
- */
-asmlinkage
-long xtensa_execve(const char __user *name,
-                   const char __user *const __user *argv,
-                   const char __user *const __user *envp,
-                   long a3, long a4, long a5,
-                   struct pt_regs *regs)
-{
-        long error;
-        struct filename *filename;
-        filename = getname(name);
-        error = PTR_ERR(filename);
-        if (IS_ERR(filename))
-                goto out;
-        error = do_execve(filename->name, argv, envp, regs);
-        putname(filename);
-out:
-        return error;
-}
diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c
index a5c01e74d5d5..5702065f472a 100644
--- a/arch/xtensa/kernel/syscall.c
+++ b/arch/xtensa/kernel/syscall.c
@@ -32,10 +32,8 @@ typedef void (*syscall_t)(void);
 syscall_t sys_call_table[__NR_syscall_count] /* FIXME __cacheline_aligned */= {
        [0 ... __NR_syscall_count - 1] = (syscall_t)&sys_ni_syscall,
-#undef __SYSCALL
 #define __SYSCALL(nr,symbol,nargs) [ nr ] = (syscall_t)symbol,
-#undef  __KERNEL_SYSCALLS__
+#include <uapi/asm/unistd.h>
-#include <asm/unistd.h>
 };
 asmlinkage long xtensa_shmat(int shmid, char __user *shmaddr, int shmflg)
@@ -49,7 +47,8 @@ asmlinkage long xtensa_shmat(int shmid, char __user *shmaddr, int shmflg)
        return (long)ret;
 }
-asmlinkage long xtensa_fadvise64_64(int fd, int advice, unsigned long long offset, unsigned long long len)
+asmlinkage long xtensa_fadvise64_64(int fd, int advice,
+                unsigned long long offset, unsigned long long len)
 {
        return sys_fadvise64_64(fd, offset, len, advice);
 }
diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index a8b9f1fd1e17..afe058b24e6e 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -43,7 +43,6 @@ EXPORT_SYMBOL(__strncpy_user);
 EXPORT_SYMBOL(clear_page);
 EXPORT_SYMBOL(copy_page);
-EXPORT_SYMBOL(kernel_thread);
 EXPORT_SYMBOL(empty_zero_page);
 /*
diff --git a/block/Kconfig b/block/Kconfig
index 09acf1b39905..a7e40a7c8214 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -89,7 +89,7 @@ config BLK_DEV_INTEGRITY
 config BLK_DEV_THROTTLING
        bool "Block layer bio throttling support"
-        depends on BLK_CGROUP=y && EXPERIMENTAL
+        depends on BLK_CGROUP=y
        default n
        ---help---
        Block layer bio throttling support. It can be used to limit
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index cafcd7431189..d0b770391ad4 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -285,6 +285,13 @@ static void blkg_destroy_all(struct request_queue *q)
                blkg_destroy(blkg);
                spin_unlock(&blkcg->lock);
        }
+        /*
+         * root blkg is destroyed.  Just clear the pointer since
+         * root_rl does not take reference on root blkg.
+         */
+        q->root_blkg = NULL;
+        q->root_rl.blkg = NULL;
 }
 static void blkg_rcu_free(struct rcu_head *rcu_head)
@@ -326,6 +333,9 @@ struct request_list *__blk_queue_next_rl(struct request_list *rl,
         */
        if (rl == &q->root_rl) {
                ent = &q->blkg_list;
+                /* There are no more block groups, hence no request lists */
+                if (list_empty(ent))
+                        return NULL;
        } else {
                blkg = container_of(rl, struct blkcg_gq, rl);
                ent = &blkg->q_node;
diff --git a/block/blk-core.c b/block/blk-core.c
index a33870b1847b..3c95c4d6e31a 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2868,7 +2868,8 @@ static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
        struct request *rqa = container_of(a, struct request, queuelist);
        struct request *rqb = container_of(b, struct request, queuelist);
-        return !(rqa->q <= rqb->q);
+        return !(rqa->q < rqb->q ||
+                (rqa->q == rqb->q && blk_rq_pos(rqa) < blk_rq_pos(rqb)));
 }
 /*
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index 671d4d6d14df..7bdd61b867c8 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -137,13 +137,18 @@ static void cryptd_queue_worker(struct work_struct *work)
        struct crypto_async_request *req, *backlog;
        cpu_queue = container_of(work, struct cryptd_cpu_queue, work);
-        /* Only handle one request at a time to avoid hogging crypto
+        /*
-         * workqueue. preempt_disable/enable is used to prevent
+         * Only handle one request at a time to avoid hogging crypto workqueue.
-         * being preempted by cryptd_enqueue_request() */
+         * preempt_disable/enable is used to prevent being preempted by
+         * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent
+         * cryptd_enqueue_request() being accessed from software interrupts.
+         */
+        local_bh_disable();
        preempt_disable();
        backlog = crypto_get_backlog(&cpu_queue->queue);
        req = crypto_dequeue_request(&cpu_queue->queue);
        preempt_enable();
+        local_bh_enable();
        if (!req)
                return;
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index d1a2d74033e9..08373086cd7e 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -159,6 +159,7 @@ static int acpi_bind_one(struct device *dev, acpi_handle handle)
        if (physical_node->node_id >= ACPI_MAX_PHYSICAL_NODE) {
                retval = -ENOSPC;
                mutex_unlock(&acpi_dev->physical_node_lock);
+                kfree(physical_node);
                goto err;
        }
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index e78c2a52ea46..bd4e5dca3ff7 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -409,6 +409,7 @@ static void acpi_processor_notify(struct acpi_device *device, u32 event)
                acpi_bus_generate_proc_event(device, event, 0);
                acpi_bus_generate_netlink_event(device->pnp.device_class,
                                                  dev_name(&device->dev), event, 0);
+                break;
        default:
                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                  "Unsupported event [0x%x]\n", event));
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index f94d4c818fc7..0230cb6cbb3a 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1345,12 +1345,15 @@ static int
 acpi_video_bus_get_devices(struct acpi_video_bus *video,
                           struct acpi_device *device)
 {
-        int status;
+        int status = 0;
        struct acpi_device *dev;
-        status = acpi_video_device_enumerate(video);
+        /*
-        if (status)
+         * There are systems where video module known to work fine regardless
-                return status;
+         * of broken _DOD and ignoring returned value here doesn't cause
+         * any issues later.
+         */
+        acpi_video_device_enumerate(video);
        list_for_each_entry(dev, &device->children, node) {
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index c22b869245d9..96b71b6536d6 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -1862,7 +1862,7 @@ int pm_genpd_attach_cpuidle(struct generic_pm_domain *genpd, int state)
        cpuidle_drv = cpuidle_driver_ref();
        if (!cpuidle_drv) {
                ret = -ENODEV;
-                goto out;
+                goto err_drv;
        }
        if (cpuidle_drv->state_count <= state) {
                ret = -EINVAL;
@@ -1884,6 +1884,9 @@ int pm_genpd_attach_cpuidle(struct generic_pm_domain *genpd, int state)
 err:
        cpuidle_driver_unref();
+ err_drv:
+        kfree(cpu_data);
        goto out;
 }
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 432aeeedfd5e..d865470bc951 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -158,9 +158,10 @@ static int bcma_register_cores(struct bcma_bus *bus)
 static void bcma_unregister_cores(struct bcma_bus *bus)
 {
-        struct bcma_device *core;
+        struct bcma_device *core, *tmp;
-        list_for_each_entry(core, &bus->cores, list) {
+        list_for_each_entry_safe(core, tmp, &bus->cores, list) {
+                list_del(&core->list);
                if (core->dev_registered)
                        device_unregister(&core->dev);
        }
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index f529407db93f..824e09c4d0d7 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -131,6 +131,7 @@ config BLK_CPQ_DA
 config BLK_CPQ_CISS_DA
        tristate "Compaq Smart Array 5xxx support"
        depends on PCI
+        select CHECK_SIGNATURE
        help
          This is the driver for Compaq Smart Array 5xxx controllers.
          Everyone using these boards should say Y here.
@@ -166,8 +167,8 @@ config BLK_DEV_DAC960
          module will be called DAC960.
 config BLK_DEV_UMEM
-        tristate "Micro Memory MM5415 Battery Backed RAM support (EXPERIMENTAL)"
+        tristate "Micro Memory MM5415 Battery Backed RAM support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        ---help---
          Saying Y here will include support for the MM5415 family of
          battery backed (Non-volatile) RAM cards.
@@ -430,8 +431,8 @@ config CDROM_PKTCDVD_BUFFERS
          a disc is opened for writing.
 config CDROM_PKTCDVD_WCACHE
-        bool "Enable write caching (EXPERIMENTAL)"
+        bool "Enable write caching"
-        depends on CDROM_PKTCDVD && EXPERIMENTAL
+        depends on CDROM_PKTCDVD
        help
          If enabled, write caching will be set for the CD-R/W device. For now
          this option is dangerous unless the CD-RW media is known good, as we
@@ -508,8 +509,8 @@ config XEN_BLKDEV_BACKEND
 config VIRTIO_BLK
-        tristate "Virtio block driver (EXPERIMENTAL)"
+        tristate "Virtio block driver"
-        depends on EXPERIMENTAL && VIRTIO
+        depends on VIRTIO
        ---help---
          This is the virtual block driver for virtio.  It can be used with
          lguest or QEMU based VMMs (like KVM or Xen).  Say Y or M.
@@ -528,7 +529,7 @@ config BLK_DEV_HD
 config BLK_DEV_RBD
        tristate "Rados block device (RBD)"
-        depends on INET && EXPERIMENTAL && BLOCK
+        depends on INET && BLOCK
        select CEPH_LIB
        select LIBCRC32C
        select CRYPTO_AES
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index b0f553b26d0f..ca83f96756ad 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -5205,7 +5205,6 @@ static void cciss_shutdown(struct pci_dev *pdev)
                return;
        }
        /* write all data in the battery backed cache to disk */
-        memset(flush_buf, 0, 4);
        return_code = sendcmd_withirq(h, CCISS_CACHE_FLUSH, flush_buf,
                4, 0, CTLR_LUNID, TYPE_CMD);
        kfree(flush_buf);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 17c675c52295..1c49d7173966 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4109,12 +4109,19 @@ static struct platform_driver floppy_driver = {
 static struct platform_device floppy_device[N_DRIVE];
+static bool floppy_available(int drive)
+{
+        if (!(allowed_drive_mask & (1 << drive)))
+                return false;
+        if (fdc_state[FDC(drive)].version == FDC_NONE)
+                return false;
+        return true;
+}
 static struct kobject *floppy_find(dev_t dev, int *part, void *data)
 {
        int drive = (*part & 3) | ((*part & 0x80) >> 5);
-        if (drive >= N_DRIVE ||
+        if (drive >= N_DRIVE || !floppy_available(drive))
-            !(allowed_drive_mask & (1 << drive)) ||
-            fdc_state[FDC(drive)].version == FDC_NONE)
                return NULL;
        if (((*part >> 2) & 0x1f) >= ARRAY_SIZE(floppy_type))
                return NULL;
@@ -4124,8 +4131,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
 static int __init do_floppy_init(void)
 {
-        int i, unit, drive;
+        int i, unit, drive, err;
-        int err, dr;
        set_debugt();
        interruptjiffies = resultjiffies = jiffies;
@@ -4137,34 +4143,32 @@ static int __init do_floppy_init(void)
        raw_cmd = NULL;
-        for (dr = 0; dr < N_DRIVE; dr++) {
+        floppy_wq = alloc_ordered_workqueue("floppy", 0);
-                disks[dr] = alloc_disk(1);
+        if (!floppy_wq)
-                if (!disks[dr]) {
+                return -ENOMEM;
-                        err = -ENOMEM;
-                        goto out_put_disk;
-                }
-                floppy_wq = alloc_ordered_workqueue("floppy", 0);
+        for (drive = 0; drive < N_DRIVE; drive++) {
-                if (!floppy_wq) {
+                disks[drive] = alloc_disk(1);
+                if (!disks[drive]) {
                        err = -ENOMEM;
                        goto out_put_disk;
                }
-                disks[dr]->queue = blk_init_queue(do_fd_request, &floppy_lock);
+                disks[drive]->queue = blk_init_queue(do_fd_request, &floppy_lock);
-                if (!disks[dr]->queue) {
+                if (!disks[drive]->queue) {
                        err = -ENOMEM;
-                        goto out_destroy_workq;
+                        goto out_put_disk;
                }
-                blk_queue_max_hw_sectors(disks[dr]->queue, 64);
+                blk_queue_max_hw_sectors(disks[drive]->queue, 64);
-                disks[dr]->major = FLOPPY_MAJOR;
+                disks[drive]->major = FLOPPY_MAJOR;
-                disks[dr]->first_minor = TOMINOR(dr);
+                disks[drive]->first_minor = TOMINOR(drive);
-                disks[dr]->fops = &floppy_fops;
+                disks[drive]->fops = &floppy_fops;
-                sprintf(disks[dr]->disk_name, "fd%d", dr);
+                sprintf(disks[drive]->disk_name, "fd%d", drive);
-                init_timer(&motor_off_timer[dr]);
+                init_timer(&motor_off_timer[drive]);
-                motor_off_timer[dr].data = dr;
+                motor_off_timer[drive].data = drive;
-                motor_off_timer[dr].function = motor_off_callback;
+                motor_off_timer[drive].function = motor_off_callback;
        }
        err = register_blkdev(FLOPPY_MAJOR, "fd");
@@ -4282,9 +4286,7 @@ static int __init do_floppy_init(void)
        }
        for (drive = 0; drive < N_DRIVE; drive++) {
-                if (!(allowed_drive_mask & (1 << drive)))
+                if (!floppy_available(drive))
-                        continue;
-                if (fdc_state[FDC(drive)].version == FDC_NONE)
                        continue;
                floppy_device[drive].name = floppy_device_name;
@@ -4293,7 +4295,7 @@ static int __init do_floppy_init(void)
                err = platform_device_register(&floppy_device[drive]);
                if (err)
-                        goto out_release_dma;
+                        goto out_remove_drives;
                err = device_create_file(&floppy_device[drive].dev,
                                         &dev_attr_cmos);
@@ -4311,29 +4313,34 @@ static int __init do_floppy_init(void)
 out_unreg_platform_dev:
        platform_device_unregister(&floppy_device[drive]);
+out_remove_drives:
+        while (drive--) {
+                if (floppy_available(drive)) {
+                        del_gendisk(disks[drive]);
+                        device_remove_file(&floppy_device[drive].dev, &dev_attr_cmos);
+                        platform_device_unregister(&floppy_device[drive]);
+                }
+        }
 out_release_dma:
        if (atomic_read(&usage_count))
                floppy_release_irq_and_dma();
 out_unreg_region:
        blk_unregister_region(MKDEV(FLOPPY_MAJOR, 0), 256);
        platform_driver_unregister(&floppy_driver);
-out_destroy_workq:
-        destroy_workqueue(floppy_wq);
 out_unreg_blkdev:
        unregister_blkdev(FLOPPY_MAJOR, "fd");
 out_put_disk:
-        while (dr--) {
+        for (drive = 0; drive < N_DRIVE; drive++) {
-                del_timer_sync(&motor_off_timer[dr]);
+                if (!disks[drive])
-                if (disks[dr]->queue) {
+                        break;
-                        blk_cleanup_queue(disks[dr]->queue);
+                if (disks[drive]->queue) {
-                        /*
+                        del_timer_sync(&motor_off_timer[drive]);
-                         * put_disk() is not paired with add_disk() and
+                        blk_cleanup_queue(disks[drive]->queue);
-                         * will put queue reference one extra time. fix it.
+                        disks[drive]->queue = NULL;
-                         */
-                        disks[dr]->queue = NULL;
                }
-                put_disk(disks[dr]);
+                put_disk(disks[drive]);
        }
+        destroy_workqueue(floppy_wq);
        return err;
 }
@@ -4551,8 +4558,7 @@ static void __exit floppy_module_exit(void)
        for (drive = 0; drive < N_DRIVE; drive++) {
                del_timer_sync(&motor_off_timer[drive]);
-                if ((allowed_drive_mask & (1 << drive)) &&
+                if (floppy_available(drive)) {
-                    fdc_state[FDC(drive)].version != FDC_NONE) {
                        del_gendisk(disks[drive]);
                        device_remove_file(&floppy_device[drive].dev, &dev_attr_cmos);
                        platform_device_unregister(&floppy_device[drive]);
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index e9d594fd12cb..54046e51160a 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -976,8 +976,21 @@ static int loop_clr_fd(struct loop_device *lo)
        if (lo->lo_state != Lo_bound)
                return -ENXIO;
-        if (lo->lo_refcnt > 1)  /* we needed one fd for the ioctl */
+        /*
-                return -EBUSY;
+         * If we've explicitly asked to tear down the loop device,
+         * and it has an elevated reference count, set it for auto-teardown when
+         * the last reference goes away. This stops $!~#$@ udev from
+         * preventing teardown because it decided that it needs to run blkid on
+         * the loopback device whenever they appear. xfstests is notorious for
+         * failing tests because blkid via udev races with a losetup
+         * <dev>/do something like mkfs/losetup -d <dev> causing the losetup -d
+         * command to fail with EBUSY.
+         */
+        if (lo->lo_refcnt > 1) {
+                lo->lo_flags |= LO_FLAGS_AUTOCLEAR;
+                mutex_unlock(&lo->lo_ctl_mutex);
+                return 0;
+        }
        if (filp == NULL)
                return -EINVAL;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index f946d31d6917..adc6f36564cf 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -2035,8 +2035,9 @@ static unsigned int implicit_sector(unsigned char command,
        }
        return rv;
 }
+static void mtip_set_timeout(struct driver_data *dd,
-static void mtip_set_timeout(struct host_to_dev_fis *fis, unsigned int *timeout)
+                                        struct host_to_dev_fis *fis,
+                                        unsigned int *timeout, u8 erasemode)
 {
        switch (fis->command) {
        case ATA_CMD_DOWNLOAD_MICRO:
@@ -2044,7 +2045,10 @@ static void mtip_set_timeout(struct host_to_dev_fis *fis, unsigned int *timeout)
                break;
        case ATA_CMD_SEC_ERASE_UNIT:
        case 0xFC:
-                *timeout = 240000; /* 4 minutes */
+                if (erasemode)
+                        *timeout = ((*(dd->port->identify + 90) * 2) * 60000);
+                else
+                        *timeout = ((*(dd->port->identify + 89) * 2) * 60000);
                break;
        case ATA_CMD_STANDBYNOW1:
                *timeout = 120000;  /* 2 minutes */
@@ -2087,6 +2091,7 @@ static int exec_drive_taskfile(struct driver_data *dd,
        unsigned int transfer_size;
        unsigned long task_file_data;
        int intotal = outtotal + req_task->out_size;
+        int erasemode = 0;
        taskout = req_task->out_size;
        taskin = req_task->in_size;
@@ -2212,7 +2217,13 @@ static int exec_drive_taskfile(struct driver_data *dd,
                fis.lba_hi,
                fis.device);
-        mtip_set_timeout(&fis, &timeout);
+        /* check for erase mode support during secure erase.*/
+        if ((fis.command == ATA_CMD_SEC_ERASE_UNIT)
+                                        && (outbuf[0] & MTIP_SEC_ERASE_MODE)) {
+                erasemode = 1;
+        }
+        mtip_set_timeout(dd, &fis, &timeout, erasemode);
        /* Determine the correct transfer size.*/
        if (force_single_sector)
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index 18627a1d04c5..5f4a917bd8bb 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -33,6 +33,9 @@
 /* offset of Device Control register in PCIe extended capabilites space */
 #define PCIE_CONFIG_EXT_DEVICE_CONTROL_OFFSET   0x48
+/* check for erase mode support during secure erase */
+#define MTIP_SEC_ERASE_MODE     0x3
 /* # of times to retry timed out/failed IOs */
 #define MTIP_MAX_RETRIES        2
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 9ad3b5ec1dc1..9a54623e52d7 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -158,8 +158,8 @@ struct xen_vbd {
        struct block_device     *bdev;
        /* Cached size parameter. */
        sector_t                size;
-        bool                    flush_support;
+        unsigned int            flush_support:1;
-        bool                    discard_secure;
+        unsigned int            discard_secure:1;
 };
 struct backend_info;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 4f66171c6683..f58434c2617c 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -105,11 +105,10 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid)
 {
        struct xen_blkif *blkif;
-        blkif = kmem_cache_alloc(xen_blkif_cachep, GFP_KERNEL);
+        blkif = kmem_cache_zalloc(xen_blkif_cachep, GFP_KERNEL);
        if (!blkif)
                return ERR_PTR(-ENOMEM);
-        memset(blkif, 0, sizeof(*blkif));
        blkif->domid = domid;
        spin_lock_init(&blkif->blk_ring_lock);
        atomic_set(&blkif->refcnt, 1);
@@ -196,7 +195,7 @@ static void xen_blkif_disconnect(struct xen_blkif *blkif)
        }
 }
-void xen_blkif_free(struct xen_blkif *blkif)
+static void xen_blkif_free(struct xen_blkif *blkif)
 {
        if (!atomic_dec_and_test(&blkif->refcnt))
                BUG();
@@ -257,7 +256,7 @@ static struct attribute_group xen_vbdstat_group = {
 VBD_SHOW(physical_device, "%x:%x\n", be->major, be->minor);
 VBD_SHOW(mode, "%s\n", be->mode);
-int xenvbd_sysfs_addif(struct xenbus_device *dev)
+static int xenvbd_sysfs_addif(struct xenbus_device *dev)
 {
        int error;
@@ -281,7 +280,7 @@ fail1:	device_remove_file(&dev->dev, &dev_attr_physical_device);
        return error;
 }
-void xenvbd_sysfs_delif(struct xenbus_device *dev)
+static void xenvbd_sysfs_delif(struct xenbus_device *dev)
 {
        sysfs_remove_group(&dev->dev.kobj, &xen_vbdstat_group);
        device_remove_file(&dev->dev, &dev_attr_mode);
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index b40ee1403be9..399831690fed 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -328,6 +328,7 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
                cpufreq_update_policy(cpu);
                break;
        case CPU_DOWN_PREPARE:
+        case CPU_DOWN_PREPARE_FROZEN:
                cpufreq_stats_free_sysfs(cpu);
                break;
        case CPU_DEAD:
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index 129e80bfff22..e3ebb4fa2c3e 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -5,7 +5,7 @@
 *  http://www.gnu.org/licenses/gpl.html
 *
 *  Maintainer:
- *  Andreas Herrmann <andreas.herrmann3@amd.com>
+ *  Andreas Herrmann <herrmann.der.user@googlemail.com>
 *
 *  Based on the powernow-k7.c module written by Dave Jones.
 *  (C) 2003 Dave Jones on behalf of SuSE Labs
@@ -1052,14 +1052,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
        struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
                                             .relation = relation };
-        /*
+        return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
-         * Must run on @pol->cpu.  cpufreq core is responsible for ensuring
-         * that we're bound to the current CPU and pol->cpu stays online.
-         */
-        if (smp_processor_id() == pol->cpu)
-                return powernowk8_target_fn(&pta);
-        else
-                return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
 }
 /* Driver entry point to verify the policy and range of frequencies */
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index f11b5b2b1a1c..7d9554cc4976 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -474,8 +474,10 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                        slot = i;
                        break;
                }
-                if (slot < 0)
+                if (slot < 0) {
+                        spin_unlock_irqrestore(&imxdma->lock, flags);
                        return -EBUSY;
+                }
                imxdma->slots_2d[slot].xsr = d->x;
                imxdma->slots_2d[slot].ysr = d->y;
diff --git a/drivers/dma/sirf-dma.c b/drivers/dma/sirf-dma.c
index 64385cde044b..d451caace806 100644
--- a/drivers/dma/sirf-dma.c
+++ b/drivers/dma/sirf-dma.c
@@ -109,7 +109,7 @@ static void sirfsoc_dma_execute(struct sirfsoc_dma_chan *schan)
        sdesc = list_first_entry(&schan->queued, struct sirfsoc_dma_desc,
                node);
        /* Move the first queued descriptor to active list */
-        list_move_tail(&schan->queued, &schan->active);
+        list_move_tail(&sdesc->node, &schan->active);
        /* Start the DMA transfer */
        writel_relaxed(sdesc->width, sdma->base + SIRFSOC_DMA_WIDTH_0 +
@@ -428,7 +428,7 @@ static struct dma_async_tx_descriptor *sirfsoc_dma_prep_interleaved(
        unsigned long iflags;
        int ret;
-        if ((xt->dir != DMA_MEM_TO_DEV) || (xt->dir != DMA_DEV_TO_MEM)) {
+        if ((xt->dir != DMA_MEM_TO_DEV) && (xt->dir != DMA_DEV_TO_MEM)) {
                ret = -EINVAL;
                goto err_dir;
        }
diff --git a/drivers/gpio/gpio-74x164.c b/drivers/gpio/gpio-74x164.c
index ed3e55161bdc..f05e54258ffb 100644
--- a/drivers/gpio/gpio-74x164.c
+++ b/drivers/gpio/gpio-74x164.c
@@ -153,7 +153,7 @@ static int __devinit gen_74x164_probe(struct spi_device *spi)
        }
        chip->gpio_chip.ngpio = GEN_74X164_NUMBER_GPIOS * chip->registers;
-        chip->buffer = devm_kzalloc(&spi->dev, chip->gpio_chip.ngpio, GFP_KERNEL);
+        chip->buffer = devm_kzalloc(&spi->dev, chip->registers, GFP_KERNEL);
        if (!chip->buffer) {
                ret = -ENOMEM;
                goto exit_destroy;
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 7a874129e5d8..cf7afb9eb61a 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -244,6 +244,8 @@ static int mvebu_gpio_direction_output(struct gpio_chip *chip, unsigned pin,
        if (ret)
                return ret;
+        mvebu_gpio_set(chip, pin, value);
        spin_lock_irqsave(&mvchip->lock, flags);
        u = readl_relaxed(mvebu_gpioreg_io_conf(mvchip));
        u &= ~(1 << pin);
@@ -644,7 +646,7 @@ static int __devinit mvebu_gpio_probe(struct platform_device *pdev)
        ct->handler = handle_edge_irq;
        ct->chip.name = mvchip->chip.label;
-        irq_setup_generic_chip(gc, IRQ_MSK(ngpios), IRQ_GC_INIT_MASK_CACHE,
+        irq_setup_generic_chip(gc, IRQ_MSK(ngpios), 0,
                               IRQ_NOREQUEST, IRQ_LEVEL | IRQ_NOPROBE);
        /* Setup irq domain on top of the generic chip. */
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 94cbc842fbc3..d335af1d4d85 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -251,6 +251,40 @@ static void _set_gpio_debounce(struct gpio_bank *bank, unsigned gpio,
        }
 }
+/**
+ * _clear_gpio_debounce - clear debounce settings for a gpio
+ * @bank: the gpio bank we're acting upon
+ * @gpio: the gpio number on this @gpio
+ *
+ * If a gpio is using debounce, then clear the debounce enable bit and if
+ * this is the only gpio in this bank using debounce, then clear the debounce
+ * time too. The debounce clock will also be disabled when calling this function
+ * if this is the only gpio in the bank using debounce.
+ */
+static void _clear_gpio_debounce(struct gpio_bank *bank, unsigned gpio)
+{
+        u32 gpio_bit = GPIO_BIT(bank, gpio);
+        if (!bank->dbck_flag)
+                return;
+        if (!(bank->dbck_enable_mask & gpio_bit))
+                return;
+        bank->dbck_enable_mask &= ~gpio_bit;
+        bank->context.debounce_en &= ~gpio_bit;
+        __raw_writel(bank->context.debounce_en,
+                     bank->base + bank->regs->debounce_en);
+        if (!bank->dbck_enable_mask) {
+                bank->context.debounce = 0;
+                __raw_writel(bank->context.debounce, bank->base +
+                             bank->regs->debounce);
+                clk_disable(bank->dbck);
+                bank->dbck_enabled = false;
+        }
+}
 static inline void set_gpio_trigger(struct gpio_bank *bank, int gpio,
                                                unsigned trigger)
 {
@@ -539,6 +573,7 @@ static void _reset_gpio(struct gpio_bank *bank, int gpio)
        _set_gpio_irqenable(bank, gpio, 0);
        _clear_gpio_irqstatus(bank, gpio);
        _set_gpio_triggering(bank, GPIO_INDEX(bank, gpio), IRQ_TYPE_NONE);
+        _clear_gpio_debounce(bank, gpio);
 }
 /* Use disable_irq_wake() and enable_irq_wake() functions from drivers */
diff --git a/drivers/gpio/gpio-timberdale.c b/drivers/gpio/gpio-timberdale.c
index 031c6adf5b65..1a3e2b9b4772 100644
--- a/drivers/gpio/gpio-timberdale.c
+++ b/drivers/gpio/gpio-timberdale.c
@@ -116,7 +116,7 @@ static void timbgpio_irq_disable(struct irq_data *d)
        unsigned long flags;
        spin_lock_irqsave(&tgpio->lock, flags);
-        tgpio->last_ier &= ~(1 << offset);
+        tgpio->last_ier &= ~(1UL << offset);
        iowrite32(tgpio->last_ier, tgpio->membase + TGPIO_IER);
        spin_unlock_irqrestore(&tgpio->lock, flags);
 }
@@ -128,7 +128,7 @@ static void timbgpio_irq_enable(struct irq_data *d)
        unsigned long flags;
        spin_lock_irqsave(&tgpio->lock, flags);
-        tgpio->last_ier |= 1 << offset;
+        tgpio->last_ier |= 1UL << offset;
        iowrite32(tgpio->last_ier, tgpio->membase + TGPIO_IER);
        spin_unlock_irqrestore(&tgpio->lock, flags);
 }
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 5d6c71edc739..1c8d9e3380e1 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -623,9 +623,11 @@ static ssize_t export_store(struct class *class,
         */
        status = gpio_request(gpio, "sysfs");
-        if (status < 0)
+        if (status < 0) {
+                if (status == -EPROBE_DEFER)
+                        status = -ENODEV;
                goto done;
+        }
        status = gpio_export(gpio, true);
        if (status < 0)
                gpio_free(gpio);
@@ -1191,8 +1193,10 @@ int gpio_request(unsigned gpio, const char *label)
        spin_lock_irqsave(&gpio_lock, flags);
-        if (!gpio_is_valid(gpio))
+        if (!gpio_is_valid(gpio)) {
+                status = -EINVAL;
                goto done;
+        }
        desc = &gpio_desc[gpio];
        chip = desc->chip;
        if (chip == NULL)
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 7ef1b673e1be..133b4132983e 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -121,6 +121,8 @@ int drm_open(struct inode *inode, struct file *filp)
        int minor_id = iminor(inode);
        struct drm_minor *minor;
        int retcode = 0;
+        int need_setup = 0;
+        struct address_space *old_mapping;
        minor = idr_find(&drm_minors_idr, minor_id);
        if (!minor)
@@ -132,23 +134,37 @@ int drm_open(struct inode *inode, struct file *filp)
        if (drm_device_is_unplugged(dev))
                return -ENODEV;
+        if (!dev->open_count++)
+                need_setup = 1;
+        mutex_lock(&dev->struct_mutex);
+        old_mapping = dev->dev_mapping;
+        if (old_mapping == NULL)
+                dev->dev_mapping = &inode->i_data;
+        /* ihold ensures nobody can remove inode with our i_data */
+        ihold(container_of(dev->dev_mapping, struct inode, i_data));
+        inode->i_mapping = dev->dev_mapping;
+        filp->f_mapping = dev->dev_mapping;
+        mutex_unlock(&dev->struct_mutex);
        retcode = drm_open_helper(inode, filp, dev);
-        if (!retcode) {
+        if (retcode)
-                atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
+                goto err_undo;
-                if (!dev->open_count++)
+        atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
-                        retcode = drm_setup(dev);
+        if (need_setup) {
-        }
+                retcode = drm_setup(dev);
-        if (!retcode) {
+                if (retcode)
-                mutex_lock(&dev->struct_mutex);
+                        goto err_undo;
-                if (dev->dev_mapping == NULL)
-                        dev->dev_mapping = &inode->i_data;
-                /* ihold ensures nobody can remove inode with our i_data */
-                ihold(container_of(dev->dev_mapping, struct inode, i_data));
-                inode->i_mapping = dev->dev_mapping;
-                filp->f_mapping = dev->dev_mapping;
-                mutex_unlock(&dev->struct_mutex);
        }
+        return 0;
+err_undo:
+        mutex_lock(&dev->struct_mutex);
+        filp->f_mapping = old_mapping;
+        inode->i_mapping = old_mapping;
+        iput(container_of(dev->dev_mapping, struct inode, i_data));
+        dev->dev_mapping = old_mapping;
+        mutex_unlock(&dev->struct_mutex);
+        dev->open_count--;
        return retcode;
 }
 EXPORT_SYMBOL(drm_open);
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 59a26e577b57..fc345d4ebb03 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -1,6 +1,6 @@
 config DRM_EXYNOS
        tristate "DRM Support for Samsung SoC EXYNOS Series"
-        depends on DRM && PLAT_SAMSUNG
+        depends on DRM && (PLAT_SAMSUNG || ARCH_MULTIPLATFORM)
        select DRM_KMS_HELPER
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index 18c271862ca8..0f68a2872673 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -374,6 +374,7 @@ struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
        exynos_connector->encoder_id = encoder->base.id;
        exynos_connector->manager = manager;
        exynos_connector->dpms = DRM_MODE_DPMS_OFF;
+        connector->dpms = DRM_MODE_DPMS_OFF;
        connector->encoder = encoder;
        err = drm_mode_connector_attach_encoder(connector, encoder);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.c b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
index e51503fbaf2b..241ad1eeec64 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
@@ -43,12 +43,14 @@
 * @manager: specific encoder has its own manager to control a hardware
 *      appropriately and we can access a hardware drawing on this manager.
 * @dpms: store the encoder dpms value.
+ * @updated: indicate whether overlay data updating is needed or not.
 */
 struct exynos_drm_encoder {
        struct drm_crtc                 *old_crtc;
        struct drm_encoder              drm_encoder;
        struct exynos_drm_manager       *manager;
-        int dpms;
+        int                             dpms;
+        bool                            updated;
 };
 static void exynos_drm_connector_power(struct drm_encoder *encoder, int mode)
@@ -85,7 +87,9 @@ static void exynos_drm_encoder_dpms(struct drm_encoder *encoder, int mode)
        switch (mode) {
        case DRM_MODE_DPMS_ON:
                if (manager_ops && manager_ops->apply)
-                        manager_ops->apply(manager->dev);
+                        if (!exynos_encoder->updated)
+                                manager_ops->apply(manager->dev);
                exynos_drm_connector_power(encoder, mode);
                exynos_encoder->dpms = mode;
                break;
@@ -94,6 +98,7 @@ static void exynos_drm_encoder_dpms(struct drm_encoder *encoder, int mode)
        case DRM_MODE_DPMS_OFF:
                exynos_drm_connector_power(encoder, mode);
                exynos_encoder->dpms = mode;
+                exynos_encoder->updated = false;
                break;
        default:
                DRM_ERROR("unspecified mode %d\n", mode);
@@ -205,13 +210,22 @@ static void exynos_drm_encoder_prepare(struct drm_encoder *encoder)
 static void exynos_drm_encoder_commit(struct drm_encoder *encoder)
 {
-        struct exynos_drm_manager *manager = exynos_drm_get_manager(encoder);
+        struct exynos_drm_encoder *exynos_encoder = to_exynos_encoder(encoder);
+        struct exynos_drm_manager *manager = exynos_encoder->manager;
        struct exynos_drm_manager_ops *manager_ops = manager->ops;
        DRM_DEBUG_KMS("%s\n", __FILE__);
        if (manager_ops && manager_ops->commit)
                manager_ops->commit(manager->dev);
+        /*
+         * this will avoid one issue that overlay data is updated to
+         * real hardware two times.
+         * And this variable will be used to check if the data was
+         * already updated or not by exynos_drm_encoder_dpms function.
+         */
+        exynos_encoder->updated = true;
 }
 static void exynos_drm_encoder_disable(struct drm_encoder *encoder)
@@ -401,19 +415,6 @@ void exynos_drm_encoder_crtc_dpms(struct drm_encoder *encoder, void *data)
                manager_ops->dpms(manager->dev, mode);
        /*
-         * set current mode to new one so that data aren't updated into
-         * registers by drm_helper_connector_dpms two times.
-         *
-         * in case that drm_crtc_helper_set_mode() is called,
-         * overlay_ops->commit() and manager_ops->commit() callbacks
-         * can be called two times, first at drm_crtc_helper_set_mode()
-         * and second at drm_helper_connector_dpms().
-         * so with this setting, when drm_helper_connector_dpms() is called
-         * encoder->funcs->dpms() will be ignored.
-         */
-        exynos_encoder->dpms = mode;
-        /*
         * if this condition is ok then it means that the crtc is already
         * detached from encoder and last function for detaching is properly
         * done, so clear pipe from manager to prevent repeated call.
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 614b2e9ac462..e7fbb823fd8e 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -1142,7 +1142,7 @@ static int __devinit mixer_probe(struct platform_device *pdev)
                const struct of_device_id *match;
                match = of_match_node(of_match_ptr(mixer_match_types),
                                                          pdev->dev.of_node);
-                drv = match->data;
+                drv = (struct mixer_drv_data *)match->data;
        } else {
                drv = (struct mixer_drv_data *)
                        platform_get_device_id(pdev)->driver_data;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index c9bfd83dde64..61ae104dca8c 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1505,7 +1505,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                goto put_gmch;
        }
-        i915_kick_out_firmware_fb(dev_priv);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                i915_kick_out_firmware_fb(dev_priv);
        pci_set_master(dev->pdev);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index f78061af7045..b726b478a4f5 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -729,7 +729,7 @@ void intel_crt_init(struct drm_device *dev)
        crt->base.type = INTEL_OUTPUT_ANALOG;
        crt->base.cloneable = true;
-        if (IS_HASWELL(dev))
+        if (IS_HASWELL(dev) || IS_I830(dev))
                crt->base.crtc_mask = (1 << 0);
        else
                crt->base.crtc_mask = (1 << 0) | (1 << 1) | (1 << 2);
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index 495625914e4a..d7bc817f51a0 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -341,9 +341,17 @@ static int intel_overlay_off(struct intel_overlay *overlay)
        intel_ring_emit(ring, flip_addr);
        intel_ring_emit(ring, MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
        /* turn overlay off */
-        intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_OFF);
+        if (IS_I830(dev)) {
-        intel_ring_emit(ring, flip_addr);
+                /* Workaround: Don't disable the overlay fully, since otherwise
-        intel_ring_emit(ring, MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
+                 * it dies on the next OVERLAY_ON cmd. */
+                intel_ring_emit(ring, MI_NOOP);
+                intel_ring_emit(ring, MI_NOOP);
+                intel_ring_emit(ring, MI_NOOP);
+        } else {
+                intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_OFF);
+                intel_ring_emit(ring, flip_addr);
+                intel_ring_emit(ring, MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
+        }
        intel_ring_advance(ring);
        return intel_overlay_do_wait_request(overlay, intel_overlay_off_tail);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index e019b2369861..e2aacd329545 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -435,7 +435,7 @@ int intel_panel_setup_backlight(struct drm_device *dev)
        props.type = BACKLIGHT_RAW;
        props.max_brightness = _intel_panel_get_max_backlight(dev);
        if (props.max_brightness == 0) {
-                DRM_ERROR("Failed to get maximum backlight value\n");
+                DRM_DEBUG_DRIVER("Failed to get maximum backlight value\n");
                return -ENODEV;
        }
        dev_priv->backlight =
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index c01d97db0061..79d308da29ff 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -894,6 +894,45 @@ static void intel_sdvo_dump_hdmi_buf(struct intel_sdvo *intel_sdvo)
 }
 #endif
+static bool intel_sdvo_write_infoframe(struct intel_sdvo *intel_sdvo,
+                                       unsigned if_index, uint8_t tx_rate,
+                                       uint8_t *data, unsigned length)
+{
+        uint8_t set_buf_index[2] = { if_index, 0 };
+        uint8_t hbuf_size, tmp[8];
+        int i;
+        if (!intel_sdvo_set_value(intel_sdvo,
+                                  SDVO_CMD_SET_HBUF_INDEX,
+                                  set_buf_index, 2))
+                return false;
+        if (!intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HBUF_INFO,
+                                  &hbuf_size, 1))
+                return false;
+        /* Buffer size is 0 based, hooray! */
+        hbuf_size++;
+        DRM_DEBUG_KMS("writing sdvo hbuf: %i, hbuf_size %i, hbuf_size: %i\n",
+                      if_index, length, hbuf_size);
+        for (i = 0; i < hbuf_size; i += 8) {
+                memset(tmp, 0, 8);
+                if (i < length)
+                        memcpy(tmp, data + i, min_t(unsigned, 8, length - i));
+                if (!intel_sdvo_set_value(intel_sdvo,
+                                          SDVO_CMD_SET_HBUF_DATA,
+                                          tmp, 8))
+                        return false;
+        }
+        return intel_sdvo_set_value(intel_sdvo,
+                                    SDVO_CMD_SET_HBUF_TXRATE,
+                                    &tx_rate, 1);
+}
 static bool intel_sdvo_set_avi_infoframe(struct intel_sdvo *intel_sdvo)
 {
        struct dip_infoframe avi_if = {
@@ -901,11 +940,7 @@ static bool intel_sdvo_set_avi_infoframe(struct intel_sdvo *intel_sdvo)
                .ver = DIP_VERSION_AVI,
                .len = DIP_LEN_AVI,
        };
-        uint8_t tx_rate = SDVO_HBUF_TX_VSYNC;
-        uint8_t set_buf_index[2] = { 1, 0 };
        uint8_t sdvo_data[4 + sizeof(avi_if.body.avi)];
-        uint64_t *data = (uint64_t *)sdvo_data;
-        unsigned i;
        intel_dip_infoframe_csum(&avi_if);
@@ -915,22 +950,9 @@ static bool intel_sdvo_set_avi_infoframe(struct intel_sdvo *intel_sdvo)
        sdvo_data[3] = avi_if.checksum;
        memcpy(&sdvo_data[4], &avi_if.body, sizeof(avi_if.body.avi));
-        if (!intel_sdvo_set_value(intel_sdvo,
+        return intel_sdvo_write_infoframe(intel_sdvo, SDVO_HBUF_INDEX_AVI_IF,
-                                  SDVO_CMD_SET_HBUF_INDEX,
+                                          SDVO_HBUF_TX_VSYNC,
-                                  set_buf_index, 2))
+                                          sdvo_data, sizeof(sdvo_data));
-                return false;
-        for (i = 0; i < sizeof(sdvo_data); i += 8) {
-                if (!intel_sdvo_set_value(intel_sdvo,
-                                          SDVO_CMD_SET_HBUF_DATA,
-                                          data, 8))
-                        return false;
-                data++;
-        }
-        return intel_sdvo_set_value(intel_sdvo,
-                                    SDVO_CMD_SET_HBUF_TXRATE,
-                                    &tx_rate, 1);
 }
 static bool intel_sdvo_set_tv_format(struct intel_sdvo *intel_sdvo)
diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h
index 9d030142ee43..770bdd6ecd9f 100644
--- a/drivers/gpu/drm/i915/intel_sdvo_regs.h
+++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h
@@ -708,6 +708,8 @@ struct intel_sdvo_enhancements_arg {
 #define SDVO_CMD_SET_AUDIO_STAT         0x91
 #define SDVO_CMD_GET_AUDIO_STAT         0x92
 #define SDVO_CMD_SET_HBUF_INDEX         0x93
+  #define SDVO_HBUF_INDEX_ELD           0
+  #define SDVO_HBUF_INDEX_AVI_IF        1
 #define SDVO_CMD_GET_HBUF_INDEX         0x94
 #define SDVO_CMD_GET_HBUF_INFO          0x95
 #define SDVO_CMD_SET_HBUF_AV_SPLIT      0x96
diff --git a/drivers/gpu/drm/nouveau/core/core/mm.c b/drivers/gpu/drm/nouveau/core/core/mm.c
index 4d6206448670..a6d3cd6490f7 100644
--- a/drivers/gpu/drm/nouveau/core/core/mm.c
+++ b/drivers/gpu/drm/nouveau/core/core/mm.c
@@ -218,13 +218,16 @@ nouveau_mm_init(struct nouveau_mm *mm, u32 offset, u32 length, u32 block)
        node = kzalloc(sizeof(*node), GFP_KERNEL);
        if (!node)
                return -ENOMEM;
-        node->offset = roundup(offset, mm->block_size);
-        node->length = rounddown(offset + length, mm->block_size) - node->offset;
+        if (length) {
+                node->offset  = roundup(offset, mm->block_size);
+                node->length  = rounddown(offset + length, mm->block_size);
+                node->length -= node->offset;
+        }
        list_add_tail(&node->nl_entry, &mm->nodes);
        list_add_tail(&node->fl_entry, &mm->free);
        mm->heap_nodes++;
-        mm->heap_size += length;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 16a9afb1060b..05a909a17cee 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -22,6 +22,8 @@
 * Authors: Ben Skeggs
 */
+#include <subdev/bar.h>
 #include <engine/software.h>
 #include <engine/disp.h>
@@ -37,6 +39,7 @@ nv50_disp_sclass[] = {
 static void
 nv50_disp_intr_vblank(struct nv50_disp_priv *priv, int crtc)
 {
+        struct nouveau_bar *bar = nouveau_bar(priv);
        struct nouveau_disp *disp = &priv->base;
        struct nouveau_software_chan *chan, *temp;
        unsigned long flags;
@@ -46,18 +49,19 @@ nv50_disp_intr_vblank(struct nv50_disp_priv *priv, int crtc)
                if (chan->vblank.crtc != crtc)
                        continue;
-                nv_wr32(priv, 0x001704, chan->vblank.channel);
-                nv_wr32(priv, 0x001710, 0x80000000 | chan->vblank.ctxdma);
                if (nv_device(priv)->chipset == 0x50) {
+                        nv_wr32(priv, 0x001704, chan->vblank.channel);
+                        nv_wr32(priv, 0x001710, 0x80000000 | chan->vblank.ctxdma);
+                        bar->flush(bar);
                        nv_wr32(priv, 0x001570, chan->vblank.offset);
                        nv_wr32(priv, 0x001574, chan->vblank.value);
                } else {
-                        if (nv_device(priv)->chipset >= 0xc0) {
+                        nv_wr32(priv, 0x001718, 0x80000000 | chan->vblank.channel);
-                                nv_wr32(priv, 0x06000c,
+                        bar->flush(bar);
-                                        upper_32_bits(chan->vblank.offset));
+                        nv_wr32(priv, 0x06000c,
-                        }
+                                upper_32_bits(chan->vblank.offset));
-                        nv_wr32(priv, 0x060010, chan->vblank.offset);
+                        nv_wr32(priv, 0x060010,
+                                lower_32_bits(chan->vblank.offset));
                        nv_wr32(priv, 0x060014, chan->vblank.value);
                }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
index 8d0021049ec0..425001204a89 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
@@ -156,8 +156,8 @@ nv40_graph_context_ctor(struct nouveau_object *parent,
 static int
 nv40_graph_context_fini(struct nouveau_object *object, bool suspend)
 {
-        struct nv04_graph_priv *priv = (void *)object->engine;
+        struct nv40_graph_priv *priv = (void *)object->engine;
-        struct nv04_graph_chan *chan = (void *)object;
+        struct nv40_graph_chan *chan = (void *)object;
        u32 inst = 0x01000000 | nv_gpuobj(chan)->addr >> 4;
        int ret = 0;
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
index 12418574efea..f7c581ad1991 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
@@ -38,7 +38,7 @@ struct nv40_mpeg_priv {
 };
 struct nv40_mpeg_chan {
-        struct nouveau_mpeg base;
+        struct nouveau_mpeg_chan base;
 };
 /*******************************************************************************
diff --git a/drivers/gpu/drm/nouveau/core/include/core/mm.h b/drivers/gpu/drm/nouveau/core/include/core/mm.h
index 9ee9bf4028ca..975137ba34a6 100644
--- a/drivers/gpu/drm/nouveau/core/include/core/mm.h
+++ b/drivers/gpu/drm/nouveau/core/include/core/mm.h
@@ -19,7 +19,6 @@ struct nouveau_mm {
        u32 block_size;
        int heap_nodes;
-        u32 heap_size;
 };
 int  nouveau_mm_init(struct nouveau_mm *, u32 offset, u32 length, u32 block);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index 27fb1af7a779..5f570806143a 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -219,13 +219,11 @@ nv50_fb_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                             ((priv->base.ram.size & 0x000000ff) << 32);
        tags = nv_rd32(priv, 0x100320);
-        if (tags) {
+        ret = nouveau_mm_init(&priv->base.tags, 0, tags, 1);
-                ret = nouveau_mm_init(&priv->base.tags, 0, tags, 1);
+        if (ret)
-                if (ret)
+                return ret;
-                        return ret;
-                nv_debug(priv, "%d compression tags\n", tags);
+        nv_debug(priv, "%d compression tags\n", tags);
-        }
        size = (priv->base.ram.size >> 12) - rsvd_head - rsvd_tail;
        switch (device->chipset) {
diff --git a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
index 3d2c88310f98..dbfc2abf0cfe 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
@@ -292,7 +292,7 @@ nouveau_i2c_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                case DCB_I2C_NVIO_BIT:
                        port->drive = info.drive & 0x0f;
                        if (device->card_type < NV_D0) {
-                                if (info.drive >= ARRAY_SIZE(nv50_i2c_port))
+                                if (port->drive >= ARRAY_SIZE(nv50_i2c_port))
                                        break;
                                port->drive = nv50_i2c_port[port->drive];
                                port->sense = port->drive;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
index 49050d991e75..9474cfca6e4c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
@@ -67,7 +67,7 @@ nv41_vm_unmap(struct nouveau_gpuobj *pgt, u32 pte, u32 cnt)
 static void
 nv41_vm_flush(struct nouveau_vm *vm)
 {
-        struct nv04_vm_priv *priv = (void *)vm->vmm;
+        struct nv04_vmmgr_priv *priv = (void *)vm->vmm;
        mutex_lock(&nv_subdev(priv)->mutex);
        nv_wr32(priv, 0x100810, 0x00000022);
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 9a6e2cb282dc..d3595b23434a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -355,7 +355,7 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)
         * valid - it's not (rh#613284)
         */
        if (nv_encoder->dcb->lvdsconf.use_acpi_for_edid) {
-                if (!(nv_connector->edid = nouveau_acpi_edid(dev, connector))) {
+                if ((nv_connector->edid = nouveau_acpi_edid(dev, connector))) {
                        status = connector_status_connected;
                        goto out;
                }
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index d2f8ffeed742..86124b131f4f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -290,6 +290,7 @@ nouveau_display_create(struct drm_device *dev)
        struct nouveau_drm *drm = nouveau_drm(dev);
        struct nouveau_disp *pdisp = nouveau_disp(drm->device);
        struct nouveau_display *disp;
+        u32 pclass = dev->pdev->class >> 8;
        int ret, gen;
        disp = drm->display = kzalloc(sizeof(*disp), GFP_KERNEL);
@@ -360,23 +361,27 @@ nouveau_display_create(struct drm_device *dev)
        drm_kms_helper_poll_init(dev);
        drm_kms_helper_poll_disable(dev);
-        if (nv_device(drm->device)->card_type < NV_50)
+        if (nouveau_modeset == 1 ||
-                ret = nv04_display_create(dev);
+            (nouveau_modeset < 0 && pclass == PCI_CLASS_DISPLAY_VGA)) {
-        else
+                if (nv_device(drm->device)->card_type < NV_50)
-        if (nv_device(drm->device)->card_type < NV_D0)
+                        ret = nv04_display_create(dev);
-                ret = nv50_display_create(dev);
+                else
-        else
+                if (nv_device(drm->device)->card_type < NV_D0)
-                ret = nvd0_display_create(dev);
+                        ret = nv50_display_create(dev);
-        if (ret)
+                else
-                goto disp_create_err;
+                        ret = nvd0_display_create(dev);
-        if (dev->mode_config.num_crtc) {
-                ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
                if (ret)
-                        goto vblank_err;
+                        goto disp_create_err;
+                if (dev->mode_config.num_crtc) {
+                        ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
+                        if (ret)
+                                goto vblank_err;
+                }
+                nouveau_backlight_init(dev);
        }
-        nouveau_backlight_init(dev);
        return 0;
 vblank_err:
@@ -395,7 +400,8 @@ nouveau_display_destroy(struct drm_device *dev)
        nouveau_backlight_exit(dev);
        drm_vblank_cleanup(dev);
-        disp->dtor(dev);
+        if (disp->dtor)
+                disp->dtor(dev);
        drm_kms_helper_poll_fini(dev);
        drm_mode_config_cleanup(dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index ccae8c26ae2b..0910125cbbc3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -63,8 +63,9 @@ MODULE_PARM_DESC(noaccel, "disable kernel/abi16 acceleration");
 static int nouveau_noaccel = 0;
 module_param_named(noaccel, nouveau_noaccel, int, 0400);
-MODULE_PARM_DESC(modeset, "enable driver");
+MODULE_PARM_DESC(modeset, "enable driver (default: auto, "
-static int nouveau_modeset = -1;
+                          "0 = disabled, 1 = enabled, 2 = headless)");
+int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 static struct drm_driver driver;
@@ -363,7 +364,8 @@ nouveau_drm_unload(struct drm_device *dev)
        nouveau_pm_fini(dev);
-        nouveau_display_fini(dev);
+        if (dev->mode_config.num_crtc)
+                nouveau_display_fini(dev);
        nouveau_display_destroy(dev);
        nouveau_irq_fini(dev);
@@ -403,13 +405,15 @@ nouveau_drm_suspend(struct pci_dev *pdev, pm_message_t pm_state)
            pm_state.event == PM_EVENT_PRETHAW)
                return 0;
-        NV_INFO(drm, "suspending fbcon...\n");
+        if (dev->mode_config.num_crtc) {
-        nouveau_fbcon_set_suspend(dev, 1);
+                NV_INFO(drm, "suspending fbcon...\n");
+                nouveau_fbcon_set_suspend(dev, 1);
-        NV_INFO(drm, "suspending display...\n");
+                NV_INFO(drm, "suspending display...\n");
-        ret = nouveau_display_suspend(dev);
+                ret = nouveau_display_suspend(dev);
-        if (ret)
+                if (ret)
-                return ret;
+                        return ret;
+        }
        NV_INFO(drm, "evicting buffers...\n");
        ttm_bo_evict_mm(&drm->ttm.bdev, TTM_PL_VRAM);
@@ -445,8 +449,10 @@ fail_client:
                nouveau_client_init(&cli->base);
        }
-        NV_INFO(drm, "resuming display...\n");
+        if (dev->mode_config.num_crtc) {
-        nouveau_display_resume(dev);
+                NV_INFO(drm, "resuming display...\n");
+                nouveau_display_resume(dev);
+        }
        return ret;
 }
@@ -486,8 +492,10 @@ nouveau_drm_resume(struct pci_dev *pdev)
        nouveau_irq_postinstall(dev);
        nouveau_pm_resume(dev);
-        NV_INFO(drm, "resuming display...\n");
+        if (dev->mode_config.num_crtc) {
-        nouveau_display_resume(dev);
+                NV_INFO(drm, "resuming display...\n");
+                nouveau_display_resume(dev);
+        }
        return 0;
 }
@@ -662,9 +670,7 @@ nouveau_drm_init(void)
 #ifdef CONFIG_VGA_CONSOLE
                if (vgacon_text_force())
                        nouveau_modeset = 0;
-                else
 #endif
-                        nouveau_modeset = 1;
        }
        if (!nouveau_modeset)
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h
index 819471217546..a10169927086 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.h
@@ -141,4 +141,6 @@ int nouveau_drm_resume(struct pci_dev *);
                nv_info((cli), fmt, ##args);                                   \
 } while (0)
+extern int nouveau_modeset;
 #endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_irq.c b/drivers/gpu/drm/nouveau/nouveau_irq.c
index 9ca8afdb5549..1d8cb506a28a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_irq.c
+++ b/drivers/gpu/drm/nouveau/nouveau_irq.c
@@ -61,13 +61,15 @@ nouveau_irq_handler(DRM_IRQ_ARGS)
        nv_subdev(pmc)->intr(nv_subdev(pmc));
-        if (device->card_type >= NV_D0) {
+        if (dev->mode_config.num_crtc) {
-                if (nv_rd32(device, 0x000100) & 0x04000000)
+                if (device->card_type >= NV_D0) {
-                        nvd0_display_intr(dev);
+                        if (nv_rd32(device, 0x000100) & 0x04000000)
-        } else
+                                nvd0_display_intr(dev);
-        if (device->card_type >= NV_50) {
+                } else
-                if (nv_rd32(device, 0x000100) & 0x04000000)
+                if (device->card_type >= NV_50) {
-                        nv50_display_intr(dev);
+                        if (nv_rd32(device, 0x000100) & 0x04000000)
+                                nv50_display_intr(dev);
+                }
        }
        return IRQ_HANDLED;
diff --git a/drivers/gpu/drm/nouveau/nv04_dac.c b/drivers/gpu/drm/nouveau/nv04_dac.c
index 347a3bd78d04..64f7020fb605 100644
--- a/drivers/gpu/drm/nouveau/nv04_dac.c
+++ b/drivers/gpu/drm/nouveau/nv04_dac.c
@@ -220,7 +220,7 @@ out:
        NVWriteVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX, saved_cr_mode);
        if (blue == 0x18) {
-                NV_INFO(drm, "Load detected on head A\n");
+                NV_DEBUG(drm, "Load detected on head A\n");
                return connector_status_connected;
        }
@@ -338,8 +338,8 @@ nv17_dac_detect(struct drm_encoder *encoder, struct drm_connector *connector)
        if (nv17_dac_sample_load(encoder) &
            NV_PRAMDAC_TEST_CONTROL_SENSEB_ALLHI) {
-                NV_INFO(drm, "Load detected on output %c\n",
+                NV_DEBUG(drm, "Load detected on output %c\n",
-                        '@' + ffs(dcb->or));
+                         '@' + ffs(dcb->or));
                return connector_status_connected;
        } else {
                return connector_status_disconnected;
@@ -413,9 +413,9 @@ static void nv04_dac_commit(struct drm_encoder *encoder)
        helper->dpms(encoder, DRM_MODE_DPMS_ON);
-        NV_INFO(drm, "Output %s is running on CRTC %d using output %c\n",
+        NV_DEBUG(drm, "Output %s is running on CRTC %d using output %c\n",
-                drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base),
+                 drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base),
-                nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
+                 nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
 }
 void nv04_dac_update_dacclk(struct drm_encoder *encoder, bool enable)
@@ -461,8 +461,8 @@ static void nv04_dac_dpms(struct drm_encoder *encoder, int mode)
                return;
        nv_encoder->last_dpms = mode;
-        NV_INFO(drm, "Setting dpms mode %d on vga encoder (output %d)\n",
+        NV_DEBUG(drm, "Setting dpms mode %d on vga encoder (output %d)\n",
-                     mode, nv_encoder->dcb->index);
+                 mode, nv_encoder->dcb->index);
        nv04_dac_update_dacclk(encoder, mode == DRM_MODE_DPMS_ON);
 }
diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
index da55d7642c8c..184cdf806761 100644
--- a/drivers/gpu/drm/nouveau/nv04_dfp.c
+++ b/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -476,9 +476,9 @@ static void nv04_dfp_commit(struct drm_encoder *encoder)
        helper->dpms(encoder, DRM_MODE_DPMS_ON);
-        NV_INFO(drm, "Output %s is running on CRTC %d using output %c\n",
+        NV_DEBUG(drm, "Output %s is running on CRTC %d using output %c\n",
-                drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base),
+                 drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base),
-                nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
+                 nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
 }
 static void nv04_dfp_update_backlight(struct drm_encoder *encoder, int mode)
@@ -520,8 +520,8 @@ static void nv04_lvds_dpms(struct drm_encoder *encoder, int mode)
                return;
        nv_encoder->last_dpms = mode;
-        NV_INFO(drm, "Setting dpms mode %d on lvds encoder (output %d)\n",
+        NV_DEBUG(drm, "Setting dpms mode %d on lvds encoder (output %d)\n",
-                     mode, nv_encoder->dcb->index);
+                 mode, nv_encoder->dcb->index);
        if (was_powersaving && is_powersaving_dpms(mode))
                return;
@@ -565,8 +565,8 @@ static void nv04_tmds_dpms(struct drm_encoder *encoder, int mode)
                return;
        nv_encoder->last_dpms = mode;
-        NV_INFO(drm, "Setting dpms mode %d on tmds encoder (output %d)\n",
+        NV_DEBUG(drm, "Setting dpms mode %d on tmds encoder (output %d)\n",
-                     mode, nv_encoder->dcb->index);
+                 mode, nv_encoder->dcb->index);
        nv04_dfp_update_backlight(encoder, mode);
        nv04_dfp_update_fp_control(encoder, mode);
diff --git a/drivers/gpu/drm/nouveau/nv04_tv.c b/drivers/gpu/drm/nouveau/nv04_tv.c
index 099fbeda6e2e..62e826a139b3 100644
--- a/drivers/gpu/drm/nouveau/nv04_tv.c
+++ b/drivers/gpu/drm/nouveau/nv04_tv.c
@@ -75,8 +75,8 @@ static void nv04_tv_dpms(struct drm_encoder *encoder, int mode)
        struct nv04_mode_state *state = &nv04_display(dev)->mode_reg;
        uint8_t crtc1A;
-        NV_INFO(drm, "Setting dpms mode %d on TV encoder (output %d)\n",
+        NV_DEBUG(drm, "Setting dpms mode %d on TV encoder (output %d)\n",
-                mode, nv_encoder->dcb->index);
+                 mode, nv_encoder->dcb->index);
        state->pllsel &= ~(PLLSEL_TV_CRTC1_MASK | PLLSEL_TV_CRTC2_MASK);
@@ -167,9 +167,8 @@ static void nv04_tv_commit(struct drm_encoder *encoder)
        helper->dpms(encoder, DRM_MODE_DPMS_ON);
-        NV_INFO(drm, "Output %s is running on CRTC %d using output %c\n",
+        NV_DEBUG(drm, "Output %s is running on CRTC %d using output %c\n",
-                      drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base), nv_crtc->index,
+                 drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base), nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
-                      '@' + ffs(nv_encoder->dcb->or));
 }
 static void nv04_tv_destroy(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 2e566e123e9e..3bce0299f64a 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1696,35 +1696,43 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                        return ATOM_PPLL2;
                DRM_ERROR("unable to allocate a PPLL\n");
                return ATOM_PPLL_INVALID;
-        } else {
+        } else if (ASIC_IS_AVIVO(rdev)) {
-                if (ASIC_IS_AVIVO(rdev)) {
+                /* in DP mode, the DP ref clock can come from either PPLL
-                        /* in DP mode, the DP ref clock can come from either PPLL
+                 * depending on the asic:
-                         * depending on the asic:
+                 * DCE3: PPLL1 or PPLL2
-                         * DCE3: PPLL1 or PPLL2
+                 */
-                         */
+                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) {
-                        if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) {
+                        /* use the same PPLL for all DP monitors */
-                                /* use the same PPLL for all DP monitors */
+                        pll = radeon_get_shared_dp_ppll(crtc);
-                                pll = radeon_get_shared_dp_ppll(crtc);
+                        if (pll != ATOM_PPLL_INVALID)
-                                if (pll != ATOM_PPLL_INVALID)
+                                return pll;
-                                        return pll;
+                } else {
-                        } else {
+                        /* use the same PPLL for all monitors with the same clock */
-                                /* use the same PPLL for all monitors with the same clock */
+                        pll = radeon_get_shared_nondp_ppll(crtc);
-                                pll = radeon_get_shared_nondp_ppll(crtc);
+                        if (pll != ATOM_PPLL_INVALID)
-                                if (pll != ATOM_PPLL_INVALID)
+                                return pll;
-                                        return pll;
+                }
-                        }
+                /* all other cases */
-                        /* all other cases */
+                pll_in_use = radeon_get_pll_use_mask(crtc);
-                        pll_in_use = radeon_get_pll_use_mask(crtc);
+                /* the order shouldn't matter here, but we probably
+                 * need this until we have atomic modeset
+                 */
+                if (rdev->flags & RADEON_IS_IGP) {
                        if (!(pll_in_use & (1 << ATOM_PPLL1)))
                                return ATOM_PPLL1;
                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                return ATOM_PPLL2;
-                        DRM_ERROR("unable to allocate a PPLL\n");
-                        return ATOM_PPLL_INVALID;
                } else {
-                        /* on pre-R5xx asics, the crtc to pll mapping is hardcoded */
+                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                        return radeon_crtc->crtc_id;
+                                return ATOM_PPLL2;
+                        if (!(pll_in_use & (1 << ATOM_PPLL1)))
+                                return ATOM_PPLL1;
                }
+                DRM_ERROR("unable to allocate a PPLL\n");
+                return ATOM_PPLL_INVALID;
+        } else {
+                /* on pre-R5xx asics, the crtc to pll mapping is hardcoded */
+                return radeon_crtc->crtc_id;
        }
 }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 14313ad43b76..af31f829f4a8 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1372,7 +1372,7 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
        WREG32(BIF_FB_EN, FB_READ_EN | FB_WRITE_EN);
        for (i = 0; i < rdev->num_crtc; i++) {
-                if (save->crtc_enabled) {
+                if (save->crtc_enabled[i]) {
                        if (ASIC_IS_DCE6(rdev)) {
                                tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i]);
                                tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 30271b641913..c042e497e450 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -264,7 +264,7 @@ static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
        /* macro tile width & height */
        palign = (8 * surf->bankw * track->npipes) * surf->mtilea;
        halign = (8 * surf->bankh * surf->nbanks) / surf->mtilea;
-        mtileb = (palign / 8) * (halign / 8) * tileb;;
+        mtileb = (palign / 8) * (halign / 8) * tileb;
        mtile_pr = surf->nbx / palign;
        mtile_ps = (mtile_pr * surf->nby) / halign;
        surf->layer_size = mtile_ps * mtileb * slice_pt;
@@ -2725,6 +2725,9 @@ static bool evergreen_vm_reg_valid(u32 reg)
        /* check config regs */
        switch (reg) {
        case GRBM_GFX_INDEX:
+        case CP_STRMOUT_CNTL:
+        case CP_COHER_CNTL:
+        case CP_COHER_SIZE:
        case VGT_VTX_VECT_EJECT_REG:
        case VGT_CACHE_INVALIDATION:
        case VGT_GS_VERTEX_REUSE:
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index df542f1a5dfb..2bc0f6a1b428 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -91,6 +91,10 @@
 #define         FB_READ_EN                                      (1 << 0)
 #define         FB_WRITE_EN                                     (1 << 1)
+#define CP_STRMOUT_CNTL                                 0x84FC
+#define CP_COHER_CNTL                                   0x85F0
+#define CP_COHER_SIZE                                   0x85F4
 #define CP_COHER_BASE                                   0x85F8
 #define CP_STALLED_STAT1                        0x8674
 #define CP_STALLED_STAT2                        0x8678
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 37f6a907aea4..15f5ded65e0c 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -352,9 +352,9 @@ static int radeon_atpx_switchto(enum vga_switcheroo_client_id id)
 }
 /**
- * radeon_atpx_switchto - switch to the requested GPU
+ * radeon_atpx_power_state - power down/up the requested GPU
 *
- * @id: GPU to switch to
+ * @id: GPU to power down/up
 * @state: requested power state (0 = off, 1 = on)
 *
 * Execute the necessary ATPX function to power down/up the discrete GPU
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 67cfc1795ecd..b884c362a8c2 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -941,7 +941,7 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
        struct drm_mode_object *obj;
        int i;
        enum drm_connector_status ret = connector_status_disconnected;
-        bool dret = false;
+        bool dret = false, broken_edid = false;
        if (!force && radeon_check_hpd_status_unchanged(connector))
                return connector->status;
@@ -965,6 +965,9 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
                                ret = connector_status_disconnected;
                                DRM_ERROR("%s: detected RS690 floating bus bug, stopping ddc detect\n", drm_get_connector_name(connector));
                                radeon_connector->ddc_bus = NULL;
+                        } else {
+                                ret = connector_status_connected;
+                                broken_edid = true; /* defer use_digital to later */
                        }
                } else {
                        radeon_connector->use_digital = !!(radeon_connector->edid->input & DRM_EDID_INPUT_DIGITAL);
@@ -1047,13 +1050,24 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
                        encoder_funcs = encoder->helper_private;
                        if (encoder_funcs->detect) {
-                                if (ret != connector_status_connected) {
+                                if (!broken_edid) {
-                                        ret = encoder_funcs->detect(encoder, connector);
+                                        if (ret != connector_status_connected) {
-                                        if (ret == connector_status_connected) {
+                                                /* deal with analog monitors without DDC */
-                                                radeon_connector->use_digital = false;
+                                                ret = encoder_funcs->detect(encoder, connector);
+                                                if (ret == connector_status_connected) {
+                                                        radeon_connector->use_digital = false;
+                                                }
+                                                if (ret != connector_status_disconnected)
+                                                        radeon_connector->detected_by_load = true;
                                        }
-                                        if (ret != connector_status_disconnected)
+                                } else {
-                                                radeon_connector->detected_by_load = true;
+                                        enum drm_connector_status lret;
+                                        /* assume digital unless load detected otherwise */
+                                        radeon_connector->use_digital = true;
+                                        lret = encoder_funcs->detect(encoder, connector);
+                                        DRM_DEBUG_KMS("load_detect %x returned: %x\n",encoder->encoder_type,lret);
+                                        if (lret == connector_status_connected)
+                                                radeon_connector->use_digital = false;
                                }
                                break;
                        }
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index 5677a424b585..6857cb4efb76 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -295,6 +295,7 @@ static void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
        struct drm_device *dev = crtc->dev;
        struct radeon_device *rdev = dev->dev_private;
+        uint32_t crtc_ext_cntl = 0;
        uint32_t mask;
        if (radeon_crtc->crtc_id)
@@ -307,6 +308,16 @@ static void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                        RADEON_CRTC_VSYNC_DIS |
                        RADEON_CRTC_HSYNC_DIS);
+        /*
+         * On all dual CRTC GPUs this bit controls the CRTC of the primary DAC.
+         * Therefore it is set in the DAC DMPS function.
+         * This is different for GPU's with a single CRTC but a primary and a
+         * TV DAC: here it controls the single CRTC no matter where it is
+         * routed. Therefore we set it here.
+         */
+        if (rdev->flags & RADEON_SINGLE_CRTC)
+                crtc_ext_cntl = RADEON_CRTC_CRT_ON;
+        
        switch (mode) {
        case DRM_MODE_DPMS_ON:
                radeon_crtc->enabled = true;
@@ -317,7 +328,7 @@ static void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                else {
                        WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_EN, ~(RADEON_CRTC_EN |
                                                                         RADEON_CRTC_DISP_REQ_EN_B));
-                        WREG32_P(RADEON_CRTC_EXT_CNTL, 0, ~mask);
+                        WREG32_P(RADEON_CRTC_EXT_CNTL, crtc_ext_cntl, ~(mask | crtc_ext_cntl));
                }
                drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
                radeon_crtc_load_lut(crtc);
@@ -331,7 +342,7 @@ static void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                else {
                        WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_DISP_REQ_EN_B, ~(RADEON_CRTC_EN |
                                                                                    RADEON_CRTC_DISP_REQ_EN_B));
-                        WREG32_P(RADEON_CRTC_EXT_CNTL, mask, ~mask);
+                        WREG32_P(RADEON_CRTC_EXT_CNTL, mask, ~(mask | crtc_ext_cntl));
                }
                radeon_crtc->enabled = false;
                /* adjust pm to dpms changes AFTER disabling crtcs */
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 0063df9d166d..f5ba2241dacc 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -537,7 +537,9 @@ static void radeon_legacy_primary_dac_dpms(struct drm_encoder *encoder, int mode
                break;
        }
-        WREG32(RADEON_CRTC_EXT_CNTL, crtc_ext_cntl);
+        /* handled in radeon_crtc_dpms() */
+        if (!(rdev->flags & RADEON_SINGLE_CRTC))
+                WREG32(RADEON_CRTC_EXT_CNTL, crtc_ext_cntl);
        WREG32(RADEON_DAC_CNTL, dac_cntl);
        WREG32(RADEON_DAC_MACRO_CNTL, dac_macro_cntl);
@@ -662,6 +664,8 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
        if (ASIC_IS_R300(rdev))
                tmp |= (0x1b6 << RADEON_DAC_FORCE_DATA_SHIFT);
+        else if (ASIC_IS_RV100(rdev))
+                tmp |= (0x1ac << RADEON_DAC_FORCE_DATA_SHIFT);
        else
                tmp |= (0x180 << RADEON_DAC_FORCE_DATA_SHIFT);
@@ -671,6 +675,7 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
        tmp |= RADEON_DAC_RANGE_CNTL_PS2 | RADEON_DAC_CMP_EN;
        WREG32(RADEON_DAC_CNTL, tmp);
+        tmp = dac_macro_cntl;
        tmp &= ~(RADEON_DAC_PDWN_R |
                 RADEON_DAC_PDWN_G |
                 RADEON_DAC_PDWN_B);
@@ -1092,7 +1097,8 @@ static void radeon_legacy_tv_dac_dpms(struct drm_encoder *encoder, int mode)
        } else {
                if (is_tv)
                        WREG32(RADEON_TV_MASTER_CNTL, tv_master_cntl);
-                else
+                /* handled in radeon_crtc_dpms() */
+                else if (!(rdev->flags & RADEON_SINGLE_CRTC))
                        WREG32(RADEON_CRTC2_GEN_CNTL, crtc2_gen_cntl);
                WREG32(RADEON_TV_DAC_CNTL, tv_dac_cntl);
        }
@@ -1416,13 +1422,104 @@ static bool radeon_legacy_tv_detect(struct drm_encoder *encoder,
        return found;
 }
+static bool radeon_legacy_ext_dac_detect(struct drm_encoder *encoder,
+                                         struct drm_connector *connector)
+{
+        struct drm_device *dev = encoder->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        uint32_t gpio_monid, fp2_gen_cntl, disp_output_cntl, crtc2_gen_cntl;
+        uint32_t disp_lin_trans_grph_a, disp_lin_trans_grph_b, disp_lin_trans_grph_c;
+        uint32_t disp_lin_trans_grph_d, disp_lin_trans_grph_e, disp_lin_trans_grph_f;
+        uint32_t tmp, crtc2_h_total_disp, crtc2_v_total_disp;
+        uint32_t crtc2_h_sync_strt_wid, crtc2_v_sync_strt_wid;
+        bool found = false;
+        int i;
+        /* save the regs we need */
+        gpio_monid = RREG32(RADEON_GPIO_MONID);
+        fp2_gen_cntl = RREG32(RADEON_FP2_GEN_CNTL);
+        disp_output_cntl = RREG32(RADEON_DISP_OUTPUT_CNTL);
+        crtc2_gen_cntl = RREG32(RADEON_CRTC2_GEN_CNTL);
+        disp_lin_trans_grph_a = RREG32(RADEON_DISP_LIN_TRANS_GRPH_A);
+        disp_lin_trans_grph_b = RREG32(RADEON_DISP_LIN_TRANS_GRPH_B);
+        disp_lin_trans_grph_c = RREG32(RADEON_DISP_LIN_TRANS_GRPH_C);
+        disp_lin_trans_grph_d = RREG32(RADEON_DISP_LIN_TRANS_GRPH_D);
+        disp_lin_trans_grph_e = RREG32(RADEON_DISP_LIN_TRANS_GRPH_E);
+        disp_lin_trans_grph_f = RREG32(RADEON_DISP_LIN_TRANS_GRPH_F);
+        crtc2_h_total_disp = RREG32(RADEON_CRTC2_H_TOTAL_DISP);
+        crtc2_v_total_disp = RREG32(RADEON_CRTC2_V_TOTAL_DISP);
+        crtc2_h_sync_strt_wid = RREG32(RADEON_CRTC2_H_SYNC_STRT_WID);
+        crtc2_v_sync_strt_wid = RREG32(RADEON_CRTC2_V_SYNC_STRT_WID);
+        tmp = RREG32(RADEON_GPIO_MONID);
+        tmp &= ~RADEON_GPIO_A_0;
+        WREG32(RADEON_GPIO_MONID, tmp);
+        WREG32(RADEON_FP2_GEN_CNTL, (RADEON_FP2_ON |
+                                     RADEON_FP2_PANEL_FORMAT |
+                                     R200_FP2_SOURCE_SEL_TRANS_UNIT |
+                                     RADEON_FP2_DVO_EN |
+                                     R200_FP2_DVO_RATE_SEL_SDR));
+        WREG32(RADEON_DISP_OUTPUT_CNTL, (RADEON_DISP_DAC_SOURCE_RMX |
+                                         RADEON_DISP_TRANS_MATRIX_GRAPHICS));
+        WREG32(RADEON_CRTC2_GEN_CNTL, (RADEON_CRTC2_EN |
+                                       RADEON_CRTC2_DISP_REQ_EN_B));
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_A, 0x00000000);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_B, 0x000003f0);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_C, 0x00000000);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_D, 0x000003f0);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_E, 0x00000000);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_F, 0x000003f0);
+        WREG32(RADEON_CRTC2_H_TOTAL_DISP, 0x01000008);
+        WREG32(RADEON_CRTC2_H_SYNC_STRT_WID, 0x00000800);
+        WREG32(RADEON_CRTC2_V_TOTAL_DISP, 0x00080001);
+        WREG32(RADEON_CRTC2_V_SYNC_STRT_WID, 0x00000080);
+        for (i = 0; i < 200; i++) {
+                tmp = RREG32(RADEON_GPIO_MONID);
+                if (tmp & RADEON_GPIO_Y_0)
+                        found = true;
+                if (found)
+                        break;
+                if (!drm_can_sleep())
+                        mdelay(1);
+                else
+                        msleep(1);
+        }
+        /* restore the regs we used */
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_A, disp_lin_trans_grph_a);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_B, disp_lin_trans_grph_b);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_C, disp_lin_trans_grph_c);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_D, disp_lin_trans_grph_d);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_E, disp_lin_trans_grph_e);
+        WREG32(RADEON_DISP_LIN_TRANS_GRPH_F, disp_lin_trans_grph_f);
+        WREG32(RADEON_CRTC2_H_TOTAL_DISP, crtc2_h_total_disp);
+        WREG32(RADEON_CRTC2_V_TOTAL_DISP, crtc2_v_total_disp);
+        WREG32(RADEON_CRTC2_H_SYNC_STRT_WID, crtc2_h_sync_strt_wid);
+        WREG32(RADEON_CRTC2_V_SYNC_STRT_WID, crtc2_v_sync_strt_wid);
+        WREG32(RADEON_CRTC2_GEN_CNTL, crtc2_gen_cntl);
+        WREG32(RADEON_DISP_OUTPUT_CNTL, disp_output_cntl);
+        WREG32(RADEON_FP2_GEN_CNTL, fp2_gen_cntl);
+        WREG32(RADEON_GPIO_MONID, gpio_monid);
+        return found;
+}
 static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder *encoder,
                                                             struct drm_connector *connector)
 {
        struct drm_device *dev = encoder->dev;
        struct radeon_device *rdev = dev->dev_private;
-        uint32_t crtc2_gen_cntl, tv_dac_cntl, dac_cntl2, dac_ext_cntl;
+        uint32_t crtc2_gen_cntl = 0, tv_dac_cntl, dac_cntl2, dac_ext_cntl;
-        uint32_t disp_hw_debug, disp_output_cntl, gpiopad_a, pixclks_cntl, tmp;
+        uint32_t gpiopad_a = 0, pixclks_cntl, tmp;
+        uint32_t disp_output_cntl = 0, disp_hw_debug = 0, crtc_ext_cntl = 0;
        enum drm_connector_status found = connector_status_disconnected;
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        struct radeon_encoder_tv_dac *tv_dac = radeon_encoder->enc_priv;
@@ -1459,12 +1556,27 @@ static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder
                return connector_status_disconnected;
        }
+        /* R200 uses an external DAC for secondary DAC */
+        if (rdev->family == CHIP_R200) {
+                if (radeon_legacy_ext_dac_detect(encoder, connector))
+                        found = connector_status_connected;
+                return found;
+        }
        /* save the regs we need */
        pixclks_cntl = RREG32_PLL(RADEON_PIXCLKS_CNTL);
-        gpiopad_a = ASIC_IS_R300(rdev) ? RREG32(RADEON_GPIOPAD_A) : 0;
-        disp_output_cntl = ASIC_IS_R300(rdev) ? RREG32(RADEON_DISP_OUTPUT_CNTL) : 0;
+        if (rdev->flags & RADEON_SINGLE_CRTC) {
-        disp_hw_debug = ASIC_IS_R300(rdev) ? 0 : RREG32(RADEON_DISP_HW_DEBUG);
+                crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL);
-        crtc2_gen_cntl = RREG32(RADEON_CRTC2_GEN_CNTL);
+        } else {
+                if (ASIC_IS_R300(rdev)) {
+                        gpiopad_a = RREG32(RADEON_GPIOPAD_A);
+                        disp_output_cntl = RREG32(RADEON_DISP_OUTPUT_CNTL);
+                } else {
+                        disp_hw_debug = RREG32(RADEON_DISP_HW_DEBUG);
+                }
+                crtc2_gen_cntl = RREG32(RADEON_CRTC2_GEN_CNTL);
+        }
        tv_dac_cntl = RREG32(RADEON_TV_DAC_CNTL);
        dac_ext_cntl = RREG32(RADEON_DAC_EXT_CNTL);
        dac_cntl2 = RREG32(RADEON_DAC_CNTL2);
@@ -1473,22 +1585,24 @@ static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder
                               | RADEON_PIX2CLK_DAC_ALWAYS_ONb);
        WREG32_PLL(RADEON_PIXCLKS_CNTL, tmp);
-        if (ASIC_IS_R300(rdev))
+        if (rdev->flags & RADEON_SINGLE_CRTC) {
-                WREG32_P(RADEON_GPIOPAD_A, 1, ~1);
+                tmp = crtc_ext_cntl | RADEON_CRTC_CRT_ON;
+                WREG32(RADEON_CRTC_EXT_CNTL, tmp);
-        tmp = crtc2_gen_cntl & ~RADEON_CRTC2_PIX_WIDTH_MASK;
-        tmp |= RADEON_CRTC2_CRT2_ON |
-                (2 << RADEON_CRTC2_PIX_WIDTH_SHIFT);
-        WREG32(RADEON_CRTC2_GEN_CNTL, tmp);
-        if (ASIC_IS_R300(rdev)) {
-                tmp = disp_output_cntl & ~RADEON_DISP_TVDAC_SOURCE_MASK;
-                tmp |= RADEON_DISP_TVDAC_SOURCE_CRTC2;
-                WREG32(RADEON_DISP_OUTPUT_CNTL, tmp);
        } else {
-                tmp = disp_hw_debug & ~RADEON_CRT2_DISP1_SEL;
+                tmp = crtc2_gen_cntl & ~RADEON_CRTC2_PIX_WIDTH_MASK;
-                WREG32(RADEON_DISP_HW_DEBUG, tmp);
+                tmp |= RADEON_CRTC2_CRT2_ON |
+                        (2 << RADEON_CRTC2_PIX_WIDTH_SHIFT);
+                WREG32(RADEON_CRTC2_GEN_CNTL, tmp);
+                if (ASIC_IS_R300(rdev)) {
+                        WREG32_P(RADEON_GPIOPAD_A, 1, ~1);
+                        tmp = disp_output_cntl & ~RADEON_DISP_TVDAC_SOURCE_MASK;
+                        tmp |= RADEON_DISP_TVDAC_SOURCE_CRTC2;
+                        WREG32(RADEON_DISP_OUTPUT_CNTL, tmp);
+                } else {
+                        tmp = disp_hw_debug & ~RADEON_CRT2_DISP1_SEL;
+                        WREG32(RADEON_DISP_HW_DEBUG, tmp);
+                }
        }
        tmp = RADEON_TV_DAC_NBLANK |
@@ -1530,14 +1644,19 @@ static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder
        WREG32(RADEON_DAC_CNTL2, dac_cntl2);
        WREG32(RADEON_DAC_EXT_CNTL, dac_ext_cntl);
        WREG32(RADEON_TV_DAC_CNTL, tv_dac_cntl);
-        WREG32(RADEON_CRTC2_GEN_CNTL, crtc2_gen_cntl);
-        if (ASIC_IS_R300(rdev)) {
+        if (rdev->flags & RADEON_SINGLE_CRTC) {
-                WREG32(RADEON_DISP_OUTPUT_CNTL, disp_output_cntl);
+                WREG32(RADEON_CRTC_EXT_CNTL, crtc_ext_cntl);
-                WREG32_P(RADEON_GPIOPAD_A, gpiopad_a, ~1);
        } else {
-                WREG32(RADEON_DISP_HW_DEBUG, disp_hw_debug);
+                WREG32(RADEON_CRTC2_GEN_CNTL, crtc2_gen_cntl);
+                if (ASIC_IS_R300(rdev)) {
+                        WREG32(RADEON_DISP_OUTPUT_CNTL, disp_output_cntl);
+                        WREG32_P(RADEON_GPIOPAD_A, gpiopad_a, ~1);
+                } else {
+                        WREG32(RADEON_DISP_HW_DEBUG, disp_hw_debug);
+                }
        }
        WREG32_PLL(RADEON_PIXCLKS_CNTL, pixclks_cntl);
        return found;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index b0db712060fb..4422d630b33b 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2474,6 +2474,7 @@ static bool si_vm_reg_valid(u32 reg)
        /* check config regs */
        switch (reg) {
        case GRBM_GFX_INDEX:
+        case CP_STRMOUT_CNTL:
        case VGT_VTX_VECT_EJECT_REG:
        case VGT_CACHE_INVALIDATION:
        case VGT_ESGS_RING_SIZE:
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 7d2a20e56577..a8871afc5b4e 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -424,6 +424,7 @@
 #       define RDERR_INT_ENABLE                         (1 << 0)
 #       define GUI_IDLE_INT_ENABLE                      (1 << 19)
+#define CP_STRMOUT_CNTL                                 0x84FC
 #define SCRATCH_REG0                                    0x8500
 #define SCRATCH_REG1                                    0x8504
 #define SCRATCH_REG2                                    0x8508
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index fccd361f7b50..87aa5f5d3c88 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -104,7 +104,7 @@ udl_fb_user_fb_create(struct drm_device *dev,
 int udl_render_hline(struct drm_device *dev, int bpp, struct urb **urb_ptr,
                     const char *front, char **urb_buf_ptr,
-                     u32 byte_offset, u32 byte_width,
+                     u32 byte_offset, u32 device_byte_offset, u32 byte_width,
                     int *ident_ptr, int *sent_ptr);
 int udl_dumb_create(struct drm_file *file_priv,
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index 69a2b16f42a6..d4ab3beaada0 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -114,9 +114,10 @@ static void udlfb_dpy_deferred_io(struct fb_info *info,
        list_for_each_entry(cur, &fbdefio->pagelist, lru) {
                if (udl_render_hline(dev, (ufbdev->ufb.base.bits_per_pixel / 8),
-                                  &urb, (char *) info->fix.smem_start,
+                                     &urb, (char *) info->fix.smem_start,
-                                  &cmd, cur->index << PAGE_SHIFT,
+                                     &cmd, cur->index << PAGE_SHIFT,
-                                  PAGE_SIZE, &bytes_identical, &bytes_sent))
+                                     cur->index << PAGE_SHIFT,
+                                     PAGE_SIZE, &bytes_identical, &bytes_sent))
                        goto error;
                bytes_rendered += PAGE_SIZE;
        }
@@ -187,10 +188,11 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
        for (i = y; i < y + height ; i++) {
                const int line_offset = fb->base.pitches[0] * i;
                const int byte_offset = line_offset + (x * bpp);
+                const int dev_byte_offset = (fb->base.width * bpp * i) + (x * bpp);
                if (udl_render_hline(dev, bpp, &urb,
                                     (char *) fb->obj->vmapping,
-                                     &cmd, byte_offset, width * bpp,
+                                     &cmd, byte_offset, dev_byte_offset,
+                                     width * bpp,
                                     &bytes_identical, &bytes_sent))
                        goto error;
        }
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index dc095526ffb7..142fee5f983f 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -213,11 +213,12 @@ static void udl_compress_hline16(
 */
 int udl_render_hline(struct drm_device *dev, int bpp, struct urb **urb_ptr,
                     const char *front, char **urb_buf_ptr,
-                     u32 byte_offset, u32 byte_width,
+                     u32 byte_offset, u32 device_byte_offset,
+                     u32 byte_width,
                     int *ident_ptr, int *sent_ptr)
 {
        const u8 *line_start, *line_end, *next_pixel;
-        u32 base16 = 0 + (byte_offset / bpp) * 2;
+        u32 base16 = 0 + (device_byte_offset / bpp) * 2;
        struct urb *urb = *urb_ptr;
        u8 *cmd = *urb_buf_ptr;
        u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
index 3ce68a2e312d..d1498bfd7873 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
@@ -306,7 +306,7 @@ void vmw_bo_pin(struct ttm_buffer_object *bo, bool pin)
        BUG_ON(!atomic_read(&bo->reserved));
        BUG_ON(old_mem_type != TTM_PL_VRAM &&
-               old_mem_type != VMW_PL_FLAG_GMR);
+               old_mem_type != VMW_PL_GMR);
        pl_flags = TTM_PL_FLAG_VRAM | VMW_PL_FLAG_GMR | TTM_PL_FLAG_CACHED;
        if (pin)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index ed3c1e7ddde9..2dd185e42f21 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1098,6 +1098,11 @@ static void vmw_pm_complete(struct device *kdev)
        struct drm_device *dev = pci_get_drvdata(pdev);
        struct vmw_private *dev_priv = vmw_priv(dev);
+        mutex_lock(&dev_priv->hw_mutex);
+        vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
+        (void) vmw_read(dev_priv, SVGA_REG_ID);
+        mutex_unlock(&dev_priv->hw_mutex);
        /**
         * Reclaim 3d reference held by fbdev and potentially
         * start fifo.
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 06ebdbb6ea02..fd7722aecf77 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -522,6 +522,12 @@ static const struct hid_device_id apple_devices[] = {
                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_JIS),
                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index bd3971bf31bf..f4109fd657ff 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1532,6 +1532,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ISO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -2139,6 +2142,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ISO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
        { }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 269b50912a4a..9d7a42857ea1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -118,6 +118,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI   0x0252
 #define USB_DEVICE_ID_APPLE_WELLSPRING5A_ISO    0x0253
 #define USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS    0x0254
+#define USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI   0x0259
+#define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO    0x025a
+#define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS    0x025b
 #define USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI   0x0249
 #define USB_DEVICE_ID_APPLE_WELLSPRING6A_ISO    0x024a
 #define USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS    0x024b
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index 3acdcfcc17df..f676c01bb471 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -28,22 +28,30 @@
 #define MS_RDESC                0x08
 #define MS_NOGET                0x10
 #define MS_DUPLICATE_USAGES     0x20
+#define MS_RDESC_3K             0x40
-/*
- * Microsoft Wireless Desktop Receiver (Model 1028) has
- * 'Usage Min/Max' where it ought to have 'Physical Min/Max'
- */
 static __u8 *ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                unsigned int *rsize)
 {
        unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+        /*
+         * Microsoft Wireless Desktop Receiver (Model 1028) has
+         * 'Usage Min/Max' where it ought to have 'Physical Min/Max'
+         */
        if ((quirks & MS_RDESC) && *rsize == 571 && rdesc[557] == 0x19 &&
                        rdesc[559] == 0x29) {
                hid_info(hdev, "fixing up Microsoft Wireless Receiver Model 1028 report descriptor\n");
                rdesc[557] = 0x35;
                rdesc[559] = 0x45;
        }
+        /* the same as above (s/usage/physical/) */
+        if ((quirks & MS_RDESC_3K) && *rsize == 106 &&
+                        !memcmp((char []){ 0x19, 0x00, 0x29, 0xff },
+                                &rdesc[94], 4)) {
+                rdesc[94] = 0x35;
+                rdesc[96] = 0x45;
+        }
        return rdesc;
 }
@@ -192,7 +200,7 @@ static const struct hid_device_id ms_devices[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB),
                .driver_data = MS_PRESENTER },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K),
-                .driver_data = MS_ERGONOMY },
+                .driver_data = MS_ERGONOMY | MS_RDESC_3K },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0),
                .driver_data = MS_NOGET },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 3eb02b94fc87..7867d69f0efe 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -210,8 +210,7 @@ static struct mt_class mt_classes[] = {
        },
        { .name = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
                .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
-                        MT_QUIRK_SLOT_IS_CONTACTNUMBER,
+                        MT_QUIRK_SLOT_IS_CONTACTNUMBER
-                .maxcontacts = 10
        },
        { .name = MT_CLS_FLATFROG,
@@ -421,11 +420,11 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         * contact max are global to the report */
                        td->last_field_index = field->index;
                        return -1;
-                }
                case HID_DG_TOUCH:
                        /* Legacy devices use TIPSWITCH and not TOUCH.
                         * Let's just ignore this field. */
                        return -1;
+                }
                /* let hid-input decide for the others */
                return 0;
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 17d15bb610d1..7c47fc3f7b2b 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -42,7 +42,6 @@ static struct cdev hidraw_cdev;
 static struct class *hidraw_class;
 static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
 static DEFINE_MUTEX(minors_lock);
-static void drop_ref(struct hidraw *hid, int exists_bit);
 static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
@@ -114,7 +113,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
        __u8 *buf;
        int ret = 0;
-        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+        if (!hidraw_table[minor]) {
                ret = -ENODEV;
                goto out;
        }
@@ -262,7 +261,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
        }
        mutex_lock(&minors_lock);
-        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+        if (!hidraw_table[minor]) {
                err = -ENODEV;
                goto out_unlock;
        }
@@ -299,12 +298,36 @@ out:
 static int hidraw_release(struct inode * inode, struct file * file)
 {
        unsigned int minor = iminor(inode);
+        struct hidraw *dev;
        struct hidraw_list *list = file->private_data;
+        int ret;
+        int i;
+        mutex_lock(&minors_lock);
+        if (!hidraw_table[minor]) {
+                ret = -ENODEV;
+                goto unlock;
+        }
-        drop_ref(hidraw_table[minor], 0);
        list_del(&list->node);
+        dev = hidraw_table[minor];
+        if (!--dev->open) {
+                if (list->hidraw->exist) {
+                        hid_hw_power(dev->hid, PM_HINT_NORMAL);
+                        hid_hw_close(dev->hid);
+                } else {
+                        kfree(list->hidraw);
+                }
+        }
+        for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
+                kfree(list->buffer[i].value);
        kfree(list);
-        return 0;
+        ret = 0;
+unlock:
+        mutex_unlock(&minors_lock);
+        return ret;
 }
 static long hidraw_ioctl(struct file *file, unsigned int cmd,
@@ -506,7 +529,21 @@ EXPORT_SYMBOL_GPL(hidraw_connect);
 void hidraw_disconnect(struct hid_device *hid)
 {
        struct hidraw *hidraw = hid->hidraw;
-        drop_ref(hidraw, 1);
+        mutex_lock(&minors_lock);
+        hidraw->exist = 0;
+        device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+        hidraw_table[hidraw->minor] = NULL;
+        if (hidraw->open) {
+                hid_hw_close(hid);
+                wake_up_interruptible(&hidraw->wait);
+        } else {
+                kfree(hidraw);
+        }
+        mutex_unlock(&minors_lock);
 }
 EXPORT_SYMBOL_GPL(hidraw_disconnect);
@@ -555,23 +592,3 @@ void hidraw_exit(void)
        unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
 }
-static void drop_ref(struct hidraw *hidraw, int exists_bit)
-{
-        mutex_lock(&minors_lock);
-        if (exists_bit) {
-                hid_hw_close(hidraw->hid);
-                hidraw->exist = 0;
-                if (hidraw->open)
-                        wake_up_interruptible(&hidraw->wait);
-        } else {
-                --hidraw->open;
-        }
-        if (!hidraw->open && !hidraw->exist) {
-                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
-                hidraw_table[hidraw->minor] = NULL;
-                kfree(hidraw);
-        }
-        mutex_unlock(&minors_lock);
-}
diff --git a/drivers/hwmon/asb100.c b/drivers/hwmon/asb100.c
index a227be47149f..520e5bf4f76d 100644
--- a/drivers/hwmon/asb100.c
+++ b/drivers/hwmon/asb100.c
@@ -32,7 +32,7 @@
 * ASB100-A supports pwm1, while plain ASB100 does not.  There is no known
 * way for the driver to tell which one is there.
 *
- * Chip #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
+ * Chip         #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
 * asb100       7       3       1       4       0x31    0x0694  yes     no
 */
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index 68ad7d255512..4f4110407387 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -2,7 +2,7 @@
 * fam15h_power.c - AMD Family 15h processor power monitoring
 *
 * Copyright (c) 2011 Advanced Micro Devices, Inc.
- * Author: Andreas Herrmann <andreas.herrmann3@amd.com>
+ * Author: Andreas Herrmann <herrmann.der.user@googlemail.com>
 *
 *
 * This driver is free software; you can redistribute it and/or
@@ -28,7 +28,7 @@
 #include <asm/processor.h>
 MODULE_DESCRIPTION("AMD Family 15h CPU processor power monitor");
-MODULE_AUTHOR("Andreas Herrmann <andreas.herrmann3@amd.com>");
+MODULE_AUTHOR("Andreas Herrmann <herrmann.der.user@googlemail.com>");
 MODULE_LICENSE("GPL");
 /* D18F3 */
diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index 36509ae32083..1381a2e3bbd4 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -630,7 +630,9 @@ static struct platform_driver gpio_fan_driver = {
        .driver = {
                .name   = "gpio-fan",
                .pm     = GPIO_FAN_PM,
+#ifdef CONFIG_OF_GPIO
                .of_match_table = of_match_ptr(of_gpio_fan_match),
+#endif
        },
 };
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 1821b7423d5b..de3c7e04c3b5 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -2083,6 +2083,7 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
        mutex_init(&data->lock);
        mutex_init(&data->update_lock);
        data->name = w83627ehf_device_names[sio_data->kind];
+        data->bank = 0xff;              /* Force initial bank selection */
        platform_set_drvdata(pdev, data);
        /* 627EHG and 627EHF have 10 voltage inputs; 627DHG and 667HG have 9 */
diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index 5b1a6a666441..af1589908709 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -25,7 +25,7 @@
 /*
 * Supports following chips:
 *
- * Chip #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
+ * Chip         #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
 * w83627hf     9       3       2       3       0x20    0x5ca3  no      yes(LPC)
 * w83627thf    7       3       3       3       0x90    0x5ca3  no      yes(LPC)
 * w83637hf     7       3       3       3       0x80    0x5ca3  no      yes(LPC)
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index 5a5046d94c3e..20f11d31da40 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -24,7 +24,7 @@
 /*
 * Supports following chips:
 *
- * Chip #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
+ * Chip         #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
 * as99127f     7       3       0       3       0x31    0x12c3  yes     no
 * as99127f rev.2 (type_name = as99127f)        0x31    0x5ca3  yes     no
 * w83781d      7       3       0       3       0x10-1  0x5ca3  yes     yes
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 39ab7bcc616e..ed397c645198 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -22,7 +22,7 @@
 /*
 * Supports following chips:
 *
- * Chip #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
+ * Chip         #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
 * w83791d      10      5       5       3       0x71    0x5ca3  yes     no
 *
 * The w83791d chip appears to be part way between the 83781d and the
diff --git a/drivers/hwmon/w83792d.c b/drivers/hwmon/w83792d.c
index 053645279f38..301942d08453 100644
--- a/drivers/hwmon/w83792d.c
+++ b/drivers/hwmon/w83792d.c
@@ -31,7 +31,7 @@
 /*
 * Supports following chips:
 *
- * Chip #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
+ * Chip         #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
 * w83792d      9       7       7       3       0x7a    0x5ca3  yes     no
 */
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index f0e8286c3c70..79710bcac2f7 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -20,7 +20,7 @@
 /*
 * Supports following chips:
 *
- * Chip #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
+ * Chip         #vin    #fanin  #pwm    #temp   wchipid vendid  i2c     ISA
 * w83l786ng    3       2       2       2       0x7b    0x5ca3  yes     no
 */
diff --git a/drivers/i2c/Makefile b/drivers/i2c/Makefile
index beee6b2d361d..1722f50f2473 100644
--- a/drivers/i2c/Makefile
+++ b/drivers/i2c/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_I2C_SMBUS)		+= i2c-smbus.o
 obj-$(CONFIG_I2C_CHARDEV)       += i2c-dev.o
 obj-$(CONFIG_I2C_MUX)           += i2c-mux.o
 obj-y                           += algos/ busses/ muxes/
+obj-$(CONFIG_I2C_STUB)          += i2c-stub.o
 ccflags-$(CONFIG_I2C_DEBUG_CORE) := -DDEBUG
 CFLAGS_i2c-core.o := -Wno-deprecated-declarations
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 65dd599a0262..e9df4612b7eb 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -81,7 +81,6 @@ config I2C_I801
        tristate "Intel 82801 (ICH/PCH)"
        depends on PCI
        select CHECK_SIGNATURE if X86 && DMI
-        select GPIOLIB if I2C_MUX
        help
          If you say yes to this option, support will be included for the Intel
          801 family of mainboard I2C interfaces.  Specifically, the following
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 2d33d62952c1..395b516ffa08 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -85,7 +85,6 @@ obj-$(CONFIG_I2C_ACORN)		+= i2c-acorn.o
 obj-$(CONFIG_I2C_ELEKTOR)       += i2c-elektor.o
 obj-$(CONFIG_I2C_PCA_ISA)       += i2c-pca-isa.o
 obj-$(CONFIG_I2C_SIBYTE)        += i2c-sibyte.o
-obj-$(CONFIG_I2C_STUB)          += i2c-stub.o
 obj-$(CONFIG_SCx200_ACB)        += scx200_acb.o
 obj-$(CONFIG_SCx200_I2C)        += scx200_i2c.o
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 37793156bd93..6abc00d59881 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -82,7 +82,8 @@
 #include <linux/wait.h>
 #include <linux/err.h>
-#if defined CONFIG_I2C_MUX || defined CONFIG_I2C_MUX_MODULE
+#if (defined CONFIG_I2C_MUX_GPIO || defined CONFIG_I2C_MUX_GPIO_MODULE) && \
+                defined CONFIG_DMI
 #include <linux/gpio.h>
 #include <linux/i2c-mux-gpio.h>
 #include <linux/platform_device.h>
@@ -192,7 +193,8 @@ struct i801_priv {
        int len;
        u8 *data;
-#if defined CONFIG_I2C_MUX || defined CONFIG_I2C_MUX_MODULE
+#if (defined CONFIG_I2C_MUX_GPIO || defined CONFIG_I2C_MUX_GPIO_MODULE) && \
+                defined CONFIG_DMI
        const struct i801_mux_config *mux_drvdata;
        struct platform_device *mux_pdev;
 #endif
@@ -921,7 +923,8 @@ static void __init input_apanel_init(void) {}
 static void __devinit i801_probe_optional_slaves(struct i801_priv *priv) {}
 #endif  /* CONFIG_X86 && CONFIG_DMI */
-#if defined CONFIG_I2C_MUX || defined CONFIG_I2C_MUX_MODULE
+#if (defined CONFIG_I2C_MUX_GPIO || defined CONFIG_I2C_MUX_GPIO_MODULE) && \
+                defined CONFIG_DMI
 static struct i801_mux_config i801_mux_config_asus_z8_d12 = {
        .gpio_chip = "gpio_ich",
        .values = { 0x02, 0x03 },
@@ -1059,7 +1062,7 @@ static unsigned int __devinit i801_get_adapter_class(struct i801_priv *priv)
        id = dmi_first_match(mux_dmi_table);
        if (id) {
-                /* Remove from branch classes from trunk */
+                /* Remove branch classes from trunk */
                mux_config = id->driver_data;
                for (i = 0; i < mux_config->n_values; i++)
                        class &= ~mux_config->classes[i];
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 1f58197062cf..286ca1917820 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -1,7 +1,7 @@
 /*
 * Freescale MXS I2C bus driver
 *
- * Copyright (C) 2011 Wolfram Sang, Pengutronix e.K.
+ * Copyright (C) 2011-2012 Wolfram Sang, Pengutronix e.K.
 *
 * based on a (non-working) driver which was:
 *
@@ -35,10 +35,6 @@
 #define DRIVER_NAME "mxs-i2c"
-static bool use_pioqueue;
-module_param(use_pioqueue, bool, 0);
-MODULE_PARM_DESC(use_pioqueue, "Use PIOQUEUE mode for transfer instead of DMA");
 #define MXS_I2C_CTRL0           (0x00)
 #define MXS_I2C_CTRL0_SET       (0x04)
@@ -75,23 +71,6 @@ MODULE_PARM_DESC(use_pioqueue, "Use PIOQUEUE mode for transfer instead of DMA");
                                 MXS_I2C_CTRL1_SLAVE_STOP_IRQ | \
                                 MXS_I2C_CTRL1_SLAVE_IRQ)
-#define MXS_I2C_QUEUECTRL       (0x60)
-#define MXS_I2C_QUEUECTRL_SET   (0x64)
-#define MXS_I2C_QUEUECTRL_CLR   (0x68)
-#define MXS_I2C_QUEUECTRL_QUEUE_RUN             0x20
-#define MXS_I2C_QUEUECTRL_PIO_QUEUE_MODE        0x04
-#define MXS_I2C_QUEUESTAT       (0x70)
-#define MXS_I2C_QUEUESTAT_RD_QUEUE_EMPTY        0x00002000
-#define MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK  0x0000001F
-#define MXS_I2C_QUEUECMD        (0x80)
-#define MXS_I2C_QUEUEDATA       (0x90)
-#define MXS_I2C_DATA            (0xa0)
 #define MXS_CMD_I2C_SELECT      (MXS_I2C_CTRL0_RETAIN_CLOCK |   \
                                 MXS_I2C_CTRL0_PRE_SEND_START | \
@@ -153,7 +132,6 @@ struct mxs_i2c_dev {
        const struct mxs_i2c_speed_config *speed;
        /* DMA support components */
-        bool                            dma_mode;
        int                             dma_channel;
        struct dma_chan                 *dmach;
        struct mxs_dma_data             dma_data;
@@ -172,99 +150,6 @@ static void mxs_i2c_reset(struct mxs_i2c_dev *i2c)
        writel(i2c->speed->timing2, i2c->regs + MXS_I2C_TIMING2);
        writel(MXS_I2C_IRQ_MASK << 8, i2c->regs + MXS_I2C_CTRL1_SET);
-        if (i2c->dma_mode)
-                writel(MXS_I2C_QUEUECTRL_PIO_QUEUE_MODE,
-                        i2c->regs + MXS_I2C_QUEUECTRL_CLR);
-        else
-                writel(MXS_I2C_QUEUECTRL_PIO_QUEUE_MODE,
-                        i2c->regs + MXS_I2C_QUEUECTRL_SET);
-}
-static void mxs_i2c_pioq_setup_read(struct mxs_i2c_dev *i2c, u8 addr, int len,
-                                        int flags)
-{
-        u32 data;
-        writel(MXS_CMD_I2C_SELECT, i2c->regs + MXS_I2C_QUEUECMD);
-        data = (addr << 1) | I2C_SMBUS_READ;
-        writel(data, i2c->regs + MXS_I2C_DATA);
-        data = MXS_CMD_I2C_READ | MXS_I2C_CTRL0_XFER_COUNT(len) | flags;
-        writel(data, i2c->regs + MXS_I2C_QUEUECMD);
-}
-static void mxs_i2c_pioq_setup_write(struct mxs_i2c_dev *i2c,
-                                    u8 addr, u8 *buf, int len, int flags)
-{
-        u32 data;
-        int i, shifts_left;
-        data = MXS_CMD_I2C_WRITE | MXS_I2C_CTRL0_XFER_COUNT(len + 1) | flags;
-        writel(data, i2c->regs + MXS_I2C_QUEUECMD);
-        /*
-         * We have to copy the slave address (u8) and buffer (arbitrary number
-         * of u8) into the data register (u32). To achieve that, the u8 are put
-         * into the MSBs of 'data' which is then shifted for the next u8. When
-         * appropriate, 'data' is written to MXS_I2C_DATA. So, the first u32
-         * looks like this:
-         *
-         *  3          2          1          0
-         * 10987654|32109876|54321098|76543210
-         * --------+--------+--------+--------
-         * buffer+2|buffer+1|buffer+0|slave_addr
-         */
-        data = ((addr << 1) | I2C_SMBUS_WRITE) << 24;
-        for (i = 0; i < len; i++) {
-                data >>= 8;
-                data |= buf[i] << 24;
-                if ((i & 3) == 2)
-                        writel(data, i2c->regs + MXS_I2C_DATA);
-        }
-        /* Write out the remaining bytes if any */
-        shifts_left = 24 - (i & 3) * 8;
-        if (shifts_left)
-                writel(data >> shifts_left, i2c->regs + MXS_I2C_DATA);
-}
-/*
- * TODO: should be replaceable with a waitqueue and RD_QUEUE_IRQ (setting the
- * rd_threshold to 1). Couldn't get this to work, though.
- */
-static int mxs_i2c_wait_for_data(struct mxs_i2c_dev *i2c)
-{
-        unsigned long timeout = jiffies + msecs_to_jiffies(1000);
-        while (readl(i2c->regs + MXS_I2C_QUEUESTAT)
-                        & MXS_I2C_QUEUESTAT_RD_QUEUE_EMPTY) {
-                        if (time_after(jiffies, timeout))
-                                return -ETIMEDOUT;
-                        cond_resched();
-        }
-        return 0;
-}
-static int mxs_i2c_finish_read(struct mxs_i2c_dev *i2c, u8 *buf, int len)
-{
-        u32 uninitialized_var(data);
-        int i;
-        for (i = 0; i < len; i++) {
-                if ((i & 3) == 0) {
-                        if (mxs_i2c_wait_for_data(i2c))
-                                return -ETIMEDOUT;
-                        data = readl(i2c->regs + MXS_I2C_QUEUEDATA);
-                }
-                buf[i] = data & 0xff;
-                data >>= 8;
-        }
-        return 0;
 }
 static void mxs_i2c_dma_finish(struct mxs_i2c_dev *i2c)
@@ -432,39 +317,17 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
        init_completion(&i2c->cmd_complete);
        i2c->cmd_err = 0;
-        if (i2c->dma_mode) {
+        ret = mxs_i2c_dma_setup_xfer(adap, msg, flags);
-                ret = mxs_i2c_dma_setup_xfer(adap, msg, flags);
+        if (ret)
-                if (ret)
+                return ret;
-                        return ret;
-        } else {
-                if (msg->flags & I2C_M_RD) {
-                        mxs_i2c_pioq_setup_read(i2c, msg->addr,
-                                                msg->len, flags);
-                } else {
-                        mxs_i2c_pioq_setup_write(i2c, msg->addr, msg->buf,
-                                                msg->len, flags);
-                }
-                writel(MXS_I2C_QUEUECTRL_QUEUE_RUN,
-                        i2c->regs + MXS_I2C_QUEUECTRL_SET);
-        }
        ret = wait_for_completion_timeout(&i2c->cmd_complete,
                                                msecs_to_jiffies(1000));
        if (ret == 0)
                goto timeout;
-        if (!i2c->dma_mode && !i2c->cmd_err && (msg->flags & I2C_M_RD)) {
-                ret = mxs_i2c_finish_read(i2c, msg->buf, msg->len);
-                if (ret)
-                        goto timeout;
-        }
        if (i2c->cmd_err == -ENXIO)
                mxs_i2c_reset(i2c);
-        else
-                writel(MXS_I2C_QUEUECTRL_QUEUE_RUN,
-                                i2c->regs + MXS_I2C_QUEUECTRL_CLR);
        dev_dbg(i2c->dev, "Done with err=%d\n", i2c->cmd_err);
@@ -472,8 +335,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
 timeout:
        dev_dbg(i2c->dev, "Timeout!\n");
-        if (i2c->dma_mode)
+        mxs_i2c_dma_finish(i2c);
-                mxs_i2c_dma_finish(i2c);
        mxs_i2c_reset(i2c);
        return -ETIMEDOUT;
 }
@@ -502,7 +364,6 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
 {
        struct mxs_i2c_dev *i2c = dev_id;
        u32 stat = readl(i2c->regs + MXS_I2C_CTRL1) & MXS_I2C_IRQ_MASK;
-        bool is_last_cmd;
        if (!stat)
                return IRQ_NONE;
@@ -515,14 +376,6 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
                /* MXS_I2C_CTRL1_OVERSIZE_XFER_TERM_IRQ is only for slaves */
                i2c->cmd_err = -EIO;
-        if (!i2c->dma_mode) {
-                is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
-                        MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
-                if (is_last_cmd || i2c->cmd_err)
-                        complete(&i2c->cmd_complete);
-        }
        writel(stat, i2c->regs + MXS_I2C_CTRL1_CLR);
        return IRQ_HANDLED;
@@ -556,23 +409,14 @@ static int mxs_i2c_get_ofdata(struct mxs_i2c_dev *i2c)
        int ret;
        /*
-         * The MXS I2C DMA mode is prefered and enabled by default.
-         * The PIO mode is still supported, but should be used only
-         * for debuging purposes etc.
-         */
-        i2c->dma_mode = !use_pioqueue;
-        if (!i2c->dma_mode)
-                dev_info(dev, "Using PIOQUEUE mode for I2C transfers!\n");
-        /*
         * TODO: This is a temporary solution and should be changed
         * to use generic DMA binding later when the helpers get in.
         */
        ret = of_property_read_u32(node, "fsl,i2c-dma-channel",
                                   &i2c->dma_channel);
        if (ret) {
-                dev_warn(dev, "Failed to get DMA channel, using PIOQUEUE!\n");
+                dev_err(dev, "Failed to get DMA channel!\n");
-                i2c->dma_mode = 0;
+                return -ENODEV;
        }
        ret = of_property_read_u32(node, "clock-frequency", &speed);
@@ -634,15 +478,13 @@ static int __devinit mxs_i2c_probe(struct platform_device *pdev)
        }
        /* Setup the DMA */
-        if (i2c->dma_mode) {
+        dma_cap_zero(mask);
-                dma_cap_zero(mask);
+        dma_cap_set(DMA_SLAVE, mask);
-                dma_cap_set(DMA_SLAVE, mask);
+        i2c->dma_data.chan_irq = dmairq;
-                i2c->dma_data.chan_irq = dmairq;
+        i2c->dmach = dma_request_channel(mask, mxs_i2c_dma_filter, i2c);
-                i2c->dmach = dma_request_channel(mask, mxs_i2c_dma_filter, i2c);
+        if (!i2c->dmach) {
-                if (!i2c->dmach) {
+                dev_err(dev, "Failed to request dma\n");
-                        dev_err(dev, "Failed to request dma\n");
+                return -ENODEV;
-                        return -ENODEV;
-                }
        }
        platform_set_drvdata(pdev, i2c);
diff --git a/drivers/i2c/busses/i2c-nomadik.c b/drivers/i2c/busses/i2c-nomadik.c
index 698d7acb0f08..02c3115a2dfa 100644
--- a/drivers/i2c/busses/i2c-nomadik.c
+++ b/drivers/i2c/busses/i2c-nomadik.c
@@ -644,7 +644,11 @@ static int nmk_i2c_xfer(struct i2c_adapter *i2c_adap,
        pm_runtime_get_sync(&dev->adev->dev);
-        clk_enable(dev->clk);
+        status = clk_prepare_enable(dev->clk);
+        if (status) {
+                dev_err(&dev->adev->dev, "can't prepare_enable clock\n");
+                goto out_clk;
+        }
        status = init_hw(dev);
        if (status)
@@ -671,7 +675,8 @@ static int nmk_i2c_xfer(struct i2c_adapter *i2c_adap,
        }
 out:
-        clk_disable(dev->clk);
+        clk_disable_unprepare(dev->clk);
+out_clk:
        pm_runtime_put_sync(&dev->adev->dev);
        dev->busy = false;
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index f981ac4e6783..dcea77bf6f50 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -742,7 +742,7 @@ static int __devinit tegra_i2c_probe(struct platform_device *pdev)
        }
        ret = devm_request_irq(&pdev->dev, i2c_dev->irq,
-                        tegra_i2c_isr, 0, pdev->name, i2c_dev);
+                        tegra_i2c_isr, 0, dev_name(&pdev->dev), i2c_dev);
        if (ret) {
                dev_err(&pdev->dev, "Failed to request irq %i\n", i2c_dev->irq);
                return ret;
diff --git a/drivers/i2c/busses/i2c-stub.c b/drivers/i2c/i2c-stub.c
index b1b3447942c9..d0a9c590c3cd 100644
--- a/drivers/i2c/busses/i2c-stub.c
+++ b/drivers/i2c/i2c-stub.c
@@ -2,7 +2,7 @@
    i2c-stub.c - I2C/SMBus chip emulator
    Copyright (c) 2004 Mark M. Hoffman <mhoffman@lightlink.com>
-    Copyright (C) 2007 Jean Delvare <khali@linux-fr.org>
+    Copyright (C) 2007, 2012 Jean Delvare <khali@linux-fr.org>
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -51,8 +51,8 @@ struct stub_chip {
 static struct stub_chip *stub_chips;
 /* Return negative errno on error. */
-static s32 stub_xfer(struct i2c_adapter * adap, u16 addr, unsigned short flags,
+static s32 stub_xfer(struct i2c_adapter *adap, u16 addr, unsigned short flags,
-        char read_write, u8 command, int size, union i2c_smbus_data * data)
+        char read_write, u8 command, int size, union i2c_smbus_data *data)
 {
        s32 ret;
        int i, len;
@@ -78,14 +78,14 @@ static s32 stub_xfer(struct i2c_adapter * adap, u16 addr, unsigned short flags,
        case I2C_SMBUS_BYTE:
                if (read_write == I2C_SMBUS_WRITE) {
                        chip->pointer = command;
-                        dev_dbg(&adap->dev, "smbus byte - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "wrote 0x%02x.\n",
+                                "smbus byte - addr 0x%02x, wrote 0x%02x.\n",
-                                        addr, command);
+                                addr, command);
                } else {
                        data->byte = chip->words[chip->pointer++] & 0xff;
-                        dev_dbg(&adap->dev, "smbus byte - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "read  0x%02x.\n",
+                                "smbus byte - addr 0x%02x, read  0x%02x.\n",
-                                        addr, data->byte);
+                                addr, data->byte);
                }
                ret = 0;
@@ -95,14 +95,14 @@ static s32 stub_xfer(struct i2c_adapter * adap, u16 addr, unsigned short flags,
                if (read_write == I2C_SMBUS_WRITE) {
                        chip->words[command] &= 0xff00;
                        chip->words[command] |= data->byte;
-                        dev_dbg(&adap->dev, "smbus byte data - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "wrote 0x%02x at 0x%02x.\n",
+                                "smbus byte data - addr 0x%02x, wrote 0x%02x at 0x%02x.\n",
-                                        addr, data->byte, command);
+                                addr, data->byte, command);
                } else {
                        data->byte = chip->words[command] & 0xff;
-                        dev_dbg(&adap->dev, "smbus byte data - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "read  0x%02x at 0x%02x.\n",
+                                "smbus byte data - addr 0x%02x, read  0x%02x at 0x%02x.\n",
-                                        addr, data->byte, command);
+                                addr, data->byte, command);
                }
                chip->pointer = command + 1;
@@ -112,14 +112,14 @@ static s32 stub_xfer(struct i2c_adapter * adap, u16 addr, unsigned short flags,
        case I2C_SMBUS_WORD_DATA:
                if (read_write == I2C_SMBUS_WRITE) {
                        chip->words[command] = data->word;
-                        dev_dbg(&adap->dev, "smbus word data - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "wrote 0x%04x at 0x%02x.\n",
+                                "smbus word data - addr 0x%02x, wrote 0x%04x at 0x%02x.\n",
-                                        addr, data->word, command);
+                                addr, data->word, command);
                } else {
                        data->word = chip->words[command];
-                        dev_dbg(&adap->dev, "smbus word data - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "read  0x%04x at 0x%02x.\n",
+                                "smbus word data - addr 0x%02x, read  0x%04x at 0x%02x.\n",
-                                        addr, data->word, command);
+                                addr, data->word, command);
                }
                ret = 0;
@@ -132,17 +132,17 @@ static s32 stub_xfer(struct i2c_adapter * adap, u16 addr, unsigned short flags,
                                chip->words[command + i] &= 0xff00;
                                chip->words[command + i] |= data->block[1 + i];
                        }
-                        dev_dbg(&adap->dev, "i2c block data - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "wrote %d bytes at 0x%02x.\n",
+                                "i2c block data - addr 0x%02x, wrote %d bytes at 0x%02x.\n",
-                                        addr, len, command);
+                                addr, len, command);
                } else {
                        for (i = 0; i < len; i++) {
                                data->block[1 + i] =
                                        chip->words[command + i] & 0xff;
                        }
-                        dev_dbg(&adap->dev, "i2c block data - addr 0x%02x, "
+                        dev_dbg(&adap->dev,
-                                        "read  %d bytes at 0x%02x.\n",
+                                "i2c block data - addr 0x%02x, read  %d bytes at 0x%02x.\n",
-                                        addr, len, command);
+                                addr, len, command);
                }
                ret = 0;
@@ -179,25 +179,24 @@ static int __init i2c_stub_init(void)
        int i, ret;
        if (!chip_addr[0]) {
-                printk(KERN_ERR "i2c-stub: Please specify a chip address\n");
+                pr_err("i2c-stub: Please specify a chip address\n");
                return -ENODEV;
        }
        for (i = 0; i < MAX_CHIPS && chip_addr[i]; i++) {
                if (chip_addr[i] < 0x03 || chip_addr[i] > 0x77) {
-                        printk(KERN_ERR "i2c-stub: Invalid chip address "
+                        pr_err("i2c-stub: Invalid chip address 0x%02x\n",
-                               "0x%02x\n", chip_addr[i]);
+                               chip_addr[i]);
                        return -EINVAL;
                }
-                printk(KERN_INFO "i2c-stub: Virtual chip at 0x%02x\n",
+                pr_info("i2c-stub: Virtual chip at 0x%02x\n", chip_addr[i]);
-                       chip_addr[i]);
        }
        /* Allocate memory for all chips at once */
        stub_chips = kzalloc(i * sizeof(struct stub_chip), GFP_KERNEL);
        if (!stub_chips) {
-                printk(KERN_ERR "i2c-stub: Out of memory\n");
+                pr_err("i2c-stub: Out of memory\n");
                return -ENOMEM;
        }
@@ -219,4 +218,3 @@ MODULE_LICENSE("GPL");
 module_init(i2c_stub_init);
 module_exit(i2c_stub_exit);
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 57e07c61ace2..afd81790ab3c 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -468,7 +468,7 @@ struct ib_mr *c4iw_register_phys_mem(struct ib_pd *pd,
        ret = alloc_pbl(mhp, npages);
        if (ret) {
                kfree(page_list);
-                goto err_pbl;
+                goto err;
        }
        ret = write_pbl(&mhp->rhp->rdev, page_list, mhp->attr.pbl_addr,
diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c
index d2fb38d43571..2f215b93db6b 100644
--- a/drivers/infiniband/hw/mlx4/alias_GUID.c
+++ b/drivers/infiniband/hw/mlx4/alias_GUID.c
@@ -107,7 +107,7 @@ static __be64 get_cached_alias_guid(struct mlx4_ib_dev *dev, int port, int index
 {
        if (index >= NUM_ALIAS_GUID_PER_PORT) {
                pr_err("%s: ERROR: asked for index:%d\n", __func__, index);
-                return  (__force __be64) ((u64) 0xFFFFFFFFFFFFFFFFUL);
+                return (__force __be64) -1;
        }
        return *(__be64 *)&dev->sriov.demux[port - 1].guid_cache[index];
 }
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 21a794152d15..0a903c129f0a 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -409,38 +409,45 @@ int mlx4_ib_find_real_gid(struct ib_device *ibdev, u8 port, __be64 guid)
 }
-static int get_pkey_phys_indices(struct mlx4_ib_dev *ibdev, u8 port, u8 ph_pkey_ix,
+static int find_slave_port_pkey_ix(struct mlx4_ib_dev *dev, int slave,
-                                 u8 *full_pk_ix, u8 *partial_pk_ix,
+                                   u8 port, u16 pkey, u16 *ix)
-                                 int *is_full_member)
 {
-        u16 search_pkey;
+        int i, ret;
-        int fm;
+        u8 unassigned_pkey_ix, pkey_ix, partial_ix = 0xFF;
-        int err = 0;
+        u16 slot_pkey;
-        u16 pk;
-        err = ib_get_cached_pkey(&ibdev->ib_dev, port, ph_pkey_ix, &search_pkey);
+        if (slave == mlx4_master_func_num(dev->dev))
-        if (err)
+                return ib_find_cached_pkey(&dev->ib_dev, port, pkey, ix);
-                return err;
-        fm = (search_pkey & 0x8000) ? 1 : 0;
+        unassigned_pkey_ix = dev->dev->phys_caps.pkey_phys_table_len[port] - 1;
-        if (fm) {
-                *full_pk_ix = ph_pkey_ix;
-                search_pkey &= 0x7FFF;
-        } else {
-                *partial_pk_ix = ph_pkey_ix;
-                search_pkey |= 0x8000;
-        }
-        if (ib_find_exact_cached_pkey(&ibdev->ib_dev, port, search_pkey, &pk))
+        for (i = 0; i < dev->dev->caps.pkey_table_len[port]; i++) {
-                pk = 0xFFFF;
+                if (dev->pkeys.virt2phys_pkey[slave][port - 1][i] == unassigned_pkey_ix)
+                        continue;
-        if (fm)
+                pkey_ix = dev->pkeys.virt2phys_pkey[slave][port - 1][i];
-                *partial_pk_ix = (pk & 0xFF);
-        else
-                *full_pk_ix = (pk & 0xFF);
-        *is_full_member = fm;
+                ret = ib_get_cached_pkey(&dev->ib_dev, port, pkey_ix, &slot_pkey);
-        return err;
+                if (ret)
+                        continue;
+                if ((slot_pkey & 0x7FFF) == (pkey & 0x7FFF)) {
+                        if (slot_pkey & 0x8000) {
+                                *ix = (u16) pkey_ix;
+                                return 0;
+                        } else {
+                                /* take first partial pkey index found */
+                                if (partial_ix == 0xFF)
+                                        partial_ix = pkey_ix;
+                        }
+                }
+        }
+        if (partial_ix < 0xFF) {
+                *ix = (u16) partial_ix;
+                return 0;
+        }
+        return -EINVAL;
 }
 int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
@@ -458,10 +465,8 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
        unsigned tun_tx_ix = 0;
        int dqpn;
        int ret = 0;
-        int i;
-        int is_full_member = 0;
        u16 tun_pkey_ix;
-        u8 ph_pkey_ix, full_pk_ix = 0, partial_pk_ix = 0;
+        u16 cached_pkey;
        if (dest_qpt > IB_QPT_GSI)
                return -EINVAL;
@@ -481,27 +486,17 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
        else
                tun_qp = &tun_ctx->qp[1];
-        /* compute pkey index for slave */
+        /* compute P_Key index to put in tunnel header for slave */
-        /* get physical pkey -- virtualized Dom0 pkey to phys*/
        if (dest_qpt) {
-                ph_pkey_ix =
+                u16 pkey_ix;
-                        dev->pkeys.virt2phys_pkey[mlx4_master_func_num(dev->dev)][port - 1][wc->pkey_index];
+                ret = ib_get_cached_pkey(&dev->ib_dev, port, wc->pkey_index, &cached_pkey);
-                /* now, translate this to the slave pkey index */
-                ret = get_pkey_phys_indices(dev, port, ph_pkey_ix, &full_pk_ix,
-                                            &partial_pk_ix, &is_full_member);
                if (ret)
                        return -EINVAL;
-                for (i = 0; i < dev->dev->caps.pkey_table_len[port]; i++) {
+                ret = find_slave_port_pkey_ix(dev, slave, port, cached_pkey, &pkey_ix);
-                        if ((dev->pkeys.virt2phys_pkey[slave][port - 1][i] == full_pk_ix) ||
+                if (ret)
-                            (is_full_member &&
-                             (dev->pkeys.virt2phys_pkey[slave][port - 1][i] == partial_pk_ix)))
-                                break;
-                }
-                if (i == dev->dev->caps.pkey_table_len[port])
                        return -EINVAL;
-                tun_pkey_ix = i;
+                tun_pkey_ix = pkey_ix;
        } else
                tun_pkey_ix = dev->pkeys.virt2phys_pkey[slave][port - 1][0];
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 3c3b54c3fdd9..25b2cdff00f8 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -233,7 +233,8 @@ static int send_mad_to_slave(int slave, struct mlx4_ib_demux_ctx *ctx,
        ib_query_ah(dev->sm_ah[ctx->port - 1], &ah_attr);
-        wc.pkey_index = 0;
+        if (ib_find_cached_pkey(&dev->ib_dev, ctx->port, IB_DEFAULT_PKEY_FULL, &wc.pkey_index))
+                return -EINVAL;
        wc.sl = 0;
        wc.dlid_path_bits = 0;
        wc.port_num = ctx->port;
@@ -1074,10 +1075,6 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy
        unsigned long end;
        int count;
-        if (ctx->flushing)
-                return;
-        ctx->flushing = 1;
        for (i = 0; i < MAX_VFS; ++i)
                clean_vf_mcast(ctx, i);
@@ -1107,9 +1104,6 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy
                force_clean_group(group);
        }
        mutex_unlock(&ctx->mcg_table_lock);
-        if (!destroy_wq)
-                ctx->flushing = 0;
 }
 struct clean_work {
@@ -1123,6 +1117,7 @@ static void mcg_clean_task(struct work_struct *work)
        struct clean_work *cw = container_of(work, struct clean_work, work);
        _mlx4_ib_mcg_port_cleanup(cw->ctx, cw->destroy_wq);
+        cw->ctx->flushing = 0;
        kfree(cw);
 }
@@ -1130,13 +1125,20 @@ void mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy_wq)
 {
        struct clean_work *work;
+        if (ctx->flushing)
+                return;
+        ctx->flushing = 1;
        if (destroy_wq) {
                _mlx4_ib_mcg_port_cleanup(ctx, destroy_wq);
+                ctx->flushing = 0;
                return;
        }
        work = kmalloc(sizeof *work, GFP_KERNEL);
        if (!work) {
+                ctx->flushing = 0;
                mcg_warn("failed allocating work for cleanup\n");
                return;
        }
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index b4b65af8612a..de0874054e9f 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -335,6 +335,7 @@ config KEYBOARD_LOCOMO
 config KEYBOARD_LPC32XX
        tristate "LPC32XX matrix key scanner support"
        depends on ARCH_LPC32XX && OF
+        select INPUT_MATRIXKMAP
        help
          Say Y here if you want to use NXP LPC32XX SoC key scanner interface,
          connected to a key matrix.
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index 803ff6fe021e..cad9d5dd5973 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -368,6 +368,9 @@ static void pxa27x_keypad_config(struct pxa27x_keypad *keypad)
        unsigned int mask = 0, direct_key_num = 0;
        unsigned long kpc = 0;
+        /* clear pending interrupt bit */
+        keypad_readl(KPC);
        /* enable matrix keys with automatic scan */
        if (pdata->matrix_key_rows && pdata->matrix_key_cols) {
                kpc |= KPC_ASACT | KPC_MIE | KPC_ME | KPC_MS_ALL;
diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c
index 02ca8680ea5b..6f7d99013031 100644
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -311,7 +311,6 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
        case XenbusStateReconfiguring:
        case XenbusStateReconfigured:
        case XenbusStateUnknown:
-        case XenbusStateClosed:
                break;
        case XenbusStateInitWait:
@@ -350,6 +349,10 @@ InitWait:
                break;
+        case XenbusStateClosed:
+                if (dev->state == XenbusStateClosed)
+                        break;
+                /* Missed the backend's CLOSING state -- fallthrough */
        case XenbusStateClosing:
                xenbus_frontend_closed(dev);
                break;
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 3a78f235fa3e..2baff1b79a55 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -84,6 +84,10 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI    0x0262
 #define USB_DEVICE_ID_APPLE_WELLSPRING7_ISO     0x0263
 #define USB_DEVICE_ID_APPLE_WELLSPRING7_JIS     0x0264
+/* MacbookPro10,2 (unibody, October 2012) */
+#define USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI   0x0259
+#define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO    0x025a
+#define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS    0x025b
 #define BCM5974_DEVICE(prod) {                                  \
        .match_flags = (USB_DEVICE_ID_MATCH_DEVICE |            \
@@ -137,6 +141,10 @@ static const struct usb_device_id bcm5974_table[] = {
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7_ISO),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7_JIS),
+        /* MacbookPro10,2 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS),
        /* Terminating entry */
        {}
 };
@@ -379,6 +387,19 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                { SN_COORD, -150, 6730 },
                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
        },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4750, 5280 },
+                { SN_COORD, -150, 6730 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
+        },
        {}
 };
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 2c1e12bf2ab4..858ad446de91 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -391,7 +391,7 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                                        features->pktlen = WACOM_PKGLEN_TPC2FG;
                                                }
-                                                if (features->type == MTSCREEN || WACOM_24HDT)
+                                                if (features->type == MTSCREEN || features->type == WACOM_24HDT)
                                                        features->pktlen = WACOM_PKGLEN_MTOUCH;
                                                if (features->type == BAMBOO_PT) {
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index aa6010131179..0a67031ffc13 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1518,6 +1518,9 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
                input_set_abs_params(input_dev, ABS_THROTTLE, 0, 71, 0, 0);
+                __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
                wacom_setup_cintiq(wacom_wac);
                break;
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 1ba232cbc09d..f7668b24c378 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -239,7 +239,7 @@ config TOUCHSCREEN_EETI
 config TOUCHSCREEN_EGALAX
        tristate "EETI eGalax multi-touch panel support"
-        depends on I2C
+        depends on I2C && OF
        help
          Say Y here to enable support for I2C connected EETI
          eGalax multi-touch panels.
diff --git a/drivers/input/touchscreen/egalax_ts.c b/drivers/input/touchscreen/egalax_ts.c
index c1e3460f1195..13fa62fdfb0b 100644
--- a/drivers/input/touchscreen/egalax_ts.c
+++ b/drivers/input/touchscreen/egalax_ts.c
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/bitops.h>
 #include <linux/input/mt.h>
+#include <linux/of_gpio.h>
 /*
 * Mouse Mode: some panel may configure the controller to mouse mode,
@@ -122,9 +123,17 @@ static irqreturn_t egalax_ts_interrupt(int irq, void *dev_id)
 /* wake up controller by an falling edge of interrupt gpio.  */
 static int egalax_wake_up_device(struct i2c_client *client)
 {
-        int gpio = irq_to_gpio(client->irq);
+        struct device_node *np = client->dev.of_node;
+        int gpio;
        int ret;
+        if (!np)
+                return -ENODEV;
+        gpio = of_get_named_gpio(np, "wakeup-gpios", 0);
+        if (!gpio_is_valid(gpio))
+                return -ENODEV;
        ret = gpio_request(gpio, "egalax_irq");
        if (ret < 0) {
                dev_err(&client->dev,
@@ -181,7 +190,11 @@ static int __devinit egalax_ts_probe(struct i2c_client *client,
        ts->input_dev = input_dev;
        /* controller may be in sleep, wake it up. */
-        egalax_wake_up_device(client);
+        error = egalax_wake_up_device(client);
+        if (error) {
+                dev_err(&client->dev, "Failed to wake up the controller\n");
+                goto err_free_dev;
+        }
        ret = egalax_firmware_version(client);
        if (ret < 0) {
@@ -274,11 +287,17 @@ static int egalax_ts_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(egalax_ts_pm_ops, egalax_ts_suspend, egalax_ts_resume);
+static struct of_device_id egalax_ts_dt_ids[] = {
+        { .compatible = "eeti,egalax_ts" },
+        { /* sentinel */ }
+};
 static struct i2c_driver egalax_ts_driver = {
        .driver = {
                .name   = "egalax_ts",
                .owner  = THIS_MODULE,
                .pm     = &egalax_ts_pm_ops,
+                .of_match_table = of_match_ptr(egalax_ts_dt_ids),
        },
        .id_table       = egalax_ts_id,
        .probe          = egalax_ts_probe,
diff --git a/drivers/input/touchscreen/tsc40.c b/drivers/input/touchscreen/tsc40.c
index 63209aaa55f0..eb96f168fb9d 100644
--- a/drivers/input/touchscreen/tsc40.c
+++ b/drivers/input/touchscreen/tsc40.c
@@ -107,7 +107,6 @@ static int tsc_connect(struct serio *serio, struct serio_driver *drv)
        __set_bit(BTN_TOUCH, input_dev->keybit);
        input_set_abs_params(ptsc->dev, ABS_X, 0, 0x3ff, 0, 0);
        input_set_abs_params(ptsc->dev, ABS_Y, 0, 0x3ff, 0, 0);
-        input_set_abs_params(ptsc->dev, ABS_PRESSURE, 0, 0, 0, 0);
        serio_set_drvdata(serio, ptsc);
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 527588708948..c44950d3eb7b 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -617,7 +617,13 @@ static void int_in_work(struct work_struct *work)
        if (rc == 0)
                /* success, resubmit interrupt read URB */
                rc = usb_submit_urb(urb, GFP_ATOMIC);
-        if (rc != 0 && rc != -ENODEV) {
+        switch (rc) {
+        case 0:         /* success */
+        case -ENODEV:   /* device gone */
+        case -EINVAL:   /* URB already resubmitted, or terminal badness */
+                break;
+        default:        /* failure: try to recover by resetting the device */
                dev_err(cs->dev, "clear halt failed: %s\n", get_usb_rcmsg(rc));
                rc = usb_lock_device_for_reset(ucs->udev, ucs->interface);
                if (rc == 0) {
@@ -2442,7 +2448,9 @@ static void gigaset_disconnect(struct usb_interface *interface)
 }
 /* gigaset_suspend
- * This function is called before the USB connection is suspended.
+ * This function is called before the USB connection is suspended
+ * or before the USB device is reset.
+ * In the latter case, message == PMSG_ON.
 */
 static int gigaset_suspend(struct usb_interface *intf, pm_message_t message)
 {
@@ -2498,7 +2506,12 @@ static int gigaset_suspend(struct usb_interface *intf, pm_message_t message)
        del_timer_sync(&ucs->timer_atrdy);
        del_timer_sync(&ucs->timer_cmd_in);
        del_timer_sync(&ucs->timer_int_in);
-        cancel_work_sync(&ucs->int_in_wq);
+        /* don't try to cancel int_in_wq from within reset as it
+         * might be the one requesting the reset
+         */
+        if (message.event != PM_EVENT_ON)
+                cancel_work_sync(&ucs->int_in_wq);
        gig_dbg(DEBUG_SUSPEND, "suspend complete");
        return 0;
diff --git a/drivers/md/faulty.c b/drivers/md/faulty.c
index 45135f69509c..5e7dc772f5de 100644
--- a/drivers/md/faulty.c
+++ b/drivers/md/faulty.c
@@ -315,8 +315,11 @@ static int run(struct mddev *mddev)
        }
        conf->nfaults = 0;
-        rdev_for_each(rdev, mddev)
+        rdev_for_each(rdev, mddev) {
                conf->rdev = rdev;
+                disk_stack_limits(mddev->gendisk, rdev->bdev,
+                                  rdev->data_offset << 9);
+        }
        md_set_array_sectors(mddev, faulty_size(mddev, 0, 0));
        mddev->private = conf;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 8034fbd6190c..636bae0405e8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2710,7 +2710,7 @@ static struct r1conf *setup_conf(struct mddev *mddev)
                    || disk_idx < 0)
                        continue;
                if (test_bit(Replacement, &rdev->flags))
-                        disk = conf->mirrors + conf->raid_disks + disk_idx;
+                        disk = conf->mirrors + mddev->raid_disks + disk_idx;
                else
                        disk = conf->mirrors + disk_idx;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 906ccbd0f7dc..d1295aff4173 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1783,7 +1783,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                clear_bit(Unmerged, &rdev->flags);
        }
        md_integrity_add_rdev(rdev, mddev);
-        if (blk_queue_discard(bdev_get_queue(rdev->bdev)))
+        if (mddev->queue && blk_queue_discard(bdev_get_queue(rdev->bdev)))
                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
        print_conf(conf);
@@ -3613,11 +3613,14 @@ static int run(struct mddev *mddev)
                        discard_supported = true;
        }
-        if (discard_supported)
+        if (mddev->queue) {
-                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
+                if (discard_supported)
-        else
+                        queue_flag_set_unlocked(QUEUE_FLAG_DISCARD,
-                queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
+                                                mddev->queue);
+                else
+                        queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD,
+                                                  mddev->queue);
+        }
        /* need to check that every block has at least one working mirror */
        if (!enough(conf, -1)) {
                printk(KERN_ERR "md/raid10:%s: not enough operational mirrors.\n",
diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
index 660bbc528862..4d50da618166 100644
--- a/drivers/mmc/host/dw_mmc-exynos.c
+++ b/drivers/mmc/host/dw_mmc-exynos.c
@@ -208,7 +208,7 @@ static unsigned long exynos5250_dwmmc_caps[4] = {
        MMC_CAP_CMD23,
 };
-static struct dw_mci_drv_data exynos5250_drv_data = {
+static const struct dw_mci_drv_data exynos5250_drv_data = {
        .caps                   = exynos5250_dwmmc_caps,
        .init                   = dw_mci_exynos_priv_init,
        .setup_clock            = dw_mci_exynos_setup_clock,
@@ -220,14 +220,14 @@ static struct dw_mci_drv_data exynos5250_drv_data = {
 static const struct of_device_id dw_mci_exynos_match[] = {
        { .compatible = "samsung,exynos5250-dw-mshc",
-                        .data = (void *)&exynos5250_drv_data, },
+                        .data = &exynos5250_drv_data, },
        {},
 };
-MODULE_DEVICE_TABLE(of, dw_mci_pltfm_match);
+MODULE_DEVICE_TABLE(of, dw_mci_exynos_match);
 int dw_mci_exynos_probe(struct platform_device *pdev)
 {
-        struct dw_mci_drv_data *drv_data;
+        const struct dw_mci_drv_data *drv_data;
        const struct of_device_id *match;
        match = of_match_node(dw_mci_exynos_match, pdev->dev.of_node);
diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
index c960ca7ffbe6..917936bee5d5 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.c
+++ b/drivers/mmc/host/dw_mmc-pltfm.c
@@ -24,7 +24,7 @@
 #include "dw_mmc.h"
 int dw_mci_pltfm_register(struct platform_device *pdev,
-                                struct dw_mci_drv_data *drv_data)
+                                const struct dw_mci_drv_data *drv_data)
 {
        struct dw_mci *host;
        struct resource *regs;
@@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
        if (!host->regs)
                return -ENOMEM;
-        if (host->drv_data->init) {
+        if (drv_data && drv_data->init) {
-                ret = host->drv_data->init(host);
+                ret = drv_data->init(host);
                if (ret)
                        return ret;
        }
diff --git a/drivers/mmc/host/dw_mmc-pltfm.h b/drivers/mmc/host/dw_mmc-pltfm.h
index 301f24541fc2..2ac37b81de4d 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.h
+++ b/drivers/mmc/host/dw_mmc-pltfm.h
@@ -13,7 +13,7 @@
 #define _DW_MMC_PLTFM_H_
 extern int dw_mci_pltfm_register(struct platform_device *pdev,
-                                struct dw_mci_drv_data *drv_data);
+                                const struct dw_mci_drv_data *drv_data);
 extern int __devexit dw_mci_pltfm_remove(struct platform_device *pdev);
 extern const struct dev_pm_ops dw_mci_pltfm_pmops;
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index c2828f35c3b8..c0667c8af2bd 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
 {
        struct mmc_data *data;
        struct dw_mci_slot *slot = mmc_priv(mmc);
+        struct dw_mci_drv_data *drv_data = slot->host->drv_data;
        u32 cmdr;
        cmd->error = -EINPROGRESS;
@@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
                        cmdr |= SDMMC_CMD_DAT_WR;
        }
-        if (slot->host->drv_data->prepare_command)
+        if (drv_data && drv_data->prepare_command)
-                slot->host->drv_data->prepare_command(slot->host, &cmdr);
+                drv_data->prepare_command(slot->host, &cmdr);
        return cmdr;
 }
@@ -434,7 +435,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
        return 0;
 }
-static struct dw_mci_dma_ops dw_mci_idmac_ops = {
+static const struct dw_mci_dma_ops dw_mci_idmac_ops = {
        .init = dw_mci_idmac_init,
        .start = dw_mci_idmac_start_dma,
        .stop = dw_mci_idmac_stop_dma,
@@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
 static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 {
        struct dw_mci_slot *slot = mmc_priv(mmc);
+        struct dw_mci_drv_data *drv_data = slot->host->drv_data;
        u32 regs;
        /* set default 1 bit mode */
@@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                slot->clock = ios->clock;
        }
-        if (slot->host->drv_data->set_ios)
+        if (drv_data && drv_data->set_ios)
-                slot->host->drv_data->set_ios(slot->host, ios);
+                drv_data->set_ios(slot->host, ios);
        switch (ios->power_mode) {
        case MMC_POWER_UP:
@@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 {
        struct mmc_host *mmc;
        struct dw_mci_slot *slot;
+        struct dw_mci_drv_data *drv_data = host->drv_data;
        int ctrl_id, ret;
        u8 bus_width;
@@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
        } else {
                ctrl_id = to_platform_device(host->dev)->id;
        }
-        if (host->drv_data && host->drv_data->caps)
+        if (drv_data && drv_data->caps)
-                mmc->caps |= host->drv_data->caps[ctrl_id];
+                mmc->caps |= drv_data->caps[ctrl_id];
        if (host->pdata->caps2)
                mmc->caps2 = host->pdata->caps2;
@@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
        else
                bus_width = 1;
-        if (host->drv_data->setup_bus) {
+        if (drv_data && drv_data->setup_bus) {
                struct device_node *slot_np;
                slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
-                ret = host->drv_data->setup_bus(host, slot_np, bus_width);
+                ret = drv_data->setup_bus(host, slot_np, bus_width);
                if (ret)
                        goto err_setup_bus;
        }
@@ -1968,7 +1971,7 @@ static void dw_mci_init_dma(struct dw_mci *host)
        /* Determine which DMA interface to use */
 #ifdef CONFIG_MMC_DW_IDMAC
        host->dma_ops = &dw_mci_idmac_ops;
-        dev_info(&host->dev, "Using internal DMA controller.\n");
+        dev_info(host->dev, "Using internal DMA controller.\n");
 #endif
        if (!host->dma_ops)
@@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
        struct dw_mci_board *pdata;
        struct device *dev = host->dev;
        struct device_node *np = dev->of_node;
+        struct dw_mci_drv_data *drv_data = host->drv_data;
        int idx, ret;
        pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
@@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
        of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
-        if (host->drv_data->parse_dt) {
+        if (drv_data && drv_data->parse_dt) {
-                ret = host->drv_data->parse_dt(host);
+                ret = drv_data->parse_dt(host);
                if (ret)
                        return ERR_PTR(ret);
        }
@@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 int dw_mci_probe(struct dw_mci *host)
 {
+        struct dw_mci_drv_data *drv_data = host->drv_data;
        int width, i, ret = 0;
        u32 fifo_size;
        int init_slots = 0;
@@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
        else
                host->bus_hz = clk_get_rate(host->ciu_clk);
-        if (host->drv_data->setup_clock) {
+        if (drv_data && drv_data->setup_clock) {
-                ret = host->drv_data->setup_clock(host);
+                ret = drv_data->setup_clock(host);
                if (ret) {
                        dev_err(host->dev,
                                "implementation specific clock setup failed\n");
@@ -2228,6 +2233,21 @@ int dw_mci_probe(struct dw_mci *host)
        else
                host->num_slots = ((mci_readl(host, HCON) >> 1) & 0x1F) + 1;
+        /*
+         * Enable interrupts for command done, data over, data empty, card det,
+         * receive ready and error such as transmit, receive timeout, crc error
+         */
+        mci_writel(host, RINTSTS, 0xFFFFFFFF);
+        mci_writel(host, INTMASK, SDMMC_INT_CMD_DONE | SDMMC_INT_DATA_OVER |
+                   SDMMC_INT_TXDR | SDMMC_INT_RXDR |
+                   DW_MCI_ERROR_FLAGS | SDMMC_INT_CD);
+        mci_writel(host, CTRL, SDMMC_CTRL_INT_ENABLE); /* Enable mci interrupt */
+        dev_info(host->dev, "DW MMC controller at irq %d, "
+                 "%d bit host data width, "
+                 "%u deep fifo\n",
+                 host->irq, width, fifo_size);
        /* We need at least one slot to succeed */
        for (i = 0; i < host->num_slots; i++) {
                ret = dw_mci_init_slot(host, i);
@@ -2257,20 +2277,6 @@ int dw_mci_probe(struct dw_mci *host)
        else
                host->data_offset = DATA_240A_OFFSET;
-        /*
-         * Enable interrupts for command done, data over, data empty, card det,
-         * receive ready and error such as transmit, receive timeout, crc error
-         */
-        mci_writel(host, RINTSTS, 0xFFFFFFFF);
-        mci_writel(host, INTMASK, SDMMC_INT_CMD_DONE | SDMMC_INT_DATA_OVER |
-                   SDMMC_INT_TXDR | SDMMC_INT_RXDR |
-                   DW_MCI_ERROR_FLAGS | SDMMC_INT_CD);
-        mci_writel(host, CTRL, SDMMC_CTRL_INT_ENABLE); /* Enable mci interrupt */
-        dev_info(host->dev, "DW MMC controller at irq %d, "
-                 "%d bit host data width, "
-                 "%u deep fifo\n",
-                 host->irq, width, fifo_size);
        if (host->quirks & DW_MCI_QUIRK_IDMAC_DTO)
                dev_info(host->dev, "Internal DMAC interrupt fix enabled.\n");
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index 565c2e4fac75..6290b7f1ccfe 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -1134,4 +1134,4 @@ module_platform_driver(mxcmci_driver);
 MODULE_DESCRIPTION("i.MX Multimedia Card Interface Driver");
 MODULE_AUTHOR("Sascha Hauer, Pengutronix");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:imx-mmc");
+MODULE_ALIAS("platform:mxc-mmc");
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 54bfd0cc106b..fedd258cc4ea 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -178,7 +178,8 @@ struct omap_hsmmc_host {
 static int omap_hsmmc_card_detect(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        /* NOTE: assumes card detect signal is active-low */
        return !gpio_get_value_cansleep(mmc->slots[0].switch_pin);
@@ -186,7 +187,8 @@ static int omap_hsmmc_card_detect(struct device *dev, int slot)
 static int omap_hsmmc_get_wp(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        /* NOTE: assumes write protect signal is active-high */
        return gpio_get_value_cansleep(mmc->slots[0].gpio_wp);
@@ -194,7 +196,8 @@ static int omap_hsmmc_get_wp(struct device *dev, int slot)
 static int omap_hsmmc_get_cover_state(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        /* NOTE: assumes card detect signal is active-low */
        return !gpio_get_value_cansleep(mmc->slots[0].switch_pin);
@@ -204,7 +207,8 @@ static int omap_hsmmc_get_cover_state(struct device *dev, int slot)
 static int omap_hsmmc_suspend_cdirq(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        disable_irq(mmc->slots[0].card_detect_irq);
        return 0;
@@ -212,7 +216,8 @@ static int omap_hsmmc_suspend_cdirq(struct device *dev, int slot)
 static int omap_hsmmc_resume_cdirq(struct device *dev, int slot)
 {
-        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
+        struct omap_mmc_platform_data *mmc = host->pdata;
        enable_irq(mmc->slots[0].card_detect_irq);
        return 0;
@@ -2009,9 +2014,9 @@ static int __devexit omap_hsmmc_remove(struct platform_device *pdev)
                clk_put(host->dbclk);
        }
-        mmc_free_host(host->mmc);
+        omap_hsmmc_gpio_free(host->pdata);
        iounmap(host->base);
-        omap_hsmmc_gpio_free(pdev->dev.platform_data);
+        mmc_free_host(host->mmc);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (res)
diff --git a/drivers/mmc/host/sdhci-dove.c b/drivers/mmc/host/sdhci-dove.c
index 90140eb03e36..8fd50a211037 100644
--- a/drivers/mmc/host/sdhci-dove.c
+++ b/drivers/mmc/host/sdhci-dove.c
@@ -19,6 +19,7 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
+#include <linux/err.h>
 #include <linux/io.h>
 #include <linux/clk.h>
 #include <linux/err.h>
@@ -84,30 +85,32 @@ static int __devinit sdhci_dove_probe(struct platform_device *pdev)
        struct sdhci_dove_priv *priv;
        int ret;
-        ret = sdhci_pltfm_register(pdev, &sdhci_dove_pdata);
-        if (ret)
-                goto sdhci_dove_register_fail;
        priv = devm_kzalloc(&pdev->dev, sizeof(struct sdhci_dove_priv),
                            GFP_KERNEL);
        if (!priv) {
                dev_err(&pdev->dev, "unable to allocate private data");
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto sdhci_dove_allocate_fail;
        }
+        priv->clk = clk_get(&pdev->dev, NULL);
+        if (!IS_ERR(priv->clk))
+                clk_prepare_enable(priv->clk);
+        ret = sdhci_pltfm_register(pdev, &sdhci_dove_pdata);
+        if (ret)
+                goto sdhci_dove_register_fail;
        host = platform_get_drvdata(pdev);
        pltfm_host = sdhci_priv(host);
        pltfm_host->priv = priv;
-        priv->clk = clk_get(&pdev->dev, NULL);
-        if (!IS_ERR(priv->clk))
-                clk_prepare_enable(priv->clk);
        return 0;
-sdhci_dove_allocate_fail:
-        sdhci_pltfm_unregister(pdev);
 sdhci_dove_register_fail:
+        if (!IS_ERR(priv->clk)) {
+                clk_disable_unprepare(priv->clk);
+                clk_put(priv->clk);
+        }
        return ret;
 }
@@ -117,14 +120,13 @@ static int __devexit sdhci_dove_remove(struct platform_device *pdev)
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
        struct sdhci_dove_priv *priv = pltfm_host->priv;
-        if (priv->clk) {
+        sdhci_pltfm_unregister(pdev);
-                if (!IS_ERR(priv->clk)) {
-                        clk_disable_unprepare(priv->clk);
+        if (!IS_ERR(priv->clk)) {
-                        clk_put(priv->clk);
+                clk_disable_unprepare(priv->clk);
-                }
+                clk_put(priv->clk);
-                devm_kfree(&pdev->dev, priv->clk);
        }
-        return sdhci_pltfm_unregister(pdev);
+        return 0;
 }
 static const struct of_device_id sdhci_dove_of_match_table[] __devinitdata = {
diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
index ae5fcbfa1eef..63d219f57cae 100644
--- a/drivers/mmc/host/sdhci-of-esdhc.c
+++ b/drivers/mmc/host/sdhci-of-esdhc.c
@@ -169,6 +169,16 @@ static void esdhc_of_resume(struct sdhci_host *host)
 }
 #endif
+static void esdhc_of_platform_init(struct sdhci_host *host)
+{
+        u32 vvn;
+        vvn = in_be32(host->ioaddr + SDHCI_SLOT_INT_STATUS);
+        vvn = (vvn & SDHCI_VENDOR_VER_MASK) >> SDHCI_VENDOR_VER_SHIFT;
+        if (vvn == VENDOR_V_22)
+                host->quirks2 |= SDHCI_QUIRK2_HOST_NO_CMD23;
+}
 static struct sdhci_ops sdhci_esdhc_ops = {
        .read_l = esdhc_readl,
        .read_w = esdhc_readw,
@@ -180,6 +190,7 @@ static struct sdhci_ops sdhci_esdhc_ops = {
        .enable_dma = esdhc_of_enable_dma,
        .get_max_clock = esdhc_of_get_max_clock,
        .get_min_clock = esdhc_of_get_min_clock,
+        .platform_init = esdhc_of_platform_init,
 #ifdef CONFIG_PM
        .platform_suspend = esdhc_of_suspend,
        .platform_resume = esdhc_of_resume,
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 4bb74b042a06..04936f353ced 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -1196,7 +1196,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
                return ERR_PTR(-ENODEV);
        }
-        if (pci_resource_len(pdev, bar) != 0x100) {
+        if (pci_resource_len(pdev, bar) < 0x100) {
                dev_err(&pdev->dev, "Invalid iomem size. You may "
                        "experience problems.\n");
        }
diff --git a/drivers/mmc/host/sdhci-pltfm.c b/drivers/mmc/host/sdhci-pltfm.c
index 65551a9709cc..27164457f861 100644
--- a/drivers/mmc/host/sdhci-pltfm.c
+++ b/drivers/mmc/host/sdhci-pltfm.c
@@ -150,6 +150,13 @@ struct sdhci_host *sdhci_pltfm_init(struct platform_device *pdev,
                goto err_remap;
        }
+        /*
+         * Some platforms need to probe the controller to be able to
+         * determine which caps should be used.
+         */
+        if (host->ops && host->ops->platform_init)
+                host->ops->platform_init(host);
        platform_set_drvdata(pdev, host);
        return host;
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 2903949594c6..a54dd5d7a5f9 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -211,8 +211,8 @@ static void sdhci_s3c_set_clock(struct sdhci_host *host, unsigned int clock)
        if (ourhost->cur_clk != best_src) {
                struct clk *clk = ourhost->clk_bus[best_src];
-                clk_enable(clk);
+                clk_prepare_enable(clk);
-                clk_disable(ourhost->clk_bus[ourhost->cur_clk]);
+                clk_disable_unprepare(ourhost->clk_bus[ourhost->cur_clk]);
                /* turn clock off to card before changing clock source */
                writew(0, host->ioaddr + SDHCI_CLOCK_CONTROL);
@@ -607,7 +607,7 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        }
        /* enable the local io clock and keep it running for the moment. */
-        clk_enable(sc->clk_io);
+        clk_prepare_enable(sc->clk_io);
        for (clks = 0, ptr = 0; ptr < MAX_BUS_CLK; ptr++) {
                struct clk *clk;
@@ -638,7 +638,7 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        }
 #ifndef CONFIG_PM_RUNTIME
-        clk_enable(sc->clk_bus[sc->cur_clk]);
+        clk_prepare_enable(sc->clk_bus[sc->cur_clk]);
 #endif
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -747,13 +747,14 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
                sdhci_s3c_setup_card_detect_gpio(sc);
 #ifdef CONFIG_PM_RUNTIME
-        clk_disable(sc->clk_io);
+        if (pdata->cd_type != S3C_SDHCI_CD_INTERNAL)
+                clk_disable_unprepare(sc->clk_io);
 #endif
        return 0;
 err_req_regs:
 #ifndef CONFIG_PM_RUNTIME
-        clk_disable(sc->clk_bus[sc->cur_clk]);
+        clk_disable_unprepare(sc->clk_bus[sc->cur_clk]);
 #endif
        for (ptr = 0; ptr < MAX_BUS_CLK; ptr++) {
                if (sc->clk_bus[ptr]) {
@@ -762,7 +763,7 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        }
 err_no_busclks:
-        clk_disable(sc->clk_io);
+        clk_disable_unprepare(sc->clk_io);
        clk_put(sc->clk_io);
 err_io_clk:
@@ -794,7 +795,8 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
                gpio_free(sc->ext_cd_gpio);
 #ifdef CONFIG_PM_RUNTIME
-        clk_enable(sc->clk_io);
+        if (pdata->cd_type != S3C_SDHCI_CD_INTERNAL)
+                clk_prepare_enable(sc->clk_io);
 #endif
        sdhci_remove_host(host, 1);
@@ -802,14 +804,14 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
        pm_runtime_disable(&pdev->dev);
 #ifndef CONFIG_PM_RUNTIME
-        clk_disable(sc->clk_bus[sc->cur_clk]);
+        clk_disable_unprepare(sc->clk_bus[sc->cur_clk]);
 #endif
        for (ptr = 0; ptr < MAX_BUS_CLK; ptr++) {
                if (sc->clk_bus[ptr]) {
                        clk_put(sc->clk_bus[ptr]);
                }
        }
-        clk_disable(sc->clk_io);
+        clk_disable_unprepare(sc->clk_io);
        clk_put(sc->clk_io);
        if (pdev->dev.of_node) {
@@ -849,8 +851,8 @@ static int sdhci_s3c_runtime_suspend(struct device *dev)
        ret = sdhci_runtime_suspend_host(host);
-        clk_disable(ourhost->clk_bus[ourhost->cur_clk]);
+        clk_disable_unprepare(ourhost->clk_bus[ourhost->cur_clk]);
-        clk_disable(busclk);
+        clk_disable_unprepare(busclk);
        return ret;
 }
@@ -861,8 +863,8 @@ static int sdhci_s3c_runtime_resume(struct device *dev)
        struct clk *busclk = ourhost->clk_io;
        int ret;
-        clk_enable(busclk);
+        clk_prepare_enable(busclk);
-        clk_enable(ourhost->clk_bus[ourhost->cur_clk]);
+        clk_prepare_enable(ourhost->clk_bus[ourhost->cur_clk]);
        ret = sdhci_runtime_resume_host(host);
        return ret;
 }
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 7922adb42386..c7851c0aabce 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1315,16 +1315,19 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
                 */
                if ((host->flags & SDHCI_NEEDS_RETUNING) &&
                    !(present_state & (SDHCI_DOING_WRITE | SDHCI_DOING_READ))) {
-                        /* eMMC uses cmd21 while sd and sdio use cmd19 */
+                        if (mmc->card) {
-                        tuning_opcode = mmc->card->type == MMC_TYPE_MMC ?
+                                /* eMMC uses cmd21 but sd and sdio use cmd19 */
-                                MMC_SEND_TUNING_BLOCK_HS200 :
+                                tuning_opcode =
-                                MMC_SEND_TUNING_BLOCK;
+                                        mmc->card->type == MMC_TYPE_MMC ?
-                        spin_unlock_irqrestore(&host->lock, flags);
+                                        MMC_SEND_TUNING_BLOCK_HS200 :
-                        sdhci_execute_tuning(mmc, tuning_opcode);
+                                        MMC_SEND_TUNING_BLOCK;
-                        spin_lock_irqsave(&host->lock, flags);
+                                spin_unlock_irqrestore(&host->lock, flags);
+                                sdhci_execute_tuning(mmc, tuning_opcode);
-                        /* Restore original mmc_request structure */
+                                spin_lock_irqsave(&host->lock, flags);
-                        host->mrq = mrq;
+                                /* Restore original mmc_request structure */
+                                host->mrq = mrq;
+                        }
                }
                if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))
@@ -2837,6 +2840,9 @@ int sdhci_add_host(struct sdhci_host *host)
        if (!(host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA))
                mmc->caps |= MMC_CAP_4_BIT_DATA;
+        if (host->quirks2 & SDHCI_QUIRK2_HOST_NO_CMD23)
+                mmc->caps &= ~MMC_CAP_CMD23;
        if (caps[0] & SDHCI_CAN_DO_HISPD)
                mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED;
@@ -2846,9 +2852,12 @@ int sdhci_add_host(struct sdhci_host *host)
        /* If vqmmc regulator and no 1.8V signalling, then there's no UHS */
        host->vqmmc = regulator_get(mmc_dev(mmc), "vqmmc");
-        if (IS_ERR(host->vqmmc)) {
+        if (IS_ERR_OR_NULL(host->vqmmc)) {
-                pr_info("%s: no vqmmc regulator found\n", mmc_hostname(mmc));
+                if (PTR_ERR(host->vqmmc) < 0) {
-                host->vqmmc = NULL;
+                        pr_info("%s: no vqmmc regulator found\n",
+                                mmc_hostname(mmc));
+                        host->vqmmc = NULL;
+                }
        }
        else if (regulator_is_supported_voltage(host->vqmmc, 1800000, 1800000))
                regulator_enable(host->vqmmc);
@@ -2904,9 +2913,12 @@ int sdhci_add_host(struct sdhci_host *host)
        ocr_avail = 0;
        host->vmmc = regulator_get(mmc_dev(mmc), "vmmc");
-        if (IS_ERR(host->vmmc)) {
+        if (IS_ERR_OR_NULL(host->vmmc)) {
-                pr_info("%s: no vmmc regulator found\n", mmc_hostname(mmc));
+                if (PTR_ERR(host->vmmc) < 0) {
-                host->vmmc = NULL;
+                        pr_info("%s: no vmmc regulator found\n",
+                                mmc_hostname(mmc));
+                        host->vmmc = NULL;
+                }
        } else
                regulator_enable(host->vmmc);
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 97653ea8942b..71a4a7ed46c5 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -278,6 +278,7 @@ struct sdhci_ops {
        void    (*hw_reset)(struct sdhci_host *host);
        void    (*platform_suspend)(struct sdhci_host *host);
        void    (*platform_resume)(struct sdhci_host *host);
+        void    (*platform_init)(struct sdhci_host *host);
 };
 #ifdef CONFIG_MMC_SDHCI_IO_ACCESSORS
diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index 11d2bc3b51d5..d25bc97dc5c6 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -1466,9 +1466,9 @@ static int __devexit sh_mmcif_remove(struct platform_device *pdev)
        platform_set_drvdata(pdev, NULL);
+        clk_disable(host->hclk);
        mmc_free_host(host->mmc);
        pm_runtime_put_sync(&pdev->dev);
-        clk_disable(host->hclk);
        pm_runtime_disable(&pdev->dev);
        return 0;
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index dc15d248443f..ef8d2a080d17 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1060,7 +1060,7 @@ static ssize_t bonding_store_primary(struct device *d,
                goto out;
        }
-        sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
+        sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
        /* check to see if we are clearing primary */
        if (!strlen(ifname) || buf[0] == '\n') {
@@ -1237,7 +1237,7 @@ static ssize_t bonding_store_active_slave(struct device *d,
                goto out;
        }
-        sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
+        sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
        /* check to see if we are clearing active */
        if (!strlen(ifname) || buf[0] == '\n') {
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index c78ecfca1e45..a412bf6d73ef 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -144,9 +144,22 @@
 #define FLEXCAN_MB_CODE_MASK            (0xf0ffffff)
-/* FLEXCAN hardware feature flags */
+/*
+ * FLEXCAN hardware feature flags
+ *
+ * Below is some version info we got:
+ *    SOC   Version   IP-Version  Glitch-  [TR]WRN_INT
+ *                                Filter?   connected?
+ *   MX25  FlexCAN2  03.00.00.00     no         no
+ *   MX28  FlexCAN2  03.00.04.00    yes        yes
+ *   MX35  FlexCAN2  03.00.00.00     no         no
+ *   MX53  FlexCAN2  03.00.00.00    yes         no
+ *   MX6s  FlexCAN3  10.00.12.00    yes        yes
+ *
+ * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
+ */
 #define FLEXCAN_HAS_V10_FEATURES        BIT(1) /* For core version >= 10 */
-#define FLEXCAN_HAS_BROKEN_ERR_STATE    BIT(2) /* Broken error state handling */
+#define FLEXCAN_HAS_BROKEN_ERR_STATE    BIT(2) /* [TR]WRN_INT not connected */
 /* Structure of the message buffer */
 struct flexcan_mb {
@@ -205,7 +218,7 @@ static struct flexcan_devtype_data fsl_p1010_devtype_data = {
 };
 static struct flexcan_devtype_data fsl_imx28_devtype_data;
 static struct flexcan_devtype_data fsl_imx6q_devtype_data = {
-        .features = FLEXCAN_HAS_V10_FEATURES | FLEXCAN_HAS_BROKEN_ERR_STATE,
+        .features = FLEXCAN_HAS_V10_FEATURES,
 };
 static const struct can_bittiming_const flexcan_bittiming_const = {
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index f5b82aeb2540..6525dbcca4e3 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -30,9 +30,10 @@
 #include "sja1000.h"
-MODULE_AUTHOR("Wolfgang Grandegger <wg@grandegger.com>");
+MODULE_AUTHOR("Stephane Grosjean <s.grosjean@peak-system.com>");
 MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCI family cards");
 MODULE_SUPPORTED_DEVICE("PEAK PCAN PCI/PCIe/PCIeC miniPCI CAN cards");
+MODULE_SUPPORTED_DEVICE("PEAK PCAN miniPCIe/cPCI PC/104+ PCI/104e CAN Cards");
 MODULE_LICENSE("GPL v2");
 #define DRV_NAME  "peak_pci"
@@ -64,7 +65,11 @@ struct peak_pci_chan {
 #define PEAK_PCI_DEVICE_ID      0x0001  /* for PCI/PCIe slot cards */
 #define PEAK_PCIEC_DEVICE_ID    0x0002  /* for ExpressCard slot cards */
 #define PEAK_PCIE_DEVICE_ID     0x0003  /* for nextgen PCIe slot cards */
-#define PEAK_MPCI_DEVICE_ID     0x0008  /* The miniPCI slot cards */
+#define PEAK_CPCI_DEVICE_ID     0x0004  /* for nextgen cPCI slot cards */
+#define PEAK_MPCI_DEVICE_ID     0x0005  /* for nextgen miniPCI slot cards */
+#define PEAK_PC_104P_DEVICE_ID  0x0006  /* PCAN-PC/104+ cards */
+#define PEAK_PCI_104E_DEVICE_ID 0x0007  /* PCAN-PCI/104 Express cards */
+#define PEAK_MPCIE_DEVICE_ID    0x0008  /* The miniPCIe slot cards */
 #define PEAK_PCI_CHAN_MAX       4
@@ -76,6 +81,10 @@ static DEFINE_PCI_DEVICE_TABLE(peak_pci_tbl) = {
        {PEAK_PCI_VENDOR_ID, PEAK_PCI_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
        {PEAK_PCI_VENDOR_ID, PEAK_PCIE_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
        {PEAK_PCI_VENDOR_ID, PEAK_MPCI_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_MPCIE_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_PC_104P_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_PCI_104E_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_CPCI_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
 #ifdef CONFIG_CAN_PEAK_PCIEC
        {PEAK_PCI_VENDOR_ID, PEAK_PCIEC_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
 #endif
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index e2e45ee5df33..6dd0dd076cc5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -137,7 +137,16 @@
 #define LINK_20GTFD             LINK_STATUS_SPEED_AND_DUPLEX_20GTFD
 #define LINK_20GXFD             LINK_STATUS_SPEED_AND_DUPLEX_20GXFD
+#define LINK_UPDATE_MASK \
+                        (LINK_STATUS_SPEED_AND_DUPLEX_MASK | \
+                         LINK_STATUS_LINK_UP | \
+                         LINK_STATUS_PHYSICAL_LINK_FLAG | \
+                         LINK_STATUS_AUTO_NEGOTIATE_COMPLETE | \
+                         LINK_STATUS_RX_FLOW_CONTROL_FLAG_MASK | \
+                         LINK_STATUS_TX_FLOW_CONTROL_FLAG_MASK | \
+                         LINK_STATUS_PARALLEL_DETECTION_FLAG_MASK | \
+                         LINK_STATUS_LINK_PARTNER_SYMMETRIC_PAUSE | \
+                         LINK_STATUS_LINK_PARTNER_ASYMMETRIC_PAUSE)
 #define SFP_EEPROM_CON_TYPE_ADDR                0x2
        #define SFP_EEPROM_CON_TYPE_VAL_LC      0x7
@@ -3295,6 +3304,21 @@ static void bnx2x_serdes_deassert(struct bnx2x *bp, u8 port)
               DEFAULT_PHY_DEV_ADDR);
 }
+static void bnx2x_xgxs_specific_func(struct bnx2x_phy *phy,
+                                     struct link_params *params,
+                                     u32 action)
+{
+        struct bnx2x *bp = params->bp;
+        switch (action) {
+        case PHY_INIT:
+                /* Set correct devad */
+                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_ST + params->port*0x18, 0);
+                REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + params->port*0x18,
+                       phy->def_md_devad);
+                break;
+        }
+}
 static void bnx2x_xgxs_deassert(struct link_params *params)
 {
        struct bnx2x *bp = params->bp;
@@ -3309,10 +3333,8 @@ static void bnx2x_xgxs_deassert(struct link_params *params)
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_CLEAR, val);
        udelay(500);
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_3_SET, val);
+        bnx2x_xgxs_specific_func(&params->phy[INT_PHY], params,
-        REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_ST + port*0x18, 0);
+                                 PHY_INIT);
-        REG_WR(bp, NIG_REG_XGXS0_CTRL_MD_DEVAD + port*0x18,
-               params->phy[INT_PHY].def_md_devad);
 }
 static void bnx2x_calc_ieee_aneg_adv(struct bnx2x_phy *phy,
@@ -3545,14 +3567,11 @@ static void bnx2x_warpcore_set_lpi_passthrough(struct bnx2x_phy *phy,
 static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                                        struct link_params *params,
                                        struct link_vars *vars) {
-        u16 val16 = 0, lane, i;
+        u16 lane, i, cl72_ctrl, an_adv = 0;
+        u16 ucode_ver;
        struct bnx2x *bp = params->bp;
        static struct bnx2x_reg_set reg_set[] = {
                {MDIO_WC_DEVAD, MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X2, 0x7},
-                {MDIO_AN_DEVAD, MDIO_WC_REG_PAR_DET_10G_CTRL, 0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL72_USERB0_CL72_MISC1_CONTROL, 0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_XGXSBLK1_LANECTRL0, 0xff},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_XGXSBLK1_LANECTRL1, 0x5555},
                {MDIO_PMA_DEVAD, MDIO_WC_REG_IEEE0BLK_AUTONEGNP, 0x0},
                {MDIO_WC_DEVAD, MDIO_WC_REG_RX66_CONTROL, 0x7415},
                {MDIO_WC_DEVAD, MDIO_WC_REG_SERDESDIGITAL_MISC2, 0x6190},
@@ -3565,12 +3584,19 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
                                 reg_set[i].val);
+        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
+                MDIO_WC_REG_CL72_USERB0_CL72_MISC1_CONTROL, &cl72_ctrl);
+        cl72_ctrl &= 0xf8ff;
+        cl72_ctrl |= 0x3800;
+        bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                MDIO_WC_REG_CL72_USERB0_CL72_MISC1_CONTROL, cl72_ctrl);
        /* Check adding advertisement for 1G KX */
        if (((vars->line_speed == SPEED_AUTO_NEG) &&
             (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
            (vars->line_speed == SPEED_1000)) {
                u32 addr = MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X2;
-                val16 |= (1<<5);
+                an_adv |= (1<<5);
                /* Enable CL37 1G Parallel Detect */
                bnx2x_cl45_read_or_write(bp, phy, MDIO_WC_DEVAD, addr, 0x1);
@@ -3580,11 +3606,14 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
             (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_10G)) ||
            (vars->line_speed ==  SPEED_10000)) {
                /* Check adding advertisement for 10G KR */
-                val16 |= (1<<7);
+                an_adv |= (1<<7);
                /* Enable 10G Parallel Detect */
+                CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
+                                  MDIO_AER_BLOCK_AER_REG, 0);
                bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
                                 MDIO_WC_REG_PAR_DET_10G_CTRL, 1);
+                bnx2x_set_aer_mmd(params, phy);
                DP(NETIF_MSG_LINK, "Advertize 10G\n");
        }
@@ -3604,7 +3633,7 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
        /* Advertised speeds */
        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
-                         MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1, val16);
+                         MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1, an_adv);
        /* Advertised and set FEC (Forward Error Correction) */
        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
@@ -3628,9 +3657,10 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
        /* Set KR Autoneg Work-Around flag for Warpcore version older than D108
         */
        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
-                        MDIO_WC_REG_UC_INFO_B1_VERSION, &val16);
+                        MDIO_WC_REG_UC_INFO_B1_VERSION, &ucode_ver);
-        if (val16 < 0xd108) {
+        if (ucode_ver < 0xd108) {
-                DP(NETIF_MSG_LINK, "Enable AN KR work-around\n");
+                DP(NETIF_MSG_LINK, "Enable AN KR work-around. WC ver:0x%x\n",
+                               ucode_ver);
                vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
        }
        bnx2x_cl45_read_or_write(bp, phy, MDIO_WC_DEVAD,
@@ -3651,21 +3681,16 @@ static void bnx2x_warpcore_set_10G_KR(struct bnx2x_phy *phy,
                                      struct link_vars *vars)
 {
        struct bnx2x *bp = params->bp;
-        u16 i;
+        u16 val16, i, lane;
        static struct bnx2x_reg_set reg_set[] = {
                /* Disable Autoneg */
                {MDIO_WC_DEVAD, MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X2, 0x7},
-                {MDIO_AN_DEVAD, MDIO_WC_REG_PAR_DET_10G_CTRL, 0},
                {MDIO_WC_DEVAD, MDIO_WC_REG_CL72_USERB0_CL72_MISC1_CONTROL,
                        0x3f00},
                {MDIO_AN_DEVAD, MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1, 0},
                {MDIO_AN_DEVAD, MDIO_WC_REG_IEEE0BLK_MIICNTL, 0x0},
                {MDIO_WC_DEVAD, MDIO_WC_REG_DIGITAL3_UP1, 0x1},
                {MDIO_WC_DEVAD, MDIO_WC_REG_DIGITAL5_MISC7, 0xa},
-                /* Disable CL36 PCS Tx */
-                {MDIO_WC_DEVAD, MDIO_WC_REG_XGXSBLK1_LANECTRL0, 0x0},
-                /* Double Wide Single Data Rate @ pll rate */
-                {MDIO_WC_DEVAD, MDIO_WC_REG_XGXSBLK1_LANECTRL1, 0xFFFF},
                /* Leave cl72 training enable, needed for KR */
                {MDIO_PMA_DEVAD,
                MDIO_WC_REG_PMD_IEEE9BLK_TENGBASE_KR_PMD_CONTROL_REGISTER_150,
@@ -3676,11 +3701,24 @@ static void bnx2x_warpcore_set_10G_KR(struct bnx2x_phy *phy,
                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
                                 reg_set[i].val);
-        /* Leave CL72 enabled */
+        lane = bnx2x_get_warpcore_lane(phy, params);
-        bnx2x_cl45_read_or_write(bp, phy, MDIO_WC_DEVAD,
+        /* Global registers */
-                                 MDIO_WC_REG_CL72_USERB0_CL72_MISC1_CONTROL,
+        CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
-                                 0x3800);
+                          MDIO_AER_BLOCK_AER_REG, 0);
+        /* Disable CL36 PCS Tx */
+        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
+                        MDIO_WC_REG_XGXSBLK1_LANECTRL0, &val16);
+        val16 &= ~(0x0011 << lane);
+        bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                         MDIO_WC_REG_XGXSBLK1_LANECTRL0, val16);
+        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
+                        MDIO_WC_REG_XGXSBLK1_LANECTRL1, &val16);
+        val16 |= (0x0303 << (lane << 1));
+        bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                         MDIO_WC_REG_XGXSBLK1_LANECTRL1, val16);
+        /* Restore AER */
+        bnx2x_set_aer_mmd(params, phy);
        /* Set speed via PMA/PMD register */
        bnx2x_cl45_write(bp, phy, MDIO_PMA_DEVAD,
                         MDIO_WC_REG_IEEE0BLK_MIICNTL, 0x2040);
@@ -4303,7 +4341,7 @@ static void bnx2x_warpcore_link_reset(struct bnx2x_phy *phy,
                                      struct link_params *params)
 {
        struct bnx2x *bp = params->bp;
-        u16 val16;
+        u16 val16, lane;
        bnx2x_sfp_e3_set_transmitter(params, phy, 0);
        bnx2x_set_mdio_clk(bp, params->chip_id, params->port);
        bnx2x_set_aer_mmd(params, phy);
@@ -4340,6 +4378,30 @@ static void bnx2x_warpcore_link_reset(struct bnx2x_phy *phy,
                         MDIO_WC_REG_XGXSBLK1_LANECTRL2,
                         val16 & 0xff00);
+        lane = bnx2x_get_warpcore_lane(phy, params);
+        /* Disable CL36 PCS Tx */
+        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
+                        MDIO_WC_REG_XGXSBLK1_LANECTRL0, &val16);
+        val16 |= (0x11 << lane);
+        if (phy->flags & FLAGS_WC_DUAL_MODE)
+                val16 |= (0x22 << lane);
+        bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                         MDIO_WC_REG_XGXSBLK1_LANECTRL0, val16);
+        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
+                        MDIO_WC_REG_XGXSBLK1_LANECTRL1, &val16);
+        val16 &= ~(0x0303 << (lane << 1));
+        val16 |= (0x0101 << (lane << 1));
+        if (phy->flags & FLAGS_WC_DUAL_MODE) {
+                val16 &= ~(0x0c0c << (lane << 1));
+                val16 |= (0x0404 << (lane << 1));
+        }
+        bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                         MDIO_WC_REG_XGXSBLK1_LANECTRL1, val16);
+        /* Restore AER */
+        bnx2x_set_aer_mmd(params, phy);
 }
 static void bnx2x_set_warpcore_loopback(struct bnx2x_phy *phy,
@@ -6296,15 +6358,7 @@ static int bnx2x_update_link_down(struct link_params *params,
        vars->mac_type = MAC_TYPE_NONE;
        /* Update shared memory */
-        vars->link_status &= ~(LINK_STATUS_SPEED_AND_DUPLEX_MASK |
+        vars->link_status &= ~LINK_UPDATE_MASK;
-                               LINK_STATUS_LINK_UP |
-                               LINK_STATUS_PHYSICAL_LINK_FLAG |
-                               LINK_STATUS_AUTO_NEGOTIATE_COMPLETE |
-                               LINK_STATUS_RX_FLOW_CONTROL_FLAG_MASK |
-                               LINK_STATUS_TX_FLOW_CONTROL_FLAG_MASK |
-                               LINK_STATUS_PARALLEL_DETECTION_FLAG_MASK |
-                               LINK_STATUS_LINK_PARTNER_SYMMETRIC_PAUSE |
-                               LINK_STATUS_LINK_PARTNER_ASYMMETRIC_PAUSE);
        vars->line_speed = 0;
        bnx2x_update_mng(params, vars->link_status);
@@ -6452,6 +6506,7 @@ int bnx2x_link_update(struct link_params *params, struct link_vars *vars)
        u16 ext_phy_line_speed = 0, prev_line_speed = vars->line_speed;
        u8 active_external_phy = INT_PHY;
        vars->phy_flags &= ~PHY_HALF_OPEN_CONN_FLAG;
+        vars->link_status &= ~LINK_UPDATE_MASK;
        for (phy_index = INT_PHY; phy_index < params->num_phys;
              phy_index++) {
                phy_vars[phy_index].flow_ctrl = 0;
@@ -7579,7 +7634,7 @@ static void bnx2x_warpcore_power_module(struct link_params *params,
 static int bnx2x_warpcore_read_sfp_module_eeprom(struct bnx2x_phy *phy,
                                                 struct link_params *params,
                                                 u16 addr, u8 byte_cnt,
-                                                 u8 *o_buf)
+                                                 u8 *o_buf, u8 is_init)
 {
        int rc = 0;
        u8 i, j = 0, cnt = 0;
@@ -7596,10 +7651,10 @@ static int bnx2x_warpcore_read_sfp_module_eeprom(struct bnx2x_phy *phy,
        /* 4 byte aligned address */
        addr32 = addr & (~0x3);
        do {
-                if (cnt == I2C_WA_PWR_ITER) {
+                if ((!is_init) && (cnt == I2C_WA_PWR_ITER)) {
                        bnx2x_warpcore_power_module(params, phy, 0);
                        /* Note that 100us are not enough here */
-                        usleep_range(1000,1000);
+                        usleep_range(1000, 2000);
                        bnx2x_warpcore_power_module(params, phy, 1);
                }
                rc = bnx2x_bsc_read(params, phy, 0xa0, addr32, 0, byte_cnt,
@@ -7719,7 +7774,7 @@ int bnx2x_read_sfp_module_eeprom(struct bnx2x_phy *phy,
        break;
        case PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT:
                rc = bnx2x_warpcore_read_sfp_module_eeprom(phy, params, addr,
-                                                           byte_cnt, o_buf);
+                                                           byte_cnt, o_buf, 0);
        break;
        }
        return rc;
@@ -7923,6 +7978,7 @@ static int bnx2x_wait_for_sfp_module_initialized(struct bnx2x_phy *phy,
 {
        u8 val;
+        int rc;
        struct bnx2x *bp = params->bp;
        u16 timeout;
        /* Initialization time after hot-plug may take up to 300ms for
@@ -7930,8 +7986,14 @@ static int bnx2x_wait_for_sfp_module_initialized(struct bnx2x_phy *phy,
         */
        for (timeout = 0; timeout < 60; timeout++) {
-                if (bnx2x_read_sfp_module_eeprom(phy, params, 1, 1, &val)
+                if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT)
-                    == 0) {
+                        rc = bnx2x_warpcore_read_sfp_module_eeprom(phy,
+                                                                   params, 1,
+                                                                   1, &val, 1);
+                else
+                        rc = bnx2x_read_sfp_module_eeprom(phy, params, 1, 1,
+                                                          &val);
+                if (rc == 0) {
                        DP(NETIF_MSG_LINK,
                           "SFP+ module initialization took %d ms\n",
                           timeout * 5);
@@ -7939,7 +8001,8 @@ static int bnx2x_wait_for_sfp_module_initialized(struct bnx2x_phy *phy,
                }
                usleep_range(5000, 10000);
        }
-        return -EINVAL;
+        rc = bnx2x_read_sfp_module_eeprom(phy, params, 1, 1, &val);
+        return rc;
 }
 static void bnx2x_8727_power_module(struct bnx2x *bp,
@@ -10993,7 +11056,7 @@ static struct bnx2x_phy phy_xgxs = {
        .format_fw_ver  = (format_fw_ver_t)NULL,
        .hw_reset       = (hw_reset_t)NULL,
        .set_link_led   = (set_link_led_t)NULL,
-        .phy_specific_func = (phy_specific_func_t)NULL
+        .phy_specific_func = (phy_specific_func_t)bnx2x_xgxs_specific_func
 };
 static struct bnx2x_phy phy_warpcore = {
        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT,
@@ -11465,6 +11528,11 @@ static int bnx2x_populate_int_phy(struct bnx2x *bp, u32 shmem_base, u8 port,
                        phy->media_type = ETH_PHY_BASE_T;
                        break;
                case PORT_HW_CFG_NET_SERDES_IF_XFI:
+                        phy->supported &= (SUPPORTED_1000baseT_Full |
+                                           SUPPORTED_10000baseT_Full |
+                                           SUPPORTED_FIBRE |
+                                           SUPPORTED_Pause |
+                                           SUPPORTED_Asym_Pause);
                        phy->media_type = ETH_PHY_XFP_FIBER;
                        break;
                case PORT_HW_CFG_NET_SERDES_IF_SFI:
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index d5648fc666bd..bd1fd3d87c24 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -6794,8 +6794,9 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
        bnx2x_init_block(bp, BLOCK_DORQ, init_phase);
+        bnx2x_init_block(bp, BLOCK_BRB1, init_phase);
        if (CHIP_IS_E1(bp) || CHIP_IS_E1H(bp)) {
-                bnx2x_init_block(bp, BLOCK_BRB1, init_phase);
                if (IS_MF(bp))
                        low = ((bp->flags & ONE_PORT_FLAG) ? 160 : 246);
@@ -11902,7 +11903,15 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
        /* disable FCOE L2 queue for E1x */
        if (CHIP_IS_E1x(bp))
                bp->flags |= NO_FCOE_FLAG;
+        /* disable FCOE for 57840 device, until FW supports it */
+        switch (ent->driver_data) {
+        case BCM57840_O:
+        case BCM57840_4_10:
+        case BCM57840_2_20:
+        case BCM57840_MFO:
+        case BCM57840_MF:
+                bp->flags |= NO_FCOE_FLAG;
+        }
 #endif
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index a4da893ac1e1..378988b5709a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -251,6 +251,8 @@ struct adapter_params {
        unsigned char rev;                /* chip revision */
        unsigned char offload;
+        unsigned char bypass;
        unsigned int ofldq_wr_cred;
 };
@@ -642,6 +644,23 @@ extern int dbfifo_int_thresh;
 #define for_each_port(adapter, iter) \
        for (iter = 0; iter < (adapter)->params.nports; ++iter)
+static inline int is_bypass(struct adapter *adap)
+{
+        return adap->params.bypass;
+}
+static inline int is_bypass_device(int device)
+{
+        /* this should be set based upon device capabilities */
+        switch (device) {
+        case 0x440b:
+        case 0x440c:
+                return 1;
+        default:
+                return 0;
+        }
+}
 static inline unsigned int core_ticks_per_usec(const struct adapter *adap)
 {
        return adap->params.vpd.cclk / 1000;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 604f4f87f550..0df1284df497 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3416,16 +3416,6 @@ static int adap_init0_config(struct adapter *adapter, int reset)
                         finicsum, cfcsum);
        /*
-         * If we're a pure NIC driver then disable all offloading facilities.
-         * This will allow the firmware to optimize aspects of the hardware
-         * configuration which will result in improved performance.
-         */
-        caps_cmd.ofldcaps = 0;
-        caps_cmd.iscsicaps = 0;
-        caps_cmd.rdmacaps = 0;
-        caps_cmd.fcoecaps = 0;
-        /*
         * And now tell the firmware to use the configuration we just loaded.
         */
        caps_cmd.op_to_write =
@@ -3513,18 +3503,6 @@ static int adap_init0_no_config(struct adapter *adapter, int reset)
        if (ret < 0)
                goto bye;
-#ifndef CONFIG_CHELSIO_T4_OFFLOAD
-        /*
-         * If we're a pure NIC driver then disable all offloading facilities.
-         * This will allow the firmware to optimize aspects of the hardware
-         * configuration which will result in improved performance.
-         */
-        caps_cmd.ofldcaps = 0;
-        caps_cmd.iscsicaps = 0;
-        caps_cmd.rdmacaps = 0;
-        caps_cmd.fcoecaps = 0;
-#endif
        if (caps_cmd.niccaps & htons(FW_CAPS_CONFIG_NIC_VM)) {
                if (!vf_acls)
                        caps_cmd.niccaps ^= htons(FW_CAPS_CONFIG_NIC_VM);
@@ -3745,6 +3723,7 @@ static int adap_init0(struct adapter *adap)
        u32 v, port_vec;
        enum dev_state state;
        u32 params[7], val[7];
+        struct fw_caps_config_cmd caps_cmd;
        int reset = 1, j;
        /*
@@ -3898,6 +3877,9 @@ static int adap_init0(struct adapter *adap)
                        goto bye;
        }
+        if (is_bypass_device(adap->pdev->device))
+                adap->params.bypass = 1;
        /*
         * Grab some of our basic fundamental operating parameters.
         */
@@ -3940,13 +3922,12 @@ static int adap_init0(struct adapter *adap)
                adap->tids.aftid_end = val[1];
        }
-#ifdef CONFIG_CHELSIO_T4_OFFLOAD
        /*
         * Get device capabilities so we can determine what resources we need
         * to manage.
         */
        memset(&caps_cmd, 0, sizeof(caps_cmd));
-        caps_cmd.op_to_write = htonl(V_FW_CMD_OP(FW_CAPS_CONFIG_CMD) |
+        caps_cmd.op_to_write = htonl(FW_CMD_OP(FW_CAPS_CONFIG_CMD) |
                                     FW_CMD_REQUEST | FW_CMD_READ);
        caps_cmd.retval_len16 = htonl(FW_LEN16(caps_cmd));
        ret = t4_wr_mbox(adap, adap->mbox, &caps_cmd, sizeof(caps_cmd),
@@ -3991,15 +3972,6 @@ static int adap_init0(struct adapter *adap)
                adap->vres.ddp.size = val[4] - val[3] + 1;
                adap->params.ofldq_wr_cred = val[5];
-                params[0] = FW_PARAM_PFVF(ETHOFLD_START);
-                params[1] = FW_PARAM_PFVF(ETHOFLD_END);
-                ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 2,
-                                      params, val);
-                if ((val[0] != val[1]) && (ret >= 0)) {
-                        adap->tids.uotid_base = val[0];
-                        adap->tids.nuotids = val[1] - val[0] + 1;
-                }
                adap->params.offload = 1;
        }
        if (caps_cmd.rdmacaps) {
@@ -4048,7 +4020,6 @@ static int adap_init0(struct adapter *adap)
        }
 #undef FW_PARAM_PFVF
 #undef FW_PARAM_DEV
-#endif /* CONFIG_CHELSIO_T4_OFFLOAD */
        /*
         * These are finalized by FW initialization, load their values now.
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 1b899fea1a91..39bec73ff87c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -102,6 +102,9 @@ struct tid_info {
        unsigned int ftid_base;
        unsigned int aftid_base;
        unsigned int aftid_end;
+        /* Server filter region */
+        unsigned int sftid_base;
+        unsigned int nsftids;
        spinlock_t atid_lock ____cacheline_aligned_in_smp;
        union aopen_entry *afree;
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index b9db0e040563..2e5daee0438a 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -478,7 +478,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
                pr_err("no resource\n");
                goto no_resource;
        }
-        if (request_resource(&ioport_resource, etsects->rsrc)) {
+        if (request_resource(&iomem_resource, etsects->rsrc)) {
                pr_err("resource busy\n");
                goto no_resource;
        }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 56b20d17d0e4..116f0e901bee 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -2673,6 +2673,9 @@ static int ixgbe_get_ts_info(struct net_device *dev,
        case ixgbe_mac_X540:
        case ixgbe_mac_82599EB:
                info->so_timestamping =
+                        SOF_TIMESTAMPING_TX_SOFTWARE |
+                        SOF_TIMESTAMPING_RX_SOFTWARE |
+                        SOF_TIMESTAMPING_SOFTWARE |
                        SOF_TIMESTAMPING_TX_HARDWARE |
                        SOF_TIMESTAMPING_RX_HARDWARE |
                        SOF_TIMESTAMPING_RAW_HARDWARE;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index c10e3a6de09f..b35094c590ba 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -143,7 +143,6 @@ void mlx4_en_destroy_tx_ring(struct mlx4_en_priv *priv,
                mlx4_bf_free(mdev->dev, &ring->bf);
        mlx4_qp_remove(mdev->dev, &ring->qp);
        mlx4_qp_free(mdev->dev, &ring->qp);
-        mlx4_qp_release_range(mdev->dev, ring->qpn, 1);
        mlx4_en_unmap_buffer(&ring->wqres.buf);
        mlx4_free_hwq_res(mdev->dev, &ring->wqres, ring->buf_size);
        kfree(ring->bounce_buf);
@@ -712,7 +711,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
        if (bounce)
                tx_desc = mlx4_en_bounce_to_desc(priv, ring, index, desc_size);
-        if (ring->bf_enabled && desc_size <= MAX_BF && !bounce && !vlan_tag) {
+        if (ring->bf_enabled && desc_size <= MAX_BF && !bounce && !vlan_tx_tag_present(skb)) {
                *(__be32 *) (&tx_desc->ctrl.vlan_tag) |= cpu_to_be32(ring->doorbell_qpn);
                op_own |= htonl((bf_index & 0xffff) << 8);
                /* Ensure new descirptor hits memory
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 51c764901ad2..b84a88bc44dc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -329,9 +329,6 @@ int set_and_calc_slave_port_state(struct mlx4_dev *dev, int slave,
        ctx = &priv->mfunc.master.slave_state[slave];
        spin_lock_irqsave(&ctx->lock, flags);
-        mlx4_dbg(dev, "%s: slave: %d, current state: %d new event :%d\n",
-                 __func__, slave, cur_state, event);
        switch (cur_state) {
        case SLAVE_PORT_DOWN:
                if (MLX4_PORT_STATE_DEV_EVENT_PORT_UP == event)
@@ -366,9 +363,6 @@ int set_and_calc_slave_port_state(struct mlx4_dev *dev, int slave,
                        goto out;
        }
        ret = mlx4_get_slave_port_state(dev, slave, port);
-        mlx4_dbg(dev, "%s: slave: %d, current state: %d new event"
-                 " :%d gen_event: %d\n",
-                 __func__, slave, cur_state, event, *gen_event);
 out:
        spin_unlock_irqrestore(&ctx->lock, flags);
@@ -843,6 +837,18 @@ static void __iomem *mlx4_get_eq_uar(struct mlx4_dev *dev, struct mlx4_eq *eq)
        return priv->eq_table.uar_map[index] + 0x800 + 8 * (eq->eqn % 4);
 }
+static void mlx4_unmap_uar(struct mlx4_dev *dev)
+{
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        int i;
+        for (i = 0; i < mlx4_num_eq_uar(dev); ++i)
+                if (priv->eq_table.uar_map[i]) {
+                        iounmap(priv->eq_table.uar_map[i]);
+                        priv->eq_table.uar_map[i] = NULL;
+                }
+}
 static int mlx4_create_eq(struct mlx4_dev *dev, int nent,
                          u8 intr, struct mlx4_eq *eq)
 {
@@ -1207,6 +1213,7 @@ err_out_unmap:
        mlx4_free_irqs(dev);
 err_out_bitmap:
+        mlx4_unmap_uar(dev);
        mlx4_bitmap_cleanup(&priv->eq_table.bitmap);
 err_out_free:
@@ -1231,10 +1238,7 @@ void mlx4_cleanup_eq_table(struct mlx4_dev *dev)
        if (!mlx4_is_slave(dev))
                mlx4_unmap_clr_int(dev);
-        for (i = 0; i < mlx4_num_eq_uar(dev); ++i)
+        mlx4_unmap_uar(dev);
-                if (priv->eq_table.uar_map[i])
-                        iounmap(priv->eq_table.uar_map[i]);
        mlx4_bitmap_cleanup(&priv->eq_table.bitmap);
        kfree(priv->eq_table.uar_map);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 80df2ab0177c..2aa80afd98d2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1405,7 +1405,10 @@ unmap_bf:
        unmap_bf_area(dev);
 err_close:
-        mlx4_close_hca(dev);
+        if (mlx4_is_slave(dev))
+                mlx4_slave_exit(dev);
+        else
+                mlx4_CLOSE_HCA(dev, 0);
 err_free_icm:
        if (!mlx4_is_slave(dev))
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 926c911c0ac4..b05705f50f0f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -330,9 +330,6 @@ static void update_pkey_index(struct mlx4_dev *dev, int slave,
        new_index = priv->virt2phys_pkey[slave][port - 1][orig_index];
        *(u8 *)(inbox->buf + 35) = new_index;
-        mlx4_dbg(dev, "port = %d, orig pkey index = %d, "
-                 "new pkey index = %d\n", port, orig_index, new_index);
 }
 static void update_gid(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *inbox,
@@ -351,9 +348,6 @@ static void update_gid(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *inbox,
                if (optpar & MLX4_QP_OPTPAR_ALT_ADDR_PATH)
                        qp_ctx->alt_path.mgid_index = slave & 0x7F;
        }
-        mlx4_dbg(dev, "slave %d, new gid index: 0x%x ",
-                slave, qp_ctx->pri_path.mgid_index);
 }
 static int mpt_mask(struct mlx4_dev *dev)
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 53743f7a2ca9..af8b4142088c 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -1524,6 +1524,7 @@ static int lpc_eth_drv_remove(struct platform_device *pdev)
                                  pldat->dma_buff_base_p);
        free_irq(ndev->irq, ndev);
        iounmap(pldat->net_base);
+        mdiobus_unregister(pldat->mii_bus);
        mdiobus_free(pldat->mii_bus);
        clk_disable(pldat->clk);
        clk_put(pldat->clk);
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index b2a94d02a521..4c4fe5b1a29a 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -339,26 +339,6 @@ static void pch_gbe_wait_clr_bit(void *reg, u32 bit)
 }
 /**
- * pch_gbe_wait_clr_bit_irq - Wait to clear a bit for interrupt context
- * @reg:        Pointer of register
- * @busy:       Busy bit
- */
-static int pch_gbe_wait_clr_bit_irq(void *reg, u32 bit)
-{
-        u32 tmp;
-        int ret = -1;
-        /* wait busy */
-        tmp = 20;
-        while ((ioread32(reg) & bit) && --tmp)
-                udelay(5);
-        if (!tmp)
-                pr_err("Error: busy bit is not cleared\n");
-        else
-                ret = 0;
-        return ret;
-}
-/**
 * pch_gbe_mac_mar_set - Set MAC address register
 * @hw:     Pointer to the HW structure
 * @addr:   Pointer to the MAC address
@@ -409,15 +389,20 @@ static void pch_gbe_mac_reset_hw(struct pch_gbe_hw *hw)
        return;
 }
-static void pch_gbe_mac_reset_rx(struct pch_gbe_hw *hw)
+static void pch_gbe_disable_mac_rx(struct pch_gbe_hw *hw)
 {
-        /* Read the MAC addresses. and store to the private data */
+        u32 rctl;
-        pch_gbe_mac_read_mac_addr(hw);
+        /* Disables Receive MAC */
-        iowrite32(PCH_GBE_RX_RST, &hw->reg->RESET);
+        rctl = ioread32(&hw->reg->MAC_RX_EN);
-        pch_gbe_wait_clr_bit_irq(&hw->reg->RESET, PCH_GBE_RX_RST);
+        iowrite32((rctl & ~PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
-        /* Setup the MAC addresses */
+}
-        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
-        return;
+static void pch_gbe_enable_mac_rx(struct pch_gbe_hw *hw)
+{
+        u32 rctl;
+        /* Enables Receive MAC */
+        rctl = ioread32(&hw->reg->MAC_RX_EN);
+        iowrite32((rctl | PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
 }
 /**
@@ -913,7 +898,7 @@ static void pch_gbe_setup_rctl(struct pch_gbe_adapter *adapter)
 static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
 {
        struct pch_gbe_hw *hw = &adapter->hw;
-        u32 rdba, rdlen, rctl, rxdma;
+        u32 rdba, rdlen, rxdma;
        pr_debug("dma adr = 0x%08llx  size = 0x%08x\n",
                 (unsigned long long)adapter->rx_ring->dma,
@@ -921,9 +906,7 @@ static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
        pch_gbe_mac_force_mac_fc(hw);
-        /* Disables Receive MAC */
+        pch_gbe_disable_mac_rx(hw);
-        rctl = ioread32(&hw->reg->MAC_RX_EN);
-        iowrite32((rctl & ~PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
        /* Disables Receive DMA */
        rxdma = ioread32(&hw->reg->DMA_CTRL);
@@ -1316,38 +1299,17 @@ void pch_gbe_update_stats(struct pch_gbe_adapter *adapter)
        spin_unlock_irqrestore(&adapter->stats_lock, flags);
 }
-static void pch_gbe_stop_receive(struct pch_gbe_adapter *adapter)
+static void pch_gbe_disable_dma_rx(struct pch_gbe_hw *hw)
 {
-        struct pch_gbe_hw *hw = &adapter->hw;
        u32 rxdma;
-        u16 value;
-        int ret;
        /* Disable Receive DMA */
        rxdma = ioread32(&hw->reg->DMA_CTRL);
        rxdma &= ~PCH_GBE_RX_DMA_EN;
        iowrite32(rxdma, &hw->reg->DMA_CTRL);
-        /* Wait Rx DMA BUS is IDLE */
-        ret = pch_gbe_wait_clr_bit_irq(&hw->reg->RX_DMA_ST, PCH_GBE_IDLE_CHECK);
-        if (ret) {
-                /* Disable Bus master */
-                pci_read_config_word(adapter->pdev, PCI_COMMAND, &value);
-                value &= ~PCI_COMMAND_MASTER;
-                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
-                /* Stop Receive */
-                pch_gbe_mac_reset_rx(hw);
-                /* Enable Bus master */
-                value |= PCI_COMMAND_MASTER;
-                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
-        } else {
-                /* Stop Receive */
-                pch_gbe_mac_reset_rx(hw);
-        }
-        /* reprogram multicast address register after reset */
-        pch_gbe_set_multi(adapter->netdev);
 }
-static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
+static void pch_gbe_enable_dma_rx(struct pch_gbe_hw *hw)
 {
        u32 rxdma;
@@ -1355,9 +1317,6 @@ static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
        rxdma = ioread32(&hw->reg->DMA_CTRL);
        rxdma |= PCH_GBE_RX_DMA_EN;
        iowrite32(rxdma, &hw->reg->DMA_CTRL);
-        /* Enables Receive */
-        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
-        return;
 }
 /**
@@ -1393,7 +1352,7 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
                        int_en = ioread32(&hw->reg->INT_EN);
                        iowrite32((int_en & ~PCH_GBE_INT_RX_FIFO_ERR),
                                  &hw->reg->INT_EN);
-                        pch_gbe_stop_receive(adapter);
+                        pch_gbe_disable_dma_rx(&adapter->hw);
                        int_st |= ioread32(&hw->reg->INT_ST);
                        int_st = int_st & ioread32(&hw->reg->INT_EN);
                }
@@ -1971,12 +1930,12 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
        struct net_device *netdev = adapter->netdev;
        struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
        struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
-        int err;
+        int err = -EINVAL;
        /* Ensure we have a valid MAC */
        if (!is_valid_ether_addr(adapter->hw.mac.addr)) {
                pr_err("Error: Invalid MAC address\n");
-                return -EINVAL;
+                goto out;
        }
        /* hardware has been reset, we need to reload some things */
@@ -1989,18 +1948,19 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
        err = pch_gbe_request_irq(adapter);
        if (err) {
-                pr_err("Error: can't bring device up\n");
+                pr_err("Error: can't bring device up - irq request failed\n");
-                return err;
+                goto out;
        }
        err = pch_gbe_alloc_rx_buffers_pool(adapter, rx_ring, rx_ring->count);
        if (err) {
-                pr_err("Error: can't bring device up\n");
+                pr_err("Error: can't bring device up - alloc rx buffers pool failed\n");
-                return err;
+                goto freeirq;
        }
        pch_gbe_alloc_tx_buffers(adapter, tx_ring);
        pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
        adapter->tx_queue_len = netdev->tx_queue_len;
-        pch_gbe_start_receive(&adapter->hw);
+        pch_gbe_enable_dma_rx(&adapter->hw);
+        pch_gbe_enable_mac_rx(&adapter->hw);
        mod_timer(&adapter->watchdog_timer, jiffies);
@@ -2009,6 +1969,11 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
        netif_start_queue(adapter->netdev);
        return 0;
+freeirq:
+        pch_gbe_free_irq(adapter);
+out:
+        return err;
 }
 /**
@@ -2405,7 +2370,6 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
        int work_done = 0;
        bool poll_end_flag = false;
        bool cleaned = false;
-        u32 int_en;
        pr_debug("budget : %d\n", budget);
@@ -2422,19 +2386,13 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
        if (poll_end_flag) {
                napi_complete(napi);
-                if (adapter->rx_stop_flag) {
-                        adapter->rx_stop_flag = false;
-                        pch_gbe_start_receive(&adapter->hw);
-                }
                pch_gbe_irq_enable(adapter);
-        } else
+        }
-                if (adapter->rx_stop_flag) {
-                        adapter->rx_stop_flag = false;
+        if (adapter->rx_stop_flag) {
-                        pch_gbe_start_receive(&adapter->hw);
+                adapter->rx_stop_flag = false;
-                        int_en = ioread32(&adapter->hw.reg->INT_EN);
+                pch_gbe_enable_dma_rx(&adapter->hw);
-                        iowrite32((int_en | PCH_GBE_INT_RX_FIFO_ERR),
+        }
-                                &adapter->hw.reg->INT_EN);
-                }
        pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
                 poll_end_flag, work_done, budget);
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index df09b1cb742f..6407d0d77e81 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -2525,6 +2525,13 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
        qdev->req_q_size =
            (u32) (NUM_REQ_Q_ENTRIES * sizeof(struct ob_mac_iocb_req));
+        qdev->rsp_q_size = NUM_RSP_Q_ENTRIES * sizeof(struct net_rsp_iocb);
+        /* The barrier is required to ensure request and response queue
+         * addr writes to the registers.
+         */
+        wmb();
        qdev->req_q_virt_addr =
            pci_alloc_consistent(qdev->pdev,
                                 (size_t) qdev->req_q_size,
@@ -2536,8 +2543,6 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
                return -ENOMEM;
        }
-        qdev->rsp_q_size = NUM_RSP_Q_ENTRIES * sizeof(struct net_rsp_iocb);
        qdev->rsp_q_virt_addr =
            pci_alloc_consistent(qdev->pdev,
                                 (size_t) qdev->rsp_q_size,
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index b26cbda5efa9..2c41894d5472 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -5,7 +5,7 @@
 config NET_VENDOR_TI
        bool "Texas Instruments (TI) devices"
        default y
-        depends on PCI || EISA || AR7 || (ARM && (ARCH_DAVINCI || ARCH_OMAP3))
+        depends on PCI || EISA || AR7 || (ARM && (ARCH_DAVINCI || ARCH_OMAP3 || SOC_AM33XX))
        ---help---
          If you have a network (Ethernet) card belonging to this class, say Y
          and read the Ethernet-HOWTO, available from
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 4e2a1628484d..4e9810013850 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -1334,11 +1334,11 @@ static int tso_count_edescs(struct sk_buff *skb)
 {
        struct skb_shared_info *sh = skb_shinfo(skb);
        unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
-        unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
+        unsigned int data_len = skb->len - sh_len;
        unsigned int p_len = sh->gso_size;
        long f_id = -1;    /* id of the current fragment */
-        long f_size = skb->hdr_len;  /* size of the current fragment */
+        long f_size = skb_headlen(skb) - sh_len;  /* current fragment size */
-        long f_used = sh_len;  /* bytes used from the current fragment */
+        long f_used = 0;  /* bytes used from the current fragment */
        long n;            /* size of the current piece of payload */
        int num_edescs = 0;
        int segment;
@@ -1353,7 +1353,7 @@ static int tso_count_edescs(struct sk_buff *skb)
                        /* Advance as needed. */
                        while (f_used >= f_size) {
                                f_id++;
-                                f_size = sh->frags[f_id].size;
+                                f_size = skb_frag_size(&sh->frags[f_id]);
                                f_used = 0;
                        }
@@ -1384,13 +1384,13 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
        struct iphdr *ih;
        struct tcphdr *th;
        unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
-        unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
+        unsigned int data_len = skb->len - sh_len;
        unsigned char *data = skb->data;
        unsigned int ih_off, th_off, p_len;
        unsigned int isum_seed, tsum_seed, id, seq;
        long f_id = -1;    /* id of the current fragment */
-        long f_size = skb->hdr_len;  /* size of the current fragment */
+        long f_size = skb_headlen(skb) - sh_len;  /* current fragment size */
-        long f_used = sh_len;  /* bytes used from the current fragment */
+        long f_used = 0;  /* bytes used from the current fragment */
        long n;            /* size of the current piece of payload */
        int segment;
@@ -1405,7 +1405,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
        isum_seed = ((0xFFFF - ih->check) +
                     (0xFFFF - ih->tot_len) +
                     (0xFFFF - ih->id));
-        tsum_seed = th->check + (0xFFFF ^ htons(sh_len + data_len));
+        tsum_seed = th->check + (0xFFFF ^ htons(skb->len));
        id = ntohs(ih->id);
        seq = ntohl(th->seq);
@@ -1444,7 +1444,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
                        /* Advance as needed. */
                        while (f_used >= f_size) {
                                f_id++;
-                                f_size = sh->frags[f_id].size;
+                                f_size = skb_frag_size(&sh->frags[f_id]);
                                f_used = 0;
                        }
@@ -1478,14 +1478,14 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
        struct tile_net_priv *priv = netdev_priv(dev);
        struct skb_shared_info *sh = skb_shinfo(skb);
        unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
-        unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
+        unsigned int data_len = skb->len - sh_len;
        unsigned int p_len = sh->gso_size;
        gxio_mpipe_edesc_t edesc_head = { { 0 } };
        gxio_mpipe_edesc_t edesc_body = { { 0 } };
        long f_id = -1;    /* id of the current fragment */
-        long f_size = skb->hdr_len;  /* size of the current fragment */
+        long f_size = skb_headlen(skb) - sh_len;  /* current fragment size */
-        long f_used = sh_len;  /* bytes used from the current fragment */
+        long f_used = 0;  /* bytes used from the current fragment */
-        void *f_data = skb->data;
+        void *f_data = skb->data + sh_len;
        long n;            /* size of the current piece of payload */
        unsigned long tx_packets = 0, tx_bytes = 0;
        unsigned int csum_start;
@@ -1516,15 +1516,18 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
                /* Egress the payload. */
                while (p_used < p_len) {
+                        void *va;
                        /* Advance as needed. */
                        while (f_used >= f_size) {
                                f_id++;
-                                f_size = sh->frags[f_id].size;
+                                f_size = skb_frag_size(&sh->frags[f_id]);
-                                f_used = 0;
                                f_data = tile_net_frag_buf(&sh->frags[f_id]);
+                                f_used = 0;
                        }
+                        va = f_data + f_used;
                        /* Use bytes from the current fragment. */
                        n = p_len - p_used;
                        if (n > f_size - f_used)
@@ -1533,7 +1536,7 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
                        p_used += n;
                        /* Egress a piece of the payload. */
-                        edesc_body.va = va_to_tile_io_addr(f_data) + f_used;
+                        edesc_body.va = va_to_tile_io_addr(va);
                        edesc_body.xfer_size = n;
                        edesc_body.bound = !(p_used < p_len);
                        gxio_mpipe_equeue_put_at(equeue, edesc_body, slot);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 983bbf4d5ef6..961f0b293913 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -15,6 +15,11 @@ if PHYLIB
 comment "MII PHY device drivers"
+config AT803X_PHY
+        tristate "Drivers for Atheros AT803X PHYs"
+        ---help---
+          Currently supports the AT8030 and AT8035 model
 config AMD_PHY
        tristate "Drivers for the AMD PHYs"
        ---help---
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 426674debae4..9645e389a58d 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -25,6 +25,7 @@ obj-$(CONFIG_STE10XP)		+= ste10Xp.o
 obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
 obj-$(CONFIG_MICREL_KS8995MA)   += spi_ks8995.o
+obj-$(CONFIG_AT803X_PHY)        += at803x.o
 obj-$(CONFIG_AMD_PHY)           += amd.o
 obj-$(CONFIG_MDIO_BUS_MUX)      += mdio-mux.o
 obj-$(CONFIG_MDIO_BUS_MUX_GPIO) += mdio-mux-gpio.o
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
new file mode 100644
index 000000000000..45cbc10de01c
--- /dev/null
+++ b/drivers/net/phy/at803x.c
@@ -0,0 +1,176 @@
+/*
+ * drivers/net/phy/at803x.c
+ *
+ * Driver for Atheros 803x PHY
+ *
+ * Author: Matus Ujhelyi <ujhelyi.m@gmail.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/phy.h>
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#define AT803X_INTR_ENABLE                      0x12
+#define AT803X_INTR_STATUS                      0x13
+#define AT803X_WOL_ENABLE                       0x01
+#define AT803X_DEVICE_ADDR                      0x03
+#define AT803X_LOC_MAC_ADDR_0_15_OFFSET         0x804C
+#define AT803X_LOC_MAC_ADDR_16_31_OFFSET        0x804B
+#define AT803X_LOC_MAC_ADDR_32_47_OFFSET        0x804A
+#define AT803X_MMD_ACCESS_CONTROL               0x0D
+#define AT803X_MMD_ACCESS_CONTROL_DATA          0x0E
+#define AT803X_FUNC_DATA                        0x4003
+MODULE_DESCRIPTION("Atheros 803x PHY driver");
+MODULE_AUTHOR("Matus Ujhelyi");
+MODULE_LICENSE("GPL");
+static void at803x_set_wol_mac_addr(struct phy_device *phydev)
+{
+        struct net_device *ndev = phydev->attached_dev;
+        const u8 *mac;
+        unsigned int i, offsets[] = {
+                AT803X_LOC_MAC_ADDR_32_47_OFFSET,
+                AT803X_LOC_MAC_ADDR_16_31_OFFSET,
+                AT803X_LOC_MAC_ADDR_0_15_OFFSET,
+        };
+        if (!ndev)
+                return;
+        mac = (const u8 *) ndev->dev_addr;
+        if (!is_valid_ether_addr(mac))
+                return;
+        for (i = 0; i < 3; i++) {
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL,
+                                  AT803X_DEVICE_ADDR);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL_DATA,
+                                  offsets[i]);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL,
+                                  AT803X_FUNC_DATA);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL_DATA,
+                                  mac[(i * 2) + 1] | (mac[(i * 2)] << 8));
+        }
+}
+static int at803x_config_init(struct phy_device *phydev)
+{
+        int val;
+        u32 features;
+        int status;
+        features = SUPPORTED_TP | SUPPORTED_MII | SUPPORTED_AUI |
+                   SUPPORTED_FIBRE | SUPPORTED_BNC;
+        val = phy_read(phydev, MII_BMSR);
+        if (val < 0)
+                return val;
+        if (val & BMSR_ANEGCAPABLE)
+                features |= SUPPORTED_Autoneg;
+        if (val & BMSR_100FULL)
+                features |= SUPPORTED_100baseT_Full;
+        if (val & BMSR_100HALF)
+                features |= SUPPORTED_100baseT_Half;
+        if (val & BMSR_10FULL)
+                features |= SUPPORTED_10baseT_Full;
+        if (val & BMSR_10HALF)
+                features |= SUPPORTED_10baseT_Half;
+        if (val & BMSR_ESTATEN) {
+                val = phy_read(phydev, MII_ESTATUS);
+                if (val < 0)
+                        return val;
+                if (val & ESTATUS_1000_TFULL)
+                        features |= SUPPORTED_1000baseT_Full;
+                if (val & ESTATUS_1000_THALF)
+                        features |= SUPPORTED_1000baseT_Half;
+        }
+        phydev->supported = features;
+        phydev->advertising = features;
+        /* enable WOL */
+        at803x_set_wol_mac_addr(phydev);
+        status = phy_write(phydev, AT803X_INTR_ENABLE, AT803X_WOL_ENABLE);
+        status = phy_read(phydev, AT803X_INTR_STATUS);
+        return 0;
+}
+/* ATHEROS 8035 */
+static struct phy_driver at8035_driver = {
+        .phy_id         = 0x004dd072,
+        .name           = "Atheros 8035 ethernet",
+        .phy_id_mask    = 0xffffffef,
+        .config_init    = at803x_config_init,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .driver         = {
+                .owner = THIS_MODULE,
+        },
+};
+/* ATHEROS 8030 */
+static struct phy_driver at8030_driver = {
+        .phy_id         = 0x004dd076,
+        .name           = "Atheros 8030 ethernet",
+        .phy_id_mask    = 0xffffffef,
+        .config_init    = at803x_config_init,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .driver         = {
+                .owner = THIS_MODULE,
+        },
+};
+static int __init atheros_init(void)
+{
+        int ret;
+        ret = phy_driver_register(&at8035_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&at8030_driver);
+        if (ret)
+                goto err2;
+        return 0;
+err2:
+        phy_driver_unregister(&at8035_driver);
+err1:
+        return ret;
+}
+static void __exit atheros_exit(void)
+{
+        phy_driver_unregister(&at8035_driver);
+        phy_driver_unregister(&at8030_driver);
+}
+module_init(atheros_init);
+module_exit(atheros_exit);
+static struct mdio_device_id __maybe_unused atheros_tbl[] = {
+        { 0x004dd076, 0xffffffef },
+        { 0x004dd072, 0xffffffef },
+        { }
+};
+MODULE_DEVICE_TABLE(mdio, atheros_tbl);
diff --git a/drivers/net/phy/mdio-bitbang.c b/drivers/net/phy/mdio-bitbang.c
index daec9b05d168..6428fcbbdd4b 100644
--- a/drivers/net/phy/mdio-bitbang.c
+++ b/drivers/net/phy/mdio-bitbang.c
@@ -234,6 +234,7 @@ void free_mdio_bitbang(struct mii_bus *bus)
        struct mdiobb_ctrl *ctrl = bus->priv;
        module_put(ctrl->ops->owner);
+        mdiobus_unregister(bus);
        mdiobus_free(bus);
 }
 EXPORT_SYMBOL(free_mdio_bitbang);
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index a03de7197049..d0129827602b 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -592,6 +592,32 @@ static const struct usb_device_id	products [] = {
        .driver_info            = 0,
 },
+/* Novatel USB551L and MC551 - handled by qmi_wwan */
+{
+        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                 | USB_DEVICE_ID_MATCH_PRODUCT
+                 | USB_DEVICE_ID_MATCH_INT_INFO,
+        .idVendor               = NOVATEL_VENDOR_ID,
+        .idProduct              = 0xB001,
+        .bInterfaceClass        = USB_CLASS_COMM,
+        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        .driver_info = 0,
+},
+/* Novatel E362 - handled by qmi_wwan */
+{
+        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                 | USB_DEVICE_ID_MATCH_PRODUCT
+                 | USB_DEVICE_ID_MATCH_INT_INFO,
+        .idVendor               = NOVATEL_VENDOR_ID,
+        .idProduct              = 0x9010,
+        .bInterfaceClass        = USB_CLASS_COMM,
+        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        .driver_info = 0,
+},
 /*
 * WHITELIST!!!
 *
@@ -604,21 +630,6 @@ static const struct usb_device_id	products [] = {
 * because of bugs/quirks in a given product (like Zaurus, above).
 */
 {
-        /* Novatel USB551L */
-        /* This match must come *before* the generic CDC-ETHER match so that
-         * we get FLAG_WWAN set on the device, since it's descriptors are
-         * generic CDC-ETHER.
-         */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_PRODUCT
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = NOVATEL_VENDOR_ID,
-        .idProduct              = 0xB001,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
-        .driver_info = (unsigned long)&wwan_info,
-}, {
        /* ZTE (Vodafone) K3805-Z */
        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
                 | USB_DEVICE_ID_MATCH_PRODUCT
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index a28a983d465e..534d8becbbdc 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -62,6 +62,7 @@
 #define USB_PRODUCT_IPAD 0x129a
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define USB_PRODUCT_IPHONE_4S   0x12a0
+#define USB_PRODUCT_IPHONE_5    0x12a8
 #define IPHETH_USBINTF_CLASS    255
 #define IPHETH_USBINTF_SUBCLASS 253
@@ -113,6 +114,10 @@ static struct usb_device_id ipheth_table[] = {
                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4S,
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_5,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
        { }
 };
 MODULE_DEVICE_TABLE(usb, ipheth_table);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6883c371c59f..3b566fa0f8e6 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -369,18 +369,73 @@ static const struct usb_device_id products[] = {
                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
                .driver_info        = (unsigned long)&qmi_wwan_info,
        },
+        {       /* Novatel USB551L and MC551 */
+                USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0xb001,
+                                              USB_CLASS_COMM,
+                                              USB_CDC_SUBCLASS_ETHERNET,
+                                              USB_CDC_PROTO_NONE),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
+        {       /* Novatel E362 */
+                USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0x9010,
+                                              USB_CLASS_COMM,
+                                              USB_CDC_SUBCLASS_ETHERNET,
+                                              USB_CDC_PROTO_NONE),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
        /* 3. Combined interface devices matching on interface number */
+        {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0021, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0025, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0031, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0042, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0049, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0052, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x0055, 1)},    /* ZTE (Vodafone) K3520-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0058, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x0063, 4)},    /* ZTE (Vodafone) K3565-Z */
        {QMI_FIXED_INTF(0x19d2, 0x0104, 4)},    /* ZTE (Vodafone) K4505-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0113, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0118, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0121, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0123, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0124, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0125, 6)},
+        {QMI_FIXED_INTF(0x19d2, 0x0126, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0130, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0133, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0141, 5)},
        {QMI_FIXED_INTF(0x19d2, 0x0157, 5)},    /* ZTE MF683 */
+        {QMI_FIXED_INTF(0x19d2, 0x0158, 3)},
        {QMI_FIXED_INTF(0x19d2, 0x0167, 4)},    /* ZTE MF820D */
+        {QMI_FIXED_INTF(0x19d2, 0x0168, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0176, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0178, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0191, 4)},    /* ZTE EuFi890 */
+        {QMI_FIXED_INTF(0x19d2, 0x0199, 1)},    /* ZTE MF820S */
+        {QMI_FIXED_INTF(0x19d2, 0x0200, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0257, 3)},    /* ZTE MF821 */
        {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
        {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
        {QMI_FIXED_INTF(0x19d2, 0x1010, 4)},    /* ZTE (Vodafone) K3571-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1012, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x1018, 3)},    /* ZTE (Vodafone) K5006-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1021, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1245, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1247, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1252, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1254, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1255, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1402, 2)},    /* ZTE MF60 */
+        {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1426, 2)},    /* ZTE MF91 */
        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
        {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index f9819d10b1f9..cb04f900cc46 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1158,6 +1158,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                usb_anchor_urb(urb, &dev->deferred);
                /* no use to process more packets */
                netif_stop_queue(net);
+                usb_put_urb(urb);
                spin_unlock_irqrestore(&dev->txq.lock, flags);
                netdev_dbg(dev->net, "Delaying transmission for resumption\n");
                goto deferred;
@@ -1310,6 +1311,8 @@ void usbnet_disconnect (struct usb_interface *intf)
        cancel_work_sync(&dev->kevent);
+        usb_scuttle_anchored_urbs(&dev->deferred);
        if (dev->driver_info->unbind)
                dev->driver_info->unbind (dev, intf);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index ce9d4f2c9776..0ae1bcc6da73 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -744,28 +744,43 @@ vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                const struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[i];
+                u32 buf_size;
-                tbi = tq->buf_info + tq->tx_ring.next2fill;
+                buf_offset = 0;
-                tbi->map_type = VMXNET3_MAP_PAGE;
+                len = skb_frag_size(frag);
-                tbi->dma_addr = skb_frag_dma_map(&adapter->pdev->dev, frag,
+                while (len) {
-                                                 0, skb_frag_size(frag),
+                        tbi = tq->buf_info + tq->tx_ring.next2fill;
-                                                 DMA_TO_DEVICE);
+                        if (len < VMXNET3_MAX_TX_BUF_SIZE) {
+                                buf_size = len;
+                                dw2 |= len;
+                        } else {
+                                buf_size = VMXNET3_MAX_TX_BUF_SIZE;
+                                /* spec says that for TxDesc.len, 0 == 2^14 */
+                        }
+                        tbi->map_type = VMXNET3_MAP_PAGE;
+                        tbi->dma_addr = skb_frag_dma_map(&adapter->pdev->dev, frag,
+                                                         buf_offset, buf_size,
+                                                         DMA_TO_DEVICE);
-                tbi->len = skb_frag_size(frag);
+                        tbi->len = buf_size;
-                gdesc = tq->tx_ring.base + tq->tx_ring.next2fill;
+                        gdesc = tq->tx_ring.base + tq->tx_ring.next2fill;
-                BUG_ON(gdesc->txd.gen == tq->tx_ring.gen);
+                        BUG_ON(gdesc->txd.gen == tq->tx_ring.gen);
-                gdesc->txd.addr = cpu_to_le64(tbi->dma_addr);
+                        gdesc->txd.addr = cpu_to_le64(tbi->dma_addr);
-                gdesc->dword[2] = cpu_to_le32(dw2 | skb_frag_size(frag));
+                        gdesc->dword[2] = cpu_to_le32(dw2);
-                gdesc->dword[3] = 0;
+                        gdesc->dword[3] = 0;
-                dev_dbg(&adapter->netdev->dev,
+                        dev_dbg(&adapter->netdev->dev,
-                        "txd[%u]: 0x%llu %u %u\n",
+                                "txd[%u]: 0x%llu %u %u\n",
-                        tq->tx_ring.next2fill, le64_to_cpu(gdesc->txd.addr),
+                                tq->tx_ring.next2fill, le64_to_cpu(gdesc->txd.addr),
-                        le32_to_cpu(gdesc->dword[2]), gdesc->dword[3]);
+                                le32_to_cpu(gdesc->dword[2]), gdesc->dword[3]);
-                vmxnet3_cmd_ring_adv_next2fill(&tq->tx_ring);
+                        vmxnet3_cmd_ring_adv_next2fill(&tq->tx_ring);
-                dw2 = tq->tx_ring.gen << VMXNET3_TXD_GEN_SHIFT;
+                        dw2 = tq->tx_ring.gen << VMXNET3_TXD_GEN_SHIFT;
+                        len -= buf_size;
+                        buf_offset += buf_size;
+                }
        }
        ctx->eop_txd = gdesc;
@@ -886,6 +901,18 @@ vmxnet3_prepare_tso(struct sk_buff *skb,
        }
 }
+static int txd_estimate(const struct sk_buff *skb)
+{
+        int count = VMXNET3_TXD_NEEDED(skb_headlen(skb)) + 1;
+        int i;
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                const struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[i];
+                count += VMXNET3_TXD_NEEDED(skb_frag_size(frag));
+        }
+        return count;
+}
 /*
 * Transmits a pkt thru a given tq
@@ -914,9 +941,7 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
        union Vmxnet3_GenericDesc tempTxDesc;
 #endif
-        /* conservatively estimate # of descriptors to use */
+        count = txd_estimate(skb);
-        count = VMXNET3_TXD_NEEDED(skb_headlen(skb)) +
-                skb_shinfo(skb)->nr_frags + 1;
        ctx.ipv4 = (vlan_get_protocol(skb) == cpu_to_be16(ETH_P_IP));
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 607976c00162..7b4adde93c01 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -816,7 +816,7 @@ static void vxlan_cleanup(unsigned long arg)
                                = container_of(p, struct vxlan_fdb, hlist);
                        unsigned long timeout;
-                        if (f->state == NUD_PERMANENT)
+                        if (f->state & NUD_PERMANENT)
                                continue;
                        timeout = f->used + vxlan->age_interval * HZ;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 89bf94d4d8a1..6f7cf49eff4d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -534,107 +534,107 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
 static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
-        {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
-        {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
-        {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
+        {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402},
-        {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
+        {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
-        {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
-        {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
-        {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
+        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
-        {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
-        {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
-        {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
-        {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
-        {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
-        {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
+        {0x0000a544, 0x52022470, 0x52022470, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
+        {0x0000a548, 0x55022490, 0x55022490, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x5a08442e, 0x5a08442e, 0x47001a83, 0x47001a83},
+        {0x0000a54c, 0x59022492, 0x59022492, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x5e0a4431, 0x5e0a4431, 0x4a001c84, 0x4a001c84},
+        {0x0000a550, 0x5d022692, 0x5d022692, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a554, 0x61022892, 0x61022892, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
+        {0x0000a558, 0x65024890, 0x65024890, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
+        {0x0000a55c, 0x69024892, 0x69024892, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a560, 0x6e024c92, 0x6e024c92, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a564, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
-        {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
-        {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
-        {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
-        {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
-        {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
-        {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
-        {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402},
+        {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402},
-        {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404},
+        {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
-        {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
-        {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
-        {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
-        {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
-        {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
-        {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
-        {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
-        {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
-        {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861},
+        {0x0000a5c4, 0x52822470, 0x52822470, 0x3f801861, 0x3f801861},
-        {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81},
+        {0x0000a5c8, 0x55822490, 0x55822490, 0x43801a81, 0x43801a81},
-        {0x0000a5cc, 0x5a88442e, 0x5a88442e, 0x47801a83, 0x47801a83},
+        {0x0000a5cc, 0x59822492, 0x59822492, 0x47801a83, 0x47801a83},
-        {0x0000a5d0, 0x5e8a4431, 0x5e8a4431, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d0, 0x5d822692, 0x5d822692, 0x4a801c84, 0x4a801c84},
-        {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d4, 0x61822892, 0x61822892, 0x4e801ce3, 0x4e801ce3},
-        {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5},
+        {0x0000a5d8, 0x65824890, 0x65824890, 0x52801ce5, 0x52801ce5},
-        {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9},
+        {0x0000a5dc, 0x69824892, 0x69824892, 0x56801ce9, 0x56801ce9},
-        {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x5a801ceb, 0x5a801ceb},
-        {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
-        {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
-        {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
-        {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
+        {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000},
-        {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
+        {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
+        {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501},
-        {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
+        {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03},
-        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04},
-        {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
+        {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04},
-        {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
-        {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
-        {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
-        {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
-        {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
-        {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
-        {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
-        {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
-        {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 924c4616c3d9..f5dda84176c3 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -38,6 +38,7 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
        { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
        { USB_DEVICE(0x040D, 0x3801) }, /* VIA */
        { USB_DEVICE(0x0cf3, 0xb003) }, /* Ubiquiti WifiStation Ext */
+        { USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */
        { USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */
        { USB_DEVICE(0x0cf3, 0x7015),
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 378bd70256b2..741918a2027b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -312,6 +312,7 @@ static struct ath_buf *ath_tx_get_buffer(struct ath_softc *sc)
        }
        bf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
+        bf->bf_next = NULL;
        list_del(&bf->list);
        spin_unlock_bh(&sc->tx.txbuflock);
@@ -393,7 +394,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
        u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0, seq_first;
        u32 ba[WME_BA_BMP_SIZE >> 5];
        int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
-        bool rc_update = true;
+        bool rc_update = true, isba;
        struct ieee80211_tx_rate rates[4];
        struct ath_frame_info *fi;
        int nframes;
@@ -437,13 +438,17 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
        tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
        tid = ATH_AN_2_TID(an, tidno);
        seq_first = tid->seq_start;
+        isba = ts->ts_flags & ATH9K_TX_BA;
        /*
         * The hardware occasionally sends a tx status for the wrong TID.
         * In this case, the BA status cannot be considered valid and all
         * subframes need to be retransmitted
+         *
+         * Only BlockAcks have a TID and therefore normal Acks cannot be
+         * checked
         */
-        if (tidno != ts->tid)
+        if (isba && tidno != ts->tid)
                txok = false;
        isaggr = bf_isaggr(bf);
@@ -1774,6 +1779,7 @@ static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
        list_add_tail(&bf->list, &bf_head);
        bf->bf_state.bf_type = 0;
+        bf->bf_next = NULL;
        bf->bf_lastbf = bf;
        ath_tx_fill_desc(sc, bf, txq, fi->framelen);
        ath_tx_txqaddbuf(sc, txq, &bf_head, false);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 73730e94e0ac..c5a99c8c8168 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5404,6 +5404,8 @@ static void b43_bcma_remove(struct bcma_device *core)
        cancel_work_sync(&wldev->restart_work);
        B43_WARN_ON(!wl);
+        if (!wldev->fw.ucode.data)
+                return;                 /* NULL if firmware never loaded */
        if (wl->current_dev == wldev && wl->hw_registred) {
                b43_leds_stop(wldev);
                ieee80211_unregister_hw(wl->hw);
@@ -5478,6 +5480,8 @@ static void b43_ssb_remove(struct ssb_device *sdev)
        cancel_work_sync(&wldev->restart_work);
        B43_WARN_ON(!wl);
+        if (!wldev->fw.ucode.data)
+                return;                 /* NULL if firmware never loaded */
        if (wl->current_dev == wldev && wl->hw_registred) {
                b43_leds_stop(wldev);
                ieee80211_unregister_hw(wl->hw);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index a2b4b1e71017..7a6dfdc67b6c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1339,7 +1339,7 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo,
        }
        ret = brcmf_bus_start(dev);
-        if (ret == -ENOLINK) {
+        if (ret) {
                brcmf_dbg(ERROR, "dongle is not responding\n");
                brcmf_detach(dev);
                goto fail;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index c1abaa6db59e..a6f1e8166008 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -3569,7 +3569,7 @@ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
        if (!request || !request->n_ssids || !request->n_match_sets) {
                WL_ERR("Invalid sched scan req!! n_ssids:%d\n",
-                       request->n_ssids);
+                       request ? request->n_ssids : 0);
                return -EINVAL;
        }
@@ -3972,7 +3972,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg,
        u8  *iovar_ie_buf;
        u8  *curr_ie_buf;
        u8  *mgmt_ie_buf = NULL;
-        u32 mgmt_ie_buf_len = 0;
+        int mgmt_ie_buf_len;
        u32 *mgmt_ie_len = 0;
        u32 del_add_ie_buf_len = 0;
        u32 total_ie_buf_len = 0;
@@ -3982,7 +3982,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg,
        struct parsed_vndr_ie_info *vndrie_info;
        s32 i;
        u8 *ptr;
-        u32 remained_buf_len;
+        int remained_buf_len;
        WL_TRACE("bssidx %d, pktflag : 0x%02X\n", bssidx, pktflag);
        iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
@@ -4606,12 +4606,13 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
        struct brcmf_cfg80211_profile *profile = cfg->profile;
        struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
        struct wiphy *wiphy = cfg_to_wiphy(cfg);
-        struct brcmf_channel_info_le channel_le;
+        struct ieee80211_channel *notify_channel = NULL;
-        struct ieee80211_channel *notify_channel;
        struct ieee80211_supported_band *band;
+        struct brcmf_bss_info_le *bi;
        u32 freq;
        s32 err = 0;
        u32 target_channel;
+        u8 *buf;
        WL_TRACE("Enter\n");
@@ -4619,11 +4620,22 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
        memcpy(profile->bssid, e->addr, ETH_ALEN);
        brcmf_update_bss_info(cfg);
-        brcmf_exec_dcmd(ndev, BRCMF_C_GET_CHANNEL, &channel_le,
+        buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
-                        sizeof(channel_le));
+        if (buf == NULL) {
+                err = -ENOMEM;
+                goto done;
+        }
+        /* data sent to dongle has to be little endian */
+        *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
+        err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_BSS_INFO, buf, WL_BSS_INFO_MAX);
+        if (err)
+                goto done;
-        target_channel = le32_to_cpu(channel_le.target_channel);
+        bi = (struct brcmf_bss_info_le *)(buf + 4);
-        WL_CONN("Roamed to channel %d\n", target_channel);
+        target_channel = bi->ctl_ch ? bi->ctl_ch :
+                                      CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
        if (target_channel <= CH_MAX_2G_CHANNEL)
                band = wiphy->bands[IEEE80211_BAND_2GHZ];
@@ -4633,6 +4645,8 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
        freq = ieee80211_channel_to_frequency(target_channel, band->band);
        notify_channel = ieee80211_get_channel(wiphy, freq);
+done:
+        kfree(buf);
        cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
                        conn_info->req_ie, conn_info->req_ie_len,
                        conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
@@ -5186,41 +5200,6 @@ brcmf_cfg80211_event(struct net_device *ndev,
                schedule_work(&cfg->event_work);
 }
-static s32 brcmf_dongle_mode(struct net_device *ndev, s32 iftype)
-{
-        s32 infra = 0;
-        s32 err = 0;
-        switch (iftype) {
-        case NL80211_IFTYPE_MONITOR:
-        case NL80211_IFTYPE_WDS:
-                WL_ERR("type (%d) : currently we do not support this mode\n",
-                       iftype);
-                err = -EINVAL;
-                return err;
-        case NL80211_IFTYPE_ADHOC:
-                infra = 0;
-                break;
-        case NL80211_IFTYPE_STATION:
-                infra = 1;
-                break;
-        case NL80211_IFTYPE_AP:
-                infra = 1;
-                break;
-        default:
-                err = -EINVAL;
-                WL_ERR("invalid type (%d)\n", iftype);
-                return err;
-        }
-        err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_INFRA, &infra);
-        if (err) {
-                WL_ERR("WLC_SET_INFRA error (%d)\n", err);
-                return err;
-        }
-        return 0;
-}
 static s32 brcmf_dongle_eventmsg(struct net_device *ndev)
 {
        /* Room for "event_msgs" + '\0' + bitvec */
@@ -5439,7 +5418,8 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
                                WL_BEACON_TIMEOUT);
        if (err)
                goto default_conf_out;
-        err = brcmf_dongle_mode(ndev, wdev->iftype);
+        err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
+                                          NULL, NULL);
        if (err && err != -EINPROGRESS)
                goto default_conf_out;
        err = brcmf_dongle_probecap(cfg);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 935120fc8c93..768bf612533e 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -10472,7 +10472,7 @@ static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
                } else
                        len = src->len;
-                dst = alloc_skb(len + sizeof(*rt_hdr), GFP_ATOMIC);
+                dst = alloc_skb(len + sizeof(*rt_hdr) + sizeof(u16)*2, GFP_ATOMIC);
                if (!dst)
                        continue;
diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index 349c205d5f62..da5862064195 100644
--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -518,7 +518,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
         * See iwlagn_mac_channel_switch.
         */
        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-        struct iwl6000_channel_switch_cmd cmd;
+        struct iwl6000_channel_switch_cmd *cmd;
        u32 switch_time_in_usec, ucode_switch_time;
        u16 ch;
        u32 tsf_low;
@@ -527,18 +527,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
        struct ieee80211_vif *vif = ctx->vif;
        struct iwl_host_cmd hcmd = {
                .id = REPLY_CHANNEL_SWITCH,
-                .len = { sizeof(cmd), },
+                .len = { sizeof(*cmd), },
                .flags = CMD_SYNC,
-                .data = { &cmd, },
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
        };
+        int err;
-        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+        hcmd.data[0] = cmd;
+        cmd->band = priv->band == IEEE80211_BAND_2GHZ;
        ch = ch_switch->channel->hw_value;
        IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
                      ctx->active.channel, ch);
-        cmd.channel = cpu_to_le16(ch);
+        cmd->channel = cpu_to_le16(ch);
-        cmd.rxon_flags = ctx->staging.flags;
+        cmd->rxon_flags = ctx->staging.flags;
-        cmd.rxon_filter_flags = ctx->staging.filter_flags;
+        cmd->rxon_filter_flags = ctx->staging.filter_flags;
        switch_count = ch_switch->count;
        tsf_low = ch_switch->timestamp & 0x0ffffffff;
        /*
@@ -554,23 +561,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
                        switch_count = 0;
        }
        if (switch_count <= 1)
-                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+                cmd->switch_time = cpu_to_le32(priv->ucode_beacon_time);
        else {
                switch_time_in_usec =
                        vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
                ucode_switch_time = iwl_usecs_to_beacons(priv,
                                                         switch_time_in_usec,
                                                         beacon_interval);
-                cmd.switch_time = iwl_add_beacon_time(priv,
+                cmd->switch_time = iwl_add_beacon_time(priv,
-                                                      priv->ucode_beacon_time,
+                                                       priv->ucode_beacon_time,
-                                                      ucode_switch_time,
+                                                       ucode_switch_time,
-                                                      beacon_interval);
+                                                       beacon_interval);
        }
        IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
-                      cmd.switch_time);
+                      cmd->switch_time);
-        cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
+        cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
-        return iwl_dvm_send_cmd(priv, &hcmd);
+        err = iwl_dvm_send_cmd(priv, &hcmd);
+        kfree(cmd);
+        return err;
 }
 struct iwl_lib_ops iwl6000_lib = {
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 0679458a1bac..780d3e168297 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1825,8 +1825,6 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                return -EBUSY;
        }
-        priv->scan_request = request;
        priv->user_scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg),
                                      GFP_KERNEL);
        if (!priv->user_scan_cfg) {
@@ -1834,6 +1832,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                return -ENOMEM;
        }
+        priv->scan_request = request;
        priv->user_scan_cfg->num_ssids = request->n_ssids;
        priv->user_scan_cfg->ssid_list = request->ssids;
@@ -1870,6 +1870,9 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
        ret = mwifiex_scan_networks(priv, priv->user_scan_cfg);
        if (ret) {
                dev_err(priv->adapter->dev, "scan failed: %d\n", ret);
+                priv->scan_request = NULL;
+                kfree(priv->user_scan_cfg);
+                priv->user_scan_cfg = NULL;
                return ret;
        }
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 00b658d3b6ec..9171aaedbccd 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1843,21 +1843,18 @@ static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
                                      struct cfg80211_ssid *req_ssid)
 {
        struct mwifiex_adapter *adapter = priv->adapter;
-        int ret = 0;
+        int ret;
        struct mwifiex_user_scan_cfg *scan_cfg;
-        if (!req_ssid)
-                return -1;
        if (adapter->scan_processing) {
-                dev_dbg(adapter->dev, "cmd: Scan already in process...\n");
+                dev_err(adapter->dev, "cmd: Scan already in process...\n");
-                return ret;
+                return -EBUSY;
        }
        if (priv->scan_block) {
-                dev_dbg(adapter->dev,
+                dev_err(adapter->dev,
                        "cmd: Scan is blocked during association...\n");
-                return ret;
+                return -EBUSY;
        }
        scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg), GFP_KERNEL);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index a12e84f892be..6b2e1e431dd2 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1988,6 +1988,7 @@ static struct usb_driver rt2500usb_driver = {
        .disconnect     = rt2x00usb_disconnect,
        .suspend        = rt2x00usb_suspend,
        .resume         = rt2x00usb_resume,
+        .reset_resume   = rt2x00usb_resume,
        .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 01dc8891070c..59474ae0aec0 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2449,7 +2449,7 @@ static int rt2800_get_gain_calibration_delta(struct rt2x00_dev *rt2x00dev)
        /*
         * Check if temperature compensation is supported.
         */
-        if (tssi_bounds[4] == 0xff)
+        if (tssi_bounds[4] == 0xff || step == 0xff)
                return 0;
        /*
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index c9e9370eb789..3b8fb5a603f2 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1282,6 +1282,7 @@ static struct usb_driver rt2800usb_driver = {
        .disconnect     = rt2x00usb_disconnect,
        .suspend        = rt2x00usb_suspend,
        .resume         = rt2x00usb_resume,
+        .reset_resume   = rt2x00usb_resume,
        .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index e5eb43b3eee7..24eec66e9fd2 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2535,6 +2535,7 @@ static struct usb_driver rt73usb_driver = {
        .disconnect     = rt2x00usb_disconnect,
        .suspend        = rt2x00usb_suspend,
        .resume         = rt2x00usb_resume,
+        .reset_resume   = rt2x00usb_resume,
        .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 030beb45d8b0..e3ea4b346889 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -673,7 +673,7 @@ static int rtl_usb_start(struct ieee80211_hw *hw)
                set_hal_start(rtlhal);
                /* Start bulk IN */
-                _rtl_usb_receive(hw);
+                err = _rtl_usb_receive(hw);
        }
        return err;
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 6241fd05bd41..a543746fb354 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -320,10 +320,7 @@ void pci_walk_bus(struct pci_bus *top, int (*cb)(struct pci_dev *, void *),
                } else
                        next = dev->bus_list.next;
-                /* Run device routines with the device locked */
-                device_lock(&dev->dev);
                retval = cb(dev, userdata);
-                device_unlock(&dev->dev);
                if (retval)
                        break;
        }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 94c6e2aa03d6..6c94fc9489e7 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -398,6 +398,8 @@ static void pci_device_shutdown(struct device *dev)
        struct pci_dev *pci_dev = to_pci_dev(dev);
        struct pci_driver *drv = pci_dev->driver;
+        pm_runtime_resume(dev);
        if (drv && drv->shutdown)
                drv->shutdown(pci_dev);
        pci_msi_shutdown(pci_dev);
@@ -408,16 +410,6 @@ static void pci_device_shutdown(struct device *dev)
         * continue to do DMA
         */
        pci_disable_device(pci_dev);
-        /*
-         * Devices may be enabled to wake up by runtime PM, but they need not
-         * be supposed to wake up the system from its "power off" state (e.g.
-         * ACPI S5).  Therefore disable wakeup for all devices that aren't
-         * supposed to wake up the system at this point.  The state argument
-         * will be ignored by pci_enable_wake().
-         */
-        if (!device_may_wakeup(dev))
-                pci_enable_wake(pci_dev, PCI_UNKNOWN, false);
 }
 #ifdef CONFIG_PM
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 02d107b15281..f39378d9da15 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -458,40 +458,6 @@ boot_vga_show(struct device *dev, struct device_attribute *attr, char *buf)
 }
 struct device_attribute vga_attr = __ATTR_RO(boot_vga);
-static void
-pci_config_pm_runtime_get(struct pci_dev *pdev)
-{
-        struct device *dev = &pdev->dev;
-        struct device *parent = dev->parent;
-        if (parent)
-                pm_runtime_get_sync(parent);
-        pm_runtime_get_noresume(dev);
-        /*
-         * pdev->current_state is set to PCI_D3cold during suspending,
-         * so wait until suspending completes
-         */
-        pm_runtime_barrier(dev);
-        /*
-         * Only need to resume devices in D3cold, because config
-         * registers are still accessible for devices suspended but
-         * not in D3cold.
-         */
-        if (pdev->current_state == PCI_D3cold)
-                pm_runtime_resume(dev);
-}
-static void
-pci_config_pm_runtime_put(struct pci_dev *pdev)
-{
-        struct device *dev = &pdev->dev;
-        struct device *parent = dev->parent;
-        pm_runtime_put(dev);
-        if (parent)
-                pm_runtime_put_sync(parent);
-}
 static ssize_t
 pci_read_config(struct file *filp, struct kobject *kobj,
                struct bin_attribute *bin_attr,
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 54858838f098..aabf64798bda 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1858,6 +1858,38 @@ bool pci_dev_run_wake(struct pci_dev *dev)
 }
 EXPORT_SYMBOL_GPL(pci_dev_run_wake);
+void pci_config_pm_runtime_get(struct pci_dev *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device *parent = dev->parent;
+        if (parent)
+                pm_runtime_get_sync(parent);
+        pm_runtime_get_noresume(dev);
+        /*
+         * pdev->current_state is set to PCI_D3cold during suspending,
+         * so wait until suspending completes
+         */
+        pm_runtime_barrier(dev);
+        /*
+         * Only need to resume devices in D3cold, because config
+         * registers are still accessible for devices suspended but
+         * not in D3cold.
+         */
+        if (pdev->current_state == PCI_D3cold)
+                pm_runtime_resume(dev);
+}
+void pci_config_pm_runtime_put(struct pci_dev *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device *parent = dev->parent;
+        pm_runtime_put(dev);
+        if (parent)
+                pm_runtime_put_sync(parent);
+}
 /**
 * pci_pm_init - Initialize PM functions of given PCI device
 * @dev: PCI device to handle.
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index bacbcba69cf3..fd92aab9904b 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -72,6 +72,8 @@ extern void pci_disable_enabled_device(struct pci_dev *dev);
 extern int pci_finish_runtime_suspend(struct pci_dev *dev);
 extern int __pci_pme_wakeup(struct pci_dev *dev, void *ign);
 extern void pci_wakeup_bus(struct pci_bus *bus);
+extern void pci_config_pm_runtime_get(struct pci_dev *dev);
+extern void pci_config_pm_runtime_put(struct pci_dev *dev);
 extern void pci_pm_init(struct pci_dev *dev);
 extern void platform_pci_wakeup_init(struct pci_dev *dev);
 extern void pci_allocate_cap_save_buffers(struct pci_dev *dev);
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 06bad96af415..af4e31cd3a3b 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -213,6 +213,7 @@ static int report_error_detected(struct pci_dev *dev, void *data)
        struct aer_broadcast_data *result_data;
        result_data = (struct aer_broadcast_data *) data;
+        device_lock(&dev->dev);
        dev->error_state = result_data->state;
        if (!dev->driver ||
@@ -231,12 +232,14 @@ static int report_error_detected(struct pci_dev *dev, void *data)
                                   dev->driver ?
                                   "no AER-aware driver" : "no driver");
                }
-                return 0;
+                goto out;
        }
        err_handler = dev->driver->err_handler;
        vote = err_handler->error_detected(dev, result_data->state);
        result_data->result = merge_result(result_data->result, vote);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
@@ -247,14 +250,17 @@ static int report_mmio_enabled(struct pci_dev *dev, void *data)
        struct aer_broadcast_data *result_data;
        result_data = (struct aer_broadcast_data *) data;
+        device_lock(&dev->dev);
        if (!dev->driver ||
                !dev->driver->err_handler ||
                !dev->driver->err_handler->mmio_enabled)
-                return 0;
+                goto out;
        err_handler = dev->driver->err_handler;
        vote = err_handler->mmio_enabled(dev);
        result_data->result = merge_result(result_data->result, vote);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
@@ -265,14 +271,17 @@ static int report_slot_reset(struct pci_dev *dev, void *data)
        struct aer_broadcast_data *result_data;
        result_data = (struct aer_broadcast_data *) data;
+        device_lock(&dev->dev);
        if (!dev->driver ||
                !dev->driver->err_handler ||
                !dev->driver->err_handler->slot_reset)
-                return 0;
+                goto out;
        err_handler = dev->driver->err_handler;
        vote = err_handler->slot_reset(dev);
        result_data->result = merge_result(result_data->result, vote);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
@@ -280,15 +289,18 @@ static int report_resume(struct pci_dev *dev, void *data)
 {
        const struct pci_error_handlers *err_handler;
+        device_lock(&dev->dev);
        dev->error_state = pci_channel_io_normal;
        if (!dev->driver ||
                !dev->driver->err_handler ||
                !dev->driver->err_handler->resume)
-                return 0;
+                goto out;
        err_handler = dev->driver->err_handler;
        err_handler->resume(dev);
+out:
+        device_unlock(&dev->dev);
        return 0;
 }
diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
index d03a7a39b2d8..ed129b414624 100644
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
@@ -272,7 +272,8 @@ static int get_port_device_capability(struct pci_dev *dev)
        }
        /* Hot-Plug Capable */
-        if (cap_mask & PCIE_PORT_SERVICE_HP) {
+        if ((cap_mask & PCIE_PORT_SERVICE_HP) &&
+            dev->pcie_flags_reg & PCI_EXP_FLAGS_SLOT) {
                pcie_capability_read_dword(dev, PCI_EXP_SLTCAP, &reg32);
                if (reg32 & PCI_EXP_SLTCAP_HPC) {
                        services |= PCIE_PORT_SERVICE_HP;
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index eb907a8faf2a..9b8505ccc56d 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -76,6 +76,8 @@ proc_bus_pci_read(struct file *file, char __user *buf, size_t nbytes, loff_t *pp
        if (!access_ok(VERIFY_WRITE, buf, cnt))
                return -EINVAL;
+        pci_config_pm_runtime_get(dev);
        if ((pos & 1) && cnt) {
                unsigned char val;
                pci_user_read_config_byte(dev, pos, &val);
@@ -121,6 +123,8 @@ proc_bus_pci_read(struct file *file, char __user *buf, size_t nbytes, loff_t *pp
                cnt--;
        }
+        pci_config_pm_runtime_put(dev);
        *ppos = pos;
        return nbytes;
 }
@@ -146,6 +150,8 @@ proc_bus_pci_write(struct file *file, const char __user *buf, size_t nbytes, lof
        if (!access_ok(VERIFY_READ, buf, cnt))
                return -EINVAL;
+        pci_config_pm_runtime_get(dev);
        if ((pos & 1) && cnt) {
                unsigned char val;
                __get_user(val, buf);
@@ -191,6 +197,8 @@ proc_bus_pci_write(struct file *file, const char __user *buf, size_t nbytes, lof
                cnt--;
        }
+        pci_config_pm_runtime_put(dev);
        *ppos = pos;
        i_size_write(ino, dp->size);
        return nbytes;
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index 7bf914df6e91..d96caefd914a 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -179,11 +179,13 @@ config PINCTRL_COH901
 config PINCTRL_SAMSUNG
        bool "Samsung pinctrl driver"
+        depends on OF && GPIOLIB
        select PINMUX
        select PINCONF
 config PINCTRL_EXYNOS4
        bool "Pinctrl driver data for Exynos4 SoC"
+        depends on OF && GPIOLIB
        select PINCTRL_SAMSUNG
 config PINCTRL_MVEBU
diff --git a/drivers/pinctrl/spear/pinctrl-spear.c b/drivers/pinctrl/spear/pinctrl-spear.c
index 5d4f44f462f0..b1fd6ee33c6c 100644
--- a/drivers/pinctrl/spear/pinctrl-spear.c
+++ b/drivers/pinctrl/spear/pinctrl-spear.c
@@ -244,7 +244,7 @@ static int spear_pinctrl_endisable(struct pinctrl_dev *pctldev,
                        else
                                temp = ~muxreg->val;
-                        val |= temp;
+                        val |= muxreg->mask & temp;
                        pmx_writel(pmx, val, muxreg->reg);
                }
        }
diff --git a/drivers/pinctrl/spear/pinctrl-spear1310.c b/drivers/pinctrl/spear/pinctrl-spear1310.c
index d6cca8c81b92..0436fc7895d6 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1310.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1310.c
@@ -25,8 +25,8 @@ static const struct pinctrl_pin_desc spear1310_pins[] = {
 };
 /* registers */
-#define PERIP_CFG                                       0x32C
+#define PERIP_CFG                                       0x3B0
-        #define MCIF_SEL_SHIFT                          3
+        #define MCIF_SEL_SHIFT                          5
        #define MCIF_SEL_SD                             (0x1 << MCIF_SEL_SHIFT)
        #define MCIF_SEL_CF                             (0x2 << MCIF_SEL_SHIFT)
        #define MCIF_SEL_XD                             (0x3 << MCIF_SEL_SHIFT)
@@ -164,6 +164,10 @@ static const struct pinctrl_pin_desc spear1310_pins[] = {
        #define PMX_SSP0_CS0_MASK                       (1 << 29)
        #define PMX_SSP0_CS1_2_MASK                     (1 << 30)
+#define PAD_DIRECTION_SEL_0                             0x65C
+#define PAD_DIRECTION_SEL_1                             0x660
+#define PAD_DIRECTION_SEL_2                             0x664
 /* combined macros */
 #define PMX_GMII_MASK           (PMX_GMIICLK_MASK |                     \
                                PMX_GMIICOL_CRS_XFERER_MIITXCLK_MASK |  \
@@ -237,6 +241,10 @@ static struct spear_muxreg i2c0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2C0_MASK,
                .val = PMX_I2C0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2C0_MASK,
+                .val = PMX_I2C0_MASK,
        },
 };
@@ -269,6 +277,10 @@ static struct spear_muxreg ssp0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_SSP0_MASK,
                .val = PMX_SSP0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SSP0_MASK,
+                .val = PMX_SSP0_MASK,
        },
 };
@@ -294,6 +306,10 @@ static struct spear_muxreg ssp0_cs0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_SSP0_CS0_MASK,
                .val = PMX_SSP0_CS0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_SSP0_CS0_MASK,
+                .val = PMX_SSP0_CS0_MASK,
        },
 };
@@ -319,6 +335,10 @@ static struct spear_muxreg ssp0_cs1_2_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_SSP0_CS1_2_MASK,
                .val = PMX_SSP0_CS1_2_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_SSP0_CS1_2_MASK,
+                .val = PMX_SSP0_CS1_2_MASK,
        },
 };
@@ -352,6 +372,10 @@ static struct spear_muxreg i2s0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2S0_MASK,
                .val = PMX_I2S0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2S0_MASK,
+                .val = PMX_I2S0_MASK,
        },
 };
@@ -384,6 +408,10 @@ static struct spear_muxreg i2s1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_I2S1_MASK,
                .val = PMX_I2S1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_I2S1_MASK,
+                .val = PMX_I2S1_MASK,
        },
 };
@@ -418,6 +446,10 @@ static struct spear_muxreg clcd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = PMX_CLCD1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -443,6 +475,10 @@ static struct spear_muxreg clcd_high_res_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_CLCD2_MASK,
                .val = PMX_CLCD2_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_CLCD2_MASK,
+                .val = PMX_CLCD2_MASK,
        },
 };
@@ -461,7 +497,7 @@ static struct spear_pingroup clcd_high_res_pingroup = {
        .nmodemuxs = ARRAY_SIZE(clcd_high_res_modemux),
 };
-static const char *const clcd_grps[] = { "clcd_grp", "clcd_high_res" };
+static const char *const clcd_grps[] = { "clcd_grp", "clcd_high_res_grp" };
 static struct spear_function clcd_function = {
        .name = "clcd",
        .groups = clcd_grps,
@@ -479,6 +515,14 @@ static struct spear_muxreg arm_gpio_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_EGPIO_1_GRP_MASK,
                .val = PMX_EGPIO_1_GRP_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_EGPIO_0_GRP_MASK,
+                .val = PMX_EGPIO_0_GRP_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_EGPIO_1_GRP_MASK,
+                .val = PMX_EGPIO_1_GRP_MASK,
        },
 };
@@ -511,6 +555,10 @@ static struct spear_muxreg smi_2_chips_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_SMI_MASK,
                .val = PMX_SMI_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SMI_MASK,
+                .val = PMX_SMI_MASK,
        },
 };
@@ -539,6 +587,14 @@ static struct spear_muxreg smi_4_chips_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
                .val = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SMI_MASK,
+                .val = PMX_SMI_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
+                .val = PMX_SMINCS2_MASK | PMX_SMINCS3_MASK,
        },
 };
@@ -573,6 +629,10 @@ static struct spear_muxreg gmii_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_GMII_MASK,
                .val = PMX_GMII_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_GMII_MASK,
+                .val = PMX_GMII_MASK,
        },
 };
@@ -615,6 +675,18 @@ static struct spear_muxreg rgmii_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_RGMII_REG2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_RGMII_REG0_MASK,
+                .val = PMX_RGMII_REG0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_RGMII_REG1_MASK,
+                .val = PMX_RGMII_REG1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_RGMII_REG2_MASK,
+                .val = PMX_RGMII_REG2_MASK,
        },
 };
@@ -649,6 +721,10 @@ static struct spear_muxreg smii_0_1_2_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_SMII_0_1_2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_SMII_0_1_2_MASK,
+                .val = PMX_SMII_0_1_2_MASK,
        },
 };
@@ -681,6 +757,10 @@ static struct spear_muxreg ras_mii_txclk_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NFCE2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NFCE2_MASK,
+                .val = PMX_NFCE2_MASK,
        },
 };
@@ -721,6 +801,14 @@ static struct spear_muxreg nand_8bit_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NAND8BIT_1_MASK,
                .val = PMX_NAND8BIT_1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_NAND8BIT_0_MASK,
+                .val = PMX_NAND8BIT_0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NAND8BIT_1_MASK,
+                .val = PMX_NAND8BIT_1_MASK,
        },
 };
@@ -747,6 +835,10 @@ static struct spear_muxreg nand_16bit_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NAND16BIT_1_MASK,
                .val = PMX_NAND16BIT_1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NAND16BIT_1_MASK,
+                .val = PMX_NAND16BIT_1_MASK,
        },
 };
@@ -772,6 +864,10 @@ static struct spear_muxreg nand_4_chips_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NAND_4CHIPS_MASK,
                .val = PMX_NAND_4CHIPS_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NAND_4CHIPS_MASK,
+                .val = PMX_NAND_4CHIPS_MASK,
        },
 };
@@ -833,6 +929,10 @@ static struct spear_muxreg keyboard_rowcol6_8_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_KBD_ROWCOL68_MASK,
                .val = PMX_KBD_ROWCOL68_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL68_MASK,
+                .val = PMX_KBD_ROWCOL68_MASK,
        },
 };
@@ -866,6 +966,10 @@ static struct spear_muxreg uart0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_UART0_MASK,
                .val = PMX_UART0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_UART0_MASK,
+                .val = PMX_UART0_MASK,
        },
 };
@@ -891,6 +995,10 @@ static struct spear_muxreg uart0_modem_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_UART0_MODEM_MASK,
                .val = PMX_UART0_MODEM_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_UART0_MODEM_MASK,
+                .val = PMX_UART0_MODEM_MASK,
        },
 };
@@ -923,6 +1031,10 @@ static struct spear_muxreg gpt0_tmr0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT0_TMR0_MASK,
                .val = PMX_GPT0_TMR0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT0_TMR0_MASK,
+                .val = PMX_GPT0_TMR0_MASK,
        },
 };
@@ -948,6 +1060,10 @@ static struct spear_muxreg gpt0_tmr1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT0_TMR1_MASK,
                .val = PMX_GPT0_TMR1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT0_TMR1_MASK,
+                .val = PMX_GPT0_TMR1_MASK,
        },
 };
@@ -980,6 +1096,10 @@ static struct spear_muxreg gpt1_tmr0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT1_TMR0_MASK,
                .val = PMX_GPT1_TMR0_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT1_TMR0_MASK,
+                .val = PMX_GPT1_TMR0_MASK,
        },
 };
@@ -1005,6 +1125,10 @@ static struct spear_muxreg gpt1_tmr1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_GPT1_TMR1_MASK,
                .val = PMX_GPT1_TMR1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_GPT1_TMR1_MASK,
+                .val = PMX_GPT1_TMR1_MASK,
        },
 };
@@ -1049,6 +1173,20 @@ static const unsigned mcif_pins[] = { 86, 87, 88, 89, 90, 91, 92, 93, 213, 214,
                .reg = PAD_FUNCTION_EN_2,                       \
                .mask = PMX_MCIFALL_2_MASK,                     \
                .val = PMX_MCIFALL_2_MASK,                      \
+        }, {                                                    \
+                .reg = PAD_DIRECTION_SEL_0,                     \
+                .mask = PMX_MCI_DATA8_15_MASK,                  \
+                .val = PMX_MCI_DATA8_15_MASK,                   \
+        }, {                                                    \
+                .reg = PAD_DIRECTION_SEL_1,                     \
+                .mask = PMX_MCIFALL_1_MASK | PMX_NFWPRT1_MASK | \
+                        PMX_NFWPRT2_MASK,                       \
+                .val = PMX_MCIFALL_1_MASK | PMX_NFWPRT1_MASK |  \
+                        PMX_NFWPRT2_MASK,                       \
+        }, {                                                    \
+                .reg = PAD_DIRECTION_SEL_2,                     \
+                .mask = PMX_MCIFALL_2_MASK,                     \
+                .val = PMX_MCIFALL_2_MASK,                      \
        }
 /* sdhci device */
@@ -1154,6 +1292,10 @@ static struct spear_muxreg touch_xy_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_TOUCH_XY_MASK,
                .val = PMX_TOUCH_XY_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_TOUCH_XY_MASK,
+                .val = PMX_TOUCH_XY_MASK,
        },
 };
@@ -1187,6 +1329,10 @@ static struct spear_muxreg uart1_dis_i2c_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2C0_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2C0_MASK,
+                .val = PMX_I2C0_MASK,
        },
 };
@@ -1213,6 +1359,12 @@ static struct spear_muxreg uart1_dis_sd_muxreg[] = {
                .mask = PMX_MCIDATA1_MASK |
                        PMX_MCIDATA2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_MCIDATA1_MASK |
+                        PMX_MCIDATA2_MASK,
+                .val = PMX_MCIDATA1_MASK |
+                        PMX_MCIDATA2_MASK,
        },
 };
@@ -1246,6 +1398,10 @@ static struct spear_muxreg uart2_3_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2S0_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2S0_MASK,
+                .val = PMX_I2S0_MASK,
        },
 };
@@ -1278,6 +1434,10 @@ static struct spear_muxreg uart4_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_I2S0_MASK | PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_I2S0_MASK | PMX_CLCD1_MASK,
+                .val = PMX_I2S0_MASK | PMX_CLCD1_MASK,
        },
 };
@@ -1310,6 +1470,10 @@ static struct spear_muxreg uart5_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -1344,6 +1508,10 @@ static struct spear_muxreg rs485_0_1_tdm_0_1_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -1376,6 +1544,10 @@ static struct spear_muxreg i2c_1_2_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK,
+                .val = PMX_CLCD1_MASK,
        },
 };
@@ -1409,6 +1581,10 @@ static struct spear_muxreg i2c3_dis_smi_clcd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_CLCD1_MASK | PMX_SMI_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_CLCD1_MASK | PMX_SMI_MASK,
+                .val = PMX_CLCD1_MASK | PMX_SMI_MASK,
        },
 };
@@ -1435,6 +1611,10 @@ static struct spear_muxreg i2c3_dis_sd_i2s0_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_I2S1_MASK | PMX_MCIDATA3_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_I2S1_MASK | PMX_MCIDATA3_MASK,
+                .val = PMX_I2S1_MASK | PMX_MCIDATA3_MASK,
        },
 };
@@ -1469,6 +1649,10 @@ static struct spear_muxreg i2c_4_5_dis_smi_muxreg[] = {
                .reg = PAD_FUNCTION_EN_0,
                .mask = PMX_SMI_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_SMI_MASK,
+                .val = PMX_SMI_MASK,
        },
 };
@@ -1499,6 +1683,14 @@ static struct spear_muxreg i2c4_dis_sd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_MCIDATA5_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_MCIDATA4_MASK,
+                .val = PMX_MCIDATA4_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIDATA5_MASK,
+                .val = PMX_MCIDATA5_MASK,
        },
 };
@@ -1526,6 +1718,12 @@ static struct spear_muxreg i2c5_dis_sd_muxreg[] = {
                .mask = PMX_MCIDATA6_MASK |
                        PMX_MCIDATA7_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIDATA6_MASK |
+                        PMX_MCIDATA7_MASK,
+                .val = PMX_MCIDATA6_MASK |
+                        PMX_MCIDATA7_MASK,
        },
 };
@@ -1560,6 +1758,10 @@ static struct spear_muxreg i2c_6_7_dis_kbd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_KBD_ROWCOL25_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL25_MASK,
+                .val = PMX_KBD_ROWCOL25_MASK,
        },
 };
@@ -1587,6 +1789,12 @@ static struct spear_muxreg i2c6_dis_sd_muxreg[] = {
                .mask = PMX_MCIIORDRE_MASK |
                        PMX_MCIIOWRWE_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIIORDRE_MASK |
+                        PMX_MCIIOWRWE_MASK,
+                .val = PMX_MCIIORDRE_MASK |
+                        PMX_MCIIOWRWE_MASK,
        },
 };
@@ -1613,6 +1821,12 @@ static struct spear_muxreg i2c7_dis_sd_muxreg[] = {
                .mask = PMX_MCIRESETCF_MASK |
                        PMX_MCICS0CE_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIRESETCF_MASK |
+                        PMX_MCICS0CE_MASK,
+                .val = PMX_MCIRESETCF_MASK |
+                        PMX_MCICS0CE_MASK,
        },
 };
@@ -1651,6 +1865,14 @@ static struct spear_muxreg can0_dis_nor_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_NFRSTPWDWN3_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_NFRSTPWDWN2_MASK,
+                .val = PMX_NFRSTPWDWN2_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_NFRSTPWDWN3_MASK,
+                .val = PMX_NFRSTPWDWN3_MASK,
        },
 };
@@ -1677,6 +1899,10 @@ static struct spear_muxreg can0_dis_sd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_MCICFINTR_MASK | PMX_MCIIORDY_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCICFINTR_MASK | PMX_MCIIORDY_MASK,
+                .val = PMX_MCICFINTR_MASK | PMX_MCIIORDY_MASK,
        },
 };
@@ -1711,6 +1937,10 @@ static struct spear_muxreg can1_dis_sd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_2,
                .mask = PMX_MCICS1_MASK | PMX_MCIDMAACK_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCICS1_MASK | PMX_MCIDMAACK_MASK,
+                .val = PMX_MCICS1_MASK | PMX_MCIDMAACK_MASK,
        },
 };
@@ -1737,6 +1967,10 @@ static struct spear_muxreg can1_dis_kbd_muxreg[] = {
                .reg = PAD_FUNCTION_EN_1,
                .mask = PMX_KBD_ROWCOL25_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL25_MASK,
+                .val = PMX_KBD_ROWCOL25_MASK,
        },
 };
@@ -1763,29 +1997,64 @@ static struct spear_function can1_function = {
        .ngroups = ARRAY_SIZE(can1_grps),
 };
-/* Pad multiplexing for pci device */
+/* Pad multiplexing for (ras-ip) pci device */
-static const unsigned pci_sata_pins[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 18,
+static const unsigned pci_pins[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 18,
        19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,
        37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54,
        55, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99 };
-#define PCI_SATA_MUXREG                         \
-        {                                       \
-                .reg = PAD_FUNCTION_EN_0,       \
-                .mask = PMX_MCI_DATA8_15_MASK,  \
-                .val = 0,                       \
-        }, {                                    \
-                .reg = PAD_FUNCTION_EN_1,       \
-                .mask = PMX_PCI_REG1_MASK,      \
-                .val = 0,                       \
-        }, {                                    \
-                .reg = PAD_FUNCTION_EN_2,       \
-                .mask = PMX_PCI_REG2_MASK,      \
-                .val = 0,                       \
-        }
-/* pad multiplexing for pcie0 device */
+static struct spear_muxreg pci_muxreg[] = {
+        {
+                .reg = PAD_FUNCTION_EN_0,
+                .mask = PMX_MCI_DATA8_15_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_FUNCTION_EN_1,
+                .mask = PMX_PCI_REG1_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_FUNCTION_EN_2,
+                .mask = PMX_PCI_REG2_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_0,
+                .mask = PMX_MCI_DATA8_15_MASK,
+                .val = PMX_MCI_DATA8_15_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_PCI_REG1_MASK,
+                .val = PMX_PCI_REG1_MASK,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_PCI_REG2_MASK,
+                .val = PMX_PCI_REG2_MASK,
+        },
+};
+static struct spear_modemux pci_modemux[] = {
+        {
+                .muxregs = pci_muxreg,
+                .nmuxregs = ARRAY_SIZE(pci_muxreg),
+        },
+};
+static struct spear_pingroup pci_pingroup = {
+        .name = "pci_grp",
+        .pins = pci_pins,
+        .npins = ARRAY_SIZE(pci_pins),
+        .modemuxs = pci_modemux,
+        .nmodemuxs = ARRAY_SIZE(pci_modemux),
+};
+static const char *const pci_grps[] = { "pci_grp" };
+static struct spear_function pci_function = {
+        .name = "pci",
+        .groups = pci_grps,
+        .ngroups = ARRAY_SIZE(pci_grps),
+};
+/* pad multiplexing for (fix-part) pcie0 device */
 static struct spear_muxreg pcie0_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = PCIE_CFG_VAL(0),
@@ -1802,15 +2071,12 @@ static struct spear_modemux pcie0_modemux[] = {
 static struct spear_pingroup pcie0_pingroup = {
        .name = "pcie0_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = pcie0_modemux,
        .nmodemuxs = ARRAY_SIZE(pcie0_modemux),
 };
-/* pad multiplexing for pcie1 device */
+/* pad multiplexing for (fix-part) pcie1 device */
 static struct spear_muxreg pcie1_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = PCIE_CFG_VAL(1),
@@ -1827,15 +2093,12 @@ static struct spear_modemux pcie1_modemux[] = {
 static struct spear_pingroup pcie1_pingroup = {
        .name = "pcie1_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = pcie1_modemux,
        .nmodemuxs = ARRAY_SIZE(pcie1_modemux),
 };
-/* pad multiplexing for pcie2 device */
+/* pad multiplexing for (fix-part) pcie2 device */
 static struct spear_muxreg pcie2_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = PCIE_CFG_VAL(2),
@@ -1852,22 +2115,20 @@ static struct spear_modemux pcie2_modemux[] = {
 static struct spear_pingroup pcie2_pingroup = {
        .name = "pcie2_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = pcie2_modemux,
        .nmodemuxs = ARRAY_SIZE(pcie2_modemux),
 };
-static const char *const pci_grps[] = { "pcie0_grp", "pcie1_grp", "pcie2_grp" };
+static const char *const pcie_grps[] = { "pcie0_grp", "pcie1_grp", "pcie2_grp"
-static struct spear_function pci_function = {
+};
-        .name = "pci",
+static struct spear_function pcie_function = {
-        .groups = pci_grps,
+        .name = "pci_express",
-        .ngroups = ARRAY_SIZE(pci_grps),
+        .groups = pcie_grps,
+        .ngroups = ARRAY_SIZE(pcie_grps),
 };
 /* pad multiplexing for sata0 device */
 static struct spear_muxreg sata0_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = SATA_CFG_VAL(0),
@@ -1884,15 +2145,12 @@ static struct spear_modemux sata0_modemux[] = {
 static struct spear_pingroup sata0_pingroup = {
        .name = "sata0_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = sata0_modemux,
        .nmodemuxs = ARRAY_SIZE(sata0_modemux),
 };
 /* pad multiplexing for sata1 device */
 static struct spear_muxreg sata1_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = SATA_CFG_VAL(1),
@@ -1909,15 +2167,12 @@ static struct spear_modemux sata1_modemux[] = {
 static struct spear_pingroup sata1_pingroup = {
        .name = "sata1_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = sata1_modemux,
        .nmodemuxs = ARRAY_SIZE(sata1_modemux),
 };
 /* pad multiplexing for sata2 device */
 static struct spear_muxreg sata2_muxreg[] = {
-        PCI_SATA_MUXREG,
        {
                .reg = PCIE_SATA_CFG,
                .mask = SATA_CFG_VAL(2),
@@ -1934,8 +2189,6 @@ static struct spear_modemux sata2_modemux[] = {
 static struct spear_pingroup sata2_pingroup = {
        .name = "sata2_grp",
-        .pins = pci_sata_pins,
-        .npins = ARRAY_SIZE(pci_sata_pins),
        .modemuxs = sata2_modemux,
        .nmodemuxs = ARRAY_SIZE(sata2_modemux),
 };
@@ -1957,6 +2210,14 @@ static struct spear_muxreg ssp1_dis_kbd_muxreg[] = {
                        PMX_KBD_COL0_MASK | PMX_NFIO8_15_MASK | PMX_NFCE1_MASK |
                        PMX_NFCE2_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_1,
+                .mask = PMX_KBD_ROWCOL25_MASK | PMX_KBD_COL1_MASK |
+                        PMX_KBD_COL0_MASK | PMX_NFIO8_15_MASK | PMX_NFCE1_MASK |
+                        PMX_NFCE2_MASK,
+                .val = PMX_KBD_ROWCOL25_MASK | PMX_KBD_COL1_MASK |
+                        PMX_KBD_COL0_MASK | PMX_NFIO8_15_MASK | PMX_NFCE1_MASK |
+                        PMX_NFCE2_MASK,
        },
 };
@@ -1983,6 +2244,12 @@ static struct spear_muxreg ssp1_dis_sd_muxreg[] = {
                .mask = PMX_MCIADDR0ALE_MASK | PMX_MCIADDR2_MASK |
                        PMX_MCICECF_MASK | PMX_MCICEXD_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCIADDR0ALE_MASK | PMX_MCIADDR2_MASK |
+                        PMX_MCICECF_MASK | PMX_MCICEXD_MASK,
+                .val = PMX_MCIADDR0ALE_MASK | PMX_MCIADDR2_MASK |
+                        PMX_MCICECF_MASK | PMX_MCICEXD_MASK,
        },
 };
@@ -2017,6 +2284,12 @@ static struct spear_muxreg gpt64_muxreg[] = {
                .mask = PMX_MCICDCF1_MASK | PMX_MCICDCF2_MASK | PMX_MCICDXD_MASK
                        | PMX_MCILEDS_MASK,
                .val = 0,
+        }, {
+                .reg = PAD_DIRECTION_SEL_2,
+                .mask = PMX_MCICDCF1_MASK | PMX_MCICDCF2_MASK | PMX_MCICDXD_MASK
+                        | PMX_MCILEDS_MASK,
+                .val = PMX_MCICDCF1_MASK | PMX_MCICDCF2_MASK | PMX_MCICDXD_MASK
+                        | PMX_MCILEDS_MASK,
        },
 };
@@ -2093,6 +2366,7 @@ static struct spear_pingroup *spear1310_pingroups[] = {
        &can0_dis_sd_pingroup,
        &can1_dis_sd_pingroup,
        &can1_dis_kbd_pingroup,
+        &pci_pingroup,
        &pcie0_pingroup,
        &pcie1_pingroup,
        &pcie2_pingroup,
@@ -2138,6 +2412,7 @@ static struct spear_function *spear1310_functions[] = {
        &can0_function,
        &can1_function,
        &pci_function,
+        &pcie_function,
        &sata_function,
        &ssp1_function,
        &gpt64_function,
diff --git a/drivers/pinctrl/spear/pinctrl-spear1340.c b/drivers/pinctrl/spear/pinctrl-spear1340.c
index a0eb057e55bd..0606b8cf3f2c 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1340.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1340.c
@@ -213,7 +213,7 @@ static const struct pinctrl_pin_desc spear1340_pins[] = {
 * Pad multiplexing for making all pads as gpio's. This is done to override the
 * values passed from bootloader and start from scratch.
 */
-static const unsigned pads_as_gpio_pins[] = { 251 };
+static const unsigned pads_as_gpio_pins[] = { 12, 88, 89, 251 };
 static struct spear_muxreg pads_as_gpio_muxreg[] = {
        {
                .reg = PAD_FUNCTION_EN_1,
@@ -1692,7 +1692,43 @@ static struct spear_pingroup clcd_pingroup = {
        .nmodemuxs = ARRAY_SIZE(clcd_modemux),
 };
-static const char *const clcd_grps[] = { "clcd_grp" };
+/* Disable cld runtime to save panel damage */
+static struct spear_muxreg clcd_sleep_muxreg[] = {
+        {
+                .reg = PAD_SHARED_IP_EN_1,
+                .mask = ARM_TRACE_MASK | MIPHY_DBG_MASK,
+                .val = 0,
+        }, {
+                .reg = PAD_FUNCTION_EN_5,
+                .mask = CLCD_REG4_MASK | CLCD_AND_ARM_TRACE_REG4_MASK,
+                .val = 0x0,
+        }, {
+                .reg = PAD_FUNCTION_EN_6,
+                .mask = CLCD_AND_ARM_TRACE_REG5_MASK,
+                .val = 0x0,
+        }, {
+                .reg = PAD_FUNCTION_EN_7,
+                .mask = CLCD_AND_ARM_TRACE_REG6_MASK,
+                .val = 0x0,
+        },
+};
+static struct spear_modemux clcd_sleep_modemux[] = {
+        {
+                .muxregs = clcd_sleep_muxreg,
+                .nmuxregs = ARRAY_SIZE(clcd_sleep_muxreg),
+        },
+};
+static struct spear_pingroup clcd_sleep_pingroup = {
+        .name = "clcd_sleep_grp",
+        .pins = clcd_pins,
+        .npins = ARRAY_SIZE(clcd_pins),
+        .modemuxs = clcd_sleep_modemux,
+        .nmodemuxs = ARRAY_SIZE(clcd_sleep_modemux),
+};
+static const char *const clcd_grps[] = { "clcd_grp", "clcd_sleep_grp" };
 static struct spear_function clcd_function = {
        .name = "clcd",
        .groups = clcd_grps,
@@ -1893,6 +1929,7 @@ static struct spear_pingroup *spear1340_pingroups[] = {
        &sdhci_pingroup,
        &cf_pingroup,
        &xd_pingroup,
+        &clcd_sleep_pingroup,
        &clcd_pingroup,
        &arm_trace_pingroup,
        &miphy_dbg_pingroup,
diff --git a/drivers/pinctrl/spear/pinctrl-spear320.c b/drivers/pinctrl/spear/pinctrl-spear320.c
index 020b1e0bdb3e..ca47b0e50780 100644
--- a/drivers/pinctrl/spear/pinctrl-spear320.c
+++ b/drivers/pinctrl/spear/pinctrl-spear320.c
@@ -2240,6 +2240,10 @@ static struct spear_muxreg pwm2_pin_34_muxreg[] = {
                .mask = PMX_SSP_CS_MASK,
                .val = 0,
        }, {
+                .reg = MODE_CONFIG_REG,
+                .mask = PMX_PWM_MASK,
+                .val = PMX_PWM_MASK,
+        }, {
                .reg = IP_SEL_PAD_30_39_REG,
                .mask = PMX_PL_34_MASK,
                .val = PMX_PWM2_PL_34_VAL,
@@ -2956,9 +2960,9 @@ static struct spear_function mii2_function = {
 };
 /* Pad multiplexing for cadence mii 1_2 as smii or rmii device */
-static const unsigned smii0_1_pins[] = { 10, 11, 13, 14, 15, 16, 17, 18, 19, 20,
+static const unsigned rmii0_1_pins[] = { 10, 11, 13, 14, 15, 16, 17, 18, 19, 20,
        21, 22, 23, 24, 25, 26, 27 };
-static const unsigned rmii0_1_pins[] = { 10, 11, 21, 22, 23, 24, 25, 26, 27 };
+static const unsigned smii0_1_pins[] = { 10, 11, 21, 22, 23, 24, 25, 26, 27 };
 static struct spear_muxreg mii0_1_muxreg[] = {
        {
                .reg = PMX_CONFIG_REG,
diff --git a/drivers/pinctrl/spear/pinctrl-spear3xx.h b/drivers/pinctrl/spear/pinctrl-spear3xx.h
index 31f44347f17c..7860b36053c4 100644
--- a/drivers/pinctrl/spear/pinctrl-spear3xx.h
+++ b/drivers/pinctrl/spear/pinctrl-spear3xx.h
@@ -15,6 +15,7 @@
 #include "pinctrl-spear.h"
 /* pad mux declarations */
+#define PMX_PWM_MASK            (1 << 16)
 #define PMX_FIRDA_MASK          (1 << 14)
 #define PMX_I2C_MASK            (1 << 13)
 #define PMX_SSP_CS_MASK         (1 << 12)
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 33bb4d891e16..4af3dfe70ef5 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -112,9 +112,6 @@ extern int for_each_subchannel(int(*fn)(struct subchannel_id, void *), void *);
 extern void css_reiterate_subchannels(void);
 void css_update_ssd_info(struct subchannel *sch);
-#define __MAX_SUBCHANNEL 65535
-#define __MAX_SSID 3
 struct channel_subsystem {
        u8 cssid;
        int valid;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index fc916f5d7314..fd3143c291c6 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1424,7 +1424,7 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
        }
        if (device_is_disconnected(cdev))
                return IO_SCH_REPROBE;
-        if (cdev->online)
+        if (cdev->online && !cdev->private->flags.resuming)
                return IO_SCH_VERIFY;
        if (cdev->private->state == DEV_STATE_NOT_OPER)
                return IO_SCH_UNREG_ATTACH;
@@ -1469,12 +1469,6 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
                rc = 0;
                goto out_unlock;
        case IO_SCH_VERIFY:
-                if (cdev->private->flags.resuming == 1) {
-                        if (cio_enable_subchannel(sch, (u32)(addr_t)sch)) {
-                                ccw_device_set_notoper(cdev);
-                                break;
-                        }
-                }
                /* Trigger path verification. */
                io_subchannel_verify(sch);
                rc = 0;
diff --git a/drivers/s390/cio/idset.c b/drivers/s390/cio/idset.c
index 199bc6791177..65d13e38803f 100644
--- a/drivers/s390/cio/idset.c
+++ b/drivers/s390/cio/idset.c
@@ -125,8 +125,7 @@ int idset_is_empty(struct idset *set)
 void idset_add_set(struct idset *to, struct idset *from)
 {
-        int len = min(__BITOPS_WORDS(to->num_ssid * to->num_id),
+        int len = min(to->num_ssid * to->num_id, from->num_ssid * from->num_id);
-                      __BITOPS_WORDS(from->num_ssid * from->num_id));
        bitmap_or(to->bitmap, to->bitmap, from->bitmap, len);
 }
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index bd4708a422cd..20fd974f903a 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -149,6 +149,7 @@ qla2x00_mark_vp_devices_dead(scsi_qla_host_t *vha)
 int
 qla24xx_disable_vp(scsi_qla_host_t *vha)
 {
+        unsigned long flags;
        int ret;
        ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL);
@@ -156,7 +157,9 @@ qla24xx_disable_vp(scsi_qla_host_t *vha)
        atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
        /* Remove port id from vp target map */
+        spin_lock_irqsave(&vha->hw->vport_slock, flags);
        qlt_update_vp_map(vha, RESET_AL_PA);
+        spin_unlock_irqrestore(&vha->hw->vport_slock, flags);
        qla2x00_mark_vp_devices_dead(vha);
        atomic_set(&vha->vp_state, VP_FAILED);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 0e09d8f433d1..62aa5584f644 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -557,6 +557,7 @@ static bool qlt_check_fcport_exist(struct scsi_qla_host *vha,
        int pmap_len;
        fc_port_t *fcport;
        int global_resets;
+        unsigned long flags;
 retry:
        global_resets = atomic_read(&ha->tgt.qla_tgt->tgt_global_resets_count);
@@ -625,10 +626,10 @@ retry:
            sess->s_id.b.area, sess->loop_id, fcport->d_id.b.domain,
            fcport->d_id.b.al_pa, fcport->d_id.b.area, fcport->loop_id);
-        sess->s_id = fcport->d_id;
+        spin_lock_irqsave(&ha->hardware_lock, flags);
-        sess->loop_id = fcport->loop_id;
+        ha->tgt.tgt_ops->update_sess(sess, fcport->d_id, fcport->loop_id,
-        sess->conf_compl_supported = !!(fcport->flags &
+                                (fcport->flags & FCF_CONF_COMP_SUPPORTED));
-            FCF_CONF_COMP_SUPPORTED);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        res = true;
@@ -740,10 +741,9 @@ static struct qla_tgt_sess *qlt_create_sess(
                                qlt_undelete_sess(sess);
                        kref_get(&sess->se_sess->sess_kref);
-                        sess->s_id = fcport->d_id;
+                        ha->tgt.tgt_ops->update_sess(sess, fcport->d_id, fcport->loop_id,
-                        sess->loop_id = fcport->loop_id;
+                                                (fcport->flags & FCF_CONF_COMP_SUPPORTED));
-                        sess->conf_compl_supported = !!(fcport->flags &
-                            FCF_CONF_COMP_SUPPORTED);
                        if (sess->local && !local)
                                sess->local = 0;
                        spin_unlock_irqrestore(&ha->hardware_lock, flags);
@@ -796,8 +796,7 @@ static struct qla_tgt_sess *qlt_create_sess(
         */
        kref_get(&sess->se_sess->sess_kref);
-        sess->conf_compl_supported = !!(fcport->flags &
+        sess->conf_compl_supported = (fcport->flags & FCF_CONF_COMP_SUPPORTED);
-            FCF_CONF_COMP_SUPPORTED);
        BUILD_BUG_ON(sizeof(sess->port_name) != sizeof(fcport->port_name));
        memcpy(sess->port_name, fcport->port_name, sizeof(sess->port_name));
@@ -869,10 +868,8 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf007,
                            "Reappeared sess %p\n", sess);
                }
-                sess->s_id = fcport->d_id;
+                ha->tgt.tgt_ops->update_sess(sess, fcport->d_id, fcport->loop_id,
-                sess->loop_id = fcport->loop_id;
+                                        (fcport->flags & FCF_CONF_COMP_SUPPORTED));
-                sess->conf_compl_supported = !!(fcport->flags &
-                    FCF_CONF_COMP_SUPPORTED);
        }
        if (sess && sess->local) {
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 170af1571214..bad749561ec2 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -648,6 +648,7 @@ struct qla_tgt_func_tmpl {
        int (*check_initiator_node_acl)(struct scsi_qla_host *, unsigned char *,
                                        void *, uint8_t *, uint16_t);
+        void (*update_sess)(struct qla_tgt_sess *, port_id_t, uint16_t, bool);
        struct qla_tgt_sess *(*find_sess_by_loop_id)(struct scsi_qla_host *,
                                                const uint16_t);
        struct qla_tgt_sess *(*find_sess_by_s_id)(struct scsi_qla_host *,
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 2358c16c4c8e..3d74f2f39ae1 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -237,7 +237,7 @@ static char *tcm_qla2xxx_get_fabric_wwn(struct se_portal_group *se_tpg)
                                struct tcm_qla2xxx_tpg, se_tpg);
        struct tcm_qla2xxx_lport *lport = tpg->lport;
-        return &lport->lport_name[0];
+        return lport->lport_naa_name;
 }
 static char *tcm_qla2xxx_npiv_get_fabric_wwn(struct se_portal_group *se_tpg)
@@ -1457,6 +1457,78 @@ static int tcm_qla2xxx_check_initiator_node_acl(
        return 0;
 }
+static void tcm_qla2xxx_update_sess(struct qla_tgt_sess *sess, port_id_t s_id,
+                                    uint16_t loop_id, bool conf_compl_supported)
+{
+        struct qla_tgt *tgt = sess->tgt;
+        struct qla_hw_data *ha = tgt->ha;
+        struct tcm_qla2xxx_lport *lport = ha->tgt.target_lport_ptr;
+        struct se_node_acl *se_nacl = sess->se_sess->se_node_acl;
+        struct tcm_qla2xxx_nacl *nacl = container_of(se_nacl,
+                        struct tcm_qla2xxx_nacl, se_node_acl);
+        u32 key;
+        if (sess->loop_id != loop_id || sess->s_id.b24 != s_id.b24)
+                pr_info("Updating session %p from port %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x loop_id %d -> %d s_id %x:%x:%x -> %x:%x:%x\n",
+                        sess,
+                        sess->port_name[0], sess->port_name[1],
+                        sess->port_name[2], sess->port_name[3],
+                        sess->port_name[4], sess->port_name[5],
+                        sess->port_name[6], sess->port_name[7],
+                        sess->loop_id, loop_id,
+                        sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa,
+                        s_id.b.domain, s_id.b.area, s_id.b.al_pa);
+        if (sess->loop_id != loop_id) {
+                /*
+                 * Because we can shuffle loop IDs around and we
+                 * update different sessions non-atomically, we might
+                 * have overwritten this session's old loop ID
+                 * already, and we might end up overwriting some other
+                 * session that will be updated later.  So we have to
+                 * be extra careful and we can't warn about those things...
+                 */
+                if (lport->lport_loopid_map[sess->loop_id].se_nacl == se_nacl)
+                        lport->lport_loopid_map[sess->loop_id].se_nacl = NULL;
+                lport->lport_loopid_map[loop_id].se_nacl = se_nacl;
+                sess->loop_id = loop_id;
+        }
+        if (sess->s_id.b24 != s_id.b24) {
+                key = (((u32) sess->s_id.b.domain << 16) |
+                       ((u32) sess->s_id.b.area   <<  8) |
+                       ((u32) sess->s_id.b.al_pa));
+                if (btree_lookup32(&lport->lport_fcport_map, key))
+                        WARN(btree_remove32(&lport->lport_fcport_map, key) != se_nacl,
+                             "Found wrong se_nacl when updating s_id %x:%x:%x\n",
+                             sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa);
+                else
+                        WARN(1, "No lport_fcport_map entry for s_id %x:%x:%x\n",
+                             sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa);
+                key = (((u32) s_id.b.domain << 16) |
+                       ((u32) s_id.b.area   <<  8) |
+                       ((u32) s_id.b.al_pa));
+                if (btree_lookup32(&lport->lport_fcport_map, key)) {
+                        WARN(1, "Already have lport_fcport_map entry for s_id %x:%x:%x\n",
+                             s_id.b.domain, s_id.b.area, s_id.b.al_pa);
+                        btree_update32(&lport->lport_fcport_map, key, se_nacl);
+                } else {
+                        btree_insert32(&lport->lport_fcport_map, key, se_nacl, GFP_ATOMIC);
+                }
+                sess->s_id = s_id;
+                nacl->nport_id = key;
+        }
+        sess->conf_compl_supported = conf_compl_supported;
+}
 /*
 * Calls into tcm_qla2xxx used by qla2xxx LLD I/O path.
 */
@@ -1467,6 +1539,7 @@ static struct qla_tgt_func_tmpl tcm_qla2xxx_template = {
        .free_cmd               = tcm_qla2xxx_free_cmd,
        .free_mcmd              = tcm_qla2xxx_free_mcmd,
        .free_session           = tcm_qla2xxx_free_session,
+        .update_sess            = tcm_qla2xxx_update_sess,
        .check_initiator_node_acl = tcm_qla2xxx_check_initiator_node_acl,
        .find_sess_by_s_id      = tcm_qla2xxx_find_sess_by_s_id,
        .find_sess_by_loop_id   = tcm_qla2xxx_find_sess_by_loop_id,
@@ -1534,6 +1607,7 @@ static struct se_wwn *tcm_qla2xxx_make_lport(
        lport->lport_wwpn = wwpn;
        tcm_qla2xxx_format_wwn(&lport->lport_name[0], TCM_QLA2XXX_NAMELEN,
                                wwpn);
+        sprintf(lport->lport_naa_name, "naa.%016llx", (unsigned long long) wwpn);
        ret = tcm_qla2xxx_init_lport(lport);
        if (ret != 0)
@@ -1601,6 +1675,7 @@ static struct se_wwn *tcm_qla2xxx_npiv_make_lport(
        lport->lport_npiv_wwnn = npiv_wwnn;
        tcm_qla2xxx_npiv_format_wwn(&lport->lport_npiv_name[0],
                        TCM_QLA2XXX_NAMELEN, npiv_wwpn, npiv_wwnn);
+        sprintf(lport->lport_naa_name, "naa.%016llx", (unsigned long long) npiv_wwpn);
 /* FIXME: tcm_qla2xxx_npiv_make_lport */
        ret = -ENOSYS;
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
index 825498103352..9ba075fe9781 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
@@ -61,6 +61,8 @@ struct tcm_qla2xxx_lport {
        u64 lport_npiv_wwnn;
        /* ASCII formatted WWPN for FC Target Lport */
        char lport_name[TCM_QLA2XXX_NAMELEN];
+        /* ASCII formatted naa WWPN for VPD page 83 etc */
+        char lport_naa_name[TCM_QLA2XXX_NAMELEN];
        /* ASCII formatted WWPN+WWNN for NPIV FC Target Lport */
        char lport_npiv_name[TCM_QLA2XXX_NPIV_NAMELEN];
        /* map for fc_port pointers in 24-bit FC Port ID space */
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index edf1360ab09e..86dd04d6bc87 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -323,6 +323,7 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
        if (!ret) {
                dev_err(ssp->dev, "DMA transfer timeout\n");
                ret = -ETIMEDOUT;
+                dmaengine_terminate_all(ssp->dmach);
                goto err_vmalloc;
        }
@@ -480,7 +481,7 @@ static int mxs_spi_transfer_one(struct spi_master *master,
                first = last = 0;
        }
-        m->status = 0;
+        m->status = status;
        spi_finalize_current_message(master);
        return status;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index d6ce2182e672..035c2c762537 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3719,7 +3719,9 @@ restart:
                 */
                iscsit_thread_check_cpumask(conn, current, 1);
-                schedule_timeout_interruptible(MAX_SCHEDULE_TIMEOUT);
+                wait_event_interruptible(conn->queues_wq,
+                                         !iscsit_conn_all_queues_empty(conn) ||
+                                         ts->status == ISCSI_THREAD_SET_RESET);
                if ((ts->status == ISCSI_THREAD_SET_RESET) ||
                     signal_pending(current))
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 2ba9f9b9435c..21048dbf7d13 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -486,6 +486,7 @@ struct iscsi_tmr_req {
 };
 struct iscsi_conn {
+        wait_queue_head_t       queues_wq;
        /* Authentication Successful for this connection */
        u8                      auth_complete;
        /* State connection is currently in */
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index cdc8a10939c3..f8dbec05d5e5 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -41,6 +41,7 @@
 static int iscsi_login_init_conn(struct iscsi_conn *conn)
 {
+        init_waitqueue_head(&conn->queues_wq);
        INIT_LIST_HEAD(&conn->conn_list);
        INIT_LIST_HEAD(&conn->conn_cmd_list);
        INIT_LIST_HEAD(&conn->immed_queue_list);
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index afd98ccd40ae..1a91195ab619 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -488,7 +488,7 @@ void iscsit_add_cmd_to_immediate_queue(
        atomic_set(&conn->check_immediate_queue, 1);
        spin_unlock_bh(&conn->immed_queue_lock);
-        wake_up_process(conn->thread_set->tx_thread);
+        wake_up(&conn->queues_wq);
 }
 struct iscsi_queue_req *iscsit_get_cmd_from_immediate_queue(struct iscsi_conn *conn)
@@ -562,7 +562,7 @@ void iscsit_add_cmd_to_response_queue(
        atomic_inc(&cmd->response_queue_count);
        spin_unlock_bh(&conn->response_queue_lock);
-        wake_up_process(conn->thread_set->tx_thread);
+        wake_up(&conn->queues_wq);
 }
 struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *conn)
@@ -616,6 +616,24 @@ static void iscsit_remove_cmd_from_response_queue(
        }
 }
+bool iscsit_conn_all_queues_empty(struct iscsi_conn *conn)
+{
+        bool empty;
+        spin_lock_bh(&conn->immed_queue_lock);
+        empty = list_empty(&conn->immed_queue_list);
+        spin_unlock_bh(&conn->immed_queue_lock);
+        if (!empty)
+                return empty;
+        spin_lock_bh(&conn->response_queue_lock);
+        empty = list_empty(&conn->response_queue_list);
+        spin_unlock_bh(&conn->response_queue_lock);
+        return empty;
+}
 void iscsit_free_queue_reqs_for_conn(struct iscsi_conn *conn)
 {
        struct iscsi_queue_req *qr, *qr_tmp;
diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h
index 44054bd35437..894d0f837924 100644
--- a/drivers/target/iscsi/iscsi_target_util.h
+++ b/drivers/target/iscsi/iscsi_target_util.h
@@ -25,6 +25,7 @@ extern struct iscsi_queue_req *iscsit_get_cmd_from_immediate_queue(struct iscsi_
 extern void iscsit_add_cmd_to_response_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
 extern struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *);
 extern void iscsit_remove_cmd_from_tx_queues(struct iscsi_cmd *, struct iscsi_conn *);
+extern bool iscsit_conn_all_queues_empty(struct iscsi_conn *);
 extern void iscsit_free_queue_reqs_for_conn(struct iscsi_conn *);
 extern void iscsit_release_cmd(struct iscsi_cmd *);
 extern void iscsit_free_cmd(struct iscsi_cmd *);
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 015f5be27bf6..c123327499a3 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -3206,7 +3206,8 @@ static int __init target_core_init_configfs(void)
        if (ret < 0)
                goto out;
-        if (core_dev_setup_virtual_lun0() < 0)
+        ret = core_dev_setup_virtual_lun0();
+        if (ret < 0)
                goto out;
        return 0;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 8d774da16320..9abef9f8eb76 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -850,20 +850,20 @@ int se_dev_check_shutdown(struct se_device *dev)
 static u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
 {
-        u32 tmp, aligned_max_sectors;
+        u32 aligned_max_sectors;
+        u32 alignment;
        /*
         * Limit max_sectors to a PAGE_SIZE aligned value for modern
         * transport_allocate_data_tasks() operation.
         */
-        tmp = rounddown((max_sectors * block_size), PAGE_SIZE);
+        alignment = max(1ul, PAGE_SIZE / block_size);
-        aligned_max_sectors = (tmp / block_size);
+        aligned_max_sectors = rounddown(max_sectors, alignment);
-        if (max_sectors != aligned_max_sectors) {
-                printk(KERN_INFO "Rounding down aligned max_sectors from %u"
+        if (max_sectors != aligned_max_sectors)
-                                " to %u\n", max_sectors, aligned_max_sectors);
+                pr_info("Rounding down aligned max_sectors from %u to %u\n",
-                return aligned_max_sectors;
+                        max_sectors, aligned_max_sectors);
-        }
-        return max_sectors;
+        return aligned_max_sectors;
 }
 void se_dev_set_default_attribs(
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 868f8aa04f13..a6e27d967c7b 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -135,6 +135,12 @@ static int sbc_emulate_verify(struct se_cmd *cmd)
        return 0;
 }
+static int sbc_emulate_noop(struct se_cmd *cmd)
+{
+        target_complete_cmd(cmd, GOOD);
+        return 0;
+}
 static inline u32 sbc_get_size(struct se_cmd *cmd, u32 sectors)
 {
        return cmd->se_dev->se_sub_dev->se_dev_attrib.block_size * sectors;
@@ -531,6 +537,18 @@ int sbc_parse_cdb(struct se_cmd *cmd, struct spc_ops *ops)
                size = 0;
                cmd->execute_cmd = sbc_emulate_verify;
                break;
+        case REZERO_UNIT:
+        case SEEK_6:
+        case SEEK_10:
+                /*
+                 * There are still clients out there which use these old SCSI-2
+                 * commands. This mainly happens when running VMs with legacy
+                 * guest systems, connected via SCSI command pass-through to
+                 * iSCSI targets. Make them happy and return status GOOD.
+                 */
+                size = 0;
+                cmd->execute_cmd = sbc_emulate_noop;
+                break;
        default:
                ret = spc_parse_cdb(cmd, &size);
                if (ret)
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 9229bd9ad61b..6fd434d3d7e4 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -605,6 +605,8 @@ static int spc_emulate_inquiry(struct se_cmd *cmd)
        unsigned char buf[SE_INQUIRY_BUF];
        int p, ret;
+        memset(buf, 0, SE_INQUIRY_BUF);
        if (dev == tpg->tpg_virt_lun0.lun_se_dev)
                buf[0] = 0x3f; /* Not connected */
        else
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 1c59a3c23b2c..be75c4331a92 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -140,15 +140,15 @@ void core_tmr_abort_task(
                printk("ABORT_TASK: Found referenced %s task_tag: %u\n",
                        se_cmd->se_tfo->get_fabric_name(), ref_tag);
-                spin_lock_irq(&se_cmd->t_state_lock);
+                spin_lock(&se_cmd->t_state_lock);
                if (se_cmd->transport_state & CMD_T_COMPLETE) {
                        printk("ABORT_TASK: ref_tag: %u already complete, skipping\n", ref_tag);
-                        spin_unlock_irq(&se_cmd->t_state_lock);
+                        spin_unlock(&se_cmd->t_state_lock);
                        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
                        goto out;
                }
                se_cmd->transport_state |= CMD_T_ABORTED;
-                spin_unlock_irq(&se_cmd->t_state_lock);
+                spin_unlock(&se_cmd->t_state_lock);
                list_del_init(&se_cmd->se_cmd_list);
                kref_get(&se_cmd->cmd_kref);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index c33baff86aa6..9097155e9ebe 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1616,7 +1616,6 @@ static void target_complete_tmr_failure(struct work_struct *work)
        se_cmd->se_tmr_req->response = TMR_LUN_DOES_NOT_EXIST;
        se_cmd->se_tfo->queue_tm_rsp(se_cmd);
-        transport_generic_free_cmd(se_cmd, 0);
 }
 /**
diff --git a/drivers/thermal/exynos_thermal.c b/drivers/thermal/exynos_thermal.c
index fd03e8581afc..6dd29e4ce36b 100644
--- a/drivers/thermal/exynos_thermal.c
+++ b/drivers/thermal/exynos_thermal.c
@@ -815,7 +815,7 @@ static struct platform_device_id exynos_tmu_driver_ids[] = {
        },
        { },
 };
-MODULE_DEVICE_TABLE(platform, exynos4_tmu_driver_ids);
+MODULE_DEVICE_TABLE(platform, exynos_tmu_driver_ids);
 static inline struct  exynos_tmu_platform_data *exynos_get_driver_data(
                        struct platform_device *pdev)
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index d4452716aaab..f7a1b574a304 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -210,7 +210,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                goto error_free_priv;
        }
-        zone = thermal_zone_device_register("rcar_thermal", 0, priv,
+        zone = thermal_zone_device_register("rcar_thermal", 0, 0, priv,
                                            &rcar_thermal_zone_ops, 0, 0);
        if (IS_ERR(zone)) {
                dev_err(&pdev->dev, "thermal zone device is NULL\n");
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 072cbbadbc36..7f93f34b7f91 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -379,7 +379,8 @@ static void handle_rx(struct vhost_net *net)
                .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE
        };
        size_t total_len = 0;
-        int err, headcount, mergeable;
+        int err, mergeable;
+        s16 headcount;
        size_t vhost_hlen, sock_hlen;
        size_t vhost_len, sock_len;
        /* TODO: check that we are running from vhost_worker? */
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index b7f5173ff9e9..917bb5681684 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -641,7 +641,6 @@ static void xenfb_backend_changed(struct xenbus_device *dev,
        case XenbusStateReconfiguring:
        case XenbusStateReconfigured:
        case XenbusStateUnknown:
-        case XenbusStateClosed:
                break;
        case XenbusStateInitWait:
@@ -670,6 +669,10 @@ InitWait:
                info->feature_resize = val;
                break;
+        case XenbusStateClosed:
+                if (dev->state == XenbusStateClosed)
+                        break;
+                /* Missed the backend's CLOSING state -- fallthrough */
        case XenbusStateClosing:
                xenbus_frontend_closed(dev);
                break;
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 1e8659ca27ef..809b0de59c09 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -225,8 +225,10 @@ EXPORT_SYMBOL_GPL(register_virtio_device);
 void unregister_virtio_device(struct virtio_device *dev)
 {
+        int index = dev->index; /* save for after device release */
        device_unregister(&dev->dev);
-        ida_simple_remove(&virtio_index_ida, dev->index);
+        ida_simple_remove(&virtio_index_ida, index);
 }
 EXPORT_SYMBOL_GPL(unregister_virtio_device);
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 0e8637035457..74354708c6c4 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -2,6 +2,7 @@ ifneq ($(CONFIG_ARM),y)
 obj-y   += manage.o balloon.o
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
+obj-$(CONFIG_X86)                       += fallback.o
 obj-y   += grant-table.o features.o events.o
 obj-y   += xenbus/
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 912ac81b6dbf..0be4df39e953 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -1395,10 +1395,10 @@ void xen_evtchn_do_upcall(struct pt_regs *regs)
 {
        struct pt_regs *old_regs = set_irq_regs(regs);
+        irq_enter();
 #ifdef CONFIG_X86
        exit_idle();
 #endif
-        irq_enter();
        __xen_evtchn_do_upcall();
diff --git a/drivers/xen/fallback.c b/drivers/xen/fallback.c
new file mode 100644
index 000000000000..0ef7c4d40f86
--- /dev/null
+++ b/drivers/xen/fallback.c
@@ -0,0 +1,80 @@
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/bug.h>
+#include <linux/export.h>
+#include <asm/hypervisor.h>
+#include <asm/xen/hypercall.h>
+int xen_event_channel_op_compat(int cmd, void *arg)
+{
+        struct evtchn_op op;
+        int rc;
+        op.cmd = cmd;
+        memcpy(&op.u, arg, sizeof(op.u));
+        rc = _hypercall1(int, event_channel_op_compat, &op);
+        switch (cmd) {
+        case EVTCHNOP_close:
+        case EVTCHNOP_send:
+        case EVTCHNOP_bind_vcpu:
+        case EVTCHNOP_unmask:
+                /* no output */
+                break;
+#define COPY_BACK(eop) \
+        case EVTCHNOP_##eop: \
+                memcpy(arg, &op.u.eop, sizeof(op.u.eop)); \
+                break
+        COPY_BACK(bind_interdomain);
+        COPY_BACK(bind_virq);
+        COPY_BACK(bind_pirq);
+        COPY_BACK(status);
+        COPY_BACK(alloc_unbound);
+        COPY_BACK(bind_ipi);
+#undef COPY_BACK
+        default:
+                WARN_ON(rc != -ENOSYS);
+                break;
+        }
+        return rc;
+}
+EXPORT_SYMBOL_GPL(xen_event_channel_op_compat);
+int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
+{
+        struct physdev_op op;
+        int rc;
+        op.cmd = cmd;
+        memcpy(&op.u, arg, sizeof(op.u));
+        rc = _hypercall1(int, physdev_op_compat, &op);
+        switch (cmd) {
+        case PHYSDEVOP_IRQ_UNMASK_NOTIFY:
+        case PHYSDEVOP_set_iopl:
+        case PHYSDEVOP_set_iobitmap:
+        case PHYSDEVOP_apic_write:
+                /* no output */
+                break;
+#define COPY_BACK(pop, fld) \
+        case PHYSDEVOP_##pop: \
+                memcpy(arg, &op.u.fld, sizeof(op.u.fld)); \
+                break
+        COPY_BACK(irq_status_query, irq_status_query);
+        COPY_BACK(apic_read, apic_op);
+        COPY_BACK(ASSIGN_VECTOR, irq_op);
+#undef COPY_BACK
+        default:
+                WARN_ON(rc != -ENOSYS);
+                break;
+        }
+        return rc;
+}
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 610bfc6be177..2e22df2f7a3f 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -105,6 +105,21 @@ static void gntdev_print_maps(struct gntdev_priv *priv,
 #endif
 }
+static void gntdev_free_map(struct grant_map *map)
+{
+        if (map == NULL)
+                return;
+        if (map->pages)
+                free_xenballooned_pages(map->count, map->pages);
+        kfree(map->pages);
+        kfree(map->grants);
+        kfree(map->map_ops);
+        kfree(map->unmap_ops);
+        kfree(map->kmap_ops);
+        kfree(map);
+}
 static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count)
 {
        struct grant_map *add;
@@ -142,12 +157,7 @@ static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count)
        return add;
 err:
-        kfree(add->pages);
+        gntdev_free_map(add);
-        kfree(add->grants);
-        kfree(add->map_ops);
-        kfree(add->unmap_ops);
-        kfree(add->kmap_ops);
-        kfree(add);
        return NULL;
 }
@@ -198,17 +208,9 @@ static void gntdev_put_map(struct grant_map *map)
                evtchn_put(map->notify.event);
        }
-        if (map->pages) {
+        if (map->pages && !use_ptemod)
-                if (!use_ptemod)
+                unmap_grant_pages(map, 0, map->count);
-                        unmap_grant_pages(map, 0, map->count);
+        gntdev_free_map(map);
-                free_xenballooned_pages(map->count, map->pages);
-        }
-        kfree(map->pages);
-        kfree(map->grants);
-        kfree(map->map_ops);
-        kfree(map->unmap_ops);
-        kfree(map);
 }
 /* ------------------------------------------------------------------ */
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 89f76252a16f..ac727028e658 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp,
                goto out;
        /* Can't write a xenbus message larger we can buffer */
-        if ((len + u->len) > sizeof(u->u.buffer)) {
+        if (len > sizeof(u->u.buffer) - u->len) {
                /* On error, dump existing buffer */
                u->len = 0;
                rc = -EINVAL;
diff --git a/fs/bio.c b/fs/bio.c
index 9298c65ad9c7..b96fc6ce4855 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -75,6 +75,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
        unsigned int sz = sizeof(struct bio) + extra_size;
        struct kmem_cache *slab = NULL;
        struct bio_slab *bslab, *new_bio_slabs;
+        unsigned int new_bio_slab_max;
        unsigned int i, entry = -1;
        mutex_lock(&bio_slab_lock);
@@ -97,12 +98,13 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
                goto out_unlock;
        if (bio_slab_nr == bio_slab_max && entry == -1) {
-                bio_slab_max <<= 1;
+                new_bio_slab_max = bio_slab_max << 1;
                new_bio_slabs = krealloc(bio_slabs,
-                                         bio_slab_max * sizeof(struct bio_slab),
+                                         new_bio_slab_max * sizeof(struct bio_slab),
                                         GFP_KERNEL);
                if (!new_bio_slabs)
                        goto out_unlock;
+                bio_slab_max = new_bio_slab_max;
                bio_slabs = new_bio_slabs;
        }
        if (entry == -1)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index b3c1d3dae77d..1a1e5e3b1eaf 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1661,6 +1661,39 @@ static int blkdev_mmap(struct file *file, struct vm_area_struct *vma)
        return ret;
 }
+static ssize_t blkdev_splice_read(struct file *file, loff_t *ppos,
+                                  struct pipe_inode_info *pipe, size_t len,
+                                  unsigned int flags)
+{
+        ssize_t ret;
+        struct block_device *bdev = I_BDEV(file->f_mapping->host);
+        percpu_down_read(&bdev->bd_block_size_semaphore);
+        ret = generic_file_splice_read(file, ppos, pipe, len, flags);
+        percpu_up_read(&bdev->bd_block_size_semaphore);
+        return ret;
+}
+static ssize_t blkdev_splice_write(struct pipe_inode_info *pipe,
+                                   struct file *file, loff_t *ppos, size_t len,
+                                   unsigned int flags)
+{
+        ssize_t ret;
+        struct block_device *bdev = I_BDEV(file->f_mapping->host);
+        percpu_down_read(&bdev->bd_block_size_semaphore);
+        ret = generic_file_splice_write(pipe, file, ppos, len, flags);
+        percpu_up_read(&bdev->bd_block_size_semaphore);
+        return ret;
+}
 /*
 * Try to release a page associated with block device when the system
 * is under memory pressure.
@@ -1699,8 +1732,8 @@ const struct file_operations def_blk_fops = {
 #ifdef CONFIG_COMPAT
        .compat_ioctl   = compat_blkdev_ioctl,
 #endif
-        .splice_read    = generic_file_splice_read,
+        .splice_read    = blkdev_splice_read,
-        .splice_write   = generic_file_splice_write,
+        .splice_write   = blkdev_splice_write,
 };
 int ioctl_by_bdev(struct block_device *bdev, unsigned cmd, unsigned long arg)
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 02ce90972d81..9349bb37a2fe 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -90,6 +90,8 @@ static int ceph_encode_fh(struct inode *inode, u32 *rawfh, int *max_len,
                *max_len = handle_length;
                type = 255;
        }
+        if (dentry)
+                dput(dentry);
        return type;
 }
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index fc783e264420..0fb15bbbe43c 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -225,6 +225,13 @@ sid_to_str(struct cifs_sid *sidptr, char *sidstr)
 }
 static void
+cifs_copy_sid(struct cifs_sid *dst, const struct cifs_sid *src)
+{
+        memcpy(dst, src, sizeof(*dst));
+        dst->num_subauth = min_t(u8, src->num_subauth, NUM_SUBAUTHS);
+}
+static void
 id_rb_insert(struct rb_root *root, struct cifs_sid *sidptr,
                struct cifs_sid_id **psidid, char *typestr)
 {
@@ -248,7 +255,7 @@ id_rb_insert(struct rb_root *root, struct cifs_sid *sidptr,
                }
        }
-        memcpy(&(*psidid)->sid, sidptr, sizeof(struct cifs_sid));
+        cifs_copy_sid(&(*psidid)->sid, sidptr);
        (*psidid)->time = jiffies - (SID_MAP_RETRY + 1);
        (*psidid)->refcount = 0;
@@ -354,7 +361,7 @@ id_to_sid(unsigned long cid, uint sidtype, struct cifs_sid *ssid)
         * any fields of the node after a reference is put .
         */
        if (test_bit(SID_ID_MAPPED, &psidid->state)) {
-                memcpy(ssid, &psidid->sid, sizeof(struct cifs_sid));
+                cifs_copy_sid(ssid, &psidid->sid);
                psidid->time = jiffies; /* update ts for accessing */
                goto id_sid_out;
        }
@@ -370,14 +377,14 @@ id_to_sid(unsigned long cid, uint sidtype, struct cifs_sid *ssid)
                if (IS_ERR(sidkey)) {
                        rc = -EINVAL;
                        cFYI(1, "%s: Can't map and id to a SID", __func__);
+                } else if (sidkey->datalen < sizeof(struct cifs_sid)) {
+                        rc = -EIO;
+                        cFYI(1, "%s: Downcall contained malformed key "
+                                "(datalen=%hu)", __func__, sidkey->datalen);
                } else {
                        lsid = (struct cifs_sid *)sidkey->payload.data;
-                        memcpy(&psidid->sid, lsid,
+                        cifs_copy_sid(&psidid->sid, lsid);
-                                sidkey->datalen < sizeof(struct cifs_sid) ?
+                        cifs_copy_sid(ssid, &psidid->sid);
-                                sidkey->datalen : sizeof(struct cifs_sid));
-                        memcpy(ssid, &psidid->sid,
-                                sidkey->datalen < sizeof(struct cifs_sid) ?
-                                sidkey->datalen : sizeof(struct cifs_sid));
                        set_bit(SID_ID_MAPPED, &psidid->state);
                        key_put(sidkey);
                        kfree(psidid->sidstr);
@@ -396,7 +403,7 @@ id_to_sid(unsigned long cid, uint sidtype, struct cifs_sid *ssid)
                        return rc;
                }
                if (test_bit(SID_ID_MAPPED, &psidid->state))
-                        memcpy(ssid, &psidid->sid, sizeof(struct cifs_sid));
+                        cifs_copy_sid(ssid, &psidid->sid);
                else
                        rc = -EINVAL;
        }
@@ -675,8 +682,6 @@ int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
 static void copy_sec_desc(const struct cifs_ntsd *pntsd,
                                struct cifs_ntsd *pnntsd, __u32 sidsoffset)
 {
-        int i;
        struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
        struct cifs_sid *nowner_sid_ptr, *ngroup_sid_ptr;
@@ -692,26 +697,14 @@ static void copy_sec_desc(const struct cifs_ntsd *pntsd,
        owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
                                le32_to_cpu(pntsd->osidoffset));
        nowner_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset);
+        cifs_copy_sid(nowner_sid_ptr, owner_sid_ptr);
-        nowner_sid_ptr->revision = owner_sid_ptr->revision;
-        nowner_sid_ptr->num_subauth = owner_sid_ptr->num_subauth;
-        for (i = 0; i < 6; i++)
-                nowner_sid_ptr->authority[i] = owner_sid_ptr->authority[i];
-        for (i = 0; i < 5; i++)
-                nowner_sid_ptr->sub_auth[i] = owner_sid_ptr->sub_auth[i];
        /* copy group sid */
        group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
                                le32_to_cpu(pntsd->gsidoffset));
        ngroup_sid_ptr = (struct cifs_sid *)((char *)pnntsd + sidsoffset +
                                        sizeof(struct cifs_sid));
+        cifs_copy_sid(ngroup_sid_ptr, group_sid_ptr);
-        ngroup_sid_ptr->revision = group_sid_ptr->revision;
-        ngroup_sid_ptr->num_subauth = group_sid_ptr->num_subauth;
-        for (i = 0; i < 6; i++)
-                ngroup_sid_ptr->authority[i] = group_sid_ptr->authority[i];
-        for (i = 0; i < 5; i++)
-                ngroup_sid_ptr->sub_auth[i] = group_sid_ptr->sub_auth[i];
        return;
 }
@@ -1120,8 +1113,7 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
                                kfree(nowner_sid_ptr);
                                return rc;
                        }
-                        memcpy(owner_sid_ptr, nowner_sid_ptr,
+                        cifs_copy_sid(owner_sid_ptr, nowner_sid_ptr);
-                                        sizeof(struct cifs_sid));
                        kfree(nowner_sid_ptr);
                        *aclflag = CIFS_ACL_OWNER;
                }
@@ -1139,8 +1131,7 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
                                kfree(ngroup_sid_ptr);
                                return rc;
                        }
-                        memcpy(group_sid_ptr, ngroup_sid_ptr,
+                        cifs_copy_sid(group_sid_ptr, ngroup_sid_ptr);
-                                        sizeof(struct cifs_sid));
                        kfree(ngroup_sid_ptr);
                        *aclflag = CIFS_ACL_GROUP;
                }
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 7c0a81283645..d3671f2acb29 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -398,7 +398,16 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
         * in network traffic in the other paths.
         */
        if (!(oflags & O_CREAT)) {
-                struct dentry *res = cifs_lookup(inode, direntry, 0);
+                struct dentry *res;
+                /*
+                 * Check for hashed negative dentry. We have already revalidated
+                 * the dentry and it is fine. No need to perform another lookup.
+                 */
+                if (!d_unhashed(direntry))
+                        return -ENOENT;
+                res = cifs_lookup(inode, direntry, 0);
                if (IS_ERR(res))
                        return PTR_ERR(res);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index da72250ddc1c..cd96649bfe62 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -346,7 +346,7 @@ static inline struct epitem *ep_item_from_epqueue(poll_table *p)
 /* Tells if the epoll_ctl(2) operation needs an event copy from userspace */
 static inline int ep_op_has_event(int op)
 {
-        return op == EPOLL_CTL_ADD || op == EPOLL_CTL_MOD;
+        return op != EPOLL_CTL_DEL;
 }
 /* Initialize the poll safe wake up structure */
@@ -676,34 +676,6 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
        return 0;
 }
-/*
- * Disables a "struct epitem" in the eventpoll set. Returns -EBUSY if the item
- * had no event flags set, indicating that another thread may be currently
- * handling that item's events (in the case that EPOLLONESHOT was being
- * used). Otherwise a zero result indicates that the item has been disabled
- * from receiving events. A disabled item may be re-enabled via
- * EPOLL_CTL_MOD. Must be called with "mtx" held.
- */
-static int ep_disable(struct eventpoll *ep, struct epitem *epi)
-{
-        int result = 0;
-        unsigned long flags;
-        spin_lock_irqsave(&ep->lock, flags);
-        if (epi->event.events & ~EP_PRIVATE_BITS) {
-                if (ep_is_linked(&epi->rdllink))
-                        list_del_init(&epi->rdllink);
-                /* Ensure ep_poll_callback will not add epi back onto ready
-                   list: */
-                epi->event.events &= EP_PRIVATE_BITS;
-                }
-        else
-                result = -EBUSY;
-        spin_unlock_irqrestore(&ep->lock, flags);
-        return result;
-}
 static void ep_free(struct eventpoll *ep)
 {
        struct rb_node *rbp;
@@ -1048,6 +1020,8 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
        rb_insert_color(&epi->rbn, &ep->rbr);
 }
 #define PATH_ARR_SIZE 5
 /*
 * These are the number paths of length 1 to 5, that we are allowing to emanate
@@ -1813,12 +1787,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                } else
                        error = -ENOENT;
                break;
-        case EPOLL_CTL_DISABLE:
-                if (epi)
-                        error = ep_disable(ep, epi);
-                else
-                        error = -ENOENT;
-                break;
        }
        mutex_unlock(&ep->mtx);
diff --git a/fs/exec.c b/fs/exec.c
index 8b9011b67041..0039055b1fc6 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1083,7 +1083,8 @@ int flush_old_exec(struct linux_binprm * bprm)
        bprm->mm = NULL;                /* We're using it now */
        set_fs(USER_DS);
-        current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD);
+        current->flags &=
+                ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD | PF_NOFREEZE);
        flush_thread();
        current->personality &= ~bprm->per_clear;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 4facdd29a350..3a100e7a62a8 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -725,6 +725,10 @@ repeat_in_this_group:
                                   "inode=%lu", ino + 1);
                        continue;
                }
+                BUFFER_TRACE(inode_bitmap_bh, "get_write_access");
+                err = ext4_journal_get_write_access(handle, inode_bitmap_bh);
+                if (err)
+                        goto fail;
                ext4_lock_group(sb, group);
                ret2 = ext4_test_and_set_bit(ino, inode_bitmap_bh->b_data);
                ext4_unlock_group(sb, group);
@@ -738,6 +742,11 @@ repeat_in_this_group:
        goto out;
 got:
+        BUFFER_TRACE(inode_bitmap_bh, "call ext4_handle_dirty_metadata");
+        err = ext4_handle_dirty_metadata(handle, NULL, inode_bitmap_bh);
+        if (err)
+                goto fail;
        /* We may have to initialize the block bitmap if it isn't already */
        if (ext4_has_group_desc_csum(sb) &&
            gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
@@ -771,11 +780,6 @@ got:
                        goto fail;
        }
-        BUFFER_TRACE(inode_bitmap_bh, "get_write_access");
-        err = ext4_journal_get_write_access(handle, inode_bitmap_bh);
-        if (err)
-                goto fail;
        BUFFER_TRACE(group_desc_bh, "get_write_access");
        err = ext4_journal_get_write_access(handle, group_desc_bh);
        if (err)
@@ -823,11 +827,6 @@ got:
        }
        ext4_unlock_group(sb, group);
-        BUFFER_TRACE(inode_bitmap_bh, "call ext4_handle_dirty_metadata");
-        err = ext4_handle_dirty_metadata(handle, NULL, inode_bitmap_bh);
-        if (err)
-                goto fail;
        BUFFER_TRACE(group_desc_bh, "call ext4_handle_dirty_metadata");
        err = ext4_handle_dirty_metadata(handle, NULL, group_desc_bh);
        if (err)
diff --git a/fs/file.c b/fs/file.c
index d3b5fa80b71b..708d997a7748 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -900,7 +900,7 @@ int replace_fd(unsigned fd, struct file *file, unsigned flags)
                return __close_fd(files, fd);
        if (fd >= rlimit(RLIMIT_NOFILE))
-                return -EMFILE;
+                return -EBADF;
        spin_lock(&files->file_lock);
        err = expand_files(files, fd);
@@ -926,7 +926,7 @@ SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags)
                return -EINVAL;
        if (newfd >= rlimit(RLIMIT_NOFILE))
-                return -EMFILE;
+                return -EBADF;
        spin_lock(&files->file_lock);
        err = expand_files(files, newfd);
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 0def0504afc1..e056b4ce4877 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -516,15 +516,13 @@ static int gfs2_mmap(struct file *file, struct vm_area_struct *vma)
                struct gfs2_holder i_gh;
                int error;
-                gfs2_holder_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
+                error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY,
-                error = gfs2_glock_nq(&i_gh);
+                                           &i_gh);
-                if (error == 0) {
-                        file_accessed(file);
-                        gfs2_glock_dq(&i_gh);
-                }
-                gfs2_holder_uninit(&i_gh);
                if (error)
                        return error;
+                /* grab lock to update inode */
+                gfs2_glock_dq_uninit(&i_gh);
+                file_accessed(file);
        }
        vma->vm_ops = &gfs2_vm_ops;
@@ -677,10 +675,8 @@ static ssize_t gfs2_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
        size_t writesize = iov_length(iov, nr_segs);
        struct dentry *dentry = file->f_dentry;
        struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
-        struct gfs2_sbd *sdp;
        int ret;
-        sdp = GFS2_SB(file->f_mapping->host);
        ret = gfs2_rs_alloc(ip);
        if (ret)
                return ret;
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 8ff95a2d54ee..9ceccb1595a3 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -393,12 +393,10 @@ static void buf_lo_add(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
        struct gfs2_meta_header *mh;
        struct gfs2_trans *tr;
-        lock_buffer(bd->bd_bh);
-        gfs2_log_lock(sdp);
        tr = current->journal_info;
        tr->tr_touched = 1;
        if (!list_empty(&bd->bd_list))
-                goto out;
+                return;
        set_bit(GLF_LFLUSH, &bd->bd_gl->gl_flags);
        set_bit(GLF_DIRTY, &bd->bd_gl->gl_flags);
        mh = (struct gfs2_meta_header *)bd->bd_bh->b_data;
@@ -414,9 +412,6 @@ static void buf_lo_add(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
        sdp->sd_log_num_buf++;
        list_add(&bd->bd_list, &sdp->sd_log_le_buf);
        tr->tr_num_buf_new++;
-out:
-        gfs2_log_unlock(sdp);
-        unlock_buffer(bd->bd_bh);
 }
 static void gfs2_check_magic(struct buffer_head *bh)
@@ -621,7 +616,6 @@ static void revoke_lo_add(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
 static void revoke_lo_before_commit(struct gfs2_sbd *sdp)
 {
-        struct gfs2_log_descriptor *ld;
        struct gfs2_meta_header *mh;
        unsigned int offset;
        struct list_head *head = &sdp->sd_log_le_revoke;
@@ -634,7 +628,6 @@ static void revoke_lo_before_commit(struct gfs2_sbd *sdp)
        length = gfs2_struct2blk(sdp, sdp->sd_log_num_revoke, sizeof(u64));
        page = gfs2_get_log_desc(sdp, GFS2_LOG_DESC_REVOKE, length, sdp->sd_log_num_revoke);
-        ld = page_address(page);
        offset = sizeof(struct gfs2_log_descriptor);
        list_for_each_entry(bd, head, bd_list) {
@@ -777,12 +770,10 @@ static void databuf_lo_add(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
        struct address_space *mapping = bd->bd_bh->b_page->mapping;
        struct gfs2_inode *ip = GFS2_I(mapping->host);
-        lock_buffer(bd->bd_bh);
-        gfs2_log_lock(sdp);
        if (tr)
                tr->tr_touched = 1;
        if (!list_empty(&bd->bd_list))
-                goto out;
+                return;
        set_bit(GLF_LFLUSH, &bd->bd_gl->gl_flags);
        set_bit(GLF_DIRTY, &bd->bd_gl->gl_flags);
        if (gfs2_is_jdata(ip)) {
@@ -793,9 +784,6 @@ static void databuf_lo_add(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
        } else {
                list_add_tail(&bd->bd_list, &sdp->sd_log_le_ordered);
        }
-out:
-        gfs2_log_unlock(sdp);
-        unlock_buffer(bd->bd_bh);
 }
 /**
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 40c4b0d42fa8..c5af8e18f27a 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -497,8 +497,11 @@ int gfs2_quota_hold(struct gfs2_inode *ip, u32 uid, u32 gid)
        struct gfs2_quota_data **qd;
        int error;
-        if (ip->i_res == NULL)
+        if (ip->i_res == NULL) {
-                gfs2_rs_alloc(ip);
+                error = gfs2_rs_alloc(ip);
+                if (error)
+                        return error;
+        }
        qd = ip->i_res->rs_qa_qd;
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 3cc402ce6fea..38fe18f2f055 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -553,7 +553,6 @@ void gfs2_free_clones(struct gfs2_rgrpd *rgd)
 */
 int gfs2_rs_alloc(struct gfs2_inode *ip)
 {
-        int error = 0;
        struct gfs2_blkreserv *res;
        if (ip->i_res)
@@ -561,7 +560,7 @@ int gfs2_rs_alloc(struct gfs2_inode *ip)
        res = kmem_cache_zalloc(gfs2_rsrv_cachep, GFP_NOFS);
        if (!res)
-                error = -ENOMEM;
+                return -ENOMEM;
        RB_CLEAR_NODE(&res->rs_node);
@@ -571,7 +570,7 @@ int gfs2_rs_alloc(struct gfs2_inode *ip)
        else
                ip->i_res = res;
        up_write(&ip->i_rw_mutex);
-        return error;
+        return 0;
 }
 static void dump_rs(struct seq_file *seq, const struct gfs2_blkreserv *rs)
@@ -1263,7 +1262,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
        int ret = 0;
        u64 amt;
        u64 trimmed = 0;
+        u64 start, end, minlen;
        unsigned int x;
+        unsigned bs_shift = sdp->sd_sb.sb_bsize_shift;
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
@@ -1271,19 +1272,25 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
        if (!blk_queue_discard(q))
                return -EOPNOTSUPP;
-        if (argp == NULL) {
+        if (copy_from_user(&r, argp, sizeof(r)))
-                r.start = 0;
-                r.len = ULLONG_MAX;
-                r.minlen = 0;
-        } else if (copy_from_user(&r, argp, sizeof(r)))
                return -EFAULT;
        ret = gfs2_rindex_update(sdp);
        if (ret)
                return ret;
-        rgd = gfs2_blk2rgrpd(sdp, r.start, 0);
+        start = r.start >> bs_shift;
-        rgd_end = gfs2_blk2rgrpd(sdp, r.start + r.len, 0);
+        end = start + (r.len >> bs_shift);
+        minlen = max_t(u64, r.minlen,
+                       q->limits.discard_granularity) >> bs_shift;
+        rgd = gfs2_blk2rgrpd(sdp, start, 0);
+        rgd_end = gfs2_blk2rgrpd(sdp, end - 1, 0);
+        if (end <= start ||
+            minlen > sdp->sd_max_rg_data ||
+            start > rgd_end->rd_data0 + rgd_end->rd_data)
+                return -EINVAL;
        while (1) {
@@ -1295,7 +1302,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
                        /* Trim each bitmap in the rgrp */
                        for (x = 0; x < rgd->rd_length; x++) {
                                struct gfs2_bitmap *bi = rgd->rd_bits + x;
-                                ret = gfs2_rgrp_send_discards(sdp, rgd->rd_data0, NULL, bi, r.minlen, &amt);
+                                ret = gfs2_rgrp_send_discards(sdp,
+                                                rgd->rd_data0, NULL, bi, minlen,
+                                                &amt);
                                if (ret) {
                                        gfs2_glock_dq_uninit(&gh);
                                        goto out;
@@ -1324,7 +1333,7 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
 out:
        r.len = trimmed << 9;
-        if (argp && copy_to_user(argp, &r, sizeof(r)))
+        if (copy_to_user(argp, &r, sizeof(r)))
                return -EFAULT;
        return ret;
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index bc737261f234..d6488674d916 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -810,7 +810,8 @@ static void gfs2_dirty_inode(struct inode *inode, int flags)
                        return;
                }
                need_unlock = 1;
-        }
+        } else if (WARN_ON_ONCE(ip->i_gl->gl_state != LM_ST_EXCLUSIVE))
+                return;
        if (current->journal_info == NULL) {
                ret = gfs2_trans_begin(sdp, RES_DINODE, 0);
diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
index adbd27875ef9..413627072f36 100644
--- a/fs/gfs2/trans.c
+++ b/fs/gfs2/trans.c
@@ -155,14 +155,22 @@ void gfs2_trans_add_bh(struct gfs2_glock *gl, struct buffer_head *bh, int meta)
        struct gfs2_sbd *sdp = gl->gl_sbd;
        struct gfs2_bufdata *bd;
+        lock_buffer(bh);
+        gfs2_log_lock(sdp);
        bd = bh->b_private;
        if (bd)
                gfs2_assert(sdp, bd->bd_gl == gl);
        else {
+                gfs2_log_unlock(sdp);
+                unlock_buffer(bh);
                gfs2_attach_bufdata(gl, bh, meta);
                bd = bh->b_private;
+                lock_buffer(bh);
+                gfs2_log_lock(sdp);
        }
        lops_add(sdp, bd);
+        gfs2_log_unlock(sdp);
+        unlock_buffer(bh);
 }
 void gfs2_trans_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
diff --git a/fs/nfs/dns_resolve.c b/fs/nfs/dns_resolve.c
index 31c26c4dcc23..ca4b11ec87a2 100644
--- a/fs/nfs/dns_resolve.c
+++ b/fs/nfs/dns_resolve.c
@@ -217,7 +217,7 @@ static int nfs_dns_parse(struct cache_detail *cd, char *buf, int buflen)
 {
        char buf1[NFS_DNS_HOSTNAME_MAXLEN+1];
        struct nfs_dns_ent key, *item;
-        unsigned long ttl;
+        unsigned int ttl;
        ssize_t len;
        int ret = -EINVAL;
@@ -240,7 +240,8 @@ static int nfs_dns_parse(struct cache_detail *cd, char *buf, int buflen)
        key.namelen = len;
        memset(&key.h, 0, sizeof(key.h));
-        ttl = get_expiry(&buf);
+        if (get_uint(&buf, &ttl) < 0)
+                goto out;
        if (ttl == 0)
                goto out;
        key.h.expiry_time = ttl + seconds_since_boot();
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 5c7325c5c5e6..6fa01aea2488 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -685,7 +685,10 @@ static void __put_nfs_open_context(struct nfs_open_context *ctx, int is_sync)
        if (ctx->cred != NULL)
                put_rpccred(ctx->cred);
        dput(ctx->dentry);
-        nfs_sb_deactive(sb);
+        if (is_sync)
+                nfs_sb_deactive(sb);
+        else
+                nfs_sb_deactive_async(sb);
        kfree(ctx->mdsthreshold);
        kfree(ctx);
 }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 59b133c5d652..05521cadac2e 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -351,10 +351,12 @@ extern int __init register_nfs_fs(void);
 extern void __exit unregister_nfs_fs(void);
 extern void nfs_sb_active(struct super_block *sb);
 extern void nfs_sb_deactive(struct super_block *sb);
+extern void nfs_sb_deactive_async(struct super_block *sb);
 /* namespace.c */
+#define NFS_PATH_CANONICAL 1
 extern char *nfs_path(char **p, struct dentry *dentry,
-                      char *buffer, ssize_t buflen);
+                      char *buffer, ssize_t buflen, unsigned flags);
 extern struct vfsmount *nfs_d_automount(struct path *path);
 struct vfsmount *nfs_submount(struct nfs_server *, struct dentry *,
                              struct nfs_fh *, struct nfs_fattr *);
@@ -498,7 +500,7 @@ static inline char *nfs_devname(struct dentry *dentry,
                                char *buffer, ssize_t buflen)
 {
        char *dummy;
-        return nfs_path(&dummy, dentry, buffer, buflen);
+        return nfs_path(&dummy, dentry, buffer, buflen, NFS_PATH_CANONICAL);
 }
 /*
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 8e65c7f1f87c..015f71f8f62c 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -181,7 +181,7 @@ int nfs_mount(struct nfs_mount_request *info)
        else
                msg.rpc_proc = &mnt_clnt->cl_procinfo[MOUNTPROC_MNT];
-        status = rpc_call_sync(mnt_clnt, &msg, 0);
+        status = rpc_call_sync(mnt_clnt, &msg, RPC_TASK_SOFT|RPC_TASK_TIMEOUT);
        rpc_shutdown_client(mnt_clnt);
        if (status < 0)
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 655925373b91..dd057bc6b65b 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -33,6 +33,7 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ;
 * @dentry - pointer to dentry
 * @buffer - result buffer
 * @buflen - length of buffer
+ * @flags - options (see below)
 *
 * Helper function for constructing the server pathname
 * by arbitrary hashed dentry.
@@ -40,8 +41,14 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ;
 * This is mainly for use in figuring out the path on the
 * server side when automounting on top of an existing partition
 * and in generating /proc/mounts and friends.
+ *
+ * Supported flags:
+ * NFS_PATH_CANONICAL: ensure there is exactly one slash after
+ *                     the original device (export) name
+ *                     (if unset, the original name is returned verbatim)
 */
-char *nfs_path(char **p, struct dentry *dentry, char *buffer, ssize_t buflen)
+char *nfs_path(char **p, struct dentry *dentry, char *buffer, ssize_t buflen,
+               unsigned flags)
 {
        char *end;
        int namelen;
@@ -74,7 +81,7 @@ rename_retry:
                rcu_read_unlock();
                goto rename_retry;
        }
-        if (*end != '/') {
+        if ((flags & NFS_PATH_CANONICAL) && *end != '/') {
                if (--buflen < 0) {
                        spin_unlock(&dentry->d_lock);
                        rcu_read_unlock();
@@ -91,9 +98,11 @@ rename_retry:
                return end;
        }
        namelen = strlen(base);
-        /* Strip off excess slashes in base string */
+        if (flags & NFS_PATH_CANONICAL) {
-        while (namelen > 0 && base[namelen - 1] == '/')
+                /* Strip off excess slashes in base string */
-                namelen--;
+                while (namelen > 0 && base[namelen - 1] == '/')
+                        namelen--;
+        }
        buflen -= namelen;
        if (buflen < 0) {
                spin_unlock(&dentry->d_lock);
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 79fbb61ce202..1e09eb78543b 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -81,7 +81,8 @@ static char *nfs_path_component(const char *nfspath, const char *end)
 static char *nfs4_path(struct dentry *dentry, char *buffer, ssize_t buflen)
 {
        char *limit;
-        char *path = nfs_path(&limit, dentry, buffer, buflen);
+        char *path = nfs_path(&limit, dentry, buffer, buflen,
+                              NFS_PATH_CANONICAL);
        if (!IS_ERR(path)) {
                char *path_component = nfs_path_component(path, limit);
                if (path_component)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 68b21d81b7ac..5eec4429970c 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -339,8 +339,7 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
                        dprintk("%s ERROR: %d Reset session\n", __func__,
                                errorcode);
                        nfs4_schedule_session_recovery(clp->cl_session, errorcode);
-                        exception->retry = 1;
+                        goto wait_on_recovery;
-                        break;
 #endif /* defined(CONFIG_NFS_V4_1) */
                case -NFS4ERR_FILE_OPEN:
                        if (exception->timeout > HZ) {
@@ -1572,9 +1571,11 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
        data->timestamp = jiffies;
        if (nfs4_setup_sequence(data->o_arg.server,
                                &data->o_arg.seq_args,
-                                &data->o_res.seq_res, task))
+                                &data->o_res.seq_res,
-                return;
+                                task) != 0)
-        rpc_call_start(task);
+                nfs_release_seqid(data->o_arg.seqid);
+        else
+                rpc_call_start(task);
        return;
 unlock_no_action:
        rcu_read_unlock();
@@ -1748,7 +1749,7 @@ static int nfs4_opendata_access(struct rpc_cred *cred,
        /* even though OPEN succeeded, access is denied. Close the file */
        nfs4_close_state(state, fmode);
-        return -NFS4ERR_ACCESS;
+        return -EACCES;
 }
 /*
@@ -2196,7 +2197,7 @@ static void nfs4_free_closedata(void *data)
        nfs4_put_open_state(calldata->state);
        nfs_free_seqid(calldata->arg.seqid);
        nfs4_put_state_owner(sp);
-        nfs_sb_deactive(sb);
+        nfs_sb_deactive_async(sb);
        kfree(calldata);
 }
@@ -2296,9 +2297,10 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
        if (nfs4_setup_sequence(NFS_SERVER(inode),
                                &calldata->arg.seq_args,
                                &calldata->res.seq_res,
-                                task))
+                                task) != 0)
-                goto out;
+                nfs_release_seqid(calldata->arg.seqid);
-        rpc_call_start(task);
+        else
+                rpc_call_start(task);
 out:
        dprintk("%s: done!\n", __func__);
 }
@@ -4529,6 +4531,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
                        if (nfs4_async_handle_error(task, calldata->server, NULL) == -EAGAIN)
                                rpc_restart_call_prepare(task);
        }
+        nfs_release_seqid(calldata->arg.seqid);
 }
 static void nfs4_locku_prepare(struct rpc_task *task, void *data)
@@ -4545,9 +4548,11 @@ static void nfs4_locku_prepare(struct rpc_task *task, void *data)
        calldata->timestamp = jiffies;
        if (nfs4_setup_sequence(calldata->server,
                                &calldata->arg.seq_args,
-                                &calldata->res.seq_res, task))
+                                &calldata->res.seq_res,
-                return;
+                                task) != 0)
-        rpc_call_start(task);
+                nfs_release_seqid(calldata->arg.seqid);
+        else
+                rpc_call_start(task);
 }
 static const struct rpc_call_ops nfs4_locku_ops = {
@@ -4692,7 +4697,7 @@ static void nfs4_lock_prepare(struct rpc_task *task, void *calldata)
        /* Do we need to do an open_to_lock_owner? */
        if (!(data->arg.lock_seqid->sequence->flags & NFS_SEQID_CONFIRMED)) {
                if (nfs_wait_on_sequence(data->arg.open_seqid, task) != 0)
-                        return;
+                        goto out_release_lock_seqid;
                data->arg.open_stateid = &state->stateid;
                data->arg.new_lock_owner = 1;
                data->res.open_seqid = data->arg.open_seqid;
@@ -4701,10 +4706,15 @@ static void nfs4_lock_prepare(struct rpc_task *task, void *calldata)
        data->timestamp = jiffies;
        if (nfs4_setup_sequence(data->server,
                                &data->arg.seq_args,
-                                &data->res.seq_res, task))
+                                &data->res.seq_res,
+                                task) == 0) {
+                rpc_call_start(task);
                return;
-        rpc_call_start(task);
+        }
-        dprintk("%s: done!, ret = %d\n", __func__, data->rpc_status);
+        nfs_release_seqid(data->arg.open_seqid);
+out_release_lock_seqid:
+        nfs_release_seqid(data->arg.lock_seqid);
+        dprintk("%s: done!, ret = %d\n", __func__, task->tk_status);
 }
 static void nfs4_recover_lock_prepare(struct rpc_task *task, void *calldata)
@@ -5667,7 +5677,7 @@ static void nfs4_add_and_init_slots(struct nfs4_slot_table *tbl,
                tbl->slots = new;
                tbl->max_slots = max_slots;
        }
-        tbl->highest_used_slotid = -1;  /* no slot is currently used */
+        tbl->highest_used_slotid = NFS4_NO_SLOT;
        for (i = 0; i < tbl->max_slots; i++)
                tbl->slots[i].seq_nr = ivalue;
        spin_unlock(&tbl->slot_tbl_lock);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index fe624c91bd00..2878f97bd78d 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -925,8 +925,8 @@ pnfs_find_alloc_layout(struct inode *ino,
        if (likely(nfsi->layout == NULL)) {     /* Won the race? */
                nfsi->layout = new;
                return new;
-        }
+        } else if (new != NULL)
-        pnfs_free_layout_hdr(new);
+                pnfs_free_layout_hdr(new);
 out_existing:
        pnfs_get_layout_hdr(nfsi->layout);
        return nfsi->layout;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index e831bce49766..652d3f7176a9 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -54,6 +54,7 @@
 #include <linux/parser.h>
 #include <linux/nsproxy.h>
 #include <linux/rcupdate.h>
+#include <linux/kthread.h>
 #include <asm/uaccess.h>
@@ -415,6 +416,54 @@ void nfs_sb_deactive(struct super_block *sb)
 }
 EXPORT_SYMBOL_GPL(nfs_sb_deactive);
+static int nfs_deactivate_super_async_work(void *ptr)
+{
+        struct super_block *sb = ptr;
+        deactivate_super(sb);
+        module_put_and_exit(0);
+        return 0;
+}
+/*
+ * same effect as deactivate_super, but will do final unmount in kthread
+ * context
+ */
+static void nfs_deactivate_super_async(struct super_block *sb)
+{
+        struct task_struct *task;
+        char buf[INET6_ADDRSTRLEN + 1];
+        struct nfs_server *server = NFS_SB(sb);
+        struct nfs_client *clp = server->nfs_client;
+        if (!atomic_add_unless(&sb->s_active, -1, 1)) {
+                rcu_read_lock();
+                snprintf(buf, sizeof(buf),
+                        rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR));
+                rcu_read_unlock();
+                __module_get(THIS_MODULE);
+                task = kthread_run(nfs_deactivate_super_async_work, sb,
+                                "%s-deactivate-super", buf);
+                if (IS_ERR(task)) {
+                        pr_err("%s: kthread_run: %ld\n",
+                                __func__, PTR_ERR(task));
+                        /* make synchronous call and hope for the best */
+                        deactivate_super(sb);
+                        module_put(THIS_MODULE);
+                }
+        }
+}
+void nfs_sb_deactive_async(struct super_block *sb)
+{
+        struct nfs_server *server = NFS_SB(sb);
+        if (atomic_dec_and_test(&server->active))
+                nfs_deactivate_super_async(sb);
+}
+EXPORT_SYMBOL_GPL(nfs_sb_deactive_async);
 /*
 * Deliver file system statistics to userspace
 */
@@ -771,7 +820,7 @@ int nfs_show_devname(struct seq_file *m, struct dentry *root)
        int err = 0;
        if (!page)
                return -ENOMEM;
-        devname = nfs_path(&dummy, root, page, PAGE_SIZE);
+        devname = nfs_path(&dummy, root, page, PAGE_SIZE, 0);
        if (IS_ERR(devname))
                err = PTR_ERR(devname);
        else
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index 13cea637eff8..3f79c77153b8 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -95,7 +95,7 @@ static void nfs_async_unlink_release(void *calldata)
        nfs_dec_sillycount(data->dir);
        nfs_free_unlinkdata(data);
-        nfs_sb_deactive(sb);
+        nfs_sb_deactive_async(sb);
 }
 static void nfs_unlink_prepare(struct rpc_task *task, void *calldata)
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index f35794b97e8e..a50636025364 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -21,6 +21,7 @@ static bool should_merge(struct fsnotify_event *old, struct fsnotify_event *new)
                        if ((old->path.mnt == new->path.mnt) &&
                            (old->path.dentry == new->path.dentry))
                                return true;
+                        break;
                case (FSNOTIFY_EVENT_NONE):
                        return true;
                default:
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 4f33c32affe3..335206a9c698 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1866,6 +1866,7 @@ xfs_alloc_fix_freelist(
        /*
         * Initialize the args structure.
         */
+        memset(&targs, 0, sizeof(targs));
        targs.tp = tp;
        targs.mp = mp;
        targs.agbp = agbp;
@@ -2207,7 +2208,7 @@ xfs_alloc_read_agf(
 * group or loop over the allocation groups to find the result.
 */
 int                             /* error */
-__xfs_alloc_vextent(
+xfs_alloc_vextent(
        xfs_alloc_arg_t *args)  /* allocation argument structure */
 {
        xfs_agblock_t   agsize; /* allocation group size */
@@ -2417,46 +2418,6 @@ error0:
        return error;
 }
-static void
-xfs_alloc_vextent_worker(
-        struct work_struct      *work)
-{
-        struct xfs_alloc_arg    *args = container_of(work,
-                                                struct xfs_alloc_arg, work);
-        unsigned long           pflags;
-        /* we are in a transaction context here */
-        current_set_flags_nested(&pflags, PF_FSTRANS);
-        args->result = __xfs_alloc_vextent(args);
-        complete(args->done);
-        current_restore_flags_nested(&pflags, PF_FSTRANS);
-}
-/*
- * Data allocation requests often come in with little stack to work on. Push
- * them off to a worker thread so there is lots of stack to use. Metadata
- * requests, OTOH, are generally from low stack usage paths, so avoid the
- * context switch overhead here.
- */
-int
-xfs_alloc_vextent(
-        struct xfs_alloc_arg    *args)
-{
-        DECLARE_COMPLETION_ONSTACK(done);
-        if (!args->userdata)
-                return __xfs_alloc_vextent(args);
-        args->done = &done;
-        INIT_WORK_ONSTACK(&args->work, xfs_alloc_vextent_worker);
-        queue_work(xfs_alloc_wq, &args->work);
-        wait_for_completion(&done);
-        return args->result;
-}
 /*
 * Free an extent.
 * Just break up the extent address and hand off to xfs_free_ag_extent
diff --git a/fs/xfs/xfs_alloc.h b/fs/xfs/xfs_alloc.h
index 93be4a667ca1..feacb061bab7 100644
--- a/fs/xfs/xfs_alloc.h
+++ b/fs/xfs/xfs_alloc.h
@@ -120,9 +120,6 @@ typedef struct xfs_alloc_arg {
        char            isfl;           /* set if is freelist blocks - !acctg */
        char            userdata;       /* set if this is user data */
        xfs_fsblock_t   firstblock;     /* io first block allocated */
-        struct completion *done;
-        struct work_struct work;
-        int             result;
 } xfs_alloc_arg_t;
 /*
diff --git a/fs/xfs/xfs_alloc_btree.c b/fs/xfs/xfs_alloc_btree.c
index f1647caace8f..f7876c6d6165 100644
--- a/fs/xfs/xfs_alloc_btree.c
+++ b/fs/xfs/xfs_alloc_btree.c
@@ -121,6 +121,8 @@ xfs_allocbt_free_block(
        xfs_extent_busy_insert(cur->bc_tp, be32_to_cpu(agf->agf_seqno), bno, 1,
                              XFS_EXTENT_BUSY_SKIP_DISCARD);
        xfs_trans_agbtree_delta(cur->bc_tp, -1);
+        xfs_trans_binval(cur->bc_tp, bp);
        return 0;
 }
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 848ffa77707b..83d0cf3df930 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -2437,6 +2437,7 @@ xfs_bmap_btalloc(
         * Normal allocation, done through xfs_alloc_vextent.
         */
        tryagain = isaligned = 0;
+        memset(&args, 0, sizeof(args));
        args.tp = ap->tp;
        args.mp = mp;
        args.fsbno = ap->blkno;
@@ -3082,6 +3083,7 @@ xfs_bmap_extents_to_btree(
         * Convert to a btree with two levels, one record in root.
         */
        XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_BTREE);
+        memset(&args, 0, sizeof(args));
        args.tp = tp;
        args.mp = mp;
        args.firstblock = *firstblock;
@@ -3237,6 +3239,7 @@ xfs_bmap_local_to_extents(
                xfs_buf_t       *bp;    /* buffer for extent block */
                xfs_bmbt_rec_host_t *ep;/* extent record pointer */
+                memset(&args, 0, sizeof(args));
                args.tp = tp;
                args.mp = ip->i_mount;
                args.firstblock = *firstblock;
@@ -4616,12 +4619,11 @@ xfs_bmapi_delay(
 STATIC int
-xfs_bmapi_allocate(
+__xfs_bmapi_allocate(
-        struct xfs_bmalloca     *bma,
+        struct xfs_bmalloca     *bma)
-        int                     flags)
 {
        struct xfs_mount        *mp = bma->ip->i_mount;
-        int                     whichfork = (flags & XFS_BMAPI_ATTRFORK) ?
+        int                     whichfork = (bma->flags & XFS_BMAPI_ATTRFORK) ?
                                                XFS_ATTR_FORK : XFS_DATA_FORK;
        struct xfs_ifork        *ifp = XFS_IFORK_PTR(bma->ip, whichfork);
        int                     tmp_logflags = 0;
@@ -4654,24 +4656,27 @@ xfs_bmapi_allocate(
         * Indicate if this is the first user data in the file, or just any
         * user data.
         */
-        if (!(flags & XFS_BMAPI_METADATA)) {
+        if (!(bma->flags & XFS_BMAPI_METADATA)) {
                bma->userdata = (bma->offset == 0) ?
                        XFS_ALLOC_INITIAL_USER_DATA : XFS_ALLOC_USERDATA;
        }
-        bma->minlen = (flags & XFS_BMAPI_CONTIG) ? bma->length : 1;
+        bma->minlen = (bma->flags & XFS_BMAPI_CONTIG) ? bma->length : 1;
        /*
         * Only want to do the alignment at the eof if it is userdata and
         * allocation length is larger than a stripe unit.
         */
        if (mp->m_dalign && bma->length >= mp->m_dalign &&
-            !(flags & XFS_BMAPI_METADATA) && whichfork == XFS_DATA_FORK) {
+            !(bma->flags & XFS_BMAPI_METADATA) && whichfork == XFS_DATA_FORK) {
                error = xfs_bmap_isaeof(bma, whichfork);
                if (error)
                        return error;
        }
+        if (bma->flags & XFS_BMAPI_STACK_SWITCH)
+                bma->stack_switch = 1;
        error = xfs_bmap_alloc(bma);
        if (error)
                return error;
@@ -4706,7 +4711,7 @@ xfs_bmapi_allocate(
         * A wasdelay extent has been initialized, so shouldn't be flagged
         * as unwritten.
         */
-        if (!bma->wasdel && (flags & XFS_BMAPI_PREALLOC) &&
+        if (!bma->wasdel && (bma->flags & XFS_BMAPI_PREALLOC) &&
            xfs_sb_version_hasextflgbit(&mp->m_sb))
                bma->got.br_state = XFS_EXT_UNWRITTEN;
@@ -4734,6 +4739,45 @@ xfs_bmapi_allocate(
        return 0;
 }
+static void
+xfs_bmapi_allocate_worker(
+        struct work_struct      *work)
+{
+        struct xfs_bmalloca     *args = container_of(work,
+                                                struct xfs_bmalloca, work);
+        unsigned long           pflags;
+        /* we are in a transaction context here */
+        current_set_flags_nested(&pflags, PF_FSTRANS);
+        args->result = __xfs_bmapi_allocate(args);
+        complete(args->done);
+        current_restore_flags_nested(&pflags, PF_FSTRANS);
+}
+/*
+ * Some allocation requests often come in with little stack to work on. Push
+ * them off to a worker thread so there is lots of stack to use. Otherwise just
+ * call directly to avoid the context switch overhead here.
+ */
+int
+xfs_bmapi_allocate(
+        struct xfs_bmalloca     *args)
+{
+        DECLARE_COMPLETION_ONSTACK(done);
+        if (!args->stack_switch)
+                return __xfs_bmapi_allocate(args);
+        args->done = &done;
+        INIT_WORK_ONSTACK(&args->work, xfs_bmapi_allocate_worker);
+        queue_work(xfs_alloc_wq, &args->work);
+        wait_for_completion(&done);
+        return args->result;
+}
 STATIC int
 xfs_bmapi_convert_unwritten(
        struct xfs_bmalloca     *bma,
@@ -4919,6 +4963,7 @@ xfs_bmapi_write(
                        bma.conv = !!(flags & XFS_BMAPI_CONVERT);
                        bma.wasdel = wasdelay;
                        bma.offset = bno;
+                        bma.flags = flags;
                        /*
                         * There's a 32/64 bit type mismatch between the
@@ -4934,7 +4979,7 @@ xfs_bmapi_write(
                        ASSERT(len > 0);
                        ASSERT(bma.length > 0);
-                        error = xfs_bmapi_allocate(&bma, flags);
+                        error = xfs_bmapi_allocate(&bma);
                        if (error)
                                goto error0;
                        if (bma.blkno == NULLFSBLOCK)
diff --git a/fs/xfs/xfs_bmap.h b/fs/xfs/xfs_bmap.h
index 803b56d7ce16..5f469c3516eb 100644
--- a/fs/xfs/xfs_bmap.h
+++ b/fs/xfs/xfs_bmap.h
@@ -77,6 +77,7 @@ typedef	struct xfs_bmap_free
 * from written to unwritten, otherwise convert from unwritten to written.
 */
 #define XFS_BMAPI_CONVERT       0x040
+#define XFS_BMAPI_STACK_SWITCH  0x080
 #define XFS_BMAPI_FLAGS \
        { XFS_BMAPI_ENTIRE,     "ENTIRE" }, \
@@ -85,7 +86,8 @@ typedef	struct xfs_bmap_free
        { XFS_BMAPI_PREALLOC,   "PREALLOC" }, \
        { XFS_BMAPI_IGSTATE,    "IGSTATE" }, \
        { XFS_BMAPI_CONTIG,     "CONTIG" }, \
-        { XFS_BMAPI_CONVERT,    "CONVERT" }
+        { XFS_BMAPI_CONVERT,    "CONVERT" }, \
+        { XFS_BMAPI_STACK_SWITCH, "STACK_SWITCH" }
 static inline int xfs_bmapi_aflag(int w)
@@ -133,6 +135,11 @@ typedef struct xfs_bmalloca {
        char                    userdata;/* set if is user data */
        char                    aeof;   /* allocated space at eof */
        char                    conv;   /* overwriting unwritten extents */
+        char                    stack_switch;
+        int                     flags;
+        struct completion       *done;
+        struct work_struct      work;
+        int                     result;
 } xfs_bmalloca_t;
 /*
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index a8d0ed911196..becf4a97efc6 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -526,7 +526,25 @@ xfs_buf_item_unpin(
                }
                xfs_buf_relse(bp);
        } else if (freed && remove) {
+                /*
+                 * There are currently two references to the buffer - the active
+                 * LRU reference and the buf log item. What we are about to do
+                 * here - simulate a failed IO completion - requires 3
+                 * references.
+                 *
+                 * The LRU reference is removed by the xfs_buf_stale() call. The
+                 * buf item reference is removed by the xfs_buf_iodone()
+                 * callback that is run by xfs_buf_do_callbacks() during ioend
+                 * processing (via the bp->b_iodone callback), and then finally
+                 * the ioend processing will drop the IO reference if the buffer
+                 * is marked XBF_ASYNC.
+                 *
+                 * Hence we need to take an additional reference here so that IO
+                 * completion processing doesn't free the buffer prematurely.
+                 */
                xfs_buf_lock(bp);
+                xfs_buf_hold(bp);
+                bp->b_flags |= XBF_ASYNC;
                xfs_buf_ioerror(bp, EIO);
                XFS_BUF_UNDONE(bp);
                xfs_buf_stale(bp);
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index c25b094efbf7..4beaede43277 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -399,9 +399,26 @@ xfs_growfs_data_private(
        /* update secondary superblocks. */
        for (agno = 1; agno < nagcount; agno++) {
-                error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp,
+                error = 0;
+                /*
+                 * new secondary superblocks need to be zeroed, not read from
+                 * disk as the contents of the new area we are growing into is
+                 * completely unknown.
+                 */
+                if (agno < oagcount) {
+                        error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp,
                                  XFS_AGB_TO_DADDR(mp, agno, XFS_SB_BLOCK(mp)),
                                  XFS_FSS_TO_BB(mp, 1), 0, &bp);
+                } else {
+                        bp = xfs_trans_get_buf(NULL, mp->m_ddev_targp,
+                                  XFS_AGB_TO_DADDR(mp, agno, XFS_SB_BLOCK(mp)),
+                                  XFS_FSS_TO_BB(mp, 1), 0);
+                        if (bp)
+                                xfs_buf_zero(bp, 0, BBTOB(bp->b_length));
+                        else
+                                error = ENOMEM;
+                }
                if (error) {
                        xfs_warn(mp,
                "error %d reading secondary superblock for ag %d",
@@ -423,7 +440,7 @@ xfs_growfs_data_private(
                        break; /* no point in continuing */
                }
        }
-        return 0;
+        return error;
 error0:
        xfs_trans_cancel(tp, XFS_TRANS_ABORT);
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 445bf1aef31c..c5c4ef4f2bdb 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -250,6 +250,7 @@ xfs_ialloc_ag_alloc(
                                        /* boundary */
        struct xfs_perag *pag;
+        memset(&args, 0, sizeof(args));
        args.tp = tp;
        args.mp = tp->t_mountp;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 2778258fcfa2..1938b41ee9f5 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1509,7 +1509,8 @@ xfs_ifree_cluster(
                 * to mark all the active inodes on the buffer stale.
                 */
                bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, blkno,
-                                        mp->m_bsize * blks_per_cluster, 0);
+                                        mp->m_bsize * blks_per_cluster,
+                                        XBF_UNMAPPED);
                if (!bp)
                        return ENOMEM;
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 8305f2ac6773..c1df3c623de2 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -70,7 +70,7 @@ xfs_find_handle(
        int                     hsize;
        xfs_handle_t            handle;
        struct inode            *inode;
-        struct fd               f;
+        struct fd               f = {0};
        struct path             path;
        int                     error;
        struct xfs_inode        *ip;
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 973dff6ad935..7f537663365b 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -584,7 +584,9 @@ xfs_iomap_write_allocate(
                         * pointer that the caller gave to us.
                         */
                        error = xfs_bmapi_write(tp, ip, map_start_fsb,
-                                                count_fsb, 0, &first_block, 1,
+                                                count_fsb,
+                                                XFS_BMAPI_STACK_SWITCH,
+                                                &first_block, 1,
                                                imap, &nimaps, &free_list);
                        if (error)
                                goto trans_cancel;
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 7f4f9370d0e7..4dad756962d0 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -2387,14 +2387,27 @@ xlog_state_do_callback(
                                /*
-                                 * update the last_sync_lsn before we drop the
+                                 * Completion of a iclog IO does not imply that
+                                 * a transaction has completed, as transactions
+                                 * can be large enough to span many iclogs. We
+                                 * cannot change the tail of the log half way
+                                 * through a transaction as this may be the only
+                                 * transaction in the log and moving th etail to
+                                 * point to the middle of it will prevent
+                                 * recovery from finding the start of the
+                                 * transaction. Hence we should only update the
+                                 * last_sync_lsn if this iclog contains
+                                 * transaction completion callbacks on it.
+                                 *
+                                 * We have to do this before we drop the
                                 * icloglock to ensure we are the only one that
                                 * can update it.
                                 */
                                ASSERT(XFS_LSN_CMP(atomic64_read(&log->l_last_sync_lsn),
                                        be64_to_cpu(iclog->ic_header.h_lsn)) <= 0);
-                                atomic64_set(&log->l_last_sync_lsn,
+                                if (iclog->ic_callback)
-                                        be64_to_cpu(iclog->ic_header.h_lsn));
+                                        atomic64_set(&log->l_last_sync_lsn,
+                                                be64_to_cpu(iclog->ic_header.h_lsn));
                        } else
                                ioerrors++;
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 5da3ace352bf..d308749fabf1 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3541,7 +3541,7 @@ xlog_do_recovery_pass(
                                 *   - order is important.
                                 */
                                error = xlog_bread_offset(log, 0,
-                                                bblks - split_bblks, hbp,
+                                                bblks - split_bblks, dbp,
                                                offset + BBTOB(split_bblks));
                                if (error)
                                        goto bread_err2;
diff --git a/include/linux/hashtable.h b/include/linux/hashtable.h
new file mode 100644
index 000000000000..227c62424f3c
--- /dev/null
+++ b/include/linux/hashtable.h
@@ -0,0 +1,192 @@
+/*
+ * Statically sized hash table implementation
+ * (C) 2012  Sasha Levin <levinsasha928@gmail.com>
+ */
+#ifndef _LINUX_HASHTABLE_H
+#define _LINUX_HASHTABLE_H
+#include <linux/list.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/hash.h>
+#include <linux/rculist.h>
+#define DEFINE_HASHTABLE(name, bits)                                            \
+        struct hlist_head name[1 << (bits)] =                                   \
+                        { [0 ... ((1 << (bits)) - 1)] = HLIST_HEAD_INIT }
+#define DECLARE_HASHTABLE(name, bits)                                           \
+        struct hlist_head name[1 << (bits)]
+#define HASH_SIZE(name) (ARRAY_SIZE(name))
+#define HASH_BITS(name) ilog2(HASH_SIZE(name))
+/* Use hash_32 when possible to allow for fast 32bit hashing in 64bit kernels. */
+#define hash_min(val, bits)                                                     \
+        (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits))
+static inline void __hash_init(struct hlist_head *ht, unsigned int sz)
+{
+        unsigned int i;
+        for (i = 0; i < sz; i++)
+                INIT_HLIST_HEAD(&ht[i]);
+}
+/**
+ * hash_init - initialize a hash table
+ * @hashtable: hashtable to be initialized
+ *
+ * Calculates the size of the hashtable from the given parameter, otherwise
+ * same as hash_init_size.
+ *
+ * This has to be a macro since HASH_BITS() will not work on pointers since
+ * it calculates the size during preprocessing.
+ */
+#define hash_init(hashtable) __hash_init(hashtable, HASH_SIZE(hashtable))
+/**
+ * hash_add - add an object to a hashtable
+ * @hashtable: hashtable to add to
+ * @node: the &struct hlist_node of the object to be added
+ * @key: the key of the object to be added
+ */
+#define hash_add(hashtable, node, key)                                          \
+        hlist_add_head(node, &hashtable[hash_min(key, HASH_BITS(hashtable))])
+/**
+ * hash_add_rcu - add an object to a rcu enabled hashtable
+ * @hashtable: hashtable to add to
+ * @node: the &struct hlist_node of the object to be added
+ * @key: the key of the object to be added
+ */
+#define hash_add_rcu(hashtable, node, key)                                      \
+        hlist_add_head_rcu(node, &hashtable[hash_min(key, HASH_BITS(hashtable))])
+/**
+ * hash_hashed - check whether an object is in any hashtable
+ * @node: the &struct hlist_node of the object to be checked
+ */
+static inline bool hash_hashed(struct hlist_node *node)
+{
+        return !hlist_unhashed(node);
+}
+static inline bool __hash_empty(struct hlist_head *ht, unsigned int sz)
+{
+        unsigned int i;
+        for (i = 0; i < sz; i++)
+                if (!hlist_empty(&ht[i]))
+                        return false;
+        return true;
+}
+/**
+ * hash_empty - check whether a hashtable is empty
+ * @hashtable: hashtable to check
+ *
+ * This has to be a macro since HASH_BITS() will not work on pointers since
+ * it calculates the size during preprocessing.
+ */
+#define hash_empty(hashtable) __hash_empty(hashtable, HASH_SIZE(hashtable))
+/**
+ * hash_del - remove an object from a hashtable
+ * @node: &struct hlist_node of the object to remove
+ */
+static inline void hash_del(struct hlist_node *node)
+{
+        hlist_del_init(node);
+}
+/**
+ * hash_del_rcu - remove an object from a rcu enabled hashtable
+ * @node: &struct hlist_node of the object to remove
+ */
+static inline void hash_del_rcu(struct hlist_node *node)
+{
+        hlist_del_init_rcu(node);
+}
+/**
+ * hash_for_each - iterate over a hashtable
+ * @name: hashtable to iterate
+ * @bkt: integer to use as bucket loop cursor
+ * @node: the &struct list_head to use as a loop cursor for each entry
+ * @obj: the type * to use as a loop cursor for each entry
+ * @member: the name of the hlist_node within the struct
+ */
+#define hash_for_each(name, bkt, node, obj, member)                             \
+        for ((bkt) = 0, node = NULL; node == NULL && (bkt) < HASH_SIZE(name); (bkt)++)\
+                hlist_for_each_entry(obj, node, &name[bkt], member)
+/**
+ * hash_for_each_rcu - iterate over a rcu enabled hashtable
+ * @name: hashtable to iterate
+ * @bkt: integer to use as bucket loop cursor
+ * @node: the &struct list_head to use as a loop cursor for each entry
+ * @obj: the type * to use as a loop cursor for each entry
+ * @member: the name of the hlist_node within the struct
+ */
+#define hash_for_each_rcu(name, bkt, node, obj, member)                         \
+        for ((bkt) = 0, node = NULL; node == NULL && (bkt) < HASH_SIZE(name); (bkt)++)\
+                hlist_for_each_entry_rcu(obj, node, &name[bkt], member)
+/**
+ * hash_for_each_safe - iterate over a hashtable safe against removal of
+ * hash entry
+ * @name: hashtable to iterate
+ * @bkt: integer to use as bucket loop cursor
+ * @node: the &struct list_head to use as a loop cursor for each entry
+ * @tmp: a &struct used for temporary storage
+ * @obj: the type * to use as a loop cursor for each entry
+ * @member: the name of the hlist_node within the struct
+ */
+#define hash_for_each_safe(name, bkt, node, tmp, obj, member)                   \
+        for ((bkt) = 0, node = NULL; node == NULL && (bkt) < HASH_SIZE(name); (bkt)++)\
+                hlist_for_each_entry_safe(obj, node, tmp, &name[bkt], member)
+/**
+ * hash_for_each_possible - iterate over all possible objects hashing to the
+ * same bucket
+ * @name: hashtable to iterate
+ * @obj: the type * to use as a loop cursor for each entry
+ * @node: the &struct list_head to use as a loop cursor for each entry
+ * @member: the name of the hlist_node within the struct
+ * @key: the key of the objects to iterate over
+ */
+#define hash_for_each_possible(name, obj, node, member, key)                    \
+        hlist_for_each_entry(obj, node, &name[hash_min(key, HASH_BITS(name))], member)
+/**
+ * hash_for_each_possible_rcu - iterate over all possible objects hashing to the
+ * same bucket in an rcu enabled hashtable
+ * in a rcu enabled hashtable
+ * @name: hashtable to iterate
+ * @obj: the type * to use as a loop cursor for each entry
+ * @node: the &struct list_head to use as a loop cursor for each entry
+ * @member: the name of the hlist_node within the struct
+ * @key: the key of the objects to iterate over
+ */
+#define hash_for_each_possible_rcu(name, obj, node, member, key)                \
+        hlist_for_each_entry_rcu(obj, node, &name[hash_min(key, HASH_BITS(name))], member)
+/**
+ * hash_for_each_possible_safe - iterate over all possible objects hashing to the
+ * same bucket safe against removals
+ * @name: hashtable to iterate
+ * @obj: the type * to use as a loop cursor for each entry
+ * @node: the &struct list_head to use as a loop cursor for each entry
+ * @tmp: a &struct used for temporary storage
+ * @member: the name of the hlist_node within the struct
+ * @key: the key of the objects to iterate over
+ */
+#define hash_for_each_possible_safe(name, obj, node, tmp, member, key)          \
+        hlist_for_each_entry_safe(obj, node, tmp,                               \
+                &name[hash_min(key, HASH_BITS(name))], member)
+#endif
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 93bfc9f9815c..ecc554374e44 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -42,19 +42,8 @@
 */
 #define KVM_MEMSLOT_INVALID     (1UL << 16)
-/*
+/* Two fragments for cross MMIO pages. */
- * If we support unaligned MMIO, at most one fragment will be split into two:
+#define KVM_MAX_MMIO_FRAGMENTS  2
- */
-#ifdef KVM_UNALIGNED_MMIO
-#  define KVM_EXTRA_MMIO_FRAGMENTS 1
-#else
-#  define KVM_EXTRA_MMIO_FRAGMENTS 0
-#endif
-#define KVM_USER_MMIO_SIZE 8
-#define KVM_MAX_MMIO_FRAGMENTS \
-        (KVM_MMIO_SIZE / KVM_USER_MMIO_SIZE + KVM_EXTRA_MMIO_FRAGMENTS)
 /*
 * For the normal pfn, the highest 12 bits should be zero,
diff --git a/include/linux/mmc/dw_mmc.h b/include/linux/mmc/dw_mmc.h
index 7c6a1139d8fa..96531664a061 100644
--- a/include/linux/mmc/dw_mmc.h
+++ b/include/linux/mmc/dw_mmc.h
@@ -137,7 +137,7 @@ struct dw_mci {
        dma_addr_t              sg_dma;
        void                    *sg_cpu;
-        struct dw_mci_dma_ops   *dma_ops;
+        const struct dw_mci_dma_ops     *dma_ops;
 #ifdef CONFIG_MMC_DW_IDMAC
        unsigned int            ring_size;
 #else
@@ -162,7 +162,7 @@ struct dw_mci {
        u16                     data_offset;
        struct device           *dev;
        struct dw_mci_board     *pdata;
-        struct dw_mci_drv_data  *drv_data;
+        const struct dw_mci_drv_data    *drv_data;
        void                    *priv;
        struct clk              *biu_clk;
        struct clk              *ciu_clk;
@@ -186,7 +186,7 @@ struct dw_mci {
        struct regulator        *vmmc;  /* Power regulator */
        unsigned long           irq_flags; /* IRQ flags */
-        unsigned int            irq;
+        int                     irq;
 };
 /* DMA ops for Internal/External DMAC interface */
diff --git a/include/linux/mmc/sdhci.h b/include/linux/mmc/sdhci.h
index fa8529a859b8..1edcb4dad8c4 100644
--- a/include/linux/mmc/sdhci.h
+++ b/include/linux/mmc/sdhci.h
@@ -91,6 +91,7 @@ struct sdhci_host {
        unsigned int quirks2;   /* More deviations from spec. */
 #define SDHCI_QUIRK2_HOST_OFF_CARD_ON                   (1<<0)
+#define SDHCI_QUIRK2_HOST_NO_CMD23                      (1<<1)
        int irq;                /* Device IRQ */
        void __iomem *ioaddr;   /* Mapped address */
diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h
index cf80f7e5277f..250a4acddb2b 100644
--- a/include/linux/percpu-rwsem.h
+++ b/include/linux/percpu-rwsem.h
@@ -12,34 +12,27 @@ struct percpu_rw_semaphore {
        struct mutex mtx;
 };
+#define light_mb()      barrier()
+#define heavy_mb()      synchronize_sched()
 static inline void percpu_down_read(struct percpu_rw_semaphore *p)
 {
-        rcu_read_lock();
+        rcu_read_lock_sched();
        if (unlikely(p->locked)) {
-                rcu_read_unlock();
+                rcu_read_unlock_sched();
                mutex_lock(&p->mtx);
                this_cpu_inc(*p->counters);
                mutex_unlock(&p->mtx);
                return;
        }
        this_cpu_inc(*p->counters);
-        rcu_read_unlock();
+        rcu_read_unlock_sched();
+        light_mb(); /* A, between read of p->locked and read of data, paired with D */
 }
 static inline void percpu_up_read(struct percpu_rw_semaphore *p)
 {
-        /*
+        light_mb(); /* B, between read of the data and write to p->counter, paired with C */
-         * On X86, write operation in this_cpu_dec serves as a memory unlock
-         * barrier (i.e. memory accesses may be moved before the write, but
-         * no memory accesses are moved past the write).
-         * On other architectures this may not be the case, so we need smp_mb()
-         * there.
-         */
-#if defined(CONFIG_X86) && (!defined(CONFIG_X86_PPRO_FENCE) && !defined(CONFIG_X86_OOSTORE))
-        barrier();
-#else
-        smp_mb();
-#endif
        this_cpu_dec(*p->counters);
 }
@@ -58,14 +51,15 @@ static inline void percpu_down_write(struct percpu_rw_semaphore *p)
 {
        mutex_lock(&p->mtx);
        p->locked = true;
-        synchronize_rcu();
+        synchronize_sched(); /* make sure that all readers exit the rcu_read_lock_sched region */
        while (__percpu_count(p->counters))
                msleep(1);
-        smp_rmb(); /* paired with smp_mb() in percpu_sem_up_read() */
+        heavy_mb(); /* C, between read of p->counter and write to data, paired with B */
 }
 static inline void percpu_up_write(struct percpu_rw_semaphore *p)
 {
+        heavy_mb(); /* D, between write to data and write to p->locked, paired with A */
        p->locked = false;
        mutex_unlock(&p->mtx);
 }
diff --git a/include/linux/raid/Kbuild b/include/linux/raid/Kbuild
index 2415a64c5e51..e69de29bb2d1 100644
--- a/include/linux/raid/Kbuild
+++ b/include/linux/raid/Kbuild
@@ -1,2 +0,0 @@
-header-y += md_p.h
-header-y += md_u.h
diff --git a/include/linux/raid/md_u.h b/include/linux/raid/md_u.h
index fb1abb3367e9..358c04bfbe2a 100644
--- a/include/linux/raid/md_u.h
+++ b/include/linux/raid/md_u.h
@@ -11,149 +11,10 @@
   (for example /usr/src/linux/COPYING); if not, write to the Free
   Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  
 */
 #ifndef _MD_U_H
 #define _MD_U_H
-/*
+#include <uapi/linux/raid/md_u.h>
- * Different major versions are not compatible.
- * Different minor versions are only downward compatible.
- * Different patchlevel versions are downward and upward compatible.
- */
-#define MD_MAJOR_VERSION                0
-#define MD_MINOR_VERSION                90
-/*
- * MD_PATCHLEVEL_VERSION indicates kernel functionality.
- * >=1 means different superblock formats are selectable using SET_ARRAY_INFO
- *     and major_version/minor_version accordingly
- * >=2 means that Internal bitmaps are supported by setting MD_SB_BITMAP_PRESENT
- *     in the super status byte
- * >=3 means that bitmap superblock version 4 is supported, which uses
- *     little-ending representation rather than host-endian
- */
-#define MD_PATCHLEVEL_VERSION           3
-/* ioctls */
-/* status */
-#define RAID_VERSION            _IOR (MD_MAJOR, 0x10, mdu_version_t)
-#define GET_ARRAY_INFO          _IOR (MD_MAJOR, 0x11, mdu_array_info_t)
-#define GET_DISK_INFO           _IOR (MD_MAJOR, 0x12, mdu_disk_info_t)
-#define PRINT_RAID_DEBUG        _IO (MD_MAJOR, 0x13)
-#define RAID_AUTORUN            _IO (MD_MAJOR, 0x14)
-#define GET_BITMAP_FILE         _IOR (MD_MAJOR, 0x15, mdu_bitmap_file_t)
-/* configuration */
-#define CLEAR_ARRAY             _IO (MD_MAJOR, 0x20)
-#define ADD_NEW_DISK            _IOW (MD_MAJOR, 0x21, mdu_disk_info_t)
-#define HOT_REMOVE_DISK         _IO (MD_MAJOR, 0x22)
-#define SET_ARRAY_INFO          _IOW (MD_MAJOR, 0x23, mdu_array_info_t)
-#define SET_DISK_INFO           _IO (MD_MAJOR, 0x24)
-#define WRITE_RAID_INFO         _IO (MD_MAJOR, 0x25)
-#define UNPROTECT_ARRAY         _IO (MD_MAJOR, 0x26)
-#define PROTECT_ARRAY           _IO (MD_MAJOR, 0x27)
-#define HOT_ADD_DISK            _IO (MD_MAJOR, 0x28)
-#define SET_DISK_FAULTY         _IO (MD_MAJOR, 0x29)
-#define HOT_GENERATE_ERROR      _IO (MD_MAJOR, 0x2a)
-#define SET_BITMAP_FILE         _IOW (MD_MAJOR, 0x2b, int)
-/* usage */
-#define RUN_ARRAY               _IOW (MD_MAJOR, 0x30, mdu_param_t)
-/*  0x31 was START_ARRAY  */
-#define STOP_ARRAY              _IO (MD_MAJOR, 0x32)
-#define STOP_ARRAY_RO           _IO (MD_MAJOR, 0x33)
-#define RESTART_ARRAY_RW        _IO (MD_MAJOR, 0x34)
-/* 63 partitions with the alternate major number (mdp) */
-#define MdpMinorShift 6
-#ifdef __KERNEL__
 extern int mdp_major;
-#endif
-typedef struct mdu_version_s {
-        int major;
-        int minor;
-        int patchlevel;
-} mdu_version_t;
-typedef struct mdu_array_info_s {
-        /*
-         * Generic constant information
-         */
-        int major_version;
-        int minor_version;
-        int patch_version;
-        int ctime;
-        int level;
-        int size;
-        int nr_disks;
-        int raid_disks;
-        int md_minor;
-        int not_persistent;
-        /*
-         * Generic state information
-         */
-        int utime;              /*  0 Superblock update time                  */
-        int state;              /*  1 State bits (clean, ...)                 */
-        int active_disks;       /*  2 Number of currently active disks        */
-        int working_disks;      /*  3 Number of working disks                 */
-        int failed_disks;       /*  4 Number of failed disks                  */
-        int spare_disks;        /*  5 Number of spare disks                   */
-        /*
-         * Personality information
-         */
-        int layout;             /*  0 the array's physical layout             */
-        int chunk_size; /*  1 chunk size in bytes                     */
-} mdu_array_info_t;
-/* non-obvious values for 'level' */
-#define LEVEL_MULTIPATH         (-4)
-#define LEVEL_LINEAR            (-1)
-#define LEVEL_FAULTY            (-5)
-/* we need a value for 'no level specified' and 0
- * means 'raid0', so we need something else.  This is
- * for internal use only
- */
-#define LEVEL_NONE              (-1000000)
-typedef struct mdu_disk_info_s {
-        /*
-         * configuration/status of one particular disk
-         */
-        int number;
-        int major;
-        int minor;
-        int raid_disk;
-        int state;
-} mdu_disk_info_t;
-typedef struct mdu_start_info_s {
-        /*
-         * configuration/status of one particular disk
-         */
-        int major;
-        int minor;
-        int raid_disk;
-        int state;
-} mdu_start_info_t;
-typedef struct mdu_bitmap_file_s
-{
-        char pathname[4096];
-} mdu_bitmap_file_t;
-typedef struct mdu_param_s
-{
-        int                     personality;    /* 1,2,3,4 */
-        int                     chunk_size;     /* in bytes */
-        int                     max_fault;      /* unused for now */
-} mdu_param_t;
 #endif 
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 8a7fc4be2d75..60b7aac15e0e 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -191,7 +191,8 @@ struct tcp_sock {
        u8      do_early_retrans:1,/* Enable RFC5827 early-retransmit  */
                early_retrans_delayed:1, /* Delayed ER timer installed */
                syn_data:1,     /* SYN includes data */
-                syn_fastopen:1; /* SYN includes Fast Open option */
+                syn_fastopen:1, /* SYN includes Fast Open option */
+                syn_data_acked:1;/* data in SYN is acked by SYN-ACK */
 /* RTT measurement */
        u32     srtt;           /* smoothed round trip time << 3        */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1b4989082244..7d5b6000378b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1218,6 +1218,7 @@ struct cfg80211_deauth_request {
        const u8 *ie;
        size_t ie_len;
        u16 reason_code;
+        bool local_state_change;
 };
 /**
@@ -2651,6 +2652,15 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
 unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
 /**
+ * ieee80211_get_mesh_hdrlen - get mesh extension header length
+ * @meshhdr: the mesh extension header, only the flags field
+ *      (first byte) will be accessed
+ * Returns the length of the extension header, which is always at
+ * least 6 bytes and at most 18 if address 5 and 6 are present.
+ */
+unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
+/**
 * DOC: Data path helpers
 *
 * In addition to generic utilities, cfg80211 also offers
diff --git a/include/sound/core.h b/include/sound/core.h
index bc056687f647..93896ad1fcdd 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -132,6 +132,7 @@ struct snd_card {
        int shutdown;                   /* this card is going down */
        int free_on_last_close;         /* free in context of file_release */
        wait_queue_head_t shutdown_sleep;
+        atomic_t refcount;              /* refcount for disconnection */
        struct device *dev;             /* device assigned to this card */
        struct device *card_dev;        /* cardX object for sysfs */
@@ -189,6 +190,7 @@ struct snd_minor {
        const struct file_operations *f_ops;    /* file operations */
        void *private_data;             /* private data for f_ops->open */
        struct device *dev;             /* device for sysfs */
+        struct snd_card *card_ptr;      /* assigned card instance */
 };
 /* return a device pointer linked to each sound device as a parent */
@@ -295,6 +297,7 @@ int snd_card_info_done(void);
 int snd_component_add(struct snd_card *card, const char *component);
 int snd_card_file_add(struct snd_card *card, struct file *file);
 int snd_card_file_remove(struct snd_card *card, struct file *file);
+void snd_card_unref(struct snd_card *card);
 #define snd_card_set_dev(card, devptr) ((card)->dev = (devptr))
diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h
index 15ba03bdd7c6..d06b6da5c1e3 100644
--- a/include/trace/events/xen.h
+++ b/include/trace/events/xen.h
@@ -377,6 +377,14 @@ DECLARE_EVENT_CLASS(xen_mmu_pgd,
 DEFINE_XEN_MMU_PGD_EVENT(xen_mmu_pgd_pin);
 DEFINE_XEN_MMU_PGD_EVENT(xen_mmu_pgd_unpin);
+TRACE_EVENT(xen_mmu_flush_tlb_all,
+            TP_PROTO(int x),
+            TP_ARGS(x),
+            TP_STRUCT__entry(__array(char, x, 0)),
+            TP_fast_assign((void)x),
+            TP_printk("%s", "")
+        );
 TRACE_EVENT(xen_mmu_flush_tlb,
            TP_PROTO(int x),
            TP_ARGS(x),
diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h
index 8c99ce7202c5..2c267bcbb85c 100644
--- a/include/uapi/linux/eventpoll.h
+++ b/include/uapi/linux/eventpoll.h
@@ -25,7 +25,6 @@
 #define EPOLL_CTL_ADD 1
 #define EPOLL_CTL_DEL 2
 #define EPOLL_CTL_MOD 3
-#define EPOLL_CTL_DISABLE 4
 /*
 * Request the handling of system wakeup events so as to prevent system suspends
diff --git a/include/uapi/linux/raid/Kbuild b/include/uapi/linux/raid/Kbuild
index aafaa5aa54d4..e2c3d25405d7 100644
--- a/include/uapi/linux/raid/Kbuild
+++ b/include/uapi/linux/raid/Kbuild
@@ -1 +1,3 @@
 # UAPI Header export list
+header-y += md_p.h
+header-y += md_u.h
diff --git a/include/linux/raid/md_p.h b/include/uapi/linux/raid/md_p.h
index ee753536ab70..ee753536ab70 100644
--- a/include/linux/raid/md_p.h
+++ b/include/uapi/linux/raid/md_p.h
diff --git a/include/uapi/linux/raid/md_u.h b/include/uapi/linux/raid/md_u.h
new file mode 100644
index 000000000000..4133e744e4e6
--- /dev/null
+++ b/include/uapi/linux/raid/md_u.h
@@ -0,0 +1,155 @@
+/*
+   md_u.h : user <=> kernel API between Linux raidtools and RAID drivers
+          Copyright (C) 1998 Ingo Molnar
+          
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+   
+   You should have received a copy of the GNU General Public License
+   (for example /usr/src/linux/COPYING); if not, write to the Free
+   Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  
+*/
+#ifndef _UAPI_MD_U_H
+#define _UAPI_MD_U_H
+/*
+ * Different major versions are not compatible.
+ * Different minor versions are only downward compatible.
+ * Different patchlevel versions are downward and upward compatible.
+ */
+#define MD_MAJOR_VERSION                0
+#define MD_MINOR_VERSION                90
+/*
+ * MD_PATCHLEVEL_VERSION indicates kernel functionality.
+ * >=1 means different superblock formats are selectable using SET_ARRAY_INFO
+ *     and major_version/minor_version accordingly
+ * >=2 means that Internal bitmaps are supported by setting MD_SB_BITMAP_PRESENT
+ *     in the super status byte
+ * >=3 means that bitmap superblock version 4 is supported, which uses
+ *     little-ending representation rather than host-endian
+ */
+#define MD_PATCHLEVEL_VERSION           3
+/* ioctls */
+/* status */
+#define RAID_VERSION            _IOR (MD_MAJOR, 0x10, mdu_version_t)
+#define GET_ARRAY_INFO          _IOR (MD_MAJOR, 0x11, mdu_array_info_t)
+#define GET_DISK_INFO           _IOR (MD_MAJOR, 0x12, mdu_disk_info_t)
+#define PRINT_RAID_DEBUG        _IO (MD_MAJOR, 0x13)
+#define RAID_AUTORUN            _IO (MD_MAJOR, 0x14)
+#define GET_BITMAP_FILE         _IOR (MD_MAJOR, 0x15, mdu_bitmap_file_t)
+/* configuration */
+#define CLEAR_ARRAY             _IO (MD_MAJOR, 0x20)
+#define ADD_NEW_DISK            _IOW (MD_MAJOR, 0x21, mdu_disk_info_t)
+#define HOT_REMOVE_DISK         _IO (MD_MAJOR, 0x22)
+#define SET_ARRAY_INFO          _IOW (MD_MAJOR, 0x23, mdu_array_info_t)
+#define SET_DISK_INFO           _IO (MD_MAJOR, 0x24)
+#define WRITE_RAID_INFO         _IO (MD_MAJOR, 0x25)
+#define UNPROTECT_ARRAY         _IO (MD_MAJOR, 0x26)
+#define PROTECT_ARRAY           _IO (MD_MAJOR, 0x27)
+#define HOT_ADD_DISK            _IO (MD_MAJOR, 0x28)
+#define SET_DISK_FAULTY         _IO (MD_MAJOR, 0x29)
+#define HOT_GENERATE_ERROR      _IO (MD_MAJOR, 0x2a)
+#define SET_BITMAP_FILE         _IOW (MD_MAJOR, 0x2b, int)
+/* usage */
+#define RUN_ARRAY               _IOW (MD_MAJOR, 0x30, mdu_param_t)
+/*  0x31 was START_ARRAY  */
+#define STOP_ARRAY              _IO (MD_MAJOR, 0x32)
+#define STOP_ARRAY_RO           _IO (MD_MAJOR, 0x33)
+#define RESTART_ARRAY_RW        _IO (MD_MAJOR, 0x34)
+/* 63 partitions with the alternate major number (mdp) */
+#define MdpMinorShift 6
+typedef struct mdu_version_s {
+        int major;
+        int minor;
+        int patchlevel;
+} mdu_version_t;
+typedef struct mdu_array_info_s {
+        /*
+         * Generic constant information
+         */
+        int major_version;
+        int minor_version;
+        int patch_version;
+        int ctime;
+        int level;
+        int size;
+        int nr_disks;
+        int raid_disks;
+        int md_minor;
+        int not_persistent;
+        /*
+         * Generic state information
+         */
+        int utime;              /*  0 Superblock update time                  */
+        int state;              /*  1 State bits (clean, ...)                 */
+        int active_disks;       /*  2 Number of currently active disks        */
+        int working_disks;      /*  3 Number of working disks                 */
+        int failed_disks;       /*  4 Number of failed disks                  */
+        int spare_disks;        /*  5 Number of spare disks                   */
+        /*
+         * Personality information
+         */
+        int layout;             /*  0 the array's physical layout             */
+        int chunk_size; /*  1 chunk size in bytes                     */
+} mdu_array_info_t;
+/* non-obvious values for 'level' */
+#define LEVEL_MULTIPATH         (-4)
+#define LEVEL_LINEAR            (-1)
+#define LEVEL_FAULTY            (-5)
+/* we need a value for 'no level specified' and 0
+ * means 'raid0', so we need something else.  This is
+ * for internal use only
+ */
+#define LEVEL_NONE              (-1000000)
+typedef struct mdu_disk_info_s {
+        /*
+         * configuration/status of one particular disk
+         */
+        int number;
+        int major;
+        int minor;
+        int raid_disk;
+        int state;
+} mdu_disk_info_t;
+typedef struct mdu_start_info_s {
+        /*
+         * configuration/status of one particular disk
+         */
+        int major;
+        int minor;
+        int raid_disk;
+        int state;
+} mdu_start_info_t;
+typedef struct mdu_bitmap_file_s
+{
+        char pathname[4096];
+} mdu_bitmap_file_t;
+typedef struct mdu_param_s
+{
+        int                     personality;    /* 1,2,3,4 */
+        int                     chunk_size;     /* in bytes */
+        int                     max_fault;      /* unused for now */
+} mdu_param_t;
+#endif /* _UAPI_MD_U_H */
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index c4b89a5cb7df..e962faa5ab0d 100644
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -130,6 +130,7 @@ enum {
 #define TCPI_OPT_WSCALE         4
 #define TCPI_OPT_ECN            8 /* ECN was negociated at TCP session init */
 #define TCPI_OPT_ECN_SEEN       16 /* we received at least one packet with ECT */
+#define TCPI_OPT_SYN_DATA       32 /* SYN-ACK acked data in SYN sent or rcvd */
 enum tcp_ca_state {
        TCP_CA_Open = 0,
diff --git a/include/xen/hvm.h b/include/xen/hvm.h
index b193fa2f9fdd..13e43e41637d 100644
--- a/include/xen/hvm.h
+++ b/include/xen/hvm.h
@@ -5,6 +5,36 @@
 #include <xen/interface/hvm/params.h>
 #include <asm/xen/hypercall.h>
+static const char *param_name(int op)
+{
+#define PARAM(x) [HVM_PARAM_##x] = #x
+        static const char *const names[] = {
+                PARAM(CALLBACK_IRQ),
+                PARAM(STORE_PFN),
+                PARAM(STORE_EVTCHN),
+                PARAM(PAE_ENABLED),
+                PARAM(IOREQ_PFN),
+                PARAM(BUFIOREQ_PFN),
+                PARAM(TIMER_MODE),
+                PARAM(HPET_ENABLED),
+                PARAM(IDENT_PT),
+                PARAM(DM_DOMAIN),
+                PARAM(ACPI_S_STATE),
+                PARAM(VM86_TSS),
+                PARAM(VPT_ALIGN),
+                PARAM(CONSOLE_PFN),
+                PARAM(CONSOLE_EVTCHN),
+        };
+#undef PARAM
+        if (op >= ARRAY_SIZE(names))
+                return "unknown";
+        if (!names[op])
+                return "reserved";
+        return names[op];
+}
 static inline int hvm_get_parameter(int idx, uint64_t *value)
 {
        struct xen_hvm_param xhv;
@@ -14,8 +44,8 @@ static inline int hvm_get_parameter(int idx, uint64_t *value)
        xhv.index = idx;
        r = HYPERVISOR_hvm_op(HVMOP_get_param, &xhv);
        if (r < 0) {
-                printk(KERN_ERR "Cannot get hvm parameter %d: %d!\n",
+                printk(KERN_ERR "Cannot get hvm parameter %s (%d): %d!\n",
-                        idx, r);
+                        param_name(idx), idx, r);
                return r;
        }
        *value = xhv.value;
diff --git a/init/main.c b/init/main.c
index 9cf77ab138a6..e33e09df3cbc 100644
--- a/init/main.c
+++ b/init/main.c
@@ -442,9 +442,11 @@ void __init __weak smp_setup_processor_id(void)
 {
 }
+# if THREAD_SIZE >= PAGE_SIZE
 void __init __weak thread_info_cache_init(void)
 {
 }
+#endif
 /*
 * Set up kernel memory allocators
diff --git a/kernel/module.c b/kernel/module.c
index 6085f5ef88ea..6e48c3a43599 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2293,12 +2293,17 @@ static void layout_symtab(struct module *mod, struct load_info *info)
        src = (void *)info->hdr + symsect->sh_offset;
        nsrc = symsect->sh_size / sizeof(*src);
+        /* strtab always starts with a nul, so offset 0 is the empty string. */
+        strtab_size = 1;
        /* Compute total space required for the core symbols' strtab. */
-        for (ndst = i = strtab_size = 1; i < nsrc; ++i, ++src)
+        for (ndst = i = 0; i < nsrc; i++) {
-                if (is_core_symbol(src, info->sechdrs, info->hdr->e_shnum)) {
+                if (i == 0 ||
-                        strtab_size += strlen(&info->strtab[src->st_name]) + 1;
+                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) {
+                        strtab_size += strlen(&info->strtab[src[i].st_name])+1;
                        ndst++;
                }
+        }
        /* Append room for core symbols at end of core part. */
        info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
@@ -2332,15 +2337,15 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
        mod->core_symtab = dst = mod->module_core + info->symoffs;
        mod->core_strtab = s = mod->module_core + info->stroffs;
        src = mod->symtab;
-        *dst = *src;
        *s++ = 0;
-        for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
+        for (ndst = i = 0; i < mod->num_symtab; i++) {
-                if (!is_core_symbol(src, info->sechdrs, info->hdr->e_shnum))
+                if (i == 0 ||
-                        continue;
+                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) {
+                        dst[ndst] = src[i];
-                dst[ndst] = *src;
+                        dst[ndst++].st_name = s - mod->core_strtab;
-                dst[ndst++].st_name = s - mod->core_strtab;
+                        s += strlcpy(s, &mod->strtab[src[i].st_name],
-                s += strlcpy(s, &mod->strtab[src->st_name], KSYM_NAME_LEN) + 1;
+                                     KSYM_NAME_LEN) + 1;
+                }
        }
        mod->core_num_syms = ndst;
 }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2624edcfb420..8b055e9379bc 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3017,6 +3017,8 @@ static int kswapd(void *p)
                                                &balanced_classzone_idx);
                }
        }
+        current->reclaim_state = NULL;
        return 0;
 }
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 9096bcb08132..ee070722a3a3 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -463,7 +463,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
        case NETDEV_PRE_TYPE_CHANGE:
                /* Forbid underlaying device to change its type. */
-                return NOTIFY_BAD;
+                if (vlan_uses_dev(dev))
+                        return NOTIFY_BAD;
+                break;
        case NETDEV_NOTIFY_PEERS:
        case NETDEV_BONDING_FAILOVER:
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 0a9084ad19a6..fd8d5afec0dd 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1167,6 +1167,8 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
        uint16_t crc;
        unsigned long entrytime;
+        spin_lock_init(&bat_priv->bla.bcast_duplist_lock);
        batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla hash registering\n");
        /* setting claim destination address */
@@ -1210,8 +1212,8 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
 /**
 * batadv_bla_check_bcast_duplist
 * @bat_priv: the bat priv with all the soft interface information
- * @bcast_packet: originator mac address
+ * @bcast_packet: encapsulated broadcast frame plus batman header
- * @hdr_size: maximum length of the frame
+ * @bcast_packet_len: length of encapsulated broadcast frame plus batman header
 *
 * check if it is on our broadcast list. Another gateway might
 * have sent the same packet because it is connected to the same backbone,
@@ -1224,20 +1226,22 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
 */
 int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                                   struct batadv_bcast_packet *bcast_packet,
-                                   int hdr_size)
+                                   int bcast_packet_len)
 {
-        int i, length, curr;
+        int i, length, curr, ret = 0;
        uint8_t *content;
        uint16_t crc;
        struct batadv_bcast_duplist_entry *entry;
-        length = hdr_size - sizeof(*bcast_packet);
+        length = bcast_packet_len - sizeof(*bcast_packet);
        content = (uint8_t *)bcast_packet;
        content += sizeof(*bcast_packet);
        /* calculate the crc ... */
        crc = crc16(0, content, length);
+        spin_lock_bh(&bat_priv->bla.bcast_duplist_lock);
        for (i = 0; i < BATADV_DUPLIST_SIZE; i++) {
                curr = (bat_priv->bla.bcast_duplist_curr + i);
                curr %= BATADV_DUPLIST_SIZE;
@@ -1259,9 +1263,12 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                /* this entry seems to match: same crc, not too old,
                 * and from another gw. therefore return 1 to forbid it.
                 */
-                return 1;
+                ret = 1;
+                goto out;
        }
-        /* not found, add a new entry (overwrite the oldest entry) */
+        /* not found, add a new entry (overwrite the oldest entry)
+         * and allow it, its the first occurence.
+         */
        curr = (bat_priv->bla.bcast_duplist_curr + BATADV_DUPLIST_SIZE - 1);
        curr %= BATADV_DUPLIST_SIZE;
        entry = &bat_priv->bla.bcast_duplist[curr];
@@ -1270,8 +1277,10 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
        memcpy(entry->orig, bcast_packet->orig, ETH_ALEN);
        bat_priv->bla.bcast_duplist_curr = curr;
-        /* allow it, its the first occurence. */
+out:
-        return 0;
+        spin_unlock_bh(&bat_priv->bla.bcast_duplist_lock);
+        return ret;
 }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 939fc01371df..376b4cc6ca82 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1124,8 +1124,14 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
        spin_unlock_bh(&orig_node->bcast_seqno_lock);
+        /* keep skb linear for crc calculation */
+        if (skb_linearize(skb) < 0)
+                goto out;
+        bcast_packet = (struct batadv_bcast_packet *)skb->data;
        /* check whether this has been sent by another originator before */
-        if (batadv_bla_check_bcast_duplist(bat_priv, bcast_packet, hdr_size))
+        if (batadv_bla_check_bcast_duplist(bat_priv, bcast_packet, skb->len))
                goto out;
        /* rebroadcast packet */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 2ed82caacdca..ac1e07a80454 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -205,6 +205,8 @@ struct batadv_priv_bla {
        struct batadv_hashtable *backbone_hash;
        struct batadv_bcast_duplist_entry bcast_duplist[BATADV_DUPLIST_SIZE];
        int bcast_duplist_curr;
+        /* protects bcast_duplist and bcast_duplist_curr */
+        spinlock_t bcast_duplist_lock;
        struct batadv_bla_claim_dst claim_dest;
        struct delayed_work work;
 };
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 8c225ef349cd..2ac8d50861e0 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -32,6 +32,8 @@
 #define SMP_TIMEOUT     msecs_to_jiffies(30000)
+#define AUTH_REQ_MASK   0x07
 static inline void swap128(u8 src[16], u8 dst[16])
 {
        int i;
@@ -230,7 +232,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
                req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
                req->init_key_dist = 0;
                req->resp_key_dist = dist_keys;
-                req->auth_req = authreq;
+                req->auth_req = (authreq & AUTH_REQ_MASK);
                return;
        }
@@ -239,7 +241,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
        rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
        rsp->init_key_dist = 0;
        rsp->resp_key_dist = req->resp_key_dist & dist_keys;
-        rsp->auth_req = authreq;
+        rsp->auth_req = (authreq & AUTH_REQ_MASK);
 }
 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 159aa8bef9e7..3ef1759403b4 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2300,10 +2300,11 @@ restart:
                        mutex_unlock(&con->mutex);
                        return;
                } else {
-                        con->ops->put(con);
                        dout("con_work %p FAILED to back off %lu\n", con,
                             con->delay);
+                        set_bit(CON_FLAG_BACKOFF, &con->flags);
                }
+                goto done;
        }
        if (con->state == CON_STATE_STANDBY) {
@@ -2749,7 +2750,8 @@ static int ceph_con_in_msg_alloc(struct ceph_connection *con, int *skip)
                msg = con->ops->alloc_msg(con, hdr, skip);
                mutex_lock(&con->mutex);
                if (con->state != CON_STATE_OPEN) {
-                        ceph_msg_put(msg);
+                        if (msg)
+                                ceph_msg_put(msg);
                        return -EAGAIN;
                }
                con->in_msg = msg;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6e04b1fa11f2..4007c1437fda 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3379,10 +3379,12 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding);
 void kfree_skb_partial(struct sk_buff *skb, bool head_stolen)
 {
-        if (head_stolen)
+        if (head_stolen) {
+                skb_release_head_state(skb);
                kmem_cache_free(skbuff_head_cache, skb);
-        else
+        } else {
                __kfree_skb(skb);
+        }
 }
 EXPORT_SYMBOL(kfree_skb_partial);
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index 9e0ffaf1d942..a82047282dbb 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -184,7 +184,8 @@ nf_nat_ipv4_out(unsigned int hooknum,
                if ((ct->tuplehash[dir].tuple.src.u3.ip !=
                     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
-                    (ct->tuplehash[dir].tuple.src.u.all !=
+                    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+                     ct->tuplehash[dir].tuple.src.u.all !=
                     ct->tuplehash[!dir].tuple.dst.u.all))
                        if (nf_xfrm_me_harder(skb, AF_INET) < 0)
                                ret = NF_DROP;
@@ -221,6 +222,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
                }
 #ifdef CONFIG_XFRM
                else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
+                         ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
                         ct->tuplehash[dir].tuple.dst.u.all !=
                         ct->tuplehash[!dir].tuple.src.u.all)
                        if (nf_xfrm_me_harder(skb, AF_INET) < 0)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 432f4bb77238..a8c651216fa6 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1163,8 +1163,12 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
        spin_lock_bh(&fnhe_lock);
        if (daddr == fnhe->fnhe_daddr) {
-                struct rtable *orig;
+                struct rtable *orig = rcu_dereference(fnhe->fnhe_rth);
+                if (orig && rt_is_expired(orig)) {
+                        fnhe->fnhe_gw = 0;
+                        fnhe->fnhe_pmtu = 0;
+                        fnhe->fnhe_expires = 0;
+                }
                if (fnhe->fnhe_pmtu) {
                        unsigned long expires = fnhe->fnhe_expires;
                        unsigned long diff = expires - jiffies;
@@ -1181,7 +1185,6 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
                } else if (!rt->rt_gateway)
                        rt->rt_gateway = daddr;
-                orig = rcu_dereference(fnhe->fnhe_rth);
                rcu_assign_pointer(fnhe->fnhe_rth, rt);
                if (orig)
                        rt_free(orig);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f32c02e2a543..197c0008503c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -549,14 +549,12 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         !tp->urg_data ||
                         before(tp->urg_seq, tp->copied_seq) ||
                         !before(tp->urg_seq, tp->rcv_nxt)) {
-                        struct sk_buff *skb;
                        answ = tp->rcv_nxt - tp->copied_seq;
-                        /* Subtract 1, if FIN is in queue. */
+                        /* Subtract 1, if FIN was received */
-                        skb = skb_peek_tail(&sk->sk_receive_queue);
+                        if (answ && sock_flag(sk, SOCK_DONE))
-                        if (answ && skb)
+                                answ--;
-                                answ -= tcp_hdr(skb)->fin;
                } else
                        answ = tp->urg_seq - tp->copied_seq;
                release_sock(sk);
@@ -2766,6 +2764,8 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
                info->tcpi_options |= TCPI_OPT_ECN;
        if (tp->ecn_flags & TCP_ECN_SEEN)
                info->tcpi_options |= TCPI_OPT_ECN_SEEN;
+        if (tp->syn_data_acked)
+                info->tcpi_options |= TCPI_OPT_SYN_DATA;
        info->tcpi_rto = jiffies_to_usecs(icsk->icsk_rto);
        info->tcpi_ato = jiffies_to_usecs(icsk->icsk_ack.ato);
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 813b43a76fec..834857f3c871 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
                        .tcpv_rttcnt = ca->cnt_rtt,
                        .tcpv_minrtt = ca->base_rtt,
                };
-                u64 t = ca->sum_rtt;
-                do_div(t, ca->cnt_rtt);
+                if (info.tcpv_rttcnt > 0) {
-                info.tcpv_rtt = t;
+                        u64 t = ca->sum_rtt;
+                        do_div(t, info.tcpv_rttcnt);
+                        info.tcpv_rtt = t;
+                }
                nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
        }
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 432c36649db3..2c2b13a999ea 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4529,6 +4529,9 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
        struct tcphdr *th;
        bool fragstolen;
+        if (size == 0)
+                return 0;
        skb = alloc_skb(size + sizeof(*th), sk->sk_allocation);
        if (!skb)
                goto err;
@@ -5646,6 +5649,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
                tcp_rearm_rto(sk);
                return true;
        }
+        tp->syn_data_acked = tp->syn_data;
        return false;
 }
@@ -5963,7 +5967,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
        req = tp->fastopen_rsk;
        if (req != NULL) {
-                BUG_ON(sk->sk_state != TCP_SYN_RECV &&
+                WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
                    sk->sk_state != TCP_FIN_WAIT1);
                if (tcp_check_req(sk, skb, req, NULL, true) == NULL)
@@ -6052,7 +6056,15 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         * ACK we have received, this would have acknowledged
                         * our SYNACK so stop the SYNACK timer.
                         */
-                        if (acceptable && req != NULL) {
+                        if (req != NULL) {
+                                /* Return RST if ack_seq is invalid.
+                                 * Note that RFC793 only says to generate a
+                                 * DUPACK for it but for TCP Fast Open it seems
+                                 * better to treat this case like TCP_SYN_RECV
+                                 * above.
+                                 */
+                                if (!acceptable)
+                                        return 1;
                                /* We no longer need the request sock. */
                                reqsk_fastopen_remove(sk, req, false);
                                tcp_rearm_rto(sk);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index ef998b008a57..0c4a64355603 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1461,6 +1461,7 @@ static int tcp_v4_conn_req_fastopen(struct sock *sk,
                skb_set_owner_r(skb, child);
                __skb_queue_tail(&child->sk_receive_queue, skb);
                tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                tp->syn_data_acked = 1;
        }
        sk->sk_data_ready(sk, 0);
        bh_unlock_sock(child);
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 4c752a6e0bcd..53bc5847bfa8 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -864,7 +864,7 @@ static int parse_nl_addr(struct genl_info *info, struct inetpeer_addr *addr,
        }
        a = info->attrs[TCP_METRICS_ATTR_ADDR_IPV6];
        if (a) {
-                if (nla_len(a) != sizeof(sizeof(struct in6_addr)))
+                if (nla_len(a) != sizeof(struct in6_addr))
                        return -EINVAL;
                addr->family = AF_INET6;
                memcpy(addr->addr.a6, nla_data(a), sizeof(addr->addr.a6));
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 27536ba16c9d..a7302d974f32 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -510,6 +510,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                newtp->rx_opt.mss_clamp = req->mss;
                TCP_ECN_openreq_child(newtp, req);
                newtp->fastopen_rsk = NULL;
+                newtp->syn_data_acked = 0;
                TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);
        }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index fc04711e80c8..d47c1b4421a3 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -347,8 +347,8 @@ void tcp_retransmit_timer(struct sock *sk)
                return;
        }
        if (tp->fastopen_rsk) {
-                BUG_ON(sk->sk_state != TCP_SYN_RECV &&
+                WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
-                    sk->sk_state != TCP_FIN_WAIT1);
+                             sk->sk_state != TCP_FIN_WAIT1);
                tcp_fastopen_synack_timer(sk);
                /* Before we receive ACK to our SYN-ACK don't retransmit
                 * anything else (e.g., data or FIN segments).
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index e418bd6350a4..d57dab17a182 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -186,7 +186,8 @@ nf_nat_ipv6_out(unsigned int hooknum,
                if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
                                      &ct->tuplehash[!dir].tuple.dst.u3) ||
-                    (ct->tuplehash[dir].tuple.src.u.all !=
+                    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
+                     ct->tuplehash[dir].tuple.src.u.all !=
                     ct->tuplehash[!dir].tuple.dst.u.all))
                        if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
                                ret = NF_DROP;
@@ -222,6 +223,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
                }
 #ifdef CONFIG_XFRM
                else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
+                         ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
                         ct->tuplehash[dir].tuple.dst.u.all !=
                         ct->tuplehash[!dir].tuple.src.u.all)
                        if (nf_xfrm_me_harder(skb, AF_INET6))
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 18bd9bbbd1c6..22c8ea951185 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -85,7 +85,7 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = {
        { }
 };
-static int __net_init nf_ct_frag6_sysctl_register(struct net *net)
+static int nf_ct_frag6_sysctl_register(struct net *net)
 {
        struct ctl_table *table;
        struct ctl_table_header *hdr;
@@ -127,7 +127,7 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
 }
 #else
-static int __net_init nf_ct_frag6_sysctl_register(struct net *net)
+static int nf_ct_frag6_sysctl_register(struct net *net)
 {
        return 0;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7c7e963260e1..b1e6cf0b95fd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -219,7 +219,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
 };
 static const u32 ip6_template_metrics[RTAX_MAX] = {
-        [RTAX_HOPLIMIT - 1] = 255,
+        [RTAX_HOPLIMIT - 1] = 0,
 };
 static const struct rt6_info ip6_null_entry_template = {
@@ -1232,7 +1232,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
        rt->rt6i_dst.addr = fl6->daddr;
        rt->rt6i_dst.plen = 128;
        rt->rt6i_idev     = idev;
-        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
+        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 0);
        spin_lock_bh(&icmp6_dst_lock);
        rt->dst.next = icmp6_dst_gc_list;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 37b8b8ba31f7..76125c57ee6d 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -291,6 +291,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
 out_del_dev:
        free_netdev(dev);
+        spriv->dev = NULL;
 out_del_session:
        l2tp_session_delete(session);
 out:
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 5f3620f0bc0a..bf87c70ac6c5 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1108,7 +1108,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
        sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
        sdata->u.ibss.ibss_join_req = jiffies;
-        memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
+        memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
        sdata->u.ibss.ssid_len = params->ssid_len;
        mutex_unlock(&sdata->u.ibss.mtx);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 6f8a73c64fb3..7de7717ad67d 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -853,7 +853,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                        if (info->control.vif == &sdata->vif) {
                                __skb_unlink(skb, &local->pending[i]);
-                                dev_kfree_skb_irq(skb);
+                                ieee80211_free_txskb(&local->hw, skb);
                        }
                }
        }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e714ed8bb198..1b7eed252fe9 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3099,22 +3099,32 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                                   ht_cfreq, ht_oper->primary_chan,
                                   cbss->channel->band);
                        ht_oper = NULL;
+                } else {
+                        channel_type = NL80211_CHAN_HT20;
                }
        }
-        if (ht_oper) {
+        if (ht_oper && sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
-                channel_type = NL80211_CHAN_HT20;
+                /*
+                 * cfg80211 already verified that the channel itself can
+                 * be used, but it didn't check that we can do the right
+                 * HT type, so do that here as well. If HT40 isn't allowed
+                 * on this channel, disable 40 MHz operation.
+                 */
-                if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        switch (ht_oper->ht_param &
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                        IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                        if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
+                        else
                                channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
+                        break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                        if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                                ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
+                        else
                                channel_type = NL80211_CHAN_HT40MINUS;
-                                break;
+                        break;
-                        }
                }
        }
@@ -3549,6 +3559,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+        bool tx = !req->local_state_change;
        mutex_lock(&ifmgd->mtx);
@@ -3565,12 +3576,12 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
        if (ifmgd->associated &&
            ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-                                       req->reason_code, true, frame_buf);
+                                       req->reason_code, tx, frame_buf);
        } else {
                drv_mgd_prepare_tx(sdata->local, sdata);
                ieee80211_send_deauth_disassoc(sdata, req->bssid,
                                               IEEE80211_STYPE_DEAUTH,
-                                               req->reason_code, true,
+                                               req->reason_code, tx,
                                               frame_buf);
        }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 61c621e9273f..00ade7feb2e3 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -531,6 +531,11 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
                if (ieee80211_is_action(hdr->frame_control)) {
                        u8 category;
+                        /* make sure category field is present */
+                        if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
+                                return RX_DROP_MONITOR;
                        mgmt = (struct ieee80211_mgmt *)hdr;
                        category = mgmt->u.action.category;
                        if (category != WLAN_CATEGORY_MESH_ACTION &&
@@ -883,14 +888,16 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                 */
                if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
                    ieee80211_is_data_present(hdr->frame_control)) {
-                        u16 ethertype;
+                        unsigned int hdrlen;
-                        u8 *payload;
+                        __be16 ethertype;
-                        payload = rx->skb->data +
+                        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-                                ieee80211_hdrlen(hdr->frame_control);
-                        ethertype = (payload[6] << 8) | payload[7];
+                        if (rx->skb->len < hdrlen + 8)
-                        if (cpu_to_be16(ethertype) ==
+                                return RX_DROP_MONITOR;
-                            rx->sdata->control_port_protocol)
+                        skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
+                        if (ethertype == rx->sdata->control_port_protocol)
                                return RX_CONTINUE;
                }
@@ -1462,11 +1469,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
        hdr = (struct ieee80211_hdr *)rx->skb->data;
        fc = hdr->frame_control;
+        if (ieee80211_is_ctl(fc))
+                return RX_CONTINUE;
        sc = le16_to_cpu(hdr->seq_ctrl);
        frag = sc & IEEE80211_SCTL_FRAG;
        if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
-                   (rx->skb)->len < 24 ||
                   is_multicast_ether_addr(hdr->addr1))) {
                /* not fragmented */
                goto out;
@@ -1889,6 +1899,20 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        hdr = (struct ieee80211_hdr *) skb->data;
        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        /* make sure fixed part of mesh header is there, also checks skb len */
+        if (!pskb_may_pull(rx->skb, hdrlen + 6))
+                return RX_DROP_MONITOR;
+        mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+        /* make sure full mesh header is there, also checks skb len */
+        if (!pskb_may_pull(rx->skb,
+                           hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
+                return RX_DROP_MONITOR;
+        /* reload pointers */
+        hdr = (struct ieee80211_hdr *) skb->data;
        mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
        /* frame is in RMC, don't forward */
@@ -1897,7 +1921,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
            mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
                return RX_DROP_MONITOR;
-        if (!ieee80211_is_data(hdr->frame_control))
+        if (!ieee80211_is_data(hdr->frame_control) ||
+            !(status->rx_flags & IEEE80211_RX_RA_MATCH))
                return RX_CONTINUE;
        if (!mesh_hdr->ttl)
@@ -1911,9 +1936,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                if (is_multicast_ether_addr(hdr->addr1)) {
                        mpp_addr = hdr->addr3;
                        proxied_addr = mesh_hdr->eaddr1;
-                } else {
+                } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+                        /* has_a4 already checked in ieee80211_rx_mesh_check */
                        mpp_addr = hdr->addr4;
                        proxied_addr = mesh_hdr->eaddr2;
+                } else {
+                        return RX_DROP_MONITOR;
                }
                rcu_read_lock();
@@ -1941,12 +1969,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        }
        skb_set_queue_mapping(skb, q);
-        if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
-                goto out;
        if (!--mesh_hdr->ttl) {
                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
-                return RX_DROP_MONITOR;
+                goto out;
        }
        if (!ifmsh->mshcfg.dot11MeshForwarding)
@@ -2353,6 +2378,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                }
                break;
        case WLAN_CATEGORY_SELF_PROTECTED:
+                if (len < (IEEE80211_MIN_ACTION_SIZE +
+                           sizeof(mgmt->u.action.u.self_prot.action_code)))
+                        break;
                switch (mgmt->u.action.u.self_prot.action_code) {
                case WLAN_SP_MESH_PEERING_OPEN:
                case WLAN_SP_MESH_PEERING_CLOSE:
@@ -2371,6 +2400,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                }
                break;
        case WLAN_CATEGORY_MESH_ACTION:
+                if (len < (IEEE80211_MIN_ACTION_SIZE +
+                           sizeof(mgmt->u.action.u.mesh_action.action_code)))
+                        break;
                if (!ieee80211_vif_is_mesh(&sdata->vif))
                        break;
                if (mesh_action_is_path_sel(mgmt) &&
@@ -2913,10 +2946,15 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
        if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
                local->dot11ReceivedFragmentCount++;
-        if (ieee80211_is_mgmt(fc))
+        if (ieee80211_is_mgmt(fc)) {
-                err = skb_linearize(skb);
+                /* drop frame if too short for header */
-        else
+                if (skb->len < ieee80211_hdrlen(fc))
+                        err = -ENOBUFS;
+                else
+                        err = skb_linearize(skb);
+        } else {
                err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
+        }
        if (err) {
                dev_kfree_skb(skb);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 797dd36a220d..0a4e4c04db89 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -650,7 +650,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
                 */
                if (!skb)
                        break;
-                dev_kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
        }
        /*
@@ -679,7 +679,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
                local->total_ps_buffered--;
                ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
                       sta->sta.addr);
-                dev_kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
        }
        /*
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 22ca35054dd0..239391807ca9 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -406,7 +406,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
        int queue = info->hw_queue;
        if (WARN_ON(!info->control.vif)) {
-                kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
                return;
        }
@@ -431,7 +431,7 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                if (WARN_ON(!info->control.vif)) {
-                        kfree_skb(skb);
+                        ieee80211_free_txskb(&local->hw, skb);
                        continue;
                }
@@ -643,13 +643,41 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                        break;
                }
-                if (id != WLAN_EID_VENDOR_SPECIFIC &&
+                switch (id) {
-                    id != WLAN_EID_QUIET &&
+                case WLAN_EID_SSID:
-                    test_bit(id, seen_elems)) {
+                case WLAN_EID_SUPP_RATES:
-                        elems->parse_error = true;
+                case WLAN_EID_FH_PARAMS:
-                        left -= elen;
+                case WLAN_EID_DS_PARAMS:
-                        pos += elen;
+                case WLAN_EID_CF_PARAMS:
-                        continue;
+                case WLAN_EID_TIM:
+                case WLAN_EID_IBSS_PARAMS:
+                case WLAN_EID_CHALLENGE:
+                case WLAN_EID_RSN:
+                case WLAN_EID_ERP_INFO:
+                case WLAN_EID_EXT_SUPP_RATES:
+                case WLAN_EID_HT_CAPABILITY:
+                case WLAN_EID_HT_OPERATION:
+                case WLAN_EID_VHT_CAPABILITY:
+                case WLAN_EID_VHT_OPERATION:
+                case WLAN_EID_MESH_ID:
+                case WLAN_EID_MESH_CONFIG:
+                case WLAN_EID_PEER_MGMT:
+                case WLAN_EID_PREQ:
+                case WLAN_EID_PREP:
+                case WLAN_EID_PERR:
+                case WLAN_EID_RANN:
+                case WLAN_EID_CHANNEL_SWITCH:
+                case WLAN_EID_EXT_CHANSWITCH_ANN:
+                case WLAN_EID_COUNTRY:
+                case WLAN_EID_PWR_CONSTRAINT:
+                case WLAN_EID_TIMEOUT_INTERVAL:
+                        if (test_bit(id, seen_elems)) {
+                                elems->parse_error = true;
+                                left -= elen;
+                                pos += elen;
+                                continue;
+                        }
+                        break;
                }
                if (calc_crc && id < 64 && (filter & (1ULL << id)))
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index bdb53aba888e..8bd2f5c6a56e 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -106,7 +106,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                if (status->flag & RX_FLAG_MMIC_ERROR)
                        goto mic_fail;
-                if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+                if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
+                    rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
                        goto update_iv;
                return RX_CONTINUE;
@@ -545,14 +546,19 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 static void bip_aad(struct sk_buff *skb, u8 *aad)
 {
+        __le16 mask_fc;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
        /* BIP AAD: FC(masked) || A1 || A2 || A3 */
        /* FC type/subtype */
-        aad[0] = skb->data[0];
        /* Mask FC Retry, PwrMgt, MoreData flags to zero */
-        aad[1] = skb->data[1] & ~(BIT(4) | BIT(5) | BIT(6));
+        mask_fc = hdr->frame_control;
+        mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
+                                IEEE80211_FCTL_MOREDATA);
+        put_unaligned(mask_fc, (__le16 *) &aad[0]);
        /* A1 || A2 || A3 */
-        memcpy(aad + 2, skb->data + 4, 3 * ETH_ALEN);
+        memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
 }
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7e7198b51c06..c4ee43710aab 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2589,6 +2589,8 @@ __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
        struct ip_vs_proto_data *pd;
 #endif
+        memset(u, 0, sizeof (*u));
 #ifdef CONFIG_IP_VS_PROTO_TCP
        pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
        u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
@@ -2766,7 +2768,6 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        {
                struct ip_vs_timeout_user t;
-                memset(&t, 0, sizeof(t));
                __ip_vs_get_timeouts(net, &t);
                if (copy_to_user(user, &t, sizeof(t)) != 0)
                        ret = -EFAULT;
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 1b30b0dee708..962795e839ab 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -753,7 +753,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
                                   flowi4_to_flowi(&fl1), false)) {
                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
                                           flowi4_to_flowi(&fl2), false)) {
-                                if (rt1->rt_gateway == rt2->rt_gateway &&
+                                if (rt_nexthop(rt1, fl1.daddr) ==
+                                    rt_nexthop(rt2, fl2.daddr) &&
                                    rt1->dst.dev  == rt2->dst.dev)
                                        ret = 1;
                                dst_release(&rt2->dst);
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 16c712563860..ae7f5daeee43 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -180,9 +180,9 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
        typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
        struct ctnl_timeout *timeout;
        struct nf_conn_timeout *timeout_ext;
-        const struct ipt_entry *e = par->entryinfo;
        struct nf_conntrack_l4proto *l4proto;
        int ret = 0;
+        u8 proto;
        rcu_read_lock();
        timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
@@ -192,9 +192,11 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
                goto out;
        }
-        if (e->ip.invflags & IPT_INV_PROTO) {
+        proto = xt_ct_find_proto(par);
+        if (!proto) {
                ret = -EINVAL;
-                pr_info("You cannot use inversion on L4 protocol\n");
+                pr_info("You must specify a L4 protocol, and not use "
+                        "inversions on it.\n");
                goto out;
        }
@@ -214,7 +216,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
        /* Make sure the timeout policy matches any existing protocol tracker,
         * otherwise default to generic.
         */
-        l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
+        l4proto = __nf_ct_l4proto_find(par->family, proto);
        if (timeout->l4proto->l4proto != l4proto->l4proto) {
                ret = -EINVAL;
                pr_info("Timeout policy `%s' can only be used by L4 protocol "
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index ee2e5bc5a8c7..bd93e51d30ac 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -70,6 +70,7 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
        fl4.daddr = info->gw.ip;
        fl4.flowi4_tos = RT_TOS(iph->tos);
        fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+        fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
        rt = ip_route_output_key(net, &fl4);
        if (IS_ERR(rt))
                return false;
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
index 81aafa8e4fef..bea7464cc43f 100644
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -111,7 +111,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .family         = NFPROTO_IPV4,
                .table          = "nat",
                .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                .me             = THIS_MODULE,
        },
        {
@@ -123,7 +123,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .family         = NFPROTO_IPV4,
                .table          = "nat",
                .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                .me             = THIS_MODULE,
        },
        {
@@ -133,7 +133,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .targetsize     = sizeof(struct nf_nat_range),
                .table          = "nat",
                .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                .me             = THIS_MODULE,
        },
        {
@@ -143,7 +143,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .targetsize     = sizeof(struct nf_nat_range),
                .table          = "nat",
                .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                .me             = THIS_MODULE,
        },
 };
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 01e944a017a4..4da797fa5ec5 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -138,6 +138,8 @@ static int netlink_dump(struct sock *sk);
 static DEFINE_RWLOCK(nl_table_lock);
 static atomic_t nl_table_users = ATOMIC_INIT(0);
+#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));
 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
 static inline u32 netlink_group_mask(u32 group)
@@ -345,6 +347,11 @@ netlink_update_listeners(struct sock *sk)
        struct hlist_node *node;
        unsigned long mask;
        unsigned int i;
+        struct listeners *listeners;
+        listeners = nl_deref_protected(tbl->listeners);
+        if (!listeners)
+                return;
        for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
                mask = 0;
@@ -352,7 +359,7 @@ netlink_update_listeners(struct sock *sk)
                        if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
                                mask |= nlk_sk(sk)->groups[i];
                }
-                tbl->listeners->masks[i] = mask;
+                listeners->masks[i] = mask;
        }
        /* this function is only called with the netlink table "grabbed", which
         * makes sure updates are visible before bind or setsockopt return. */
@@ -536,7 +543,11 @@ static int netlink_release(struct socket *sock)
        if (netlink_is_kernel(sk)) {
                BUG_ON(nl_table[sk->sk_protocol].registered == 0);
                if (--nl_table[sk->sk_protocol].registered == 0) {
-                        kfree(nl_table[sk->sk_protocol].listeners);
+                        struct listeners *old;
+                        old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
+                        RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
+                        kfree_rcu(old, rcu);
                        nl_table[sk->sk_protocol].module = NULL;
                        nl_table[sk->sk_protocol].bind = NULL;
                        nl_table[sk->sk_protocol].flags = 0;
@@ -982,7 +993,7 @@ int netlink_has_listeners(struct sock *sk, unsigned int group)
        rcu_read_lock();
        listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);
-        if (group - 1 < nl_table[sk->sk_protocol].groups)
+        if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
                res = test_bit(group - 1, listeners->masks);
        rcu_read_unlock();
@@ -1625,7 +1636,7 @@ int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
                new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
                if (!new)
                        return -ENOMEM;
-                old = rcu_dereference_protected(tbl->listeners, 1);
+                old = nl_deref_protected(tbl->listeners);
                memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
                rcu_assign_pointer(tbl->listeners, new);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 59d16ea927f0..a60d1f8b41c5 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -974,7 +974,7 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
        void *addr_buf;
        struct sctp_af *af;
-        SCTP_DEBUG_PRINTK("sctp_setsocktopt_bindx: sk %p addrs %p"
+        SCTP_DEBUG_PRINTK("sctp_setsockopt_bindx: sk %p addrs %p"
                          " addrs_size %d opt %d\n", sk, addrs, addrs_size, op);
        if (unlikely(addrs_size <= 0))
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 5a3d675d2f2f..a9c0bbccad6b 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -172,7 +172,7 @@ out_free:
                xprt_free_allocation(req);
        dprintk("RPC:       setup backchannel transport failed\n");
-        return -1;
+        return -ENOMEM;
 }
 EXPORT_SYMBOL_GPL(xprt_setup_backchannel);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 443d4d7deea2..3f7253052088 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -526,8 +526,7 @@ int wiphy_register(struct wiphy *wiphy)
                for (i = 0; i < sband->n_channels; i++) {
                        sband->channels[i].orig_flags =
                                sband->channels[i].flags;
-                        sband->channels[i].orig_mag =
+                        sband->channels[i].orig_mag = INT_MAX;
-                                sband->channels[i].max_antenna_gain;
                        sband->channels[i].orig_mpwr =
                                sband->channels[i].max_power;
                        sband->channels[i].band = band;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 8016fee0752b..904a7f368325 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                .reason_code = reason,
                .ie = ie,
                .ie_len = ie_len,
+                .local_state_change = local_state_change,
        };
        ASSERT_WDEV_LOCK(wdev);
-        if (local_state_change) {
+        if (local_state_change && (!wdev->current_bss ||
-                if (wdev->current_bss &&
+            !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
-                    ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
-                        cfg80211_unhold_bss(wdev->current_bss);
-                        cfg80211_put_bss(&wdev->current_bss->pub);
-                        wdev->current_bss = NULL;
-                }
                return 0;
-        }
        return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 3b8cbbc214db..bcc7d7ee5a51 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -908,7 +908,7 @@ static void handle_channel(struct wiphy *wiphy,
                        map_regdom_flags(reg_rule->flags) | bw_flags;
                chan->max_antenna_gain = chan->orig_mag =
                        (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-                chan->max_power = chan->orig_mpwr =
+                chan->max_reg_power = chan->max_power = chan->orig_mpwr =
                        (int) MBM_TO_DBM(power_rule->max_eirp);
                return;
        }
@@ -1331,7 +1331,8 @@ static void handle_channel_custom(struct wiphy *wiphy,
        chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
        chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-        chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+        chan->max_reg_power = chan->max_power =
+                (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 static void handle_band_custom(struct wiphy *wiphy, enum ieee80211_band band,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ef35f4ef2aa6..2762e8329986 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -309,23 +309,21 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
-static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
 {
        int ae = meshhdr->flags & MESH_FLAGS_AE;
-        /* 7.1.3.5a.2 */
+        /* 802.11-2012, 8.2.4.7.3 */
        switch (ae) {
+        default:
        case 0:
                return 6;
        case MESH_FLAGS_AE_A4:
                return 12;
        case MESH_FLAGS_AE_A5_A6:
                return 18;
-        case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
-                return 24;
-        default:
-                return 6;
        }
 }
+EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
 int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                           enum nl80211_iftype iftype)
@@ -373,6 +371,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                        /* make sure meshdr->flags is on the linear part */
                        if (!pskb_may_pull(skb, hdrlen + 1))
                                return -1;
+                        if (meshdr->flags & MESH_FLAGS_AE_A4)
+                                return -1;
                        if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
                                skb_copy_bits(skb, hdrlen +
                                        offsetof(struct ieee80211s_hdr, eaddr1),
@@ -397,6 +397,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                        /* make sure meshdr->flags is on the linear part */
                        if (!pskb_may_pull(skb, hdrlen + 1))
                                return -1;
+                        if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
+                                return -1;
                        if (meshdr->flags & MESH_FLAGS_AE_A4)
                                skb_copy_bits(skb, hdrlen +
                                        offsetof(struct ieee80211s_hdr, eaddr1),
diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
index dda4b2b61927..ecbb44797e28 100644
--- a/scripts/Makefile.modinst
+++ b/scripts/Makefile.modinst
@@ -16,8 +16,9 @@ PHONY += $(modules)
 __modinst: $(modules)
        @:
+# Don't stop modules_install if we can't sign external modules.
 quiet_cmd_modules_install = INSTALL $@
-      cmd_modules_install = mkdir -p $(2); cp $@ $(2) ; $(mod_strip_cmd) $(2)/$(notdir $@) ; $(mod_sign_cmd) $(2)/$(notdir $@)
+      cmd_modules_install = mkdir -p $(2); cp $@ $(2) ; $(mod_strip_cmd) $(2)/$(notdir $@) ; $(mod_sign_cmd) $(2)/$(notdir $@) $(patsubst %,|| true,$(KBUILD_EXTMOD))
 # Modules built outside the kernel source tree go into extra by default
 INSTALL_MOD_DIR ?= extra
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 21a9f5de0a21..f18750e3bd6c 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1890,8 +1890,10 @@ sub process {
                }
                if ($realfile =~ m@^(drivers/net/|net/)@ &&
-                    $rawline !~ m@^\+[ \t]*(\/\*|\*\/)@ &&
+                    $rawline !~ m@^\+[ \t]*\*/[ \t]*$@ &&       #trailing */
-                    $rawline =~ m@^\+[ \t]*.+\*\/[ \t]*$@) {
+                    $rawline !~ m@^\+.*/\*.*\*/[ \t]*$@ &&      #inline /*...*/
+                    $rawline !~ m@^\+.*\*{2,}/[ \t]*$@ &&       #trailing **/
+                    $rawline =~ m@^\+[ \t]*.+\*\/[ \t]*$@) {    #non blank */
                        WARN("NETWORKING_BLOCK_COMMENT_STYLE",
                             "networking block comments put the trailing */ on a separate line\n" . $herecurr);
                }
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index c40ae573346d..ad11dc994792 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -100,12 +100,15 @@ static int snd_compr_open(struct inode *inode, struct file *f)
        if (dirn != compr->direction) {
                pr_err("this device doesn't support this direction\n");
+                snd_card_unref(compr->card);
                return -EINVAL;
        }
        data = kzalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
+        if (!data) {
+                snd_card_unref(compr->card);
                return -ENOMEM;
+        }
        data->stream.ops = compr->ops;
        data->stream.direction = dirn;
        data->stream.private_data = compr->private_data;
@@ -113,6 +116,7 @@ static int snd_compr_open(struct inode *inode, struct file *f)
        runtime = kzalloc(sizeof(*runtime), GFP_KERNEL);
        if (!runtime) {
                kfree(data);
+                snd_card_unref(compr->card);
                return -ENOMEM;
        }
        runtime->state = SNDRV_PCM_STATE_OPEN;
@@ -126,7 +130,8 @@ static int snd_compr_open(struct inode *inode, struct file *f)
                kfree(runtime);
                kfree(data);
        }
-        return ret;
+        snd_card_unref(compr->card);
+        return 0;
 }
 static int snd_compr_free(struct inode *inode, struct file *f)
diff --git a/sound/core/control.c b/sound/core/control.c
index 7e86a5b9f3b5..8c7c2c9bba61 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -86,6 +86,7 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
        write_lock_irqsave(&card->ctl_files_rwlock, flags);
        list_add_tail(&ctl->list, &card->ctl_files);
        write_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+        snd_card_unref(card);
        return 0;
      __error:
@@ -93,6 +94,8 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
      __error2:
        snd_card_file_remove(card, file);
      __error1:
+        if (card)
+                snd_card_unref(card);
        return err;
 }
@@ -1434,6 +1437,8 @@ static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
                        spin_unlock_irq(&ctl->read_lock);
                        schedule();
                        remove_wait_queue(&ctl->change_sleep, &wait);
+                        if (ctl->card->shutdown)
+                                return -ENODEV;
                        if (signal_pending(current))
                                return -ERESTARTSYS;
                        spin_lock_irq(&ctl->read_lock);
diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index 75ea16f35b1a..3f7f6628cf7b 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -100,8 +100,10 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
        if (hw == NULL)
                return -ENODEV;
-        if (!try_module_get(hw->card->module))
+        if (!try_module_get(hw->card->module)) {
+                snd_card_unref(hw->card);
                return -EFAULT;
+        }
        init_waitqueue_entry(&wait, current);
        add_wait_queue(&hw->open_wait, &wait);
@@ -129,6 +131,10 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
                mutex_unlock(&hw->open_mutex);
                schedule();
                mutex_lock(&hw->open_mutex);
+                if (hw->card->shutdown) {
+                        err = -ENODEV;
+                        break;
+                }
                if (signal_pending(current)) {
                        err = -ERESTARTSYS;
                        break;
@@ -148,6 +154,7 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
        mutex_unlock(&hw->open_mutex);
        if (err < 0)
                module_put(hw->card->module);
+        snd_card_unref(hw->card);
        return err;
 }
@@ -459,12 +466,15 @@ static int snd_hwdep_dev_disconnect(struct snd_device *device)
                mutex_unlock(&register_mutex);
                return -EINVAL;
        }
+        mutex_lock(&hwdep->open_mutex);
+        wake_up(&hwdep->open_wait);
 #ifdef CONFIG_SND_OSSEMUL
        if (hwdep->ossreg)
                snd_unregister_oss_device(hwdep->oss_type, hwdep->card, hwdep->device);
 #endif
        snd_unregister_device(SNDRV_DEVICE_TYPE_HWDEP, hwdep->card, hwdep->device);
        list_del_init(&hwdep->list);
+        mutex_unlock(&hwdep->open_mutex);
        mutex_unlock(&register_mutex);
        return 0;
 }
diff --git a/sound/core/init.c b/sound/core/init.c
index d8ec849af128..7b012d15c2cf 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -213,6 +213,7 @@ int snd_card_create(int idx, const char *xid,
        spin_lock_init(&card->files_lock);
        INIT_LIST_HEAD(&card->files_list);
        init_waitqueue_head(&card->shutdown_sleep);
+        atomic_set(&card->refcount, 0);
 #ifdef CONFIG_PM
        mutex_init(&card->power_lock);
        init_waitqueue_head(&card->power_sleep);
@@ -446,21 +447,36 @@ static int snd_card_do_free(struct snd_card *card)
        return 0;
 }
+/**
+ * snd_card_unref - release the reference counter
+ * @card: the card instance
+ *
+ * Decrements the reference counter.  When it reaches to zero, wake up
+ * the sleeper and call the destructor if needed.
+ */
+void snd_card_unref(struct snd_card *card)
+{
+        if (atomic_dec_and_test(&card->refcount)) {
+                wake_up(&card->shutdown_sleep);
+                if (card->free_on_last_close)
+                        snd_card_do_free(card);
+        }
+}
+EXPORT_SYMBOL(snd_card_unref);
 int snd_card_free_when_closed(struct snd_card *card)
 {
-        int free_now = 0;
+        int ret;
-        int ret = snd_card_disconnect(card);
-        if (ret)
-                return ret;
-        spin_lock(&card->files_lock);
+        atomic_inc(&card->refcount);
-        if (list_empty(&card->files_list))
+        ret = snd_card_disconnect(card);
-                free_now = 1;
+        if (ret) {
-        else
+                atomic_dec(&card->refcount);
-                card->free_on_last_close = 1;
+                return ret;
-        spin_unlock(&card->files_lock);
+        }
-        if (free_now)
+        card->free_on_last_close = 1;
+        if (atomic_dec_and_test(&card->refcount))
                snd_card_do_free(card);
        return 0;
 }
@@ -474,7 +490,7 @@ int snd_card_free(struct snd_card *card)
                return ret;
        /* wait, until all devices are ready for the free operation */
-        wait_event(card->shutdown_sleep, list_empty(&card->files_list));
+        wait_event(card->shutdown_sleep, !atomic_read(&card->refcount));
        snd_card_do_free(card);
        return 0;
 }
@@ -886,6 +902,7 @@ int snd_card_file_add(struct snd_card *card, struct file *file)
                return -ENODEV;
        }
        list_add(&mfile->list, &card->files_list);
+        atomic_inc(&card->refcount);
        spin_unlock(&card->files_lock);
        return 0;
 }
@@ -908,7 +925,6 @@ EXPORT_SYMBOL(snd_card_file_add);
 int snd_card_file_remove(struct snd_card *card, struct file *file)
 {
        struct snd_monitor_file *mfile, *found = NULL;
-        int last_close = 0;
        spin_lock(&card->files_lock);
        list_for_each_entry(mfile, &card->files_list, list) {
@@ -923,19 +939,13 @@ int snd_card_file_remove(struct snd_card *card, struct file *file)
                        break;
                }
        }
-        if (list_empty(&card->files_list))
-                last_close = 1;
        spin_unlock(&card->files_lock);
-        if (last_close) {
-                wake_up(&card->shutdown_sleep);
-                if (card->free_on_last_close)
-                        snd_card_do_free(card);
-        }
        if (!found) {
                snd_printk(KERN_ERR "ALSA card file remove problem (%p)\n", file);
                return -ENOENT;
        }
        kfree(found);
+        snd_card_unref(card);
        return 0;
 }
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 29f6ded02555..e8a1d18774b2 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -52,14 +52,19 @@ static int snd_mixer_oss_open(struct inode *inode, struct file *file)
                                         SNDRV_OSS_DEVICE_TYPE_MIXER);
        if (card == NULL)
                return -ENODEV;
-        if (card->mixer_oss == NULL)
+        if (card->mixer_oss == NULL) {
+                snd_card_unref(card);
                return -ENODEV;
+        }
        err = snd_card_file_add(card, file);
-        if (err < 0)
+        if (err < 0) {
+                snd_card_unref(card);
                return err;
+        }
        fmixer = kzalloc(sizeof(*fmixer), GFP_KERNEL);
        if (fmixer == NULL) {
                snd_card_file_remove(card, file);
+                snd_card_unref(card);
                return -ENOMEM;
        }
        fmixer->card = card;
@@ -68,8 +73,10 @@ static int snd_mixer_oss_open(struct inode *inode, struct file *file)
        if (!try_module_get(card->module)) {
                kfree(fmixer);
                snd_card_file_remove(card, file);
+                snd_card_unref(card);
                return -EFAULT;
        }
+        snd_card_unref(card);
        return 0;
 }
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 08fde0060fd9..4c1cc51772e6 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2441,6 +2441,10 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
                mutex_unlock(&pcm->open_mutex);
                schedule();
                mutex_lock(&pcm->open_mutex);
+                if (pcm->card->shutdown) {
+                        err = -ENODEV;
+                        break;
+                }
                if (signal_pending(current)) {
                        err = -ERESTARTSYS;
                        break;
@@ -2450,6 +2454,7 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
        mutex_unlock(&pcm->open_mutex);
        if (err < 0)
                goto __error;
+        snd_card_unref(pcm->card);
        return err;
      __error:
@@ -2457,6 +2462,8 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
      __error2:
        snd_card_file_remove(pcm->card, file);
      __error1:
+        if (pcm)
+                snd_card_unref(pcm->card);
        return err;
 }
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index f2991940b271..030102caeee9 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -1086,11 +1086,19 @@ static int snd_pcm_dev_disconnect(struct snd_device *device)
        if (list_empty(&pcm->list))
                goto unlock;
+        mutex_lock(&pcm->open_mutex);
+        wake_up(&pcm->open_wait);
        list_del_init(&pcm->list);
        for (cidx = 0; cidx < 2; cidx++)
-                for (substream = pcm->streams[cidx].substream; substream; substream = substream->next)
+                for (substream = pcm->streams[cidx].substream; substream; substream = substream->next) {
-                        if (substream->runtime)
+                        snd_pcm_stream_lock_irq(substream);
+                        if (substream->runtime) {
                                substream->runtime->status->state = SNDRV_PCM_STATE_DISCONNECTED;
+                                wake_up(&substream->runtime->sleep);
+                                wake_up(&substream->runtime->tsleep);
+                        }
+                        snd_pcm_stream_unlock_irq(substream);
+                }
        list_for_each_entry(notify, &snd_pcm_notify_list, list) {
                notify->n_disconnect(pcm);
        }
@@ -1110,6 +1118,7 @@ static int snd_pcm_dev_disconnect(struct snd_device *device)
                        pcm->streams[cidx].chmap_kctl = NULL;
                }
        }
+        mutex_unlock(&pcm->open_mutex);
 unlock:
        mutex_unlock(&register_mutex);
        return 0;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 5e12e5bacbba..f9ddecf2f4cd 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -369,6 +369,14 @@ static int period_to_usecs(struct snd_pcm_runtime *runtime)
        return usecs;
 }
+static void snd_pcm_set_state(struct snd_pcm_substream *substream, int state)
+{
+        snd_pcm_stream_lock_irq(substream);
+        if (substream->runtime->status->state != SNDRV_PCM_STATE_DISCONNECTED)
+                substream->runtime->status->state = state;
+        snd_pcm_stream_unlock_irq(substream);
+}
 static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
                             struct snd_pcm_hw_params *params)
 {
@@ -452,7 +460,7 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
                runtime->boundary *= 2;
        snd_pcm_timer_resolution_change(substream);
-        runtime->status->state = SNDRV_PCM_STATE_SETUP;
+        snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP);
        if (pm_qos_request_active(&substream->latency_pm_qos_req))
                pm_qos_remove_request(&substream->latency_pm_qos_req);
@@ -464,7 +472,7 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
        /* hardware might be unusable from this time,
           so we force application to retry to set
           the correct hardware parameter settings */
-        runtime->status->state = SNDRV_PCM_STATE_OPEN;
+        snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN);
        if (substream->ops->hw_free != NULL)
                substream->ops->hw_free(substream);
        return err;
@@ -512,7 +520,7 @@ static int snd_pcm_hw_free(struct snd_pcm_substream *substream)
                return -EBADFD;
        if (substream->ops->hw_free)
                result = substream->ops->hw_free(substream);
-        runtime->status->state = SNDRV_PCM_STATE_OPEN;
+        snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN);
        pm_qos_remove_request(&substream->latency_pm_qos_req);
        return result;
 }
@@ -1320,7 +1328,7 @@ static void snd_pcm_post_prepare(struct snd_pcm_substream *substream, int state)
 {
        struct snd_pcm_runtime *runtime = substream->runtime;
        runtime->control->appl_ptr = runtime->status->hw_ptr;
-        runtime->status->state = SNDRV_PCM_STATE_PREPARED;
+        snd_pcm_set_state(substream, SNDRV_PCM_STATE_PREPARED);
 }
 static struct action_ops snd_pcm_action_prepare = {
@@ -1510,6 +1518,10 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream,
                down_read(&snd_pcm_link_rwsem);
                snd_pcm_stream_lock_irq(substream);
                remove_wait_queue(&to_check->sleep, &wait);
+                if (card->shutdown) {
+                        result = -ENODEV;
+                        break;
+                }
                if (tout == 0) {
                        if (substream->runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
                                result = -ESTRPIPE;
@@ -1634,6 +1646,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
        write_unlock_irq(&snd_pcm_link_rwlock);
        up_write(&snd_pcm_link_rwsem);
 _nolock:
+        snd_card_unref(substream1->pcm->card);
        fput_light(file, fput_needed);
        if (res < 0)
                kfree(group);
@@ -2108,7 +2121,10 @@ static int snd_pcm_playback_open(struct inode *inode, struct file *file)
                return err;
        pcm = snd_lookup_minor_data(iminor(inode),
                                    SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
-        return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
+        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
+        if (pcm)
+                snd_card_unref(pcm->card);
+        return err;
 }
 static int snd_pcm_capture_open(struct inode *inode, struct file *file)
@@ -2119,7 +2135,10 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
                return err;
        pcm = snd_lookup_minor_data(iminor(inode),
                                    SNDRV_DEVICE_TYPE_PCM_CAPTURE);
-        return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
+        err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
+        if (pcm)
+                snd_card_unref(pcm->card);
+        return err;
 }
 static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream)
@@ -2156,6 +2175,10 @@ static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream)
                mutex_unlock(&pcm->open_mutex);
                schedule();
                mutex_lock(&pcm->open_mutex);
+                if (pcm->card->shutdown) {
+                        err = -ENODEV;
+                        break;
+                }
                if (signal_pending(current)) {
                        err = -ERESTARTSYS;
                        break;
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index ebf6e49ad3d4..1bb95aeea084 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -379,8 +379,10 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
        if (rmidi == NULL)
                return -ENODEV;
-        if (!try_module_get(rmidi->card->module))
+        if (!try_module_get(rmidi->card->module)) {
+                snd_card_unref(rmidi->card);
                return -ENXIO;
+        }
        mutex_lock(&rmidi->open_mutex);
        card = rmidi->card;
@@ -422,6 +424,10 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
                mutex_unlock(&rmidi->open_mutex);
                schedule();
                mutex_lock(&rmidi->open_mutex);
+                if (rmidi->card->shutdown) {
+                        err = -ENODEV;
+                        break;
+                }
                if (signal_pending(current)) {
                        err = -ERESTARTSYS;
                        break;
@@ -440,6 +446,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
 #endif
        file->private_data = rawmidi_file;
        mutex_unlock(&rmidi->open_mutex);
+        snd_card_unref(rmidi->card);
        return 0;
 __error:
@@ -447,6 +454,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
 __error_card:
        mutex_unlock(&rmidi->open_mutex);
        module_put(rmidi->card->module);
+        snd_card_unref(rmidi->card);
        return err;
 }
@@ -991,6 +999,8 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun
                        spin_unlock_irq(&runtime->lock);
                        schedule();
                        remove_wait_queue(&runtime->sleep, &wait);
+                        if (rfile->rmidi->card->shutdown)
+                                return -ENODEV;
                        if (signal_pending(current))
                                return result > 0 ? result : -ERESTARTSYS;
                        if (!runtime->avail)
@@ -1234,6 +1244,8 @@ static ssize_t snd_rawmidi_write(struct file *file, const char __user *buf,
                        spin_unlock_irq(&runtime->lock);
                        timeout = schedule_timeout(30 * HZ);
                        remove_wait_queue(&runtime->sleep, &wait);
+                        if (rfile->rmidi->card->shutdown)
+                                return -ENODEV;
                        if (signal_pending(current))
                                return result > 0 ? result : -ERESTARTSYS;
                        if (!runtime->avail && !timeout)
@@ -1609,9 +1621,20 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
 static int snd_rawmidi_dev_disconnect(struct snd_device *device)
 {
        struct snd_rawmidi *rmidi = device->device_data;
+        int dir;
        mutex_lock(&register_mutex);
+        mutex_lock(&rmidi->open_mutex);
+        wake_up(&rmidi->open_wait);
        list_del_init(&rmidi->list);
+        for (dir = 0; dir < 2; dir++) {
+                struct snd_rawmidi_substream *s;
+                list_for_each_entry(s, &rmidi->streams[dir].substreams, list) {
+                        if (s->runtime)
+                                wake_up(&s->runtime->sleep);
+                }
+        }
 #ifdef CONFIG_SND_OSSEMUL
        if (rmidi->ossreg) {
                if ((int)rmidi->device == midi_map[rmidi->card->number]) {
@@ -1626,6 +1649,7 @@ static int snd_rawmidi_dev_disconnect(struct snd_device *device)
        }
 #endif /* CONFIG_SND_OSSEMUL */
        snd_unregister_device(SNDRV_DEVICE_TYPE_RAWMIDI, rmidi->card, rmidi->device);
+        mutex_unlock(&rmidi->open_mutex);
        mutex_unlock(&register_mutex);
        return 0;
 }
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 643976000ce8..70ccdab74153 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -98,6 +98,10 @@ static void snd_request_other(int minor)
 *
 * Checks that a minor device with the specified type is registered, and returns
 * its user data pointer.
+ *
+ * This function increments the reference counter of the card instance
+ * if an associated instance with the given minor number and type is found.
+ * The caller must call snd_card_unref() appropriately later.
 */
 void *snd_lookup_minor_data(unsigned int minor, int type)
 {
@@ -108,9 +112,11 @@ void *snd_lookup_minor_data(unsigned int minor, int type)
                return NULL;
        mutex_lock(&sound_mutex);
        mreg = snd_minors[minor];
-        if (mreg && mreg->type == type)
+        if (mreg && mreg->type == type) {
                private_data = mreg->private_data;
-        else
+                if (private_data && mreg->card_ptr)
+                        atomic_inc(&mreg->card_ptr->refcount);
+        } else
                private_data = NULL;
        mutex_unlock(&sound_mutex);
        return private_data;
@@ -275,6 +281,7 @@ int snd_register_device_for_dev(int type, struct snd_card *card, int dev,
        preg->device = dev;
        preg->f_ops = f_ops;
        preg->private_data = private_data;
+        preg->card_ptr = card;
        mutex_lock(&sound_mutex);
 #ifdef CONFIG_SND_DYNAMIC_MINORS
        minor = snd_find_free_minor(type);
diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c
index e9528333e36d..726a49ac9725 100644
--- a/sound/core/sound_oss.c
+++ b/sound/core/sound_oss.c
@@ -40,6 +40,9 @@
 static struct snd_minor *snd_oss_minors[SNDRV_OSS_MINORS];
 static DEFINE_MUTEX(sound_oss_mutex);
+/* NOTE: This function increments the refcount of the associated card like
+ * snd_lookup_minor_data(); the caller must call snd_card_unref() appropriately
+ */
 void *snd_lookup_oss_minor_data(unsigned int minor, int type)
 {
        struct snd_minor *mreg;
@@ -49,9 +52,11 @@ void *snd_lookup_oss_minor_data(unsigned int minor, int type)
                return NULL;
        mutex_lock(&sound_oss_mutex);
        mreg = snd_oss_minors[minor];
-        if (mreg && mreg->type == type)
+        if (mreg && mreg->type == type) {
                private_data = mreg->private_data;
-        else
+                if (private_data && mreg->card_ptr)
+                        atomic_inc(&mreg->card_ptr->refcount);
+        } else
                private_data = NULL;
        mutex_unlock(&sound_oss_mutex);
        return private_data;
@@ -123,6 +128,7 @@ int snd_register_oss_device(int type, struct snd_card *card, int dev,
        preg->device = dev;
        preg->f_ops = f_ops;
        preg->private_data = private_data;
+        preg->card_ptr = card;
        mutex_lock(&sound_oss_mutex);
        snd_oss_minors[minor] = preg;
        minor_unit = SNDRV_MINOR_OSS_DEVICE(minor);
diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c
index ef68d710d08c..e04e750a77ed 100644
--- a/sound/i2c/other/ak4113.c
+++ b/sound/i2c/other/ak4113.c
@@ -426,7 +426,7 @@ static struct snd_kcontrol_new snd_ak4113_iec958_controls[] = {
 },
 {
        .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
-        .name =         "IEC958 Preample Capture Default",
+        .name =         "IEC958 Preamble Capture Default",
        .access =       SNDRV_CTL_ELEM_ACCESS_READ |
                SNDRV_CTL_ELEM_ACCESS_VOLATILE,
        .info =         snd_ak4113_spdif_pinfo,
diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c
index 816e7d225fb0..5bf4fca19e48 100644
--- a/sound/i2c/other/ak4114.c
+++ b/sound/i2c/other/ak4114.c
@@ -401,7 +401,7 @@ static struct snd_kcontrol_new snd_ak4114_iec958_controls[] = {
 },
 {
        .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
-        .name =         "IEC958 Preample Capture Default",
+        .name =         "IEC958 Preamble Capture Default",
        .access =       SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
        .info =         snd_ak4114_spdif_pinfo,
        .get =          snd_ak4114_spdif_pget,
diff --git a/sound/i2c/other/ak4117.c b/sound/i2c/other/ak4117.c
index b4b2a51fc117..40e33c9f2b09 100644
--- a/sound/i2c/other/ak4117.c
+++ b/sound/i2c/other/ak4117.c
@@ -380,7 +380,7 @@ static struct snd_kcontrol_new snd_ak4117_iec958_controls[] = {
 },
 {
        .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
-        .name =         "IEC958 Preample Capture Default",
+        .name =         "IEC958 Preamble Capture Default",
        .access =       SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
        .info =         snd_ak4117_spdif_pinfo,
        .get =          snd_ak4117_spdif_pget,
diff --git a/sound/pci/es1968.c b/sound/pci/es1968.c
index 5d0e568fdea1..50169bcfd903 100644
--- a/sound/pci/es1968.c
+++ b/sound/pci/es1968.c
@@ -2655,6 +2655,8 @@ static struct ess_device_list pm_whitelist[] __devinitdata = {
        { TYPE_MAESTRO2E, 0x1179 },
        { TYPE_MAESTRO2E, 0x14c0 },     /* HP omnibook 4150 */
        { TYPE_MAESTRO2E, 0x1558 },
+        { TYPE_MAESTRO2E, 0x125d },     /* a PCI card, e.g. Terratec DMX */
+        { TYPE_MAESTRO2, 0x125d },      /* a PCI card, e.g. SF64-PCE2 */
 };
 static struct ess_device_list mpu_blacklist[] __devinitdata = {
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 72b085ae7d46..cd2dbaf1be78 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -3563,6 +3563,8 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
        /* Teradici */
        { PCI_DEVICE(0x6549, 0x1200),
          .driver_data = AZX_DRIVER_TERA | AZX_DCAPS_NO_64BIT },
+        { PCI_DEVICE(0x6549, 0x2200),
+          .driver_data = AZX_DRIVER_TERA | AZX_DCAPS_NO_64BIT },
        /* Creative X-Fi (CA0110-IBG) */
        /* CTHDA chips */
        { PCI_DEVICE(0x1102, 0x0010),
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index cdd43eadbc67..1eeba7386666 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -545,6 +545,7 @@ static int ad198x_build_pcms(struct hda_codec *codec)
        if (spec->multiout.dig_out_nid) {
                info++;
                codec->num_pcms++;
+                codec->spdif_status_reset = 1;
                info->name = "AD198x Digital";
                info->pcm_type = HDA_PCM_TYPE_SPDIF;
                info->stream[SNDRV_PCM_STREAM_PLAYBACK] = ad198x_pcm_digital_playback;
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 61a71131711c..d5f3a26d608d 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -101,8 +101,8 @@ enum {
 #define CS420X_VENDOR_NID       0x11
 #define CS_DIG_OUT1_PIN_NID     0x10
 #define CS_DIG_OUT2_PIN_NID     0x15
-#define CS_DMIC1_PIN_NID        0x12
+#define CS_DMIC1_PIN_NID        0x0e
-#define CS_DMIC2_PIN_NID        0x0e
+#define CS_DMIC2_PIN_NID        0x12
 /* coef indices */
 #define IDX_SPDIF_STAT          0x0000
@@ -1079,14 +1079,18 @@ static void init_input(struct hda_codec *codec)
                        cs_automic(codec, NULL);
                coef = 0x000a; /* ADC1/2 - Digital and Analog Soft Ramp */
+                cs_vendor_coef_set(codec, IDX_ADC_CFG, coef);
+                coef = cs_vendor_coef_get(codec, IDX_BEEP_CFG);
                if (is_active_pin(codec, CS_DMIC2_PIN_NID))
-                        coef |= 0x0500; /* DMIC2 2 chan on, GPIO1 off */
+                        coef |= 1 << 4; /* DMIC2 2 chan on, GPIO1 off */
                if (is_active_pin(codec, CS_DMIC1_PIN_NID))
-                        coef |= 0x1800; /* DMIC1 2 chan on, GPIO0 off
+                        coef |= 1 << 3; /* DMIC1 2 chan on, GPIO0 off
                                         * No effect if SPDIF_OUT2 is
                                         * selected in IDX_SPDIF_CTL.
                                        */
-                cs_vendor_coef_set(codec, IDX_ADC_CFG, coef);
+                cs_vendor_coef_set(codec, IDX_BEEP_CFG, coef);
        } else {
                if (spec->mic_detect)
                        cs_automic(codec, NULL);
@@ -1107,7 +1111,7 @@ static const struct hda_verb cs_coef_init_verbs[] = {
          | 0x0400 /* Disable Coefficient Auto increment */
          )},
        /* Beep */
-        {0x11, AC_VERB_SET_COEF_INDEX, IDX_DAC_CFG},
+        {0x11, AC_VERB_SET_COEF_INDEX, IDX_BEEP_CFG},
        {0x11, AC_VERB_SET_PROC_COEF, 0x0007}, /* Enable Beep thru DAC1/2/3 */
        {} /* terminator */
@@ -1728,8 +1732,7 @@ static int cs421x_mux_enum_put(struct snd_kcontrol *kcontrol,
 }
-static struct snd_kcontrol_new cs421x_capture_source = {
+static const struct snd_kcontrol_new cs421x_capture_source = {
        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
        .name = "Capture Source",
        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
@@ -1946,7 +1949,7 @@ static int cs421x_suspend(struct hda_codec *codec)
 }
 #endif
-static struct hda_codec_ops cs421x_patch_ops = {
+static const struct hda_codec_ops cs421x_patch_ops = {
        .build_controls = cs421x_build_controls,
        .build_pcms = cs_build_pcms,
        .init = cs421x_init,
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f7397ad02a0d..c0ce3b1f04b4 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5840,7 +5840,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
        return alc_parse_auto_config(codec, alc269_ignore, ssids);
 }
-static void alc269_toggle_power_output(struct hda_codec *codec, int power_up)
+static void alc269vb_toggle_power_output(struct hda_codec *codec, int power_up)
 {
        int val = alc_read_coef_idx(codec, 0x04);
        if (power_up)
@@ -5857,10 +5857,10 @@ static void alc269_shutup(struct hda_codec *codec)
        if (spec->codec_variant != ALC269_TYPE_ALC269VB)
                return;
-        if ((alc_get_coef0(codec) & 0x00ff) == 0x017)
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB)
-                alc269_toggle_power_output(codec, 0);
+                alc269vb_toggle_power_output(codec, 0);
-        if ((alc_get_coef0(codec) & 0x00ff) == 0x018) {
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB &&
-                alc269_toggle_power_output(codec, 0);
+                        (alc_get_coef0(codec) & 0x00ff) == 0x018) {
                msleep(150);
        }
 }
@@ -5870,24 +5870,22 @@ static int alc269_resume(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        if (spec->codec_variant == ALC269_TYPE_ALC269VB ||
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB)
+                alc269vb_toggle_power_output(codec, 0);
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB &&
                        (alc_get_coef0(codec) & 0x00ff) == 0x018) {
-                alc269_toggle_power_output(codec, 0);
                msleep(150);
        }
        codec->patch_ops.init(codec);
-        if (spec->codec_variant == ALC269_TYPE_ALC269VB ||
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB)
+                alc269vb_toggle_power_output(codec, 1);
+        if (spec->codec_variant == ALC269_TYPE_ALC269VB &&
                        (alc_get_coef0(codec) & 0x00ff) == 0x017) {
-                alc269_toggle_power_output(codec, 1);
                msleep(200);
        }
-        if (spec->codec_variant == ALC269_TYPE_ALC269VB ||
-                        (alc_get_coef0(codec) & 0x00ff) == 0x018)
-                alc269_toggle_power_output(codec, 1);
        snd_hda_codec_resume_amp(codec);
        snd_hda_codec_resume_cache(codec);
        hda_call_check_power_status(codec, 0x01);
@@ -7079,6 +7077,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
          .patch = patch_alc662 },
        { .id = 0x10ec0663, .name = "ALC663", .patch = patch_alc662 },
        { .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
+        { .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
        { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
        { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
        { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
@@ -7096,6 +7095,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
        { .id = 0x10ec0889, .name = "ALC889", .patch = patch_alc882 },
        { .id = 0x10ec0892, .name = "ALC892", .patch = patch_alc662 },
        { .id = 0x10ec0899, .name = "ALC898", .patch = patch_alc882 },
+        { .id = 0x10ec0900, .name = "ALC1150", .patch = patch_alc882 },
        {} /* terminator */
 };
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 770013ff556f..9ba8af056170 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1763,6 +1763,8 @@ static const struct snd_pci_quirk stac92hd83xxx_cfg_tbl[] = {
                          "HP", STAC_HP_ZEPHYR),
        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3660,
                          "HP Mini", STAC_92HD83XXX_HP_LED),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x144E,
+                          "HP Pavilion dv5", STAC_92HD83XXX_HP_INV_LED),
        {} /* terminator */
 };
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 72a2f60b087c..019e1a00414a 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -1809,11 +1809,11 @@ static int via_auto_fill_dac_nids(struct hda_codec *codec)
 {
        struct via_spec *spec = codec->spec;
        const struct auto_pin_cfg *cfg = &spec->autocfg;
-        int i, dac_num;
+        int i;
        hda_nid_t nid;
+        spec->multiout.num_dacs = 0;
        spec->multiout.dac_nids = spec->private_dac_nids;
-        dac_num = 0;
        for (i = 0; i < cfg->line_outs; i++) {
                hda_nid_t dac = 0;
                nid = cfg->line_out_pins[i];
@@ -1824,16 +1824,13 @@ static int via_auto_fill_dac_nids(struct hda_codec *codec)
                if (!i && parse_output_path(codec, nid, dac, 1,
                                            &spec->out_mix_path))
                        dac = spec->out_mix_path.path[0];
-                if (dac) {
+                if (dac)
-                        spec->private_dac_nids[i] = dac;
+                        spec->private_dac_nids[spec->multiout.num_dacs++] = dac;
-                        dac_num++;
-                }
        }
        if (!spec->out_path[0].depth && spec->out_mix_path.depth) {
                spec->out_path[0] = spec->out_mix_path;
                spec->out_mix_path.depth = 0;
        }
-        spec->multiout.num_dacs = dac_num;
        return 0;
 }
@@ -3628,6 +3625,7 @@ static void set_widgets_power_state_vt2002P(struct hda_codec *codec)
 */
 enum {
        VIA_FIXUP_INTMIC_BOOST,
+        VIA_FIXUP_ASUS_G75,
 };
 static void via_fixup_intmic_boost(struct hda_codec *codec,
@@ -3642,13 +3640,35 @@ static const struct hda_fixup via_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = via_fixup_intmic_boost,
        },
+        [VIA_FIXUP_ASUS_G75] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        /* set 0x24 and 0x33 as speakers */
+                        { 0x24, 0x991301f0 },
+                        { 0x33, 0x991301f1 }, /* subwoofer */
+                        { }
+                }
+        },
 };
 static const struct snd_pci_quirk vt2002p_fixups[] = {
+        SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
        SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
        {}
 };
+/* NIDs 0x24 and 0x33 on VT1802 have connections to non-existing NID 0x3e
+ * Replace this with mixer NID 0x1c
+ */
+static void fix_vt1802_connections(struct hda_codec *codec)
+{
+        static hda_nid_t conn_24[] = { 0x14, 0x1c };
+        static hda_nid_t conn_33[] = { 0x1c };
+        snd_hda_override_conn_list(codec, 0x24, ARRAY_SIZE(conn_24), conn_24);
+        snd_hda_override_conn_list(codec, 0x33, ARRAY_SIZE(conn_33), conn_33);
+}
 /* patch for vt2002P */
 static int patch_vt2002P(struct hda_codec *codec)
 {
@@ -3663,6 +3683,8 @@ static int patch_vt2002P(struct hda_codec *codec)
        spec->aa_mix_nid = 0x21;
        override_mic_boost(codec, 0x2b, 0, 3, 40);
        override_mic_boost(codec, 0x29, 0, 3, 40);
+        if (spec->codec_type == VT1802)
+                fix_vt1802_connections(codec);
        add_secret_dac_path(codec);
        snd_hda_pick_fixup(codec, NULL, vt2002p_fixups, via_fixups);
diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c
index 3050a5279253..245d874891ba 100644
--- a/sound/pci/ice1712/ice1724.c
+++ b/sound/pci/ice1712/ice1724.c
@@ -2859,7 +2859,12 @@ static int snd_vt1724_resume(struct device *dev)
                ice->set_spdif_clock(ice, 0);
        } else {
                /* internal on-card clock */
-                snd_vt1724_set_pro_rate(ice, ice->pro_rate_default, 1);
+                int rate;
+                if (ice->cur_rate)
+                        rate = ice->cur_rate;
+                else
+                        rate = ice->pro_rate_default;
+                snd_vt1724_set_pro_rate(ice, rate, 1);
        }
        update_spdif_bits(ice, ice->pm_saved_spdif_ctrl);
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index f1cd1e387801..748e36c66603 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -3979,7 +3979,8 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                case 8: /* SYNC IN */
                        val = hdspm_sync_in_sync_check(hdspm); break;
                default:
-                        val = hdspm_s1_sync_check(hdspm, ucontrol->id.index-1);
+                        val = hdspm_s1_sync_check(hdspm,
+                                        kcontrol->private_value-1);
                }
                break;
@@ -4899,7 +4900,7 @@ snd_hdspm_proc_read_madi(struct snd_info_entry * entry,
                insel = "Coaxial";
                break;
        default:
-                insel = "Unkown";
+                insel = "Unknown";
        }
        snd_iprintf(buffer,
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index 61599298fb26..4d8db3685e96 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -763,7 +763,7 @@ static int cs42l52_set_sysclk(struct snd_soc_dai *codec_dai,
        if ((freq >= CS42L52_MIN_CLK) && (freq <= CS42L52_MAX_CLK)) {
                cs42l52->sysclk = freq;
        } else {
-                dev_err(codec->dev, "Invalid freq paramter\n");
+                dev_err(codec->dev, "Invalid freq parameter\n");
                return -EINVAL;
        }
        return 0;
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 3fddc7ad1127..b2b2b37131bd 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3722,7 +3722,7 @@ static irqreturn_t wm8958_mic_irq(int irq, void *data)
        } while (count--);
        if (count == 0)
-                dev_warn(codec->dev, "No impedence range reported for jack\n");
+                dev_warn(codec->dev, "No impedance range reported for jack\n");
 #ifndef CONFIG_SND_SOC_WM8994_MODULE
        trace_snd_soc_jack_irq(dev_name(codec->dev));
diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c
index 68f2cd1a9206..5a6aeaf552a8 100644
--- a/sound/soc/omap/omap-dmic.c
+++ b/sound/soc/omap/omap-dmic.c
@@ -464,9 +464,9 @@ static __devinit int asoc_dmic_probe(struct platform_device *pdev)
        mutex_init(&dmic->mutex);
-        dmic->fclk = clk_get(dmic->dev, "dmic_fck");
+        dmic->fclk = clk_get(dmic->dev, "fck");
        if (IS_ERR(dmic->fclk)) {
-                dev_err(dmic->dev, "cant get dmic_fck\n");
+                dev_err(dmic->dev, "cant get fck\n");
                return -ENODEV;
        }
diff --git a/sound/soc/omap/zoom2.c b/sound/soc/omap/zoom2.c
index 677b567935f8..1ff6bb9ade5c 100644
--- a/sound/soc/omap/zoom2.c
+++ b/sound/soc/omap/zoom2.c
@@ -21,15 +21,14 @@
 #include <linux/clk.h>
 #include <linux/platform_device.h>
+#include <linux/gpio.h>
 #include <sound/core.h>
 #include <sound/pcm.h>
 #include <sound/soc.h>
 #include <asm/mach-types.h>
-#include <mach/hardware.h>
-#include <mach/gpio.h>
-#include <mach/board-zoom.h>
 #include <linux/platform_data/asoc-ti-mcbsp.h>
+#include <linux/platform_data/gpio-omap.h>
 /* Register descriptions for twl4030 codec part */
 #include <linux/mfd/twl4030-audio.h>
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 561bb74fd364..282f0fc9fed1 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -339,7 +339,7 @@ static int snd_usb_audio_create(struct usb_device *dev, int idx,
        }
        mutex_init(&chip->mutex);
-        mutex_init(&chip->shutdown_mutex);
+        init_rwsem(&chip->shutdown_rwsem);
        chip->index = idx;
        chip->dev = dev;
        chip->card = card;
@@ -560,7 +560,7 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
        card = chip->card;
        mutex_lock(&register_mutex);
-        mutex_lock(&chip->shutdown_mutex);
+        down_write(&chip->shutdown_rwsem);
        chip->shutdown = 1;
        chip->num_interfaces--;
        if (chip->num_interfaces <= 0) {
@@ -582,11 +582,11 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
                        snd_usb_mixer_disconnect(p);
                }
                usb_chip[chip->index] = NULL;
-                mutex_unlock(&chip->shutdown_mutex);
+                up_write(&chip->shutdown_rwsem);
                mutex_unlock(&register_mutex);
                snd_card_free_when_closed(card);
        } else {
-                mutex_unlock(&chip->shutdown_mutex);
+                up_write(&chip->shutdown_rwsem);
                mutex_unlock(&register_mutex);
        }
 }
@@ -618,16 +618,20 @@ int snd_usb_autoresume(struct snd_usb_audio *chip)
 {
        int err = -ENODEV;
+        down_read(&chip->shutdown_rwsem);
        if (!chip->shutdown && !chip->probing)
                err = usb_autopm_get_interface(chip->pm_intf);
+        up_read(&chip->shutdown_rwsem);
        return err;
 }
 void snd_usb_autosuspend(struct snd_usb_audio *chip)
 {
+        down_read(&chip->shutdown_rwsem);
        if (!chip->shutdown && !chip->probing)
                usb_autopm_put_interface(chip->pm_intf);
+        up_read(&chip->shutdown_rwsem);
 }
 static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
diff --git a/sound/usb/card.h b/sound/usb/card.h
index afa4f9e9b27a..814cb357ff88 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -126,6 +126,7 @@ struct snd_usb_substream {
        struct snd_usb_endpoint *sync_endpoint;
        unsigned long flags;
        bool need_setup_ep;             /* (re)configure EP at prepare? */
+        unsigned int speed;             /* USB_SPEED_XXX */
        u64 formats;                    /* format bitmasks (all or'ed) */
        unsigned int num_formats;               /* number of supported audio formats (list) */
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 7f78c6d782b0..34de6f2faf61 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -35,6 +35,7 @@
 #define EP_FLAG_ACTIVATED       0
 #define EP_FLAG_RUNNING         1
+#define EP_FLAG_STOPPING        2
 /*
 * snd_usb_endpoint is a model that abstracts everything related to an
@@ -502,10 +503,20 @@ static int wait_clear_urbs(struct snd_usb_endpoint *ep)
        if (alive)
                snd_printk(KERN_ERR "timeout: still %d active urbs on EP #%x\n",
                                        alive, ep->ep_num);
+        clear_bit(EP_FLAG_STOPPING, &ep->flags);
        return 0;
 }
+/* sync the pending stop operation;
+ * this function itself doesn't trigger the stop operation
+ */
+void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep)
+{
+        if (ep && test_bit(EP_FLAG_STOPPING, &ep->flags))
+                wait_clear_urbs(ep);
+}
 /*
 * unlink active urbs.
 */
@@ -918,6 +929,8 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
                if (wait)
                        wait_clear_urbs(ep);
+                else
+                        set_bit(EP_FLAG_STOPPING, &ep->flags);
        }
 }
diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
index 6376ccf10fd4..3d4c9705041f 100644
--- a/sound/usb/endpoint.h
+++ b/sound/usb/endpoint.h
@@ -19,6 +19,7 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
 int  snd_usb_endpoint_start(struct snd_usb_endpoint *ep, int can_sleep);
 void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
                           int force, int can_sleep, int wait);
+void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
 int  snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
 int  snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_free(struct list_head *head);
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index fe56c9da38e9..298070e8f2d4 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -287,25 +287,32 @@ static int get_ctl_value_v1(struct usb_mixer_elem_info *cval, int request, int v
        unsigned char buf[2];
        int val_len = cval->val_type >= USB_MIXER_S16 ? 2 : 1;
        int timeout = 10;
-        int err;
+        int idx = 0, err;
        err = snd_usb_autoresume(cval->mixer->chip);
        if (err < 0)
                return -EIO;
+        down_read(&chip->shutdown_rwsem);
        while (timeout-- > 0) {
+                if (chip->shutdown)
+                        break;
+                idx = snd_usb_ctrl_intf(chip) | (cval->id << 8);
                if (snd_usb_ctl_msg(chip->dev, usb_rcvctrlpipe(chip->dev, 0), request,
                                    USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
-                                    validx, snd_usb_ctrl_intf(chip) | (cval->id << 8),
+                                    validx, idx, buf, val_len) >= val_len) {
-                                    buf, val_len) >= val_len) {
                        *value_ret = convert_signed_value(cval, snd_usb_combine_bytes(buf, val_len));
-                        snd_usb_autosuspend(cval->mixer->chip);
+                        err = 0;
-                        return 0;
+                        goto out;
                }
        }
-        snd_usb_autosuspend(cval->mixer->chip);
        snd_printdd(KERN_ERR "cannot get ctl value: req = %#x, wValue = %#x, wIndex = %#x, type = %d\n",
-                    request, validx, snd_usb_ctrl_intf(chip) | (cval->id << 8), cval->val_type);
+                    request, validx, idx, cval->val_type);
-        return -EINVAL;
+        err = -EINVAL;
+ out:
+        up_read(&chip->shutdown_rwsem);
+        snd_usb_autosuspend(cval->mixer->chip);
+        return err;
 }
 static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request, int validx, int *value_ret)
@@ -313,7 +320,7 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request, int v
        struct snd_usb_audio *chip = cval->mixer->chip;
        unsigned char buf[2 + 3*sizeof(__u16)]; /* enough space for one range */
        unsigned char *val;
-        int ret, size;
+        int idx = 0, ret, size;
        __u8 bRequest;
        if (request == UAC_GET_CUR) {
@@ -330,16 +337,22 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request, int v
        if (ret)
                goto error;
-        ret = snd_usb_ctl_msg(chip->dev, usb_rcvctrlpipe(chip->dev, 0), bRequest,
+        down_read(&chip->shutdown_rwsem);
+        if (chip->shutdown)
+                ret = -ENODEV;
+        else {
+                idx = snd_usb_ctrl_intf(chip) | (cval->id << 8);
+                ret = snd_usb_ctl_msg(chip->dev, usb_rcvctrlpipe(chip->dev, 0), bRequest,
                              USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
-                              validx, snd_usb_ctrl_intf(chip) | (cval->id << 8),
+                              validx, idx, buf, size);
-                              buf, size);
+        }
+        up_read(&chip->shutdown_rwsem);
        snd_usb_autosuspend(chip);
        if (ret < 0) {
 error:
                snd_printk(KERN_ERR "cannot get ctl value: req = %#x, wValue = %#x, wIndex = %#x, type = %d\n",
-                           request, validx, snd_usb_ctrl_intf(chip) | (cval->id << 8), cval->val_type);
+                           request, validx, idx, cval->val_type);
                return ret;
        }
@@ -417,7 +430,7 @@ int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
 {
        struct snd_usb_audio *chip = cval->mixer->chip;
        unsigned char buf[2];
-        int val_len, err, timeout = 10;
+        int idx = 0, val_len, err, timeout = 10;
        if (cval->mixer->protocol == UAC_VERSION_1) {
                val_len = cval->val_type >= USB_MIXER_S16 ? 2 : 1;
@@ -440,19 +453,27 @@ int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
        err = snd_usb_autoresume(chip);
        if (err < 0)
                return -EIO;
-        while (timeout-- > 0)
+        down_read(&chip->shutdown_rwsem);
+        while (timeout-- > 0) {
+                if (chip->shutdown)
+                        break;
+                idx = snd_usb_ctrl_intf(chip) | (cval->id << 8);
                if (snd_usb_ctl_msg(chip->dev,
                                    usb_sndctrlpipe(chip->dev, 0), request,
                                    USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_OUT,
-                                    validx, snd_usb_ctrl_intf(chip) | (cval->id << 8),
+                                    validx, idx, buf, val_len) >= 0) {
-                                    buf, val_len) >= 0) {
+                        err = 0;
-                        snd_usb_autosuspend(chip);
+                        goto out;
-                        return 0;
                }
-        snd_usb_autosuspend(chip);
+        }
        snd_printdd(KERN_ERR "cannot set ctl value: req = %#x, wValue = %#x, wIndex = %#x, type = %d, data = %#x/%#x\n",
-                    request, validx, snd_usb_ctrl_intf(chip) | (cval->id << 8), cval->val_type, buf[0], buf[1]);
+                    request, validx, idx, cval->val_type, buf[0], buf[1]);
-        return -EINVAL;
+        err = -EINVAL;
+ out:
+        up_read(&chip->shutdown_rwsem);
+        snd_usb_autosuspend(chip);
+        return err;
 }
 static int set_cur_ctl_value(struct usb_mixer_elem_info *cval, int validx, int value)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 690000db0ec0..ae2b71435220 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -283,6 +283,11 @@ static int snd_audigy2nx_led_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e
        if (value > 1)
                return -EINVAL;
        changed = value != mixer->audigy2nx_leds[index];
+        down_read(&mixer->chip->shutdown_rwsem);
+        if (mixer->chip->shutdown) {
+                err = -ENODEV;
+                goto out;
+        }
        if (mixer->chip->usb_id == USB_ID(0x041e, 0x3042))
                err = snd_usb_ctl_msg(mixer->chip->dev,
                              usb_sndctrlpipe(mixer->chip->dev, 0), 0x24,
@@ -299,6 +304,8 @@ static int snd_audigy2nx_led_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e
                              usb_sndctrlpipe(mixer->chip->dev, 0), 0x24,
                              USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
                              value, index + 2, NULL, 0);
+ out:
+        up_read(&mixer->chip->shutdown_rwsem);
        if (err < 0)
                return err;
        mixer->audigy2nx_leds[index] = value;
@@ -392,11 +399,16 @@ static void snd_audigy2nx_proc_read(struct snd_info_entry *entry,
        for (i = 0; jacks[i].name; ++i) {
                snd_iprintf(buffer, "%s: ", jacks[i].name);
-                err = snd_usb_ctl_msg(mixer->chip->dev,
+                down_read(&mixer->chip->shutdown_rwsem);
+                if (mixer->chip->shutdown)
+                        err = 0;
+                else
+                        err = snd_usb_ctl_msg(mixer->chip->dev,
                                      usb_rcvctrlpipe(mixer->chip->dev, 0),
                                      UAC_GET_MEM, USB_DIR_IN | USB_TYPE_CLASS |
                                      USB_RECIP_INTERFACE, 0,
                                      jacks[i].unitid << 8, buf, 3);
+                up_read(&mixer->chip->shutdown_rwsem);
                if (err == 3 && (buf[0] == 3 || buf[0] == 6))
                        snd_iprintf(buffer, "%02x %02x\n", buf[1], buf[2]);
                else
@@ -426,10 +438,15 @@ static int snd_xonar_u1_switch_put(struct snd_kcontrol *kcontrol,
        else
                new_status = old_status & ~0x02;
        changed = new_status != old_status;
-        err = snd_usb_ctl_msg(mixer->chip->dev,
+        down_read(&mixer->chip->shutdown_rwsem);
+        if (mixer->chip->shutdown)
+                err = -ENODEV;
+        else
+                err = snd_usb_ctl_msg(mixer->chip->dev,
                              usb_sndctrlpipe(mixer->chip->dev, 0), 0x08,
                              USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
                              50, 0, &new_status, 1);
+        up_read(&mixer->chip->shutdown_rwsem);
        if (err < 0)
                return err;
        mixer->xonar_u1_status = new_status;
@@ -468,11 +485,17 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
        u8 bRequest = (kcontrol->private_value >> 16) & 0xff;
        u16 wIndex = kcontrol->private_value & 0xffff;
        u8 tmp;
+        int ret;
-        int ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
+        down_read(&mixer->chip->shutdown_rwsem);
+        if (mixer->chip->shutdown)
+                ret = -ENODEV;
+        else
+                ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
                                  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
                                  0, cpu_to_le16(wIndex),
                                  &tmp, sizeof(tmp), 1000);
+        up_read(&mixer->chip->shutdown_rwsem);
        if (ret < 0) {
                snd_printk(KERN_ERR
@@ -493,11 +516,17 @@ static int snd_nativeinstruments_control_put(struct snd_kcontrol *kcontrol,
        u8 bRequest = (kcontrol->private_value >> 16) & 0xff;
        u16 wIndex = kcontrol->private_value & 0xffff;
        u16 wValue = ucontrol->value.integer.value[0];
+        int ret;
-        int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
+        down_read(&mixer->chip->shutdown_rwsem);
+        if (mixer->chip->shutdown)
+                ret = -ENODEV;
+        else
+                ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
                                  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
                                  cpu_to_le16(wValue), cpu_to_le16(wIndex),
                                  NULL, 0, 1000);
+        up_read(&mixer->chip->shutdown_rwsem);
        if (ret < 0) {
                snd_printk(KERN_ERR
@@ -656,11 +685,16 @@ static int snd_ftu_eff_switch_get(struct snd_kcontrol *kctl,
                return -EINVAL;
-        err = snd_usb_ctl_msg(chip->dev,
+        down_read(&mixer->chip->shutdown_rwsem);
+        if (mixer->chip->shutdown)
+                err = -ENODEV;
+        else
+                err = snd_usb_ctl_msg(chip->dev,
                        usb_rcvctrlpipe(chip->dev, 0), UAC_GET_CUR,
                        USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
                        validx << 8, snd_usb_ctrl_intf(chip) | (id << 8),
                        value, val_len);
+        up_read(&mixer->chip->shutdown_rwsem);
        if (err < 0)
                return err;
@@ -703,11 +737,16 @@ static int snd_ftu_eff_switch_put(struct snd_kcontrol *kctl,
        if (!pval->is_cached) {
                /* Read current value */
-                err = snd_usb_ctl_msg(chip->dev,
+                down_read(&mixer->chip->shutdown_rwsem);
+                if (mixer->chip->shutdown)
+                        err = -ENODEV;
+                else
+                        err = snd_usb_ctl_msg(chip->dev,
                                usb_rcvctrlpipe(chip->dev, 0), UAC_GET_CUR,
                                USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
                                validx << 8, snd_usb_ctrl_intf(chip) | (id << 8),
                                value, val_len);
+                up_read(&mixer->chip->shutdown_rwsem);
                if (err < 0)
                        return err;
@@ -719,11 +758,16 @@ static int snd_ftu_eff_switch_put(struct snd_kcontrol *kctl,
        if (cur_val != new_val) {
                value[0] = new_val;
                value[1] = 0;
-                err = snd_usb_ctl_msg(chip->dev,
+                down_read(&mixer->chip->shutdown_rwsem);
+                if (mixer->chip->shutdown)
+                        err = -ENODEV;
+                else
+                        err = snd_usb_ctl_msg(chip->dev,
                                usb_sndctrlpipe(chip->dev, 0), UAC_SET_CUR,
                                USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_OUT,
                                validx << 8, snd_usb_ctrl_intf(chip) | (id << 8),
                                value, val_len);
+                up_read(&mixer->chip->shutdown_rwsem);
                if (err < 0)
                        return err;
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 55e19e1b80ec..5c12a3fe8c3e 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -71,6 +71,8 @@ static snd_pcm_uframes_t snd_usb_pcm_pointer(struct snd_pcm_substream *substream
        unsigned int hwptr_done;
        subs = (struct snd_usb_substream *)substream->runtime->private_data;
+        if (subs->stream->chip->shutdown)
+                return SNDRV_PCM_POS_XRUN;
        spin_lock(&subs->lock);
        hwptr_done = subs->hwptr_done;
        substream->runtime->delay = snd_usb_pcm_delay(subs,
@@ -444,7 +446,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
 {
        int ret;
-        mutex_lock(&subs->stream->chip->shutdown_mutex);
        /* format changed */
        stop_endpoints(subs, 0, 0, 0);
        ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -455,7 +456,7 @@ static int configure_endpoint(struct snd_usb_substream *subs)
                                          subs->cur_audiofmt,
                                          subs->sync_endpoint);
        if (ret < 0)
-                goto unlock;
+                return ret;
        if (subs->sync_endpoint)
                ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -465,9 +466,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
                                                  subs->cur_rate,
                                                  subs->cur_audiofmt,
                                                  NULL);
-unlock:
-        mutex_unlock(&subs->stream->chip->shutdown_mutex);
        return ret;
 }
@@ -505,7 +503,13 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
                return -EINVAL;
        }
-        if ((ret = set_format(subs, fmt)) < 0)
+        down_read(&subs->stream->chip->shutdown_rwsem);
+        if (subs->stream->chip->shutdown)
+                ret = -ENODEV;
+        else
+                ret = set_format(subs, fmt);
+        up_read(&subs->stream->chip->shutdown_rwsem);
+        if (ret < 0)
                return ret;
        subs->interface = fmt->iface;
@@ -527,10 +531,12 @@ static int snd_usb_hw_free(struct snd_pcm_substream *substream)
        subs->cur_audiofmt = NULL;
        subs->cur_rate = 0;
        subs->period_bytes = 0;
-        mutex_lock(&subs->stream->chip->shutdown_mutex);
+        down_read(&subs->stream->chip->shutdown_rwsem);
-        stop_endpoints(subs, 0, 1, 1);
+        if (!subs->stream->chip->shutdown) {
-        deactivate_endpoints(subs);
+                stop_endpoints(subs, 0, 1, 1);
-        mutex_unlock(&subs->stream->chip->shutdown_mutex);
+                deactivate_endpoints(subs);
+        }
+        up_read(&subs->stream->chip->shutdown_rwsem);
        return snd_pcm_lib_free_vmalloc_buffer(substream);
 }
@@ -552,12 +558,22 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
                return -ENXIO;
        }
-        if (snd_BUG_ON(!subs->data_endpoint))
+        down_read(&subs->stream->chip->shutdown_rwsem);
-                return -EIO;
+        if (subs->stream->chip->shutdown) {
+                ret = -ENODEV;
+                goto unlock;
+        }
+        if (snd_BUG_ON(!subs->data_endpoint)) {
+                ret = -EIO;
+                goto unlock;
+        }
+        snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint);
+        snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);
        ret = set_format(subs, subs->cur_audiofmt);
        if (ret < 0)
-                return ret;
+                goto unlock;
        iface = usb_ifnum_to_if(subs->dev, subs->cur_audiofmt->iface);
        alts = &iface->altsetting[subs->cur_audiofmt->altset_idx];
@@ -567,12 +583,12 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
                                       subs->cur_audiofmt,
                                       subs->cur_rate);
        if (ret < 0)
-                return ret;
+                goto unlock;
        if (subs->need_setup_ep) {
                ret = configure_endpoint(subs);
                if (ret < 0)
-                        return ret;
+                        goto unlock;
                subs->need_setup_ep = false;
        }
@@ -592,9 +608,11 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
        /* for playback, submit the URBs now; otherwise, the first hwptr_done
         * updates for all URBs would happen at the same time when starting */
        if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
-                return start_endpoints(subs, 1);
+                ret = start_endpoints(subs, 1);
-        return 0;
+ unlock:
+        up_read(&subs->stream->chip->shutdown_rwsem);
+        return ret;
 }
 static struct snd_pcm_hardware snd_usb_hardware =
@@ -647,7 +665,7 @@ static int hw_check_valid_format(struct snd_usb_substream *subs,
                return 0;
        }
        /* check whether the period time is >= the data packet interval */
-        if (snd_usb_get_speed(subs->dev) != USB_SPEED_FULL) {
+        if (subs->speed != USB_SPEED_FULL) {
                ptime = 125 * (1 << fp->datainterval);
                if (ptime > pt->max || (ptime == pt->max && pt->openmax)) {
                        hwc_debug("   > check: ptime %u > max %u\n", ptime, pt->max);
@@ -925,7 +943,7 @@ static int setup_hw_info(struct snd_pcm_runtime *runtime, struct snd_usb_substre
                return err;
        param_period_time_if_needed = SNDRV_PCM_HW_PARAM_PERIOD_TIME;
-        if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL)
+        if (subs->speed == USB_SPEED_FULL)
                /* full speed devices have fixed data packet interval */
                ptmin = 1000;
        if (ptmin == 1000)
diff --git a/sound/usb/proc.c b/sound/usb/proc.c
index ebc1a5b5b3f1..d218f763501f 100644
--- a/sound/usb/proc.c
+++ b/sound/usb/proc.c
@@ -108,7 +108,7 @@ static void proc_dump_substream_formats(struct snd_usb_substream *subs, struct s
                        }
                        snd_iprintf(buffer, "\n");
                }
-                if (snd_usb_get_speed(subs->dev) != USB_SPEED_FULL)
+                if (subs->speed != USB_SPEED_FULL)
                        snd_iprintf(buffer, "    Data packet interval: %d us\n",
                                    125 * (1 << fp->datainterval));
                // snd_iprintf(buffer, "    Max Packet Size = %d\n", fp->maxpacksize);
@@ -124,7 +124,7 @@ static void proc_dump_ep_status(struct snd_usb_substream *subs,
                return;
        snd_iprintf(buffer, "    Packet Size = %d\n", ep->curpacksize);
        snd_iprintf(buffer, "    Momentary freq = %u Hz (%#x.%04x)\n",
-                    snd_usb_get_speed(subs->dev) == USB_SPEED_FULL
+                    subs->speed == USB_SPEED_FULL
                    ? get_full_speed_hz(ep->freqm)
                    : get_high_speed_hz(ep->freqm),
                    ep->freqm >> 16, ep->freqm & 0xffff);
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 083ed81160e5..1de0c8c002a8 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -90,6 +90,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as,
        subs->direction = stream;
        subs->dev = as->chip->dev;
        subs->txfr_quirk = as->chip->txfr_quirk;
+        subs->speed = snd_usb_get_speed(subs->dev);
        snd_usb_set_pcm_ops(as->pcm, stream);
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
index b8233ebe250f..ef42797f56fb 100644
--- a/sound/usb/usbaudio.h
+++ b/sound/usb/usbaudio.h
@@ -37,7 +37,7 @@ struct snd_usb_audio {
        struct usb_interface *pm_intf;
        u32 usb_id;
        struct mutex mutex;
-        struct mutex shutdown_mutex;
+        struct rw_semaphore shutdown_rwsem;
        unsigned int shutdown:1;
        unsigned int probing:1;
        unsigned int autosuspended:1;   
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index b51d787176d3..c7ba7614061b 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -1740,8 +1740,10 @@ sub install {
    open(IN, "$output_config") or dodie("Can't read config file");
    while (<IN>) {
        if (/CONFIG_MODULES(=y)?/) {
-            $install_mods = 1 if (defined($1));
+            if (defined($1)) {
-            last;
+                $install_mods = 1;
+                last;
+            }
        }
    }
    close(IN);
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 43480149119e..85baf11e2acd 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -1,4 +1,4 @@
-TARGETS = breakpoints kcmp mqueue vm cpu-hotplug memory-hotplug epoll
+TARGETS = breakpoints kcmp mqueue vm cpu-hotplug memory-hotplug
 all:
        for TARGET in $(TARGETS); do \
diff --git a/tools/testing/selftests/epoll/Makefile b/tools/testing/selftests/epoll/Makefile
deleted file mode 100644
index 19806ed62f50..000000000000
--- a/tools/testing/selftests/epoll/Makefile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Makefile for epoll selftests
-all: test_epoll
-%: %.c
-        gcc -pthread -g -o $@ $^
-run_tests: all
-        ./test_epoll
-clean:
-        $(RM) test_epoll
diff --git a/tools/testing/selftests/epoll/test_epoll.c b/tools/testing/selftests/epoll/test_epoll.c
deleted file mode 100644
index f7525392ce84..000000000000
--- a/tools/testing/selftests/epoll/test_epoll.c
+++ /dev/null
@@ -1,344 +0,0 @@
-/*
- *  tools/testing/selftests/epoll/test_epoll.c
- *
- *  Copyright 2012 Adobe Systems Incorporated
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  Paton J. Lewis <palewis@adobe.com>
- *
- */
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/epoll.h>
-#include <sys/socket.h>
-/*
- * A pointer to an epoll_item_private structure will be stored in the epoll
- * item's event structure so that we can get access to the epoll_item_private
- * data after calling epoll_wait:
- */
-struct epoll_item_private {
-        int index;  /* Position of this struct within the epoll_items array. */
-        int fd;
-        uint32_t events;
-        pthread_mutex_t mutex;  /* Guards the following variables... */
-        int stop;
-        int status;  /* Stores any error encountered while handling item. */
-        /* The following variable allows us to test whether we have encountered
-           a problem while attempting to cancel and delete the associated
-           event. When the test program exits, 'deleted' should be exactly
-           one. If it is greater than one, then the failed test reflects a real
-           world situation where we would have tried to access the epoll item's
-           private data after deleting it: */
-        int deleted;
-};
-struct epoll_item_private *epoll_items;
-/*
- * Delete the specified item from the epoll set. In a real-world secneario this
- * is where we would free the associated data structure, but in this testing
- * environment we retain the structure so that we can test for double-deletion:
- */
-void delete_item(int index)
-{
-        __sync_fetch_and_add(&epoll_items[index].deleted, 1);
-}
-/*
- * A pointer to a read_thread_data structure will be passed as the argument to
- * each read thread:
- */
-struct read_thread_data {
-        int stop;
-        int status;  /* Indicates any error encountered by the read thread. */
-        int epoll_set;
-};
-/*
- * The function executed by the read threads:
- */
-void *read_thread_function(void *function_data)
-{
-        struct read_thread_data *thread_data =
-                (struct read_thread_data *)function_data;
-        struct epoll_event event_data;
-        struct epoll_item_private *item_data;
-        char socket_data;
-        /* Handle events until we encounter an error or this thread's 'stop'
-           condition is set: */
-        while (1) {
-                int result = epoll_wait(thread_data->epoll_set,
-                                        &event_data,
-                                        1,      /* Number of desired events */
-                                        1000);  /* Timeout in ms */
-                if (result < 0) {
-                        /* Breakpoints signal all threads. Ignore that while
-                           debugging: */
-                        if (errno == EINTR)
-                                continue;
-                        thread_data->status = errno;
-                        return 0;
-                } else if (thread_data->stop)
-                        return 0;
-                else if (result == 0)  /* Timeout */
-                        continue;
-                /* We need the mutex here because checking for the stop
-                   condition and re-enabling the epoll item need to be done
-                   together as one atomic operation when EPOLL_CTL_DISABLE is
-                   available: */
-                item_data = (struct epoll_item_private *)event_data.data.ptr;
-                pthread_mutex_lock(&item_data->mutex);
-                /* Remove the item from the epoll set if we want to stop
-                   handling that event: */
-                if (item_data->stop)
-                        delete_item(item_data->index);
-                else {
-                        /* Clear the data that was written to the other end of
-                           our non-blocking socket: */
-                        do {
-                                if (read(item_data->fd, &socket_data, 1) < 1) {
-                                        if ((errno == EAGAIN) ||
-                                            (errno == EWOULDBLOCK))
-                                                break;
-                                        else
-                                                goto error_unlock;
-                                }
-                        } while (item_data->events & EPOLLET);
-                        /* The item was one-shot, so re-enable it: */
-                        event_data.events = item_data->events;
-                        if (epoll_ctl(thread_data->epoll_set,
-                                                  EPOLL_CTL_MOD,
-                                                  item_data->fd,
-                                                  &event_data) < 0)
-                                goto error_unlock;
-                }
-                pthread_mutex_unlock(&item_data->mutex);
-        }
-error_unlock:
-        thread_data->status = item_data->status = errno;
-        pthread_mutex_unlock(&item_data->mutex);
-        return 0;
-}
-/*
- * A pointer to a write_thread_data structure will be passed as the argument to
- * the write thread:
- */
-struct write_thread_data {
-        int stop;
-        int status;  /* Indicates any error encountered by the write thread. */
-        int n_fds;
-        int *fds;
-};
-/*
- * The function executed by the write thread. It writes a single byte to each
- * socket in turn until the stop condition for this thread is set. If writing to
- * a socket would block (i.e. errno was EAGAIN), we leave that socket alone for
- * the moment and just move on to the next socket in the list. We don't care
- * about the order in which we deliver events to the epoll set. In fact we don't
- * care about the data we're writing to the pipes at all; we just want to
- * trigger epoll events:
- */
-void *write_thread_function(void *function_data)
-{
-        const char data = 'X';
-        int index;
-        struct write_thread_data *thread_data =
-                (struct write_thread_data *)function_data;
-        while (!thread_data->stop)
-                for (index = 0;
-                     !thread_data->stop && (index < thread_data->n_fds);
-                     ++index)
-                        if ((write(thread_data->fds[index], &data, 1) < 1) &&
-                                (errno != EAGAIN) &&
-                                (errno != EWOULDBLOCK)) {
-                                thread_data->status = errno;
-                                return;
-                        }
-}
-/*
- * Arguments are currently ignored:
- */
-int main(int argc, char **argv)
-{
-        const int n_read_threads = 100;
-        const int n_epoll_items = 500;
-        int index;
-        int epoll_set = epoll_create1(0);
-        struct write_thread_data write_thread_data = {
-                0, 0, n_epoll_items, malloc(n_epoll_items * sizeof(int))
-        };
-        struct read_thread_data *read_thread_data =
-                malloc(n_read_threads * sizeof(struct read_thread_data));
-        pthread_t *read_threads = malloc(n_read_threads * sizeof(pthread_t));
-        pthread_t write_thread;
-        printf("-----------------\n");
-        printf("Runing test_epoll\n");
-        printf("-----------------\n");
-        epoll_items = malloc(n_epoll_items * sizeof(struct epoll_item_private));
-        if (epoll_set < 0 || epoll_items == 0 || write_thread_data.fds == 0 ||
-                read_thread_data == 0 || read_threads == 0)
-                goto error;
-        if (sysconf(_SC_NPROCESSORS_ONLN) < 2) {
-                printf("Error: please run this test on a multi-core system.\n");
-                goto error;
-        }
-        /* Create the socket pairs and epoll items: */
-        for (index = 0; index < n_epoll_items; ++index) {
-                int socket_pair[2];
-                struct epoll_event event_data;
-                if (socketpair(AF_UNIX,
-                               SOCK_STREAM | SOCK_NONBLOCK,
-                               0,
-                               socket_pair) < 0)
-                        goto error;
-                write_thread_data.fds[index] = socket_pair[0];
-                epoll_items[index].index = index;
-                epoll_items[index].fd = socket_pair[1];
-                if (pthread_mutex_init(&epoll_items[index].mutex, NULL) != 0)
-                        goto error;
-                /* We always use EPOLLONESHOT because this test is currently
-                   structured to demonstrate the need for EPOLL_CTL_DISABLE,
-                   which only produces useful information in the EPOLLONESHOT
-                   case (without EPOLLONESHOT, calling epoll_ctl with
-                   EPOLL_CTL_DISABLE will never return EBUSY). If support for
-                   testing events without EPOLLONESHOT is desired, it should
-                   probably be implemented in a separate unit test. */
-                epoll_items[index].events = EPOLLIN | EPOLLONESHOT;
-                if (index < n_epoll_items / 2)
-                        epoll_items[index].events |= EPOLLET;
-                epoll_items[index].stop = 0;
-                epoll_items[index].status = 0;
-                epoll_items[index].deleted = 0;
-                event_data.events = epoll_items[index].events;
-                event_data.data.ptr = &epoll_items[index];
-                if (epoll_ctl(epoll_set,
-                              EPOLL_CTL_ADD,
-                              epoll_items[index].fd,
-                              &event_data) < 0)
-                        goto error;
-        }
-        /* Create and start the read threads: */
-        for (index = 0; index < n_read_threads; ++index) {
-                read_thread_data[index].stop = 0;
-                read_thread_data[index].status = 0;
-                read_thread_data[index].epoll_set = epoll_set;
-                if (pthread_create(&read_threads[index],
-                                   NULL,
-                                   read_thread_function,
-                                   &read_thread_data[index]) != 0)
-                        goto error;
-        }
-        if (pthread_create(&write_thread,
-                           NULL,
-                           write_thread_function,
-                           &write_thread_data) != 0)
-                goto error;
-        /* Cancel all event pollers: */
-#ifdef EPOLL_CTL_DISABLE
-        for (index = 0; index < n_epoll_items; ++index) {
-                pthread_mutex_lock(&epoll_items[index].mutex);
-                ++epoll_items[index].stop;
-                if (epoll_ctl(epoll_set,
-                              EPOLL_CTL_DISABLE,
-                              epoll_items[index].fd,
-                              NULL) == 0)
-                        delete_item(index);
-                else if (errno != EBUSY) {
-                        pthread_mutex_unlock(&epoll_items[index].mutex);
-                        goto error;
-                }
-                /* EBUSY means events were being handled; allow the other thread
-                   to delete the item. */
-                pthread_mutex_unlock(&epoll_items[index].mutex);
-        }
-#else
-        for (index = 0; index < n_epoll_items; ++index) {
-                pthread_mutex_lock(&epoll_items[index].mutex);
-                ++epoll_items[index].stop;
-                pthread_mutex_unlock(&epoll_items[index].mutex);
-                /* Wait in case a thread running read_thread_function is
-                   currently executing code between epoll_wait and
-                   pthread_mutex_lock with this item. Note that a longer delay
-                   would make double-deletion less likely (at the expense of
-                   performance), but there is no guarantee that any delay would
-                   ever be sufficient. Note also that we delete all event
-                   pollers at once for testing purposes, but in a real-world
-                   environment we are likely to want to be able to cancel event
-                   pollers at arbitrary times. Therefore we can't improve this
-                   situation by just splitting this loop into two loops
-                   (i.e. signal 'stop' for all items, sleep, and then delete all
-                   items). We also can't fix the problem via EPOLL_CTL_DEL
-                   because that command can't prevent the case where some other
-                   thread is executing read_thread_function within the region
-                   mentioned above: */
-                usleep(1);
-                pthread_mutex_lock(&epoll_items[index].mutex);
-                if (!epoll_items[index].deleted)
-                        delete_item(index);
-                pthread_mutex_unlock(&epoll_items[index].mutex);
-        }
-#endif
-        /* Shut down the read threads: */
-        for (index = 0; index < n_read_threads; ++index)
-                __sync_fetch_and_add(&read_thread_data[index].stop, 1);
-        for (index = 0; index < n_read_threads; ++index) {
-                if (pthread_join(read_threads[index], NULL) != 0)
-                        goto error;
-                if (read_thread_data[index].status)
-                        goto error;
-        }
-        /* Shut down the write thread: */
-        __sync_fetch_and_add(&write_thread_data.stop, 1);
-        if ((pthread_join(write_thread, NULL) != 0) || write_thread_data.status)
-                goto error;
-        /* Check for final error conditions: */
-        for (index = 0; index < n_epoll_items; ++index) {
-                if (epoll_items[index].status != 0)
-                        goto error;
-                if (pthread_mutex_destroy(&epoll_items[index].mutex) < 0)
-                        goto error;
-        }
-        for (index = 0; index < n_epoll_items; ++index)
-                if (epoll_items[index].deleted != 1) {
-                        printf("Error: item data deleted %1d times.\n",
-                                   epoll_items[index].deleted);
-                        goto error;
-                }
-        printf("[PASS]\n");
-        return 0;
- error:
-        printf("[FAIL]\n");
-        return errno;
-}