885 files changed, 14473 insertions, 9491 deletions

diff --git a/Documentation/ABI/testing/sysfs-class-regulator b/Documentation/ABI/testing/sysfs-class-regulator
index e091fa873792..bc578bc60628 100644
--- a/Documentation/ABI/testing/sysfs-class-regulator
+++ b/Documentation/ABI/testing/sysfs-class-regulator
@@ -349,3 +349,24 @@ Description:
 
                 This will be one of the same strings reported by
                 the "state" attribute.
+
+What:           /sys/class/regulator/.../bypass
+Date:           September 2012
+KernelVersion:  3.7
+Contact:        Mark Brown <broonie@opensource.wolfsonmicro.com>
+Description:
+                Some regulator directories will contain a field called
+                bypass.  This indicates if the device is in bypass mode.
+
+                This will be one of the following strings:
+
+                'enabled'
+                'disabled'
+                'unknown'
+
+                'enabled' means the regulator is in bypass mode.
+
+                'disabled' means that the regulator is regulating.
+
+                'unknown' means software cannot determine the state, or
+                the reported state is invalid.
diff --git a/Documentation/ABI/testing/sysfs-driver-wacom b/Documentation/ABI/testing/sysfs-driver-wacom
index 8d55a83d6921..7fc781048b79 100644
--- a/Documentation/ABI/testing/sysfs-driver-wacom
+++ b/Documentation/ABI/testing/sysfs-driver-wacom
@@ -1,3 +1,16 @@
+WWhat:          /sys/class/hidraw/hidraw*/device/oled*_img
+Date:           June 2012
+Contact:        linux-bluetooth@vger.kernel.org
+Description:
+                The /sys/class/hidraw/hidraw*/device/oled*_img files control
+                OLED mocro displays on Intuos4 Wireless tablet. Accepted image
+                has to contain 256 bytes (64x32 px 1 bit colour). The format
+                is the same as PBM image 62x32px without header (64 bits per
+                horizontal line, 32 lines). An example of setting OLED No. 0:
+                dd bs=256 count=1 if=img_file of=[path to oled0_img]/oled0_img
+                The attribute is read only and no local copy of the image is
+                stored.
+
 What:           /sys/class/hidraw/hidraw*/device/speed
 Date:           April 2010
 Kernel Version: 2.6.35
diff --git a/Documentation/RCU/checklist.txt b/Documentation/RCU/checklist.txt
index fc103d7a0474..cdb20d41a44a 100644
--- a/Documentation/RCU/checklist.txt
+++ b/Documentation/RCU/checklist.txt
@@ -310,6 +310,12 @@ over a rather long period of time, but improvements are always welcome!
         code under the influence of preempt_disable(), you instead
         need to use synchronize_irq() or synchronize_sched().
 
+        This same limitation also applies to synchronize_rcu_bh()
+        and synchronize_srcu(), as well as to the asynchronous and
+        expedited forms of the three primitives, namely call_rcu(),
+        call_rcu_bh(), call_srcu(), synchronize_rcu_expedited(),
+        synchronize_rcu_bh_expedited(), and synchronize_srcu_expedited().
+
 12.     Any lock acquired by an RCU callback must be acquired elsewhere
         with softirq disabled, e.g., via spin_lock_irqsave(),
         spin_lock_bh(), etc.  Failing to disable irq on a given
diff --git a/Documentation/RCU/stallwarn.txt b/Documentation/RCU/stallwarn.txt
index 523364e4e1f1..1927151b386b 100644
--- a/Documentation/RCU/stallwarn.txt
+++ b/Documentation/RCU/stallwarn.txt
@@ -99,7 +99,7 @@ In kernels with CONFIG_RCU_FAST_NO_HZ, even more information is
 printed:
 
         INFO: rcu_preempt detected stall on CPU
-        0: (64628 ticks this GP) idle=dd5/3fffffffffffffff/0 drain=0 . timer=-1
+        0: (64628 ticks this GP) idle=dd5/3fffffffffffffff/0 drain=0 . timer not pending
            (t=65000 jiffies)
 
 The "(64628 ticks this GP)" indicates that this CPU has taken more
@@ -116,13 +116,13 @@ number between the two "/"s is the value of the nesting, which will
 be a small positive number if in the idle loop and a very large positive
 number (as shown above) otherwise.
 
-For CONFIG_RCU_FAST_NO_HZ kernels, the "drain=0" indicates that the
-CPU is not in the process of trying to force itself into dyntick-idle
-state, the "." indicates that the CPU has not given up forcing RCU
-into dyntick-idle mode (it would be "H" otherwise), and the "timer=-1"
-indicates that the CPU has not recented forced RCU into dyntick-idle
-mode (it would otherwise indicate the number of microseconds remaining
-in this forced state).
+For CONFIG_RCU_FAST_NO_HZ kernels, the "drain=0" indicates that the CPU is
+not in the process of trying to force itself into dyntick-idle state, the
+"." indicates that the CPU has not given up forcing RCU into dyntick-idle
+mode (it would be "H" otherwise), and the "timer not pending" indicates
+that the CPU has not recently forced RCU into dyntick-idle mode (it
+would otherwise indicate the number of microseconds remaining in this
+forced state).
 
 
 Multiple Warnings From One Stall
diff --git a/Documentation/RCU/trace.txt b/Documentation/RCU/trace.txt
index f6f15ce39903..672d19083252 100644
--- a/Documentation/RCU/trace.txt
+++ b/Documentation/RCU/trace.txt
@@ -333,23 +333,23 @@ o	Each element of the form "1/1 0:127 ^0" represents one struct
 The output of "cat rcu/rcu_pending" looks as follows:
 
 rcu_sched:
-  0 np=255892 qsp=53936 rpq=85 cbr=0 cng=14417 gpc=10033 gps=24320 nf=6445 nn=146741
-  1 np=261224 qsp=54638 rpq=33 cbr=0 cng=25723 gpc=16310 gps=2849 nf=5912 nn=155792
-  2 np=237496 qsp=49664 rpq=23 cbr=0 cng=2762 gpc=45478 gps=1762 nf=1201 nn=136629
-  3 np=236249 qsp=48766 rpq=98 cbr=0 cng=286 gpc=48049 gps=1218 nf=207 nn=137723
-  4 np=221310 qsp=46850 rpq=7 cbr=0 cng=26 gpc=43161 gps=4634 nf=3529 nn=123110
-  5 np=237332 qsp=48449 rpq=9 cbr=0 cng=54 gpc=47920 gps=3252 nf=201 nn=137456
-  6 np=219995 qsp=46718 rpq=12 cbr=0 cng=50 gpc=42098 gps=6093 nf=4202 nn=120834
-  7 np=249893 qsp=49390 rpq=42 cbr=0 cng=72 gpc=38400 gps=17102 nf=41 nn=144888
+  0 np=255892 qsp=53936 rpq=85 cbr=0 cng=14417 gpc=10033 gps=24320 nn=146741
+  1 np=261224 qsp=54638 rpq=33 cbr=0 cng=25723 gpc=16310 gps=2849 nn=155792
+  2 np=237496 qsp=49664 rpq=23 cbr=0 cng=2762 gpc=45478 gps=1762 nn=136629
+  3 np=236249 qsp=48766 rpq=98 cbr=0 cng=286 gpc=48049 gps=1218 nn=137723
+  4 np=221310 qsp=46850 rpq=7 cbr=0 cng=26 gpc=43161 gps=4634 nn=123110
+  5 np=237332 qsp=48449 rpq=9 cbr=0 cng=54 gpc=47920 gps=3252 nn=137456
+  6 np=219995 qsp=46718 rpq=12 cbr=0 cng=50 gpc=42098 gps=6093 nn=120834
+  7 np=249893 qsp=49390 rpq=42 cbr=0 cng=72 gpc=38400 gps=17102 nn=144888
 rcu_bh:
-  0 np=146741 qsp=1419 rpq=6 cbr=0 cng=6 gpc=0 gps=0 nf=2 nn=145314
-  1 np=155792 qsp=12597 rpq=3 cbr=0 cng=0 gpc=4 gps=8 nf=3 nn=143180
-  2 np=136629 qsp=18680 rpq=1 cbr=0 cng=0 gpc=7 gps=6 nf=0 nn=117936
-  3 np=137723 qsp=2843 rpq=0 cbr=0 cng=0 gpc=10 gps=7 nf=0 nn=134863
-  4 np=123110 qsp=12433 rpq=0 cbr=0 cng=0 gpc=4 gps=2 nf=0 nn=110671
-  5 np=137456 qsp=4210 rpq=1 cbr=0 cng=0 gpc=6 gps=5 nf=0 nn=133235
-  6 np=120834 qsp=9902 rpq=2 cbr=0 cng=0 gpc=6 gps=3 nf=2 nn=110921
-  7 np=144888 qsp=26336 rpq=0 cbr=0 cng=0 gpc=8 gps=2 nf=0 nn=118542
+  0 np=146741 qsp=1419 rpq=6 cbr=0 cng=6 gpc=0 gps=0 nn=145314
+  1 np=155792 qsp=12597 rpq=3 cbr=0 cng=0 gpc=4 gps=8 nn=143180
+  2 np=136629 qsp=18680 rpq=1 cbr=0 cng=0 gpc=7 gps=6 nn=117936
+  3 np=137723 qsp=2843 rpq=0 cbr=0 cng=0 gpc=10 gps=7 nn=134863
+  4 np=123110 qsp=12433 rpq=0 cbr=0 cng=0 gpc=4 gps=2 nn=110671
+  5 np=137456 qsp=4210 rpq=1 cbr=0 cng=0 gpc=6 gps=5 nn=133235
+  6 np=120834 qsp=9902 rpq=2 cbr=0 cng=0 gpc=6 gps=3 nn=110921
+  7 np=144888 qsp=26336 rpq=0 cbr=0 cng=0 gpc=8 gps=2 nn=118542
 
 As always, this is once again split into "rcu_sched" and "rcu_bh"
 portions, with CONFIG_TREE_PREEMPT_RCU kernels having an additional
@@ -377,17 +377,6 @@ o	"gpc" is the number of times that an old grace period had
 o       "gps" is the number of times that a new grace period had started,
         but this CPU was not yet aware of it.
 
-o       "nf" is the number of times that this CPU suspected that the
-        current grace period had run for too long, and thus needed to
-        be forced.
-
-        Please note that "forcing" consists of sending resched IPIs
-        to holdout CPUs.  If that CPU really still is in an old RCU
-        read-side critical section, then we really do have to wait for it.
-        The assumption behing "forcing" is that the CPU is not still in
-        an old RCU read-side critical section, but has not yet responded
-        for some other reason.
-
 o       "nn" is the number of times that this CPU needed nothing.  Alert
         readers will note that the rcu "nn" number for a given CPU very
         closely matches the rcu_bh "np" number for that same CPU.  This
diff --git a/Documentation/RCU/whatisRCU.txt b/Documentation/RCU/whatisRCU.txt
index 69ee188515e7..bf0f6de2aa00 100644
--- a/Documentation/RCU/whatisRCU.txt
+++ b/Documentation/RCU/whatisRCU.txt
@@ -873,7 +873,7 @@ d.	Do you need to treat NMI handlers, hardirq handlers,
         and code segments with preemption disabled (whether
         via preempt_disable(), local_irq_save(), local_bh_disable(),
         or some other mechanism) as if they were explicit RCU readers?
-        If so, you need RCU-sched.
+        If so, RCU-sched is the only choice that will work for you.
 
 e.      Do you need RCU grace periods to complete even in the face
         of softirq monopolization of one or more of the CPUs?  For
@@ -884,7 +884,12 @@ f.	Is your workload too update-intensive for normal use of
         RCU, but inappropriate for other synchronization mechanisms?
         If so, consider SLAB_DESTROY_BY_RCU.  But please be careful!
 
-g.      Otherwise, use RCU.
+g.      Do you need read-side critical sections that are respected
+        even though they are in the middle of the idle loop, during
+        user-mode execution, or on an offlined CPU?  If so, SRCU is the
+        only choice that will work for you.
+
+h.      Otherwise, use RCU.
 
 Of course, this all assumes that you have determined that RCU is in fact
 the right tool for your job.
diff --git a/Documentation/accounting/getdelays.c b/Documentation/accounting/getdelays.c
index f6318f6d7baf..6f706aca2049 100644
--- a/Documentation/accounting/getdelays.c
+++ b/Documentation/accounting/getdelays.c
@@ -98,10 +98,9 @@ static int create_nl_socket(int protocol)
         if (rcvbufsz)
                 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF,
                                 &rcvbufsz, sizeof(rcvbufsz)) < 0) {
-                        fprintf(stderr, "Unable to set socket rcv buf size "
-                                        "to %d\n",
+                        fprintf(stderr, "Unable to set socket rcv buf size to %d\n",
                                 rcvbufsz);
-                        return -1;
+                        goto error;
                 }
 
         memset(&local, 0, sizeof(local));
diff --git a/Documentation/devicetree/bindings/regulator/regulator.txt b/Documentation/devicetree/bindings/regulator/regulator.txt
index 66ece3f87bbc..ecfc6ccd67ef 100644
--- a/Documentation/devicetree/bindings/regulator/regulator.txt
+++ b/Documentation/devicetree/bindings/regulator/regulator.txt
@@ -11,10 +11,13 @@ Optional properties:
 - regulator-boot-on: bootloader/firmware enabled regulator
 - <name>-supply: phandle to the parent supply/regulator node
 - regulator-ramp-delay: ramp delay for regulator(in uV/uS)
+
+Deprecated properties:
 - regulator-compatible: If a regulator chip contains multiple
   regulators, and if the chip's binding contains a child node that
   describes each regulator, then this property indicates which regulator
-  this child node is intended to configure.
+  this child node is intended to configure. If this property is missing,
+  the node's name will be used instead.
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/regulator/tps65217.txt b/Documentation/devicetree/bindings/regulator/tps65217.txt
index 0487e9675ba0..d316fb895daf 100644
--- a/Documentation/devicetree/bindings/regulator/tps65217.txt
+++ b/Documentation/devicetree/bindings/regulator/tps65217.txt
@@ -22,66 +22,49 @@ Example:
                 compatible = "ti,tps65217";
 
                 regulators {
-                        #address-cells = <1>;
-                        #size-cells = <0>;
-
-                        dcdc1_reg: regulator@0 {
-                                reg = <0>;
-                                regulator-compatible = "dcdc1";
+                        dcdc1_reg: dcdc1 {
                                 regulator-min-microvolt = <900000>;
                                 regulator-max-microvolt = <1800000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        dcdc2_reg: regulator@1 {
-                                reg = <1>;
-                                regulator-compatible = "dcdc2";
+                        dcdc2_reg: dcdc2 {
                                 regulator-min-microvolt = <900000>;
                                 regulator-max-microvolt = <3300000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        dcdc3_reg: regulator@2 {
-                                reg = <2>;
-                                regulator-compatible = "dcdc3";
+                        dcdc3_reg: dcc3 {
                                 regulator-min-microvolt = <900000>;
                                 regulator-max-microvolt = <1500000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        ldo1_reg: regulator@3 {
-                                reg = <3>;
-                                regulator-compatible = "ldo1";
+                        ldo1_reg: ldo1 {
                                 regulator-min-microvolt = <1000000>;
                                 regulator-max-microvolt = <3300000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        ldo2_reg: regulator@4 {
-                                reg = <4>;
-                                regulator-compatible = "ldo2";
+                        ldo2_reg: ldo2 {
                                 regulator-min-microvolt = <900000>;
                                 regulator-max-microvolt = <3300000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        ldo3_reg: regulator@5 {
-                                reg = <5>;
-                                regulator-compatible = "ldo3";
+                        ldo3_reg: ldo3 {
                                 regulator-min-microvolt = <1800000>;
                                 regulator-max-microvolt = <3300000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        ldo4_reg: regulator@6 {
-                                reg = <6>;
-                                regulator-compatible = "ldo4";
+                        ldo4_reg: ldo4 {
                                 regulator-min-microvolt = <1800000>;
                                 regulator-max-microvolt = <3300000>;
                                 regulator-boot-on;
diff --git a/Documentation/devicetree/bindings/regulator/tps6586x.txt b/Documentation/devicetree/bindings/regulator/tps6586x.txt
index da80c2ae0915..07b9ef6e49d5 100644
--- a/Documentation/devicetree/bindings/regulator/tps6586x.txt
+++ b/Documentation/devicetree/bindings/regulator/tps6586x.txt
@@ -6,9 +6,13 @@ Required properties:
 - interrupts: the interrupt outputs of the controller
 - #gpio-cells: number of cells to describe a GPIO
 - gpio-controller: mark the device as a GPIO controller
-- regulators: list of regulators provided by this controller, must have
-  property "regulator-compatible" to match their hardware counterparts:
-  sm[0-2], ldo[0-9] and ldo_rtc
+- regulators: A node that houses a sub-node for each regulator within the
+  device. Each sub-node is identified using the node's name (or the deprecated
+  regulator-compatible property if present), with valid values listed below.
+  The content of each sub-node is defined by the standard binding for
+  regulators; see regulator.txt.
+  sys, sm[0-2], ldo[0-9] and ldo_rtc
+- sys-supply: The input supply for SYS.
 - vin-sm0-supply: The input supply for the SM0.
 - vin-sm1-supply: The input supply for the SM1.
 - vin-sm2-supply: The input supply for the SM2.
@@ -20,6 +24,9 @@ Required properties:
 
 Each regulator is defined using the standard binding for regulators.
 
+Note: LDO5 and LDO_RTC is supplied by SYS regulator internally and driver
+      take care of making proper parent child relationship.
+
 Example:
 
         pmu: tps6586x@34 {
@@ -30,6 +37,7 @@ Example:
                 #gpio-cells = <2>;
                 gpio-controller;
 
+                sys-supply = <&some_reg>;
                 vin-sm0-supply = <&some_reg>;
                 vin-sm1-supply = <&some_reg>;
                 vin-sm2-supply = <&some_reg>;
@@ -40,103 +48,80 @@ Example:
                 vinldo9-supply = <...>;
 
                 regulators {
-                        #address-cells = <1>;
-                        #size-cells = <0>;
+                        sys_reg: sys {
+                                regulator-name = "vdd_sys";
+                                regulator-boot-on;
+                                regulator-always-on;
+                        };
 
-                        sm0_reg: regulator@0 {
-                                reg = <0>;
-                                regulator-compatible = "sm0";
+                        sm0_reg: sm0 {
                                 regulator-min-microvolt = < 725000>;
                                 regulator-max-microvolt = <1500000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        sm1_reg: regulator@1 {
-                                reg = <1>;
-                                regulator-compatible = "sm1";
+                        sm1_reg: sm1 {
                                 regulator-min-microvolt = < 725000>;
                                 regulator-max-microvolt = <1500000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        sm2_reg: regulator@2 {
-                                reg = <2>;
-                                regulator-compatible = "sm2";
+                        sm2_reg: sm2 {
                                 regulator-min-microvolt = <3000000>;
                                 regulator-max-microvolt = <4550000>;
                                 regulator-boot-on;
                                 regulator-always-on;
                         };
 
-                        ldo0_reg: regulator@3 {
-                                reg = <3>;
-                                regulator-compatible = "ldo0";
+                        ldo0_reg: ldo0 {
                                 regulator-name = "PCIE CLK";
                                 regulator-min-microvolt = <3300000>;
                                 regulator-max-microvolt = <3300000>;
                         };
 
-                        ldo1_reg: regulator@4 {
-                                reg = <4>;
-                                regulator-compatible = "ldo1";
+                        ldo1_reg: ldo1 {
                                 regulator-min-microvolt = < 725000>;
                                 regulator-max-microvolt = <1500000>;
                         };
 
-                        ldo2_reg: regulator@5 {
-                                reg = <5>;
-                                regulator-compatible = "ldo2";
+                        ldo2_reg: ldo2 {
                                 regulator-min-microvolt = < 725000>;
                                 regulator-max-microvolt = <1500000>;
                         };
 
-                        ldo3_reg: regulator@6 {
-                                reg = <6>;
-                                regulator-compatible = "ldo3";
+                        ldo3_reg: ldo3 {
                                 regulator-min-microvolt = <1250000>;
                                 regulator-max-microvolt = <3300000>;
                         };
 
-                        ldo4_reg: regulator@7 {
-                                reg = <7>;
-                                regulator-compatible = "ldo4";
+                        ldo4_reg: ldo4 {
                                 regulator-min-microvolt = <1700000>;
                                 regulator-max-microvolt = <2475000>;
                         };
 
-                        ldo5_reg: regulator@8 {
-                                reg = <8>;
-                                regulator-compatible = "ldo5";
+                        ldo5_reg: ldo5 {
                                 regulator-min-microvolt = <1250000>;
                                 regulator-max-microvolt = <3300000>;
                         };
 
-                        ldo6_reg: regulator@9 {
-                                reg = <9>;
-                                regulator-compatible = "ldo6";
+                        ldo6_reg: ldo6 {
                                 regulator-min-microvolt = <1250000>;
                                 regulator-max-microvolt = <3300000>;
                         };
 
-                        ldo7_reg: regulator@10 {
-                                reg = <10>;
-                                regulator-compatible = "ldo7";
+                        ldo7_reg: ldo7 {
                                 regulator-min-microvolt = <1250000>;
                                 regulator-max-microvolt = <3300000>;
                         };
 
-                        ldo8_reg: regulator@11 {
-                                reg = <11>;
-                                regulator-compatible = "ldo8";
+                        ldo8_reg: ldo8 {
                                 regulator-min-microvolt = <1250000>;
                                 regulator-max-microvolt = <3300000>;
                         };
 
-                        ldo9_reg: regulator@12 {
-                                reg = <12>;
-                                regulator-compatible = "ldo9";
+                        ldo9_reg: ldo9 {
                                 regulator-min-microvolt = <1250000>;
                                 regulator-max-microvolt = <3300000>;
                         };
diff --git a/Documentation/dontdiff b/Documentation/dontdiff
index 39462cf35cd4..74c25c8d8884 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
@@ -162,7 +162,6 @@ mach-types.h
 machtypes.h
 map
 map_hugetlb
-maui_boot.h
 media
 mconf
 miboot*
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index 615142da4ef6..157416e78cc4 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -21,6 +21,7 @@ Supported adapters:
   * Intel DH89xxCC (PCH)
   * Intel Panther Point (PCH)
   * Intel Lynx Point (PCH)
+  * Intel Lynx Point-LP (PCH)
    Datasheets: Publicly available at the Intel website
 
 On Intel Patsburg and later chipsets, both the normal host SMBus controller
diff --git a/Documentation/ia64/aliasing-test.c b/Documentation/ia64/aliasing-test.c
index 5caa2af33207..62a190d45f38 100644
--- a/Documentation/ia64/aliasing-test.c
+++ b/Documentation/ia64/aliasing-test.c
@@ -132,6 +132,7 @@ static int read_rom(char *path)
 
         rc = write(fd, "1", 2);
         if (rc <= 0) {
+                close(fd);
                 perror("write");
                 return -1;
         }
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index ad7e2e5088c1..55ada0471f93 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2385,6 +2385,17 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         rcutree.rcu_cpu_stall_timeout= [KNL,BOOT]
                         Set timeout for RCU CPU stall warning messages.
 
+        rcutree.jiffies_till_first_fqs= [KNL,BOOT]
+                        Set delay from grace-period initialization to
+                        first attempt to force quiescent states.
+                        Units are jiffies, minimum value is zero,
+                        and maximum value is HZ.
+
+        rcutree.jiffies_till_next_fqs= [KNL,BOOT]
+                        Set delay between subsequent attempts to force
+                        quiescent states.  Units are jiffies, minimum
+                        value is one, and maximum value is HZ.
+
         rcutorture.fqs_duration= [KNL,BOOT]
                         Set duration of force_quiescent_state bursts.
 
diff --git a/Documentation/power/swsusp.txt b/Documentation/power/swsusp.txt
index 92341b84250d..0b4b63e7e9b6 100644
--- a/Documentation/power/swsusp.txt
+++ b/Documentation/power/swsusp.txt
@@ -53,7 +53,7 @@ before suspend (it is limited to 500 MB by default).
 
 Article about goals and implementation of Software Suspend for Linux
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-Author: G‚ábor Kuti
+Author: Gábor Kuti
 Last revised: 2003-10-20 by Pavel Machek
 
 Idea and goals to achieve
diff --git a/Documentation/trace/kprobetrace.txt b/Documentation/trace/kprobetrace.txt
index d0d0bb9e3e25..d68ea5fc812b 100644
--- a/Documentation/trace/kprobetrace.txt
+++ b/Documentation/trace/kprobetrace.txt
@@ -12,7 +12,7 @@ kprobes can probe (this means, all functions body except for __kprobes
 functions). Unlike the Tracepoint based event, this can be added and removed
 dynamically, on the fly.
 
-To enable this feature, build your kernel with CONFIG_KPROBE_TRACING=y.
+To enable this feature, build your kernel with CONFIG_KPROBE_EVENT=y.
 
 Similar to the events tracer, this doesn't need to be activated via
 current_tracer. Instead of that, add probe points via
diff --git a/Documentation/vfio.txt b/Documentation/vfio.txt
index 0cb6685c8029..8eda3635a17d 100644
--- a/Documentation/vfio.txt
+++ b/Documentation/vfio.txt
@@ -133,7 +133,7 @@ character devices for this group:
 $ lspci -n -s 0000:06:0d.0
 06:0d.0 0401: 1102:0002 (rev 08)
 # echo 0000:06:0d.0 > /sys/bus/pci/devices/0000:06:0d.0/driver/unbind
-# echo 1102 0002 > /sys/bus/pci/drivers/vfio/new_id
+# echo 1102 0002 > /sys/bus/pci/drivers/vfio-pci/new_id
 
 Now we need to look at what other devices are in the group to free
 it for use by VFIO:
diff --git a/MAINTAINERS b/MAINTAINERS
index fdc0119963e7..9362f54bccb8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3388,7 +3388,7 @@ M:	"Wolfram Sang (embedded platforms)" <w.sang@pengutronix.de>
 L:      linux-i2c@vger.kernel.org
 W:      http://i2c.wiki.kernel.org/
 T:      quilt kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-i2c/
-T:      git git://git.fluff.org/bjdooks/linux.git
+T:      git git://git.pengutronix.de/git/wsa/linux.git
 S:      Maintained
 F:      Documentation/i2c/
 F:      drivers/i2c/
@@ -3552,11 +3552,12 @@ K:	\b(ABS|SYN)_MT_
 
 INTEL C600 SERIES SAS CONTROLLER DRIVER
 M:      Intel SCU Linux support <intel-linux-scu@intel.com>
+M:      Lukasz Dorau <lukasz.dorau@intel.com>
+M:      Maciej Patelczyk <maciej.patelczyk@intel.com>
 M:      Dave Jiang <dave.jiang@intel.com>
-M:      Ed Nadolski <edmund.nadolski@intel.com>
 L:      linux-scsi@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/djbw/isci.git
-S:      Maintained
+T:      git git://git.code.sf.net/p/intel-sas/isci
+S:      Supported
 F:      drivers/scsi/isci/
 F:      firmware/isci/
 
@@ -3666,11 +3667,12 @@ F:	Documentation/networking/README.ipw2200
 F:      drivers/net/wireless/ipw2x00/
 
 INTEL(R) TRUSTED EXECUTION TECHNOLOGY (TXT)
-M:      Joseph Cihula <joseph.cihula@intel.com>
+M:      Richard L Maliszewski <richard.l.maliszewski@intel.com>
+M:      Gang Wei <gang.wei@intel.com>
 M:      Shane Wang <shane.wang@intel.com>
 L:      tboot-devel@lists.sourceforge.net
 W:      http://tboot.sourceforge.net
-T:      Mercurial http://www.bughost.org/repos.hg/tboot.hg
+T:      hg http://tboot.hg.sourceforge.net:8000/hgroot/tboot/tboot
 S:      Supported
 F:      Documentation/intel_txt.txt
 F:      include/linux/tboot.h
@@ -5320,6 +5322,12 @@ L:	linux-mtd@lists.infradead.org
 S:      Maintained
 F:      drivers/mtd/devices/phram.c
 
+PICOLCD HID DRIVER
+M:      Bruno Prémont <bonbons@linux-vserver.org>
+L:      linux-input@vger.kernel.org
+S:      Maintained
+F:      drivers/hid/hid-picolcd*
+
 PICOXCELL SUPPORT
 M:      Jamie Iles <jamie@jamieiles.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -5543,6 +5551,8 @@ F:	Documentation/devicetree/bindings/pwm/
 F:      include/linux/pwm.h
 F:      include/linux/of_pwm.h
 F:      drivers/pwm/
+F:      drivers/video/backlight/pwm_bl.c
+F:      include/linux/pwm_backlight.h
 
 PXA2xx/PXA3xx SUPPORT
 M:      Eric Miao <eric.y.miao@gmail.com>
diff --git a/Makefile b/Makefile
index 843f2f6c28a7..846dd7607854 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 6
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
-NAME = Saber-toothed Squirrel
+EXTRAVERSION =
+NAME = Terrified Chipmunk
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/Kconfig b/arch/Kconfig
index 2a83a3f6a615..1a7b468abf4a 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -294,4 +294,14 @@ config SECCOMP_FILTER
 
           See Documentation/prctl/seccomp_filter.txt for details.
 
+config HAVE_RCU_USER_QS
+        bool
+        help
+          Provide kernel entry/exit hooks necessary for userspace
+          RCU extended quiescent state. Syscalls need to be wrapped inside
+          rcu_user_exit()-rcu_user_enter() through the slow path using
+          TIF_NOHZ flag. Exceptions handlers must be wrapped as well. Irqs
+          are already protected inside rcu_irq_enter/rcu_irq_exit() but
+          preemption or signal handling on irq exit still need to be protected.
+
 source "kernel/gcov/Kconfig"
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index d6fde98b74b3..83638aa096d5 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -28,6 +28,7 @@
 #include <linux/tty.h>
 #include <linux/console.h>
 #include <linux/slab.h>
+#include <linux/rcupdate.h>
 
 #include <asm/reg.h>
 #include <asm/uaccess.h>
@@ -54,9 +55,12 @@ cpu_idle(void)
                 /* FIXME -- EV6 and LCA45 know how to power down
                    the CPU.  */
 
+                rcu_idle_enter();
                 while (!need_resched())
                         cpu_relax();
-                schedule();
+
+                rcu_idle_exit();
+                schedule_preempt_disabled();
         }
 }
 
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 35ddc02bfa4a..a41ad90a97a6 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -166,6 +166,7 @@ smp_callin(void)
         DBGS(("smp_callin: commencing CPU %d current %p active_mm %p\n",
               cpuid, current, current->active_mm));
 
+        preempt_disable();
         /* Do nothing.  */
         cpu_idle();
 }
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index f15f82bf3a50..e968a52e4881 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -356,15 +356,15 @@ choice
                   is nothing connected to read from the DCC.
 
         config DEBUG_SEMIHOSTING
-                bool "Kernel low-level debug output via semihosting I"
+                bool "Kernel low-level debug output via semihosting I/O"
                 help
                   Semihosting enables code running on an ARM target to use
                   the I/O facilities on a host debugger/emulator through a
-                  simple SVC calls. The host debugger or emulator must have
+                  simple SVC call. The host debugger or emulator must have
                   semihosting enabled for the special svc call to be trapped
                   otherwise the kernel will crash.
 
-                  This is known to work with OpenOCD, as wellas
+                  This is known to work with OpenOCD, as well as
                   ARM's Fast Models, or any other controlling environment
                   that implements semihosting.
 
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 30eae87ead6d..a051dfbdd7db 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -284,10 +284,10 @@ zImage Image xipImage bootpImage uImage: vmlinux
 zinstall uinstall install: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
 
-%.dtb:
+%.dtb: scripts
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 
-dtbs:
+dtbs: scripts
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 
 # We use MRPROPER_FILES and CLEAN_FILES now
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index b8c64b80bafc..bc67cbff3944 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -653,16 +653,21 @@ __armv7_mmu_cache_on:
                 mcrne   p15, 0, r0, c8, c7, 0   @ flush I,D TLBs
 #endif
                 mrc     p15, 0, r0, c1, c0, 0   @ read control reg
+                bic     r0, r0, #1 << 28        @ clear SCTLR.TRE
                 orr     r0, r0, #0x5000         @ I-cache enable, RR cache replacement
                 orr     r0, r0, #0x003c         @ write buffer
 #ifdef CONFIG_MMU
 #ifdef CONFIG_CPU_ENDIAN_BE8
                 orr     r0, r0, #1 << 25        @ big-endian page tables
 #endif
+                mrcne   p15, 0, r6, c2, c0, 2   @ read ttb control reg
                 orrne   r0, r0, #1              @ MMU enabled
                 movne   r1, #0xfffffffd         @ domain 0 = client
+                bic     r6, r6, #1 << 31        @ 32-bit translation system
+                bic     r6, r6, #3 << 0         @ use only ttbr0
                 mcrne   p15, 0, r3, c2, c0, 0   @ load page table pointer
                 mcrne   p15, 0, r1, c3, c0, 0   @ load domain access control
+                mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
 #endif
                 mcr     p15, 0, r0, c7, c5, 4   @ ISB
                 mcr     p15, 0, r0, c1, c0, 0   @ load control register
diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
index 66389c1c6f62..7c95f76398de 100644
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -104,6 +104,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioB: gpio@fffff600 {
@@ -113,6 +114,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioC: gpio@fffff800 {
@@ -122,6 +124,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         dbgu: serial@fffff200 {
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index b460d6ce9eb5..195019b7ca0e 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -95,6 +95,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioB: gpio@fffff400 {
@@ -104,6 +105,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioC: gpio@fffff600 {
@@ -113,6 +115,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioD: gpio@fffff800 {
@@ -122,6 +125,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioE: gpio@fffffa00 {
@@ -131,6 +135,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         dbgu: serial@ffffee00 {
diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
index bafa8806fc17..63751b1e744b 100644
--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -113,6 +113,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioB: gpio@fffff400 {
@@ -122,6 +123,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioC: gpio@fffff600 {
@@ -131,6 +133,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioD: gpio@fffff800 {
@@ -140,6 +143,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioE: gpio@fffffa00 {
@@ -149,6 +153,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         dbgu: serial@ffffee00 {
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index bfac0dfc332c..ef9336ae9614 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -107,6 +107,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioB: gpio@fffff600 {
@@ -116,6 +117,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioC: gpio@fffff800 {
@@ -125,6 +127,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioD: gpio@fffffa00 {
@@ -134,6 +137,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         dbgu: serial@fffff200 {
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 4a18c393b136..8a387a8d61b7 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -115,6 +115,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioB: gpio@fffff600 {
@@ -124,6 +125,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioC: gpio@fffff800 {
@@ -133,6 +135,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         pioD: gpio@fffffa00 {
@@ -142,6 +145,7 @@
                                 #gpio-cells = <2>;
                                 gpio-controller;
                                 interrupt-controller;
+                                #interrupt-cells = <2>;
                         };
 
                         dbgu: serial@fffff200 {
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 03fb93621d0d..5c8b3bf4d825 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -320,4 +320,12 @@
         .size \name , . - \name
         .endm
 
+        .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+#ifndef CONFIG_CPU_USE_DOMAINS
+        adds    \tmp, \addr, #\size - 1
+        sbcccs  \tmp, \tmp, \limit
+        bcs     \bad
+#endif
+        .endm
+
 #endif /* __ASM_ASSEMBLER_H__ */
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index e965f1b560f1..5f6ddcc56452 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -187,6 +187,7 @@ static inline unsigned long __phys_to_virt(unsigned long x)
 #define __phys_to_virt(x)       ((x) - PHYS_OFFSET + PAGE_OFFSET)
 #endif
 #endif
+#endif /* __ASSEMBLY__ */
 
 #ifndef PHYS_OFFSET
 #ifdef PLAT_PHYS_OFFSET
@@ -196,6 +197,8 @@ static inline unsigned long __phys_to_virt(unsigned long x)
 #endif
 #endif
 
+#ifndef __ASSEMBLY__
+
 /*
  * PFNs are used to describe any physical page; this means
  * PFN 0 == physical address 0.
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 314d4664eae7..99a19512ee26 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -199,6 +199,9 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 {
         pgtable_page_dtor(pte);
 
+#ifdef CONFIG_ARM_LPAE
+        tlb_add_flush(tlb, addr);
+#else
         /*
          * With the classic ARM MMU, a pte page has two corresponding pmd
          * entries, each covering 1MB.
@@ -206,6 +209,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
         addr &= PMD_MASK;
         tlb_add_flush(tlb, addr + SZ_1M - PAGE_SIZE);
         tlb_add_flush(tlb, addr + SZ_1M);
+#endif
 
         tlb_remove_page(tlb, pte);
 }
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 479a6352e0b5..77bd79f2ffdb 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -101,28 +101,39 @@ extern int __get_user_1(void *);
 extern int __get_user_2(void *);
 extern int __get_user_4(void *);
 
-#define __get_user_x(__r2,__p,__e,__s,__i...)                           \
+#define __GUP_CLOBBER_1 "lr", "cc"
+#ifdef CONFIG_CPU_USE_DOMAINS
+#define __GUP_CLOBBER_2 "ip", "lr", "cc"
+#else
+#define __GUP_CLOBBER_2 "lr", "cc"
+#endif
+#define __GUP_CLOBBER_4 "lr", "cc"
+
+#define __get_user_x(__r2,__p,__e,__l,__s)                              \
            __asm__ __volatile__ (                                       \
                 __asmeq("%0", "r0") __asmeq("%1", "r2")                 \
+                __asmeq("%3", "r1")                                     \
                 "bl     __get_user_" #__s                               \
                 : "=&r" (__e), "=r" (__r2)                              \
-                : "0" (__p)                                             \
-                : __i, "cc")
+                : "0" (__p), "r" (__l)                                  \
+                : __GUP_CLOBBER_##__s)
 
-#define get_user(x,p)                                                   \
+#define __get_user_check(x,p)                                                   \
         ({                                                              \
+                unsigned long __limit = current_thread_info()->addr_limit - 1; \
                 register const typeof(*(p)) __user *__p asm("r0") = (p);\
                 register unsigned long __r2 asm("r2");                  \
+                register unsigned long __l asm("r1") = __limit;         \
                 register int __e asm("r0");                             \
                 switch (sizeof(*(__p))) {                               \
                 case 1:                                                 \
-                        __get_user_x(__r2, __p, __e, 1, "lr");          \
-                        break;                                          \
+                        __get_user_x(__r2, __p, __e, __l, 1);           \
+                        break;                                          \
                 case 2:                                                 \
-                        __get_user_x(__r2, __p, __e, 2, "r3", "lr");    \
+                        __get_user_x(__r2, __p, __e, __l, 2);           \
                         break;                                          \
                 case 4:                                                 \
-                        __get_user_x(__r2, __p, __e, 4, "lr");          \
+                        __get_user_x(__r2, __p, __e, __l, 4);           \
                         break;                                          \
                 default: __e = __get_user_bad(); break;                 \
                 }                                                       \
@@ -130,42 +141,57 @@ extern int __get_user_4(void *);
                 __e;                                                    \
         })
 
+#define get_user(x,p)                                                   \
+        ({                                                              \
+                might_fault();                                          \
+                __get_user_check(x,p);                                  \
+         })
+
 extern int __put_user_1(void *, unsigned int);
 extern int __put_user_2(void *, unsigned int);
 extern int __put_user_4(void *, unsigned int);
 extern int __put_user_8(void *, unsigned long long);
 
-#define __put_user_x(__r2,__p,__e,__s)                                  \
+#define __put_user_x(__r2,__p,__e,__l,__s)                              \
            __asm__ __volatile__ (                                       \
                 __asmeq("%0", "r0") __asmeq("%2", "r2")                 \
+                __asmeq("%3", "r1")                                     \
                 "bl     __put_user_" #__s                               \
                 : "=&r" (__e)                                           \
-                : "0" (__p), "r" (__r2)                                 \
+                : "0" (__p), "r" (__r2), "r" (__l)                      \
                 : "ip", "lr", "cc")
 
-#define put_user(x,p)                                                   \
+#define __put_user_check(x,p)                                                   \
         ({                                                              \
+                unsigned long __limit = current_thread_info()->addr_limit - 1; \
                 register const typeof(*(p)) __r2 asm("r2") = (x);       \
                 register const typeof(*(p)) __user *__p asm("r0") = (p);\
+                register unsigned long __l asm("r1") = __limit;         \
                 register int __e asm("r0");                             \
                 switch (sizeof(*(__p))) {                               \
                 case 1:                                                 \
-                        __put_user_x(__r2, __p, __e, 1);                \
+                        __put_user_x(__r2, __p, __e, __l, 1);           \
                         break;                                          \
                 case 2:                                                 \
-                        __put_user_x(__r2, __p, __e, 2);                \
+                        __put_user_x(__r2, __p, __e, __l, 2);           \
                         break;                                          \
                 case 4:                                                 \
-                        __put_user_x(__r2, __p, __e, 4);                \
+                        __put_user_x(__r2, __p, __e, __l, 4);           \
                         break;                                          \
                 case 8:                                                 \
-                        __put_user_x(__r2, __p, __e, 8);                \
+                        __put_user_x(__r2, __p, __e, __l, 8);           \
                         break;                                          \
                 default: __e = __put_user_bad(); break;                 \
                 }                                                       \
                 __e;                                                    \
         })
 
+#define put_user(x,p)                                                   \
+        ({                                                              \
+                might_fault();                                          \
+                __put_user_check(x,p);                                  \
+         })
+
 #else /* CONFIG_MMU */
 
 /*
@@ -219,6 +245,7 @@ do {									\
         unsigned long __gu_addr = (unsigned long)(ptr);                 \
         unsigned long __gu_val;                                         \
         __chk_user_ptr(ptr);                                            \
+        might_fault();                                                  \
         switch (sizeof(*(ptr))) {                                       \
         case 1: __get_user_asm_byte(__gu_val,__gu_addr,err);    break;  \
         case 2: __get_user_asm_half(__gu_val,__gu_addr,err);    break;  \
@@ -300,6 +327,7 @@ do {									\
         unsigned long __pu_addr = (unsigned long)(ptr);                 \
         __typeof__(*(ptr)) __pu_val = (x);                              \
         __chk_user_ptr(ptr);                                            \
+        might_fault();                                                  \
         switch (sizeof(*(ptr))) {                                       \
         case 1: __put_user_asm_byte(__pu_val,__pu_addr,err);    break;  \
         case 2: __put_user_asm_half(__pu_val,__pu_addr,err);    break;  \
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 0cab47d4a83f..2fde5fd1acce 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -404,6 +404,7 @@
 #define __NR_setns                      (__NR_SYSCALL_BASE+375)
 #define __NR_process_vm_readv           (__NR_SYSCALL_BASE+376)
 #define __NR_process_vm_writev          (__NR_SYSCALL_BASE+377)
+                                        /* 378 for kcmp */
 
 /*
  * The following SWIs are ARM private.
@@ -483,6 +484,7 @@
  */
 #define __IGNORE_fadvise64_64
 #define __IGNORE_migrate_pages
+#define __IGNORE_kcmp
 
 #endif /* __KERNEL__ */
 #endif /* __ASM_ARM_UNISTD_H */
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 463ff4a0ec8a..e337879595e5 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -387,6 +387,7 @@
 /* 375 */       CALL(sys_setns)
                 CALL(sys_process_vm_readv)
                 CALL(sys_process_vm_writev)
+                CALL(sys_ni_syscall)    /* reserved for sys_kcmp */
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index ba386bd94107..281bf3301241 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -159,6 +159,12 @@ static int debug_arch_supported(void)
                 arch >= ARM_DEBUG_ARCH_V7_1;
 }
 
+/* Can we determine the watchpoint access type from the fsr? */
+static int debug_exception_updates_fsr(void)
+{
+        return 0;
+}
+
 /* Determine number of WRP registers available. */
 static int get_num_wrp_resources(void)
 {
@@ -604,13 +610,14 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
                 /* Aligned */
                 break;
         case 1:
-                /* Allow single byte watchpoint. */
-                if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
-                        break;
         case 2:
                 /* Allow halfword watchpoints and breakpoints. */
                 if (info->ctrl.len == ARM_BREAKPOINT_LEN_2)
                         break;
+        case 3:
+                /* Allow single byte watchpoint. */
+                if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
+                        break;
         default:
                 ret = -EINVAL;
                 goto out;
@@ -619,18 +626,35 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
         info->address &= ~alignment_mask;
         info->ctrl.len <<= offset;
 
-        /*
-         * Currently we rely on an overflow handler to take
-         * care of single-stepping the breakpoint when it fires.
-         * In the case of userspace breakpoints on a core with V7 debug,
-         * we can use the mismatch feature as a poor-man's hardware
-         * single-step, but this only works for per-task breakpoints.
-         */
-        if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
-            !core_has_mismatch_brps() || !bp->hw.bp_target)) {
-                pr_warning("overflow handler required but none found\n");
-                ret = -EINVAL;
+        if (!bp->overflow_handler) {
+                /*
+                 * Mismatch breakpoints are required for single-stepping
+                 * breakpoints.
+                 */
+                if (!core_has_mismatch_brps())
+                        return -EINVAL;
+
+                /* We don't allow mismatch breakpoints in kernel space. */
+                if (arch_check_bp_in_kernelspace(bp))
+                        return -EPERM;
+
+                /*
+                 * Per-cpu breakpoints are not supported by our stepping
+                 * mechanism.
+                 */
+                if (!bp->hw.bp_target)
+                        return -EINVAL;
+
+                /*
+                 * We only support specific access types if the fsr
+                 * reports them.
+                 */
+                if (!debug_exception_updates_fsr() &&
+                    (info->ctrl.type == ARM_BREAKPOINT_LOAD ||
+                     info->ctrl.type == ARM_BREAKPOINT_STORE))
+                        return -EINVAL;
         }
+
 out:
         return ret;
 }
@@ -706,10 +730,12 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
                                 goto unlock;
 
                         /* Check that the access type matches. */
-                        access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
-                                 HW_BREAKPOINT_R;
-                        if (!(access & hw_breakpoint_type(wp)))
-                                goto unlock;
+                        if (debug_exception_updates_fsr()) {
+                                access = (fsr & ARM_FSR_ACCESS_MASK) ?
+                                          HW_BREAKPOINT_W : HW_BREAKPOINT_R;
+                                if (!(access & hw_breakpoint_type(wp)))
+                                        goto unlock;
+                        }
 
                         /* We have a winner. */
                         info->trigger = addr;
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index fef42b21cecb..e1f906989bb8 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -11,7 +11,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/clk.h>
-#include <linux/cpufreq.h>
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/err.h>
@@ -96,7 +95,52 @@ static void twd_timer_stop(struct clock_event_device *clk)
         disable_percpu_irq(clk->irq);
 }
 
-#ifdef CONFIG_CPU_FREQ
+#ifdef CONFIG_COMMON_CLK
+
+/*
+ * Updates clockevent frequency when the cpu frequency changes.
+ * Called on the cpu that is changing frequency with interrupts disabled.
+ */
+static void twd_update_frequency(void *new_rate)
+{
+        twd_timer_rate = *((unsigned long *) new_rate);
+
+        clockevents_update_freq(*__this_cpu_ptr(twd_evt), twd_timer_rate);
+}
+
+static int twd_rate_change(struct notifier_block *nb,
+        unsigned long flags, void *data)
+{
+        struct clk_notifier_data *cnd = data;
+
+        /*
+         * The twd clock events must be reprogrammed to account for the new
+         * frequency.  The timer is local to a cpu, so cross-call to the
+         * changing cpu.
+         */
+        if (flags == POST_RATE_CHANGE)
+                smp_call_function(twd_update_frequency,
+                                  (void *)&cnd->new_rate, 1);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block twd_clk_nb = {
+        .notifier_call = twd_rate_change,
+};
+
+static int twd_clk_init(void)
+{
+        if (twd_evt && *__this_cpu_ptr(twd_evt) && !IS_ERR(twd_clk))
+                return clk_notifier_register(twd_clk, &twd_clk_nb);
+
+        return 0;
+}
+core_initcall(twd_clk_init);
+
+#elif defined (CONFIG_CPU_FREQ)
+
+#include <linux/cpufreq.h>
 
 /*
  * Updates clockevent frequency when the cpu frequency changes.
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index f7945218b8c6..b0179b89a04c 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -420,20 +420,23 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
 #endif
                         instr = *(u32 *) pc;
         } else if (thumb_mode(regs)) {
-                get_user(instr, (u16 __user *)pc);
+                if (get_user(instr, (u16 __user *)pc))
+                        goto die_sig;
                 if (is_wide_instruction(instr)) {
                         unsigned int instr2;
-                        get_user(instr2, (u16 __user *)pc+1);
+                        if (get_user(instr2, (u16 __user *)pc+1))
+                                goto die_sig;
                         instr <<= 16;
                         instr |= instr2;
                 }
-        } else {
-                get_user(instr, (u32 __user *)pc);
+        } else if (get_user(instr, (u32 __user *)pc)) {
+                goto die_sig;
         }
 
         if (call_undef_hook(regs, instr) == 0)
                 return;
 
+die_sig:
 #ifdef CONFIG_DEBUG_USER
         if (user_debug & UDBG_UNDEFINED) {
                 printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
index d6dacc69254e..395d5fbb8fa2 100644
--- a/arch/arm/lib/delay.c
+++ b/arch/arm/lib/delay.c
@@ -59,6 +59,7 @@ void __init init_current_timer_delay(unsigned long freq)
 {
         pr_info("Switching to timer-based delay loop\n");
         lpj_fine                        = freq / HZ;
+        loops_per_jiffy                 = lpj_fine;
         arm_delay_ops.delay             = __timer_delay;
         arm_delay_ops.const_udelay      = __timer_const_udelay;
         arm_delay_ops.udelay            = __timer_udelay;
diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 11093a7c3e32..9b06bb41fca6 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -16,8 +16,9 @@
  * __get_user_X
  *
  * Inputs:      r0 contains the address
+ *              r1 contains the address limit, which must be preserved
  * Outputs:     r0 is the error code
- *              r2, r3 contains the zero-extended value
+ *              r2 contains the zero-extended value
  *              lr corrupted
  *
  * No other registers must be altered.  (see <asm/uaccess.h>
@@ -27,33 +28,39 @@
  * Note also that it is intended that __get_user_bad is not global.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 
 ENTRY(__get_user_1)
+        check_uaccess r0, 1, r1, r2, __get_user_bad
 1: TUSER(ldrb)  r2, [r0]
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__get_user_1)
 
 ENTRY(__get_user_2)
-#ifdef CONFIG_THUMB2_KERNEL
-2: TUSER(ldrb)  r2, [r0]
-3: TUSER(ldrb)  r3, [r0, #1]
+        check_uaccess r0, 2, r1, r2, __get_user_bad
+#ifdef CONFIG_CPU_USE_DOMAINS
+rb      .req    ip
+2:      ldrbt   r2, [r0], #1
+3:      ldrbt   rb, [r0], #0
 #else
-2: TUSER(ldrb)  r2, [r0], #1
-3: TUSER(ldrb)  r3, [r0]
+rb      .req    r0
+2:      ldrb    r2, [r0]
+3:      ldrb    rb, [r0, #1]
 #endif
 #ifndef __ARMEB__
-        orr     r2, r2, r3, lsl #8
+        orr     r2, r2, rb, lsl #8
 #else
-        orr     r2, r3, r2, lsl #8
+        orr     r2, rb, r2, lsl #8
 #endif
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__get_user_2)
 
 ENTRY(__get_user_4)
+        check_uaccess r0, 4, r1, r2, __get_user_bad
 4: TUSER(ldr)   r2, [r0]
         mov     r0, #0
         mov     pc, lr
diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
index 7db25990c589..3d73dcb959b0 100644
--- a/arch/arm/lib/putuser.S
+++ b/arch/arm/lib/putuser.S
@@ -16,6 +16,7 @@
  * __put_user_X
  *
  * Inputs:      r0 contains the address
+ *              r1 contains the address limit, which must be preserved
  *              r2, r3 contains the value
  * Outputs:     r0 is the error code
  *              lr corrupted
@@ -27,16 +28,19 @@
  * Note also that it is intended that __put_user_bad is not global.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 
 ENTRY(__put_user_1)
+        check_uaccess r0, 1, r1, ip, __put_user_bad
 1: TUSER(strb)  r2, [r0]
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__put_user_1)
 
 ENTRY(__put_user_2)
+        check_uaccess r0, 2, r1, ip, __put_user_bad
         mov     ip, r2, lsr #8
 #ifdef CONFIG_THUMB2_KERNEL
 #ifndef __ARMEB__
@@ -60,12 +64,14 @@ ENTRY(__put_user_2)
 ENDPROC(__put_user_2)
 
 ENTRY(__put_user_4)
+        check_uaccess r0, 4, r1, ip, __put_user_bad
 4: TUSER(str)   r2, [r0]
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__put_user_4)
 
 ENTRY(__put_user_8)
+        check_uaccess r0, 8, r1, ip, __put_user_bad
 #ifdef CONFIG_THUMB2_KERNEL
 5: TUSER(str)   r2, [r0]
 6: TUSER(str)   r3, [r0, #4]
diff --git a/arch/arm/mach-imx/clk-imx25.c b/arch/arm/mach-imx/clk-imx25.c
index fdd8cc87c9fe..d20d4795f4ea 100644
--- a/arch/arm/mach-imx/clk-imx25.c
+++ b/arch/arm/mach-imx/clk-imx25.c
@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void)
         clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0");
         clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0");
         clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0");
-        clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0");
-        clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0");
-        clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1");
-        clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1");
+        clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0");
+        clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1");
         clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0");
         clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0");
         clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0");
@@ -243,6 +241,6 @@ int __init mx25_clocks_init(void)
         clk_register_clkdev(clk[sdma_ahb], "ahb", "imx35-sdma");
         clk_register_clkdev(clk[iim_ipg], "iim", NULL);
 
-        mxc_timer_init(MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), 54);
+        mxc_timer_init(MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), MX25_INT_GPT1);
         return 0;
 }
diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
index c6422fb10bae..65fb8bcd86cb 100644
--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -230,10 +230,8 @@ int __init mx35_clocks_init()
         clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb");
         clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1");
         clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma");
-        clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0");
-        clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0");
-        clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1");
-        clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1");
+        clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0");
+        clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1");
         /* i.mx35 has the i.mx21 type uart */
         clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0");
         clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0");
diff --git a/arch/arm/mach-imx/mach-armadillo5x0.c b/arch/arm/mach-imx/mach-armadillo5x0.c
index 2c6ab3273f9e..5985ed1b8c98 100644
--- a/arch/arm/mach-imx/mach-armadillo5x0.c
+++ b/arch/arm/mach-imx/mach-armadillo5x0.c
@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(void)
         imx31_add_mxc_nand(&armadillo5x0_nand_board_info);
 
         /* set NAND page size to 2k if not configured via boot mode pins */
-        __raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR);
+        __raw_writel(__raw_readl(mx3_ccm_base + MXC_CCM_RCSR) |
+                                        (1 << 30), mx3_ccm_base + MXC_CCM_RCSR);
 
         /* RTC */
         /* Get RTC IRQ and register the chip */
diff --git a/arch/arm/mach-mxs/mach-mxs.c b/arch/arm/mach-mxs/mach-mxs.c
index 8dabfe81d07c..ff886e01a0b0 100644
--- a/arch/arm/mach-mxs/mach-mxs.c
+++ b/arch/arm/mach-mxs/mach-mxs.c
@@ -261,7 +261,7 @@ static void __init apx4devkit_init(void)
         enable_clk_enet_out();
 
         if (IS_BUILTIN(CONFIG_PHYLIB))
-                phy_register_fixup_for_uid(PHY_ID_KS8051, MICREL_PHY_ID_MASK,
+                phy_register_fixup_for_uid(PHY_ID_KSZ8051, MICREL_PHY_ID_MASK,
                                            apx4devkit_phy_fixup);
 
         mxsfb_pdata.mode_list = apx4devkit_video_modes;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index fcd4e85c4ddc..346fd26f3aa6 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -232,10 +232,11 @@ config MACH_OMAP3_PANDORA
         select OMAP_PACKAGE_CBB
         select REGULATOR_FIXED_VOLTAGE if REGULATOR
 
-config MACH_OMAP3_TOUCHBOOK
+config MACH_TOUCHBOOK
         bool "OMAP3 Touch Book"
         depends on ARCH_OMAP3
         default y
+        select OMAP_PACKAGE_CBB
 
 config MACH_OMAP_3430SDP
         bool "OMAP 3430 SDP board"
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index f6a24b3f9c4f..34c2c7f59f0a 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -255,7 +255,7 @@ obj-$(CONFIG_MACH_OMAP_3630SDP)		+= board-zoom-display.o
 obj-$(CONFIG_MACH_CM_T35)               += board-cm-t35.o
 obj-$(CONFIG_MACH_CM_T3517)             += board-cm-t3517.o
 obj-$(CONFIG_MACH_IGEP0020)             += board-igep0020.o
-obj-$(CONFIG_MACH_OMAP3_TOUCHBOOK)      += board-omap3touchbook.o
+obj-$(CONFIG_MACH_TOUCHBOOK)            += board-omap3touchbook.o
 obj-$(CONFIG_MACH_OMAP_4430SDP)         += board-4430sdp.o
 obj-$(CONFIG_MACH_OMAP4_PANDA)          += board-omap4panda.o
 
diff --git a/arch/arm/mach-omap2/clock33xx_data.c b/arch/arm/mach-omap2/clock33xx_data.c
index 25bbcc7ca4dc..ae27de8899a6 100644
--- a/arch/arm/mach-omap2/clock33xx_data.c
+++ b/arch/arm/mach-omap2/clock33xx_data.c
@@ -1036,13 +1036,13 @@ static struct omap_clk am33xx_clks[] = {
         CLK(NULL,       "mmu_fck",              &mmu_fck,       CK_AM33XX),
         CLK(NULL,       "smartreflex0_fck",     &smartreflex0_fck,      CK_AM33XX),
         CLK(NULL,       "smartreflex1_fck",     &smartreflex1_fck,      CK_AM33XX),
-        CLK(NULL,       "gpt1_fck",             &timer1_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt2_fck",             &timer2_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt3_fck",             &timer3_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt4_fck",             &timer4_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt5_fck",             &timer5_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt6_fck",             &timer6_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt7_fck",             &timer7_fck,    CK_AM33XX),
+        CLK(NULL,       "timer1_fck",           &timer1_fck,    CK_AM33XX),
+        CLK(NULL,       "timer2_fck",           &timer2_fck,    CK_AM33XX),
+        CLK(NULL,       "timer3_fck",           &timer3_fck,    CK_AM33XX),
+        CLK(NULL,       "timer4_fck",           &timer4_fck,    CK_AM33XX),
+        CLK(NULL,       "timer5_fck",           &timer5_fck,    CK_AM33XX),
+        CLK(NULL,       "timer6_fck",           &timer6_fck,    CK_AM33XX),
+        CLK(NULL,       "timer7_fck",           &timer7_fck,    CK_AM33XX),
         CLK(NULL,       "usbotg_fck",           &usbotg_fck,    CK_AM33XX),
         CLK(NULL,       "ieee5000_fck",         &ieee5000_fck,  CK_AM33XX),
         CLK(NULL,       "wdt1_fck",             &wdt1_fck,      CK_AM33XX),
diff --git a/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c b/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
index a0d68dbecfa3..f99e65cfb862 100644
--- a/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
+++ b/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
@@ -241,6 +241,52 @@ static void omap3_clkdm_deny_idle(struct clockdomain *clkdm)
                 _clkdm_del_autodeps(clkdm);
 }
 
+static int omap3xxx_clkdm_clk_enable(struct clockdomain *clkdm)
+{
+        bool hwsup = false;
+
+        if (!clkdm->clktrctrl_mask)
+                return 0;
+
+        hwsup = omap2_cm_is_clkdm_in_hwsup(clkdm->pwrdm.ptr->prcm_offs,
+                                clkdm->clktrctrl_mask);
+
+        if (hwsup) {
+                /* Disable HW transitions when we are changing deps */
+                _disable_hwsup(clkdm);
+                _clkdm_add_autodeps(clkdm);
+                _enable_hwsup(clkdm);
+        } else {
+                if (clkdm->flags & CLKDM_CAN_FORCE_WAKEUP)
+                        omap3_clkdm_wakeup(clkdm);
+        }
+
+        return 0;
+}
+
+static int omap3xxx_clkdm_clk_disable(struct clockdomain *clkdm)
+{
+        bool hwsup = false;
+
+        if (!clkdm->clktrctrl_mask)
+                return 0;
+
+        hwsup = omap2_cm_is_clkdm_in_hwsup(clkdm->pwrdm.ptr->prcm_offs,
+                                clkdm->clktrctrl_mask);
+
+        if (hwsup) {
+                /* Disable HW transitions when we are changing deps */
+                _disable_hwsup(clkdm);
+                _clkdm_del_autodeps(clkdm);
+                _enable_hwsup(clkdm);
+        } else {
+                if (clkdm->flags & CLKDM_CAN_FORCE_SLEEP)
+                        omap3_clkdm_sleep(clkdm);
+        }
+
+        return 0;
+}
+
 struct clkdm_ops omap2_clkdm_operations = {
         .clkdm_add_wkdep        = omap2_clkdm_add_wkdep,
         .clkdm_del_wkdep        = omap2_clkdm_del_wkdep,
@@ -267,6 +313,6 @@ struct clkdm_ops omap3_clkdm_operations = {
         .clkdm_wakeup           = omap3_clkdm_wakeup,
         .clkdm_allow_idle       = omap3_clkdm_allow_idle,
         .clkdm_deny_idle        = omap3_clkdm_deny_idle,
-        .clkdm_clk_enable       = omap2_clkdm_clk_enable,
-        .clkdm_clk_disable      = omap2_clkdm_clk_disable,
+        .clkdm_clk_enable       = omap3xxx_clkdm_clk_enable,
+        .clkdm_clk_disable      = omap3xxx_clkdm_clk_disable,
 };
diff --git a/arch/arm/mach-omap2/cm-regbits-34xx.h b/arch/arm/mach-omap2/cm-regbits-34xx.h
index 766338fe4d34..975f6bda0e0b 100644
--- a/arch/arm/mach-omap2/cm-regbits-34xx.h
+++ b/arch/arm/mach-omap2/cm-regbits-34xx.h
@@ -67,6 +67,7 @@
 #define OMAP3430_EN_IVA2_DPLL_MASK                      (0x7 << 0)
 
 /* CM_IDLEST_IVA2 */
+#define OMAP3430_ST_IVA2_SHIFT                          0
 #define OMAP3430_ST_IVA2_MASK                           (1 << 0)
 
 /* CM_IDLEST_PLL_IVA2 */
diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
index 05fdebfaa195..330d4c6e746b 100644
--- a/arch/arm/mach-omap2/omap-wakeupgen.c
+++ b/arch/arm/mach-omap2/omap-wakeupgen.c
@@ -46,7 +46,7 @@
 static void __iomem *wakeupgen_base;
 static void __iomem *sar_base;
 static DEFINE_SPINLOCK(wakeupgen_lock);
-static unsigned int irq_target_cpu[NR_IRQS];
+static unsigned int irq_target_cpu[MAX_IRQS];
 static unsigned int irq_banks = MAX_NR_REG_BANKS;
 static unsigned int max_irqs = MAX_IRQS;
 static unsigned int omap_secure_apis;
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 6ca8e519968d..37afbd173c2c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1889,6 +1889,7 @@ static int _enable(struct omap_hwmod *oh)
                         _enable_sysc(oh);
                 }
         } else {
+                _omap4_disable_module(oh);
                 _disable_clocks(oh);
                 pr_debug("omap_hwmod: %s: _wait_target_ready: %d\n",
                          oh->name, r);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index c9e38200216b..ce7e6068768f 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -100,9 +100,9 @@ static struct omap_hwmod omap3xxx_mpu_hwmod = {
 
 /* IVA2 (IVA2) */
 static struct omap_hwmod_rst_info omap3xxx_iva_resets[] = {
-        { .name = "logic", .rst_shift = 0 },
-        { .name = "seq0", .rst_shift = 1 },
-        { .name = "seq1", .rst_shift = 2 },
+        { .name = "logic", .rst_shift = 0, .st_shift = 8 },
+        { .name = "seq0", .rst_shift = 1, .st_shift = 9 },
+        { .name = "seq1", .rst_shift = 2, .st_shift = 10 },
 };
 
 static struct omap_hwmod omap3xxx_iva_hwmod = {
@@ -112,6 +112,15 @@ static struct omap_hwmod omap3xxx_iva_hwmod = {
         .rst_lines      = omap3xxx_iva_resets,
         .rst_lines_cnt  = ARRAY_SIZE(omap3xxx_iva_resets),
         .main_clk       = "iva2_ck",
+        .prcm = {
+                .omap2 = {
+                        .module_offs = OMAP3430_IVA2_MOD,
+                        .prcm_reg_id = 1,
+                        .module_bit = OMAP3430_CM_FCLKEN_IVA2_EN_IVA2_SHIFT,
+                        .idlest_reg_id = 1,
+                        .idlest_idle_bit = OMAP3430_ST_IVA2_SHIFT,
+                }
+        },
 };
 
 /* timer class */
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 242aee498ceb..afb60917a948 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -4210,7 +4210,7 @@ static struct omap_hwmod_ocp_if omap44xx_dsp__iva = {
 };
 
 /* dsp -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_dsp__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_dsp__sl2if = {
         .master         = &omap44xx_dsp_hwmod,
         .slave          = &omap44xx_sl2if_hwmod,
         .clk            = "dpll_iva_m5x2_ck",
@@ -4828,7 +4828,7 @@ static struct omap_hwmod_ocp_if omap44xx_l3_main_2__iss = {
 };
 
 /* iva -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_iva__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_iva__sl2if = {
         .master         = &omap44xx_iva_hwmod,
         .slave          = &omap44xx_sl2if_hwmod,
         .clk            = "dpll_iva_m5x2_ck",
@@ -5362,7 +5362,7 @@ static struct omap_hwmod_ocp_if omap44xx_l4_wkup__scrm = {
 };
 
 /* l3_main_2 -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_l3_main_2__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_l3_main_2__sl2if = {
         .master         = &omap44xx_l3_main_2_hwmod,
         .slave          = &omap44xx_sl2if_hwmod,
         .clk            = "l3_div_ck",
@@ -6032,7 +6032,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
         &omap44xx_l4_abe__dmic,
         &omap44xx_l4_abe__dmic_dma,
         &omap44xx_dsp__iva,
-        &omap44xx_dsp__sl2if,
+        /* &omap44xx_dsp__sl2if, */
         &omap44xx_l4_cfg__dsp,
         &omap44xx_l3_main_2__dss,
         &omap44xx_l4_per__dss,
@@ -6068,7 +6068,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
         &omap44xx_l4_per__i2c4,
         &omap44xx_l3_main_2__ipu,
         &omap44xx_l3_main_2__iss,
-        &omap44xx_iva__sl2if,
+        /* &omap44xx_iva__sl2if, */
         &omap44xx_l3_main_2__iva,
         &omap44xx_l4_wkup__kbd,
         &omap44xx_l4_cfg__mailbox,
@@ -6099,7 +6099,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
         &omap44xx_l4_cfg__cm_core,
         &omap44xx_l4_wkup__prm,
         &omap44xx_l4_wkup__scrm,
-        &omap44xx_l3_main_2__sl2if,
+        /* &omap44xx_l3_main_2__sl2if, */
         &omap44xx_l4_abe__slimbus1,
         &omap44xx_l4_abe__slimbus1_dma,
         &omap44xx_l4_per__slimbus2,
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 2ff6d41ec6c6..2ba4f57dda86 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -260,6 +260,7 @@ static u32 notrace dmtimer_read_sched_clock(void)
         return 0;
 }
 
+#ifdef CONFIG_OMAP_32K_TIMER
 /* Setup free-running counter for clocksource */
 static int __init omap2_sync32k_clocksource_init(void)
 {
@@ -299,6 +300,12 @@ static int __init omap2_sync32k_clocksource_init(void)
 
         return ret;
 }
+#else
+static inline int omap2_sync32k_clocksource_init(void)
+{
+        return -ENODEV;
+}
+#endif
 
 static void __init omap2_gptimer_clocksource_init(int gptimer_id,
                                                 const char *fck_source)
diff --git a/arch/arm/mach-orion5x/common.c b/arch/arm/mach-orion5x/common.c
index 410291c67666..a6cd14ab1e4e 100644
--- a/arch/arm/mach-orion5x/common.c
+++ b/arch/arm/mach-orion5x/common.c
@@ -204,6 +204,13 @@ void __init orion5x_wdt_init(void)
 void __init orion5x_init_early(void)
 {
         orion_time_set_base(TIMER_VIRT_BASE);
+
+        /*
+         * Some Orion5x devices allocate their coherent buffers from atomic
+         * context. Increase size of atomic coherent pool to make sure such
+         * the allocations won't fail.
+         */
+        init_dma_coherent_pool_size(SZ_1M);
 }
 
 int orion5x_tclk;
diff --git a/arch/arm/mach-shmobile/board-kzm9g.c b/arch/arm/mach-shmobile/board-kzm9g.c
index 53b7ea92c32c..3b8a0171c3cb 100644
--- a/arch/arm/mach-shmobile/board-kzm9g.c
+++ b/arch/arm/mach-shmobile/board-kzm9g.c
@@ -346,11 +346,11 @@ static struct resource sh_mmcif_resources[] = {
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
-                .start  = gic_spi(141),
+                .start  = gic_spi(140),
                 .flags  = IORESOURCE_IRQ,
         },
         [2] = {
-                .start  = gic_spi(140),
+                .start  = gic_spi(141),
                 .flags  = IORESOURCE_IRQ,
         },
 };
diff --git a/arch/arm/mach-tegra/board-harmony-power.c b/arch/arm/mach-tegra/board-harmony-power.c
index b7344beec102..94486e7e9dfd 100644
--- a/arch/arm/mach-tegra/board-harmony-power.c
+++ b/arch/arm/mach-tegra/board-harmony-power.c
@@ -67,6 +67,13 @@ static struct regulator_init_data ldo0_data = {
                 },                                                      \
         }
 
+static struct regulator_init_data sys_data = {
+        .supply_regulator = "vdd_5v0",
+        .constraints = {
+                .name = "vdd_sys",
+        },
+};
+
 HARMONY_REGULATOR_INIT(sm0,  "vdd_sm0",  "vdd_sys", 725, 1500, 1);
 HARMONY_REGULATOR_INIT(sm1,  "vdd_sm1",  "vdd_sys", 725, 1500, 1);
 HARMONY_REGULATOR_INIT(sm2,  "vdd_sm2",  "vdd_sys", 3000, 4550, 1);
@@ -74,7 +81,7 @@ HARMONY_REGULATOR_INIT(ldo1, "vdd_ldo1", "vdd_sm2", 725, 1500, 1);
 HARMONY_REGULATOR_INIT(ldo2, "vdd_ldo2", "vdd_sm2", 725, 1500, 0);
 HARMONY_REGULATOR_INIT(ldo3, "vdd_ldo3", "vdd_sm2", 1250, 3300, 1);
 HARMONY_REGULATOR_INIT(ldo4, "vdd_ldo4", "vdd_sm2", 1700, 2475, 1);
-HARMONY_REGULATOR_INIT(ldo5, "vdd_ldo5", NULL,      1250, 3300, 1);
+HARMONY_REGULATOR_INIT(ldo5, "vdd_ldo5", "vdd_sys", 1250, 3300, 1);
 HARMONY_REGULATOR_INIT(ldo6, "vdd_ldo6", "vdd_sm2", 1250, 3300, 0);
 HARMONY_REGULATOR_INIT(ldo7, "vdd_ldo7", "vdd_sm2", 1250, 3300, 0);
 HARMONY_REGULATOR_INIT(ldo8, "vdd_ldo8", "vdd_sm2", 1250, 3300, 0);
@@ -88,6 +95,7 @@ HARMONY_REGULATOR_INIT(ldo9, "vdd_ldo9", "vdd_sm2", 1250, 3300, 1);
         }
 
 static struct tps6586x_subdev_info tps_devs[] = {
+        TPS_REG(SYS, &sys_data),
         TPS_REG(SM_0, &sm0_data),
         TPS_REG(SM_1, &sm1_data),
         TPS_REG(SM_2, &sm2_data),
@@ -120,7 +128,7 @@ static struct i2c_board_info __initdata harmony_regulators[] = {
 
 int __init harmony_regulator_init(void)
 {
-        regulator_register_always_on(0, "vdd_sys",
+        regulator_register_always_on(0, "vdd_5v0",
                 NULL, 0, 5000000);
 
         if (machine_is_harmony()) {
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 119bc52ab93e..4e07eec1270d 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -63,10 +63,11 @@ static int contextidr_notifier(struct notifier_block *unused, unsigned long cmd,
         pid = task_pid_nr(thread->task) << ASID_BITS;
         asm volatile(
         "       mrc     p15, 0, %0, c13, c0, 1\n"
-        "       bfi     %1, %0, #0, %2\n"
-        "       mcr     p15, 0, %1, c13, c0, 1\n"
+        "       and     %0, %0, %2\n"
+        "       orr     %0, %0, %1\n"
+        "       mcr     p15, 0, %0, c13, c0, 1\n"
         : "=r" (contextidr), "+r" (pid)
-        : "I" (ASID_BITS));
+        : "I" (~ASID_MASK));
         isb();
 
         return NOTIFY_OK;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 051204fc4617..13f555d62491 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -346,6 +346,8 @@ static int __init atomic_pool_init(void)
                        (unsigned)pool->size / 1024);
                 return 0;
         }
+
+        kfree(pages);
 no_pages:
         kfree(bitmap);
 no_bitmap:
@@ -489,7 +491,7 @@ static bool __in_atomic_pool(void *start, size_t size)
         void *pool_start = pool->vaddr;
         void *pool_end = pool->vaddr + pool->size;
 
-        if (start < pool_start || start > pool_end)
+        if (start < pool_start || start >= pool_end)
                 return false;
 
         if (end <= pool_end)
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index 6776160618ef..a8ee92da3544 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
 /* permanent static mappings from iotable_init() */
 #define VM_ARM_STATIC_MAPPING   0x40000000
 
+/* empty mapping */
+#define VM_ARM_EMPTY_MAPPING    0x20000000
+
 /* mapping type (attributes) for permanent static mappings */
 #define VM_ARM_MTYPE(mt)                ((mt) << 20)
 #define VM_ARM_MTYPE_MASK       (0x1f << 20)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4c2d0451e84a..c2fa21d0103e 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -807,7 +807,7 @@ static void __init pmd_empty_section_gap(unsigned long addr)
         vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
         vm->addr = (void *)addr;
         vm->size = SECTION_SIZE;
-        vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
+        vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING;
         vm->caller = pmd_empty_section_gap;
         vm_area_add_early(vm);
 }
@@ -820,7 +820,7 @@ static void __init fill_pmd_gaps(void)
 
         /* we're still single threaded hence no lock needed here */
         for (vm = vmlist; vm; vm = vm->next) {
-                if (!(vm->flags & VM_ARM_STATIC_MAPPING))
+                if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING)))
                         continue;
                 addr = (unsigned long)vm->addr;
                 if (addr < next)
@@ -961,8 +961,8 @@ void __init sanity_check_meminfo(void)
                  * Check whether this memory bank would partially overlap
                  * the vmalloc area.
                  */
-                if (__va(bank->start + bank->size) > vmalloc_min ||
-                    __va(bank->start + bank->size) < __va(bank->start)) {
+                if (__va(bank->start + bank->size - 1) >= vmalloc_min ||
+                    __va(bank->start + bank->size - 1) <= __va(bank->start)) {
                         unsigned long newsize = vmalloc_min - __va(bank->start);
                         printk(KERN_NOTICE "Truncating RAM at %.8llx-%.8llx "
                                "to -%.8llx (vmalloc region overlap).\n",
diff --git a/arch/arm/plat-mxc/include/mach/mx25.h b/arch/arm/plat-mxc/include/mach/mx25.h
index 627d94f1b010..ec466400a200 100644
--- a/arch/arm/plat-mxc/include/mach/mx25.h
+++ b/arch/arm/plat-mxc/include/mach/mx25.h
@@ -98,6 +98,7 @@
 #define MX25_INT_UART1          (NR_IRQS_LEGACY + 45)
 #define MX25_INT_GPIO2          (NR_IRQS_LEGACY + 51)
 #define MX25_INT_GPIO1          (NR_IRQS_LEGACY + 52)
+#define MX25_INT_GPT1           (NR_IRQS_LEGACY + 54)
 #define MX25_INT_FEC            (NR_IRQS_LEGACY + 57)
 
 #define MX25_DMA_REQ_SSI2_RX1   22
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 766181cb5c95..024f3b08db29 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -68,6 +68,7 @@
 
 static unsigned long omap_sram_start;
 static void __iomem *omap_sram_base;
+static unsigned long omap_sram_skip;
 static unsigned long omap_sram_size;
 static void __iomem *omap_sram_ceil;
 
@@ -106,6 +107,7 @@ static int is_sram_locked(void)
  */
 static void __init omap_detect_sram(void)
 {
+        omap_sram_skip = SRAM_BOOTLOADER_SZ;
         if (cpu_class_is_omap2()) {
                 if (is_sram_locked()) {
                         if (cpu_is_omap34xx()) {
@@ -113,6 +115,7 @@ static void __init omap_detect_sram(void)
                                 if ((omap_type() == OMAP2_DEVICE_TYPE_EMU) ||
                                     (omap_type() == OMAP2_DEVICE_TYPE_SEC)) {
                                         omap_sram_size = 0x7000; /* 28K */
+                                        omap_sram_skip += SZ_16K;
                                 } else {
                                         omap_sram_size = 0x8000; /* 32K */
                                 }
@@ -175,8 +178,10 @@ static void __init omap_map_sram(void)
                 return;
 
 #ifdef CONFIG_OMAP4_ERRATA_I688
+        if (cpu_is_omap44xx()) {
                 omap_sram_start += PAGE_SIZE;
                 omap_sram_size -= SZ_16K;
+        }
 #endif
         if (cpu_is_omap34xx()) {
                 /*
@@ -203,8 +208,8 @@ static void __init omap_map_sram(void)
          * Looks like we need to preserve some bootloader code at the
          * beginning of SRAM for jumping to flash for reboot to work...
          */
-        memset_io(omap_sram_base + SRAM_BOOTLOADER_SZ, 0,
-                  omap_sram_size - SRAM_BOOTLOADER_SZ);
+        memset_io(omap_sram_base + omap_sram_skip, 0,
+                  omap_sram_size - omap_sram_skip);
 }
 
 /*
@@ -218,7 +223,7 @@ void *omap_sram_push_address(unsigned long size)
 {
         unsigned long available, new_ceil = (unsigned long)omap_sram_ceil;
 
-        available = omap_sram_ceil - (omap_sram_base + SRAM_BOOTLOADER_SZ);
+        available = omap_sram_ceil - (omap_sram_base + omap_sram_skip);
 
         if (size > available) {
                 pr_err("Not enough space in SRAM\n");
diff --git a/arch/arm/plat-samsung/clock.c b/arch/arm/plat-samsung/clock.c
index 65c5eca475e7..d1116e2dfbea 100644
--- a/arch/arm/plat-samsung/clock.c
+++ b/arch/arm/plat-samsung/clock.c
@@ -144,6 +144,7 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
 
 int clk_set_rate(struct clk *clk, unsigned long rate)
 {
+        unsigned long flags;
         int ret;
 
         if (IS_ERR(clk))
@@ -159,9 +160,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
         if (clk->ops == NULL || clk->ops->set_rate == NULL)
                 return -EINVAL;
 
-        spin_lock(&clocks_lock);
+        spin_lock_irqsave(&clocks_lock, flags);
         ret = (clk->ops->set_rate)(clk, rate);
-        spin_unlock(&clocks_lock);
+        spin_unlock_irqrestore(&clocks_lock, flags);
 
         return ret;
 }
@@ -173,17 +174,18 @@ struct clk *clk_get_parent(struct clk *clk)
 
 int clk_set_parent(struct clk *clk, struct clk *parent)
 {
+        unsigned long flags;
         int ret = 0;
 
         if (IS_ERR(clk))
                 return -EINVAL;
 
-        spin_lock(&clocks_lock);
+        spin_lock_irqsave(&clocks_lock, flags);
 
         if (clk->ops && clk->ops->set_parent)
                 ret = (clk->ops->set_parent)(clk, parent);
 
-        spin_unlock(&clocks_lock);
+        spin_unlock_irqrestore(&clocks_lock, flags);
 
         return ret;
 }
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index f34861920634..c7092e6057c5 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -38,6 +38,7 @@ config BLACKFIN
         select GENERIC_ATOMIC64
         select GENERIC_IRQ_PROBE
         select IRQ_PER_CPU if SMP
+        select USE_GENERIC_SMP_HELPERS if SMP
         select HAVE_NMI_WATCHDOG if NMI_WATCHDOG
         select GENERIC_SMP_IDLE_THREAD
         select ARCH_USES_GETTIMEOFFSET if !GENERIC_CLOCKEVENTS
diff --git a/arch/blackfin/Makefile b/arch/blackfin/Makefile
index d3d7e64ca96d..66cf00095b84 100644
--- a/arch/blackfin/Makefile
+++ b/arch/blackfin/Makefile
@@ -20,7 +20,6 @@ endif
 KBUILD_AFLAGS           += $(call cc-option,-mno-fdpic)
 KBUILD_CFLAGS_MODULE    += -mlong-calls
 LDFLAGS                 += -m elf32bfin
-KALLSYMS         += --symbol-prefix=_
 
 KBUILD_DEFCONFIG := BF537-STAMP_defconfig
 
diff --git a/arch/blackfin/include/asm/smp.h b/arch/blackfin/include/asm/smp.h
index dc3d144b4bb5..9631598dcc5d 100644
--- a/arch/blackfin/include/asm/smp.h
+++ b/arch/blackfin/include/asm/smp.h
@@ -18,6 +18,8 @@
 #define raw_smp_processor_id()  blackfin_core_id()
 
 extern void bfin_relocate_coreb_l1_mem(void);
+extern void arch_send_call_function_single_ipi(int cpu);
+extern void arch_send_call_function_ipi_mask(const struct cpumask *mask);
 
 #if defined(CONFIG_SMP) && defined(CONFIG_ICACHE_FLUSH_L1)
 asmlinkage void blackfin_icache_flush_range_l1(unsigned long *ptr);
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index 00bbe672b3b3..a40151306b77 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -48,10 +48,13 @@ unsigned long blackfin_iflush_l1_entry[NR_CPUS];
 
 struct blackfin_initial_pda __cpuinitdata initial_pda_coreb;
 
-#define BFIN_IPI_TIMER        0
-#define BFIN_IPI_RESCHEDULE   1
-#define BFIN_IPI_CALL_FUNC    2
-#define BFIN_IPI_CPU_STOP     3
+enum ipi_message_type {
+        BFIN_IPI_TIMER,
+        BFIN_IPI_RESCHEDULE,
+        BFIN_IPI_CALL_FUNC,
+        BFIN_IPI_CALL_FUNC_SINGLE,
+        BFIN_IPI_CPU_STOP,
+};
 
 struct blackfin_flush_data {
         unsigned long start;
@@ -60,35 +63,20 @@ struct blackfin_flush_data {
 
 void *secondary_stack;
 
-
-struct smp_call_struct {
-        void (*func)(void *info);
-        void *info;
-        int wait;
-        cpumask_t *waitmask;
-};
-
 static struct blackfin_flush_data smp_flush_data;
 
 static DEFINE_SPINLOCK(stop_lock);
 
-struct ipi_message {
-        unsigned long type;
-        struct smp_call_struct call_struct;
-};
-
 /* A magic number - stress test shows this is safe for common cases */
 #define BFIN_IPI_MSGQ_LEN 5
 
 /* Simple FIFO buffer, overflow leads to panic */
-struct ipi_message_queue {
-        spinlock_t lock;
+struct ipi_data {
         unsigned long count;
-        unsigned long head; /* head of the queue */
-        struct ipi_message ipi_message[BFIN_IPI_MSGQ_LEN];
+        unsigned long bits;
 };
 
-static DEFINE_PER_CPU(struct ipi_message_queue, ipi_msg_queue);
+static DEFINE_PER_CPU(struct ipi_data, bfin_ipi);
 
 static void ipi_cpu_stop(unsigned int cpu)
 {
@@ -129,28 +117,6 @@ static void ipi_flush_icache(void *info)
         blackfin_icache_flush_range(fdata->start, fdata->end);
 }
 
-static void ipi_call_function(unsigned int cpu, struct ipi_message *msg)
-{
-        int wait;
-        void (*func)(void *info);
-        void *info;
-        func = msg->call_struct.func;
-        info = msg->call_struct.info;
-        wait = msg->call_struct.wait;
-        func(info);
-        if (wait) {
-#ifdef __ARCH_SYNC_CORE_DCACHE
-                /*
-                 * 'wait' usually means synchronization between CPUs.
-                 * Invalidate D cache in case shared data was changed
-                 * by func() to ensure cache coherence.
-                 */
-                resync_core_dcache();
-#endif
-                cpumask_clear_cpu(cpu, msg->call_struct.waitmask);
-        }
-}
-
 /* Use IRQ_SUPPLE_0 to request reschedule.
  * When returning from interrupt to user space,
  * there is chance to reschedule */
@@ -172,152 +138,95 @@ void ipi_timer(void)
 
 static irqreturn_t ipi_handler_int1(int irq, void *dev_instance)
 {
-        struct ipi_message *msg;
-        struct ipi_message_queue *msg_queue;
+        struct ipi_data *bfin_ipi_data;
         unsigned int cpu = smp_processor_id();
-        unsigned long flags;
+        unsigned long pending;
+        unsigned long msg;
 
         platform_clear_ipi(cpu, IRQ_SUPPLE_1);
 
-        msg_queue = &__get_cpu_var(ipi_msg_queue);
-
-        spin_lock_irqsave(&msg_queue->lock, flags);
-
-        while (msg_queue->count) {
-                msg = &msg_queue->ipi_message[msg_queue->head];
-                switch (msg->type) {
-                case BFIN_IPI_TIMER:
-                        ipi_timer();
-                        break;
-                case BFIN_IPI_RESCHEDULE:
-                        scheduler_ipi();
-                        break;
-                case BFIN_IPI_CALL_FUNC:
-                        ipi_call_function(cpu, msg);
-                        break;
-                case BFIN_IPI_CPU_STOP:
-                        ipi_cpu_stop(cpu);
-                        break;
-                default:
-                        printk(KERN_CRIT "CPU%u: Unknown IPI message 0x%lx\n",
-                               cpu, msg->type);
-                        break;
-                }
-                msg_queue->head++;
-                msg_queue->head %= BFIN_IPI_MSGQ_LEN;
-                msg_queue->count--;
+        bfin_ipi_data = &__get_cpu_var(bfin_ipi);
+
+        while ((pending = xchg(&bfin_ipi_data->bits, 0)) != 0) {
+                msg = 0;
+                do {
+                        msg = find_next_bit(&pending, BITS_PER_LONG, msg + 1);
+                        switch (msg) {
+                        case BFIN_IPI_TIMER:
+                                ipi_timer();
+                                break;
+                        case BFIN_IPI_RESCHEDULE:
+                                scheduler_ipi();
+                                break;
+                        case BFIN_IPI_CALL_FUNC:
+                                generic_smp_call_function_interrupt();
+                                break;
+
+                        case BFIN_IPI_CALL_FUNC_SINGLE:
+                                generic_smp_call_function_single_interrupt();
+                                break;
+
+                        case BFIN_IPI_CPU_STOP:
+                                ipi_cpu_stop(cpu);
+                                break;
+                        }
+                } while (msg < BITS_PER_LONG);
+
+                smp_mb();
         }
-        spin_unlock_irqrestore(&msg_queue->lock, flags);
         return IRQ_HANDLED;
 }
 
-static void ipi_queue_init(void)
+static void bfin_ipi_init(void)
 {
         unsigned int cpu;
-        struct ipi_message_queue *msg_queue;
+        struct ipi_data *bfin_ipi_data;
         for_each_possible_cpu(cpu) {
-                msg_queue = &per_cpu(ipi_msg_queue, cpu);
-                spin_lock_init(&msg_queue->lock);
-                msg_queue->count = 0;
-                msg_queue->head = 0;
+                bfin_ipi_data = &per_cpu(bfin_ipi, cpu);
+                bfin_ipi_data->bits = 0;
+                bfin_ipi_data->count = 0;
         }
 }
 
-static inline void smp_send_message(cpumask_t callmap, unsigned long type,
-                                        void (*func) (void *info), void *info, int wait)
+void send_ipi(const struct cpumask *cpumask, enum ipi_message_type msg)
 {
         unsigned int cpu;
-        struct ipi_message_queue *msg_queue;
-        struct ipi_message *msg;
-        unsigned long flags, next_msg;
-        cpumask_t waitmask; /* waitmask is shared by all cpus */
-
-        cpumask_copy(&waitmask, &callmap);
-        for_each_cpu(cpu, &callmap) {
-                msg_queue = &per_cpu(ipi_msg_queue, cpu);
-                spin_lock_irqsave(&msg_queue->lock, flags);
-                if (msg_queue->count < BFIN_IPI_MSGQ_LEN) {
-                        next_msg = (msg_queue->head + msg_queue->count)
-                                        % BFIN_IPI_MSGQ_LEN;
-                        msg = &msg_queue->ipi_message[next_msg];
-                        msg->type = type;
-                        if (type == BFIN_IPI_CALL_FUNC) {
-                                msg->call_struct.func = func;
-                                msg->call_struct.info = info;
-                                msg->call_struct.wait = wait;
-                                msg->call_struct.waitmask = &waitmask;
-                        }
-                        msg_queue->count++;
-                } else
-                        panic("IPI message queue overflow\n");
-                spin_unlock_irqrestore(&msg_queue->lock, flags);
+        struct ipi_data *bfin_ipi_data;
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        for_each_cpu(cpu, cpumask) {
+                bfin_ipi_data = &per_cpu(bfin_ipi, cpu);
+                smp_mb();
+                set_bit(msg, &bfin_ipi_data->bits);
+                bfin_ipi_data->count++;
                 platform_send_ipi_cpu(cpu, IRQ_SUPPLE_1);
         }
 
-        if (wait) {
-                while (!cpumask_empty(&waitmask))
-                        blackfin_dcache_invalidate_range(
-                                (unsigned long)(&waitmask),
-                                (unsigned long)(&waitmask));
-#ifdef __ARCH_SYNC_CORE_DCACHE
-                /*
-                 * Invalidate D cache in case shared data was changed by
-                 * other processors to ensure cache coherence.
-                 */
-                resync_core_dcache();
-#endif
-        }
+        local_irq_restore(flags);
 }
 
-int smp_call_function(void (*func)(void *info), void *info, int wait)
+void arch_send_call_function_single_ipi(int cpu)
 {
-        cpumask_t callmap;
-
-        preempt_disable();
-        cpumask_copy(&callmap, cpu_online_mask);
-        cpumask_clear_cpu(smp_processor_id(), &callmap);
-        if (!cpumask_empty(&callmap))
-                smp_send_message(callmap, BFIN_IPI_CALL_FUNC, func, info, wait);
-
-        preempt_enable();
-
-        return 0;
+        send_ipi(cpumask_of(cpu), BFIN_IPI_CALL_FUNC_SINGLE);
 }
-EXPORT_SYMBOL_GPL(smp_call_function);
 
-int smp_call_function_single(int cpuid, void (*func) (void *info), void *info,
-                                int wait)
+void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 {
-        unsigned int cpu = cpuid;
-        cpumask_t callmap;
-
-        if (cpu_is_offline(cpu))
-                return 0;
-        cpumask_clear(&callmap);
-        cpumask_set_cpu(cpu, &callmap);
-
-        smp_send_message(callmap, BFIN_IPI_CALL_FUNC, func, info, wait);
-
-        return 0;
+        send_ipi(mask, BFIN_IPI_CALL_FUNC);
 }
-EXPORT_SYMBOL_GPL(smp_call_function_single);
 
 void smp_send_reschedule(int cpu)
 {
-        cpumask_t callmap;
-        /* simply trigger an ipi */
-
-        cpumask_clear(&callmap);
-        cpumask_set_cpu(cpu, &callmap);
-
-        smp_send_message(callmap, BFIN_IPI_RESCHEDULE, NULL, NULL, 0);
+        send_ipi(cpumask_of(cpu), BFIN_IPI_RESCHEDULE);
 
         return;
 }
 
 void smp_send_msg(const struct cpumask *mask, unsigned long type)
 {
-        smp_send_message(*mask, type, NULL, NULL, 0);
+        send_ipi(mask, type);
 }
 
 void smp_timer_broadcast(const struct cpumask *mask)
@@ -333,7 +242,7 @@ void smp_send_stop(void)
         cpumask_copy(&callmap, cpu_online_mask);
         cpumask_clear_cpu(smp_processor_id(), &callmap);
         if (!cpumask_empty(&callmap))
-                smp_send_message(callmap, BFIN_IPI_CPU_STOP, NULL, NULL, 0);
+                send_ipi(&callmap, BFIN_IPI_CPU_STOP);
 
         preempt_enable();
 
@@ -436,7 +345,7 @@ void __init smp_prepare_boot_cpu(void)
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         platform_prepare_cpus(max_cpus);
-        ipi_queue_init();
+        bfin_ipi_init();
         platform_request_ipi(IRQ_SUPPLE_0, ipi_handler_int0);
         platform_request_ipi(IRQ_SUPPLE_1, ipi_handler_int1);
 }
diff --git a/arch/c6x/include/asm/Kbuild b/arch/c6x/include/asm/Kbuild
index 3af601e31e66..f08e89183cda 100644
--- a/arch/c6x/include/asm/Kbuild
+++ b/arch/c6x/include/asm/Kbuild
@@ -2,6 +2,7 @@ include include/asm-generic/Kbuild.asm
 
 generic-y += atomic.h
 generic-y += auxvec.h
+generic-y += barrier.h
 generic-y += bitsperlong.h
 generic-y += bugs.h
 generic-y += cputime.h
diff --git a/arch/c6x/include/asm/barrier.h b/arch/c6x/include/asm/barrier.h
deleted file mode 100644
index 538240e85909..000000000000
--- a/arch/c6x/include/asm/barrier.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- *  Port on Texas Instruments TMS320C6x architecture
- *
- *  Copyright (C) 2004, 2009, 2010, 2011 Texas Instruments Incorporated
- *  Author: Aurelien Jacquiot (aurelien.jacquiot@jaluna.com)
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- */
-#ifndef _ASM_C6X_BARRIER_H
-#define _ASM_C6X_BARRIER_H
-
-#define nop()                    asm("NOP\n");
-
-#define mb()                     barrier()
-#define rmb()                    barrier()
-#define wmb()                    barrier()
-#define set_mb(var, value)       do { var = value;  mb(); } while (0)
-#define set_wmb(var, value)      do { var = value; wmb(); } while (0)
-
-#define smp_mb()                 barrier()
-#define smp_rmb()                barrier()
-#define smp_wmb()                barrier()
-#define smp_read_barrier_depends()      do { } while (0)
-
-#endif /* _ASM_C6X_BARRIER_H */
diff --git a/arch/cris/kernel/process.c b/arch/cris/kernel/process.c
index 66fd01728790..7f65be6f7f17 100644
--- a/arch/cris/kernel/process.c
+++ b/arch/cris/kernel/process.c
@@ -25,6 +25,7 @@
 #include <linux/elfcore.h>
 #include <linux/mqueue.h>
 #include <linux/reboot.h>
+#include <linux/rcupdate.h>
 
 //#define DEBUG
 
@@ -74,6 +75,7 @@ void cpu_idle (void)
 {
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched()) {
                         void (*idle)(void);
                         /*
@@ -86,6 +88,7 @@ void cpu_idle (void)
                                 idle = default_idle;
                         idle();
                 }
+                rcu_idle_exit();
                 schedule_preempt_disabled();
         }
 }
diff --git a/arch/frv/kernel/process.c b/arch/frv/kernel/process.c
index ff95f50efea5..2eb7fa5bf9d8 100644
--- a/arch/frv/kernel/process.c
+++ b/arch/frv/kernel/process.c
@@ -25,6 +25,7 @@
 #include <linux/reboot.h>
 #include <linux/interrupt.h>
 #include <linux/pagemap.h>
+#include <linux/rcupdate.h>
 
 #include <asm/asm-offsets.h>
 #include <asm/uaccess.h>
@@ -69,12 +70,14 @@ void cpu_idle(void)
 {
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched()) {
                         check_pgt_cache();
 
                         if (!frv_dma_inprogress && idle)
                                 idle();
                 }
+                rcu_idle_exit();
 
                 schedule_preempt_disabled();
         }
diff --git a/arch/h8300/kernel/process.c b/arch/h8300/kernel/process.c
index 0e9c315be104..f153ed1a4c08 100644
--- a/arch/h8300/kernel/process.c
+++ b/arch/h8300/kernel/process.c
@@ -36,6 +36,7 @@
 #include <linux/reboot.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/rcupdate.h>
 
 #include <asm/uaccess.h>
 #include <asm/traps.h>
@@ -78,8 +79,10 @@ void (*idle)(void) = default_idle;
 void cpu_idle(void)
 {
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched())
                         idle();
+                rcu_idle_exit();
                 schedule_preempt_disabled();
         }
 }
diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
index dd6fc1449741..3e316ec0b835 100644
--- a/arch/ia64/kernel/process.c
+++ b/arch/ia64/kernel/process.c
@@ -29,6 +29,7 @@
 #include <linux/kdebug.h>
 #include <linux/utsname.h>
 #include <linux/tracehook.h>
+#include <linux/rcupdate.h>
 
 #include <asm/cpu.h>
 #include <asm/delay.h>
@@ -279,6 +280,7 @@ cpu_idle (void)
 
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 if (can_do_pal_halt) {
                         current_thread_info()->status &= ~TS_POLLING;
                         /*
@@ -309,6 +311,7 @@ cpu_idle (void)
                         normal_xtp();
 #endif
                 }
+                rcu_idle_exit();
                 schedule_preempt_disabled();
                 check_pgt_cache();
                 if (cpu_is_offline(cpu))
diff --git a/arch/m32r/kernel/process.c b/arch/m32r/kernel/process.c
index 3a4a32b27208..384e63f3a4c4 100644
--- a/arch/m32r/kernel/process.c
+++ b/arch/m32r/kernel/process.c
@@ -26,6 +26,7 @@
 #include <linux/ptrace.h>
 #include <linux/unistd.h>
 #include <linux/hardirq.h>
+#include <linux/rcupdate.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -82,6 +83,7 @@ void cpu_idle (void)
 {
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched()) {
                         void (*idle)(void) = pm_idle;
 
@@ -90,6 +92,7 @@ void cpu_idle (void)
 
                         idle();
                 }
+                rcu_idle_exit();
                 schedule_preempt_disabled();
         }
 }
diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
index c488e3cfab53..ac2892e49c7c 100644
--- a/arch/m68k/kernel/process.c
+++ b/arch/m68k/kernel/process.c
@@ -25,6 +25,7 @@
 #include <linux/reboot.h>
 #include <linux/init_task.h>
 #include <linux/mqueue.h>
+#include <linux/rcupdate.h>
 
 #include <asm/uaccess.h>
 #include <asm/traps.h>
@@ -75,8 +76,10 @@ void cpu_idle(void)
 {
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched())
                         idle();
+                rcu_idle_exit();
                 schedule_preempt_disabled();
         }
 }
diff --git a/arch/m68k/platform/coldfire/clk.c b/arch/m68k/platform/coldfire/clk.c
index 75f9ee967ea7..9cd13b4ce42b 100644
--- a/arch/m68k/platform/coldfire/clk.c
+++ b/arch/m68k/platform/coldfire/clk.c
@@ -146,9 +146,3 @@ struct clk_ops clk_ops1 = {
 };
 #endif /* MCFPM_PPMCR1 */
 #endif /* MCFPM_PPMCR0 */
-
-struct clk *devm_clk_get(struct device *dev, const char *id)
-{
-        return NULL;
-}
-EXPORT_SYMBOL(devm_clk_get);
diff --git a/arch/mips/kernel/smp-cmp.c b/arch/mips/kernel/smp-cmp.c
index e7e03ecf5495..afc379ca3753 100644
--- a/arch/mips/kernel/smp-cmp.c
+++ b/arch/mips/kernel/smp-cmp.c
@@ -102,7 +102,7 @@ static void cmp_init_secondary(void)
         c->vpe_id = (read_c0_tcbind() >> TCBIND_CURVPE_SHIFT) & TCBIND_CURVPE;
 #endif
 #ifdef CONFIG_MIPS_MT_SMTC
-        c->tc_id  = (read_c0_tcbind() >> TCBIND_CURTC_SHIFT) & TCBIND_CURTC;
+        c->tc_id  = (read_c0_tcbind() & TCBIND_CURTC) >> TCBIND_CURTC_SHIFT;
 #endif
 }
 
diff --git a/arch/mips/mm/gup.c b/arch/mips/mm/gup.c
index 33aadbcf170b..dcfd573871c1 100644
--- a/arch/mips/mm/gup.c
+++ b/arch/mips/mm/gup.c
@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsigned long addr, unsigned long end,
         do {
                 VM_BUG_ON(compound_head(page) != head);
                 pages[*nr] = page;
+                if (PageTail(page))
+                        get_huge_page_tail(page);
                 (*nr)++;
                 page++;
                 refs++;
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index 7b13a4caeea4..fea823f18479 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -273,16 +273,19 @@ asmlinkage void plat_irq_dispatch(void)
         unsigned int pending = read_c0_cause() & read_c0_status() & ST0_IM;
         int irq;
 
+        if (unlikely(!pending)) {
+                spurious_interrupt();
+                return;
+        }
+
         irq = irq_ffs(pending);
 
         if (irq == MIPSCPU_INT_I8259A)
                 malta_hw0_irqdispatch();
         else if (gic_present && ((1 << irq) & ipi_map[smp_processor_id()]))
                 malta_ipi_irqdispatch();
-        else if (irq >= 0)
-                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
         else
-                spurious_interrupt();
+                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
 }
 
 #ifdef CONFIG_MIPS_MT_SMP
diff --git a/arch/mips/mti-malta/malta-platform.c b/arch/mips/mti-malta/malta-platform.c
index 4c35301720e7..80562b81f0f2 100644
--- a/arch/mips/mti-malta/malta-platform.c
+++ b/arch/mips/mti-malta/malta-platform.c
@@ -138,11 +138,6 @@ static int __init malta_add_devices(void)
         if (err)
                 return err;
 
-        /*
-         * Set RTC to BCD mode to support current alarm code.
-         */
-        CMOS_WRITE(CMOS_READ(RTC_CONTROL) & ~RTC_DM_BINARY, RTC_CONTROL);
-
         return 0;
 }
 
diff --git a/arch/mn10300/kernel/process.c b/arch/mn10300/kernel/process.c
index 7dab0cd36466..e9cceba193b6 100644
--- a/arch/mn10300/kernel/process.c
+++ b/arch/mn10300/kernel/process.c
@@ -25,6 +25,7 @@
 #include <linux/err.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/rcupdate.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
@@ -107,6 +108,7 @@ void cpu_idle(void)
 {
         /* endless idle loop with no priority at all */
         for (;;) {
+                rcu_idle_enter();
                 while (!need_resched()) {
                         void (*idle)(void);
 
@@ -121,6 +123,7 @@ void cpu_idle(void)
                         }
                         idle();
                 }
+                rcu_idle_exit();
 
                 schedule_preempt_disabled();
         }
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index 2c05a9292a81..8c6b6b6561f0 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -48,6 +48,7 @@
 #include <linux/unistd.h>
 #include <linux/kallsyms.h>
 #include <linux/uaccess.h>
+#include <linux/rcupdate.h>
 
 #include <asm/io.h>
 #include <asm/asm-offsets.h>
@@ -69,8 +70,10 @@ void cpu_idle(void)
 
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched())
                         barrier();
+                rcu_idle_exit();
                 schedule_preempt_disabled();
                 check_pgt_cache();
         }
diff --git a/arch/powerpc/boot/.gitignore b/arch/powerpc/boot/.gitignore
index 1c1aadc8c48f..c32ae5ce9fff 100644
--- a/arch/powerpc/boot/.gitignore
+++ b/arch/powerpc/boot/.gitignore
@@ -1,10 +1,6 @@
 addnote
 empty.c
 hack-coff
-infblock.c
-infblock.h
-infcodes.c
-infcodes.h
 inffast.c
 inffast.h
 inffixed.h
diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
index 799ed0f1643d..2d6e6e380564 100644
--- a/arch/s390/include/asm/hugetlb.h
+++ b/arch/s390/include/asm/hugetlb.h
@@ -66,16 +66,6 @@ static inline pte_t huge_ptep_get(pte_t *ptep)
         return pte;
 }
 
-static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
-                                            unsigned long addr, pte_t *ptep)
-{
-        pte_t pte = huge_ptep_get(ptep);
-
-        mm->context.flush_mm = 1;
-        pmd_clear((pmd_t *) ptep);
-        return pte;
-}
-
 static inline void __pmd_csp(pmd_t *pmdp)
 {
         register unsigned long reg2 asm("2") = pmd_val(*pmdp);
@@ -117,6 +107,15 @@ static inline void huge_ptep_invalidate(struct mm_struct *mm,
                 __pmd_csp(pmdp);
 }
 
+static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+                                            unsigned long addr, pte_t *ptep)
+{
+        pte_t pte = huge_ptep_get(ptep);
+
+        huge_ptep_invalidate(mm, addr, ptep);
+        return pte;
+}
+
 #define huge_ptep_set_access_flags(__vma, __addr, __ptep, __entry, __dirty) \
 ({                                                                          \
         int __changed = !pte_same(huge_ptep_get(__ptep), __entry);          \
@@ -131,10 +130,7 @@ static inline void huge_ptep_invalidate(struct mm_struct *mm,
 ({                                                                      \
         pte_t __pte = huge_ptep_get(__ptep);                            \
         if (pte_write(__pte)) {                                         \
-                (__mm)->context.flush_mm = 1;                           \
-                if (atomic_read(&(__mm)->context.attach_count) > 1 ||   \
-                    (__mm) != current->active_mm)                       \
-                        huge_ptep_invalidate(__mm, __addr, __ptep);     \
+                huge_ptep_invalidate(__mm, __addr, __ptep);             \
                 set_huge_pte_at(__mm, __addr, __ptep,                   \
                                 huge_pte_wrprotect(__pte));             \
         }                                                               \
diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
index 9fde315f3a7c..1d8fe2b17ef6 100644
--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -90,12 +90,10 @@ static inline void __tlb_flush_mm(struct mm_struct * mm)
 
 static inline void __tlb_flush_mm_cond(struct mm_struct * mm)
 {
-        spin_lock(&mm->page_table_lock);
         if (mm->context.flush_mm) {
                 __tlb_flush_mm(mm);
                 mm->context.flush_mm = 0;
         }
-        spin_unlock(&mm->page_table_lock);
 }
 
 /*
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index f86c81e13c37..40b57693de38 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -974,11 +974,13 @@ static void __init setup_hwcaps(void)
         if (MACHINE_HAS_HPAGE)
                 elf_hwcap |= HWCAP_S390_HPAGE;
 
+#if defined(CONFIG_64BIT)
         /*
          * 64-bit register support for 31-bit processes
          * HWCAP_S390_HIGH_GPRS is bit 9.
          */
         elf_hwcap |= HWCAP_S390_HIGH_GPRS;
+#endif
 
         get_cpu_id(&cpu_id);
         switch (cpu_id.machine) {
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 60ee2b883797..2d37bb861faf 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -2,69 +2,82 @@
  *  User access functions based on page table walks for enhanced
  *  system layout without hardware support.
  *
- *    Copyright IBM Corp. 2006
+ *    Copyright IBM Corp. 2006, 2012
  *    Author(s): Gerald Schaefer (gerald.schaefer@de.ibm.com)
  */
 
 #include <linux/errno.h>
 #include <linux/hardirq.h>
 #include <linux/mm.h>
+#include <linux/hugetlb.h>
 #include <asm/uaccess.h>
 #include <asm/futex.h>
 #include "uaccess.h"
 
-static inline pte_t *follow_table(struct mm_struct *mm, unsigned long addr)
+
+/*
+ * Returns kernel address for user virtual address. If the returned address is
+ * >= -4095 (IS_ERR_VALUE(x) returns true), a fault has occured and the address
+ * contains the (negative) exception code.
+ */
+static __always_inline unsigned long follow_table(struct mm_struct *mm,
+                                                  unsigned long addr, int write)
 {
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
+        pte_t *ptep;
 
         pgd = pgd_offset(mm, addr);
         if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
-                return (pte_t *) 0x3a;
+                return -0x3aUL;
 
         pud = pud_offset(pgd, addr);
         if (pud_none(*pud) || unlikely(pud_bad(*pud)))
-                return (pte_t *) 0x3b;
+                return -0x3bUL;
 
         pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd)))
-                return (pte_t *) 0x10;
+        if (pmd_none(*pmd))
+                return -0x10UL;
+        if (pmd_huge(*pmd)) {
+                if (write && (pmd_val(*pmd) & _SEGMENT_ENTRY_RO))
+                        return -0x04UL;
+                return (pmd_val(*pmd) & HPAGE_MASK) + (addr & ~HPAGE_MASK);
+        }
+        if (unlikely(pmd_bad(*pmd)))
+                return -0x10UL;
+
+        ptep = pte_offset_map(pmd, addr);
+        if (!pte_present(*ptep))
+                return -0x11UL;
+        if (write && !pte_write(*ptep))
+                return -0x04UL;
 
-        return pte_offset_map(pmd, addr);
+        return (pte_val(*ptep) & PAGE_MASK) + (addr & ~PAGE_MASK);
 }
 
 static __always_inline size_t __user_copy_pt(unsigned long uaddr, void *kptr,
                                              size_t n, int write_user)
 {
         struct mm_struct *mm = current->mm;
-        unsigned long offset, pfn, done, size;
-        pte_t *pte;
+        unsigned long offset, done, size, kaddr;
         void *from, *to;
 
         done = 0;
 retry:
         spin_lock(&mm->page_table_lock);
         do {
-                pte = follow_table(mm, uaddr);
-                if ((unsigned long) pte < 0x1000)
+                kaddr = follow_table(mm, uaddr, write_user);
+                if (IS_ERR_VALUE(kaddr))
                         goto fault;
-                if (!pte_present(*pte)) {
-                        pte = (pte_t *) 0x11;
-                        goto fault;
-                } else if (write_user && !pte_write(*pte)) {
-                        pte = (pte_t *) 0x04;
-                        goto fault;
-                }
 
-                pfn = pte_pfn(*pte);
-                offset = uaddr & (PAGE_SIZE - 1);
+                offset = uaddr & ~PAGE_MASK;
                 size = min(n - done, PAGE_SIZE - offset);
                 if (write_user) {
-                        to = (void *)((pfn << PAGE_SHIFT) + offset);
+                        to = (void *) kaddr;
                         from = kptr + done;
                 } else {
-                        from = (void *)((pfn << PAGE_SHIFT) + offset);
+                        from = (void *) kaddr;
                         to = kptr + done;
                 }
                 memcpy(to, from, size);
@@ -75,7 +88,7 @@ retry:
         return n - done;
 fault:
         spin_unlock(&mm->page_table_lock);
-        if (__handle_fault(uaddr, (unsigned long) pte, write_user))
+        if (__handle_fault(uaddr, -kaddr, write_user))
                 return n - done;
         goto retry;
 }
@@ -84,27 +97,22 @@ fault:
  * Do DAT for user address by page table walk, return kernel address.
  * This function needs to be called with current->mm->page_table_lock held.
  */
-static __always_inline unsigned long __dat_user_addr(unsigned long uaddr)
+static __always_inline unsigned long __dat_user_addr(unsigned long uaddr,
+                                                     int write)
 {
         struct mm_struct *mm = current->mm;
-        unsigned long pfn;
-        pte_t *pte;
+        unsigned long kaddr;
         int rc;
 
 retry:
-        pte = follow_table(mm, uaddr);
-        if ((unsigned long) pte < 0x1000)
-                goto fault;
-        if (!pte_present(*pte)) {
-                pte = (pte_t *) 0x11;
+        kaddr = follow_table(mm, uaddr, write);
+        if (IS_ERR_VALUE(kaddr))
                 goto fault;
-        }
 
-        pfn = pte_pfn(*pte);
-        return (pfn << PAGE_SHIFT) + (uaddr & (PAGE_SIZE - 1));
+        return kaddr;
 fault:
         spin_unlock(&mm->page_table_lock);
-        rc = __handle_fault(uaddr, (unsigned long) pte, 0);
+        rc = __handle_fault(uaddr, -kaddr, write);
         spin_lock(&mm->page_table_lock);
         if (!rc)
                 goto retry;
@@ -159,11 +167,9 @@ static size_t clear_user_pt(size_t n, void __user *to)
 
 static size_t strnlen_user_pt(size_t count, const char __user *src)
 {
-        char *addr;
         unsigned long uaddr = (unsigned long) src;
         struct mm_struct *mm = current->mm;
-        unsigned long offset, pfn, done, len;
-        pte_t *pte;
+        unsigned long offset, done, len, kaddr;
         size_t len_str;
 
         if (segment_eq(get_fs(), KERNEL_DS))
@@ -172,19 +178,13 @@ static size_t strnlen_user_pt(size_t count, const char __user *src)
 retry:
         spin_lock(&mm->page_table_lock);
         do {
-                pte = follow_table(mm, uaddr);
-                if ((unsigned long) pte < 0x1000)
-                        goto fault;
-                if (!pte_present(*pte)) {
-                        pte = (pte_t *) 0x11;
+                kaddr = follow_table(mm, uaddr, 0);
+                if (IS_ERR_VALUE(kaddr))
                         goto fault;
-                }
 
-                pfn = pte_pfn(*pte);
-                offset = uaddr & (PAGE_SIZE-1);
-                addr = (char *)(pfn << PAGE_SHIFT) + offset;
+                offset = uaddr & ~PAGE_MASK;
                 len = min(count - done, PAGE_SIZE - offset);
-                len_str = strnlen(addr, len);
+                len_str = strnlen((char *) kaddr, len);
                 done += len_str;
                 uaddr += len_str;
         } while ((len_str == len) && (done < count));
@@ -192,7 +192,7 @@ retry:
         return done + 1;
 fault:
         spin_unlock(&mm->page_table_lock);
-        if (__handle_fault(uaddr, (unsigned long) pte, 0))
+        if (__handle_fault(uaddr, -kaddr, 0))
                 return 0;
         goto retry;
 }
@@ -225,11 +225,10 @@ static size_t copy_in_user_pt(size_t n, void __user *to,
                               const void __user *from)
 {
         struct mm_struct *mm = current->mm;
-        unsigned long offset_from, offset_to, offset_max, pfn_from, pfn_to,
-                      uaddr, done, size, error_code;
+        unsigned long offset_max, uaddr, done, size, error_code;
         unsigned long uaddr_from = (unsigned long) from;
         unsigned long uaddr_to = (unsigned long) to;
-        pte_t *pte_from, *pte_to;
+        unsigned long kaddr_to, kaddr_from;
         int write_user;
 
         if (segment_eq(get_fs(), KERNEL_DS)) {
@@ -242,38 +241,23 @@ retry:
         do {
                 write_user = 0;
                 uaddr = uaddr_from;
-                pte_from = follow_table(mm, uaddr_from);
-                error_code = (unsigned long) pte_from;
-                if (error_code < 0x1000)
-                        goto fault;
-                if (!pte_present(*pte_from)) {
-                        error_code = 0x11;
+                kaddr_from = follow_table(mm, uaddr_from, 0);
+                error_code = kaddr_from;
+                if (IS_ERR_VALUE(error_code))
                         goto fault;
-                }
 
                 write_user = 1;
                 uaddr = uaddr_to;
-                pte_to = follow_table(mm, uaddr_to);
-                error_code = (unsigned long) pte_to;
-                if (error_code < 0x1000)
-                        goto fault;
-                if (!pte_present(*pte_to)) {
-                        error_code = 0x11;
+                kaddr_to = follow_table(mm, uaddr_to, 1);
+                error_code = (unsigned long) kaddr_to;
+                if (IS_ERR_VALUE(error_code))
                         goto fault;
-                } else if (!pte_write(*pte_to)) {
-                        error_code = 0x04;
-                        goto fault;
-                }
 
-                pfn_from = pte_pfn(*pte_from);
-                pfn_to = pte_pfn(*pte_to);
-                offset_from = uaddr_from & (PAGE_SIZE-1);
-                offset_to = uaddr_from & (PAGE_SIZE-1);
-                offset_max = max(offset_from, offset_to);
+                offset_max = max(uaddr_from & ~PAGE_MASK,
+                                 uaddr_to & ~PAGE_MASK);
                 size = min(n - done, PAGE_SIZE - offset_max);
 
-                memcpy((void *)(pfn_to << PAGE_SHIFT) + offset_to,
-                       (void *)(pfn_from << PAGE_SHIFT) + offset_from, size);
+                memcpy((void *) kaddr_to, (void *) kaddr_from, size);
                 done += size;
                 uaddr_from += size;
                 uaddr_to += size;
@@ -282,7 +266,7 @@ retry:
         return n - done;
 fault:
         spin_unlock(&mm->page_table_lock);
-        if (__handle_fault(uaddr, error_code, write_user))
+        if (__handle_fault(uaddr, -error_code, write_user))
                 return n - done;
         goto retry;
 }
@@ -341,7 +325,7 @@ int futex_atomic_op_pt(int op, u32 __user *uaddr, int oparg, int *old)
                 return __futex_atomic_op_pt(op, uaddr, oparg, old);
         spin_lock(&current->mm->page_table_lock);
         uaddr = (u32 __force __user *)
-                __dat_user_addr((__force unsigned long) uaddr);
+                __dat_user_addr((__force unsigned long) uaddr, 1);
         if (!uaddr) {
                 spin_unlock(&current->mm->page_table_lock);
                 return -EFAULT;
@@ -378,7 +362,7 @@ int futex_atomic_cmpxchg_pt(u32 *uval, u32 __user *uaddr,
                 return __futex_atomic_cmpxchg_pt(uval, uaddr, oldval, newval);
         spin_lock(&current->mm->page_table_lock);
         uaddr = (u32 __force __user *)
-                __dat_user_addr((__force unsigned long) uaddr);
+                __dat_user_addr((__force unsigned long) uaddr, 1);
         if (!uaddr) {
                 spin_unlock(&current->mm->page_table_lock);
                 return -EFAULT;
diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
index 2707023c7563..637970cfd3f4 100644
--- a/arch/score/kernel/process.c
+++ b/arch/score/kernel/process.c
@@ -27,6 +27,7 @@
 #include <linux/reboot.h>
 #include <linux/elfcore.h>
 #include <linux/pm.h>
+#include <linux/rcupdate.h>
 
 void (*pm_power_off)(void);
 EXPORT_SYMBOL(pm_power_off);
@@ -50,9 +51,10 @@ void __noreturn cpu_idle(void)
 {
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched())
                         barrier();
-
+                rcu_idle_exit();
                 schedule_preempt_disabled();
         }
 }
diff --git a/arch/sh/kernel/cpu/sh5/entry.S b/arch/sh/kernel/cpu/sh5/entry.S
index b7cf6a547f11..7e605b95592a 100644
--- a/arch/sh/kernel/cpu/sh5/entry.S
+++ b/arch/sh/kernel/cpu/sh5/entry.S
@@ -933,7 +933,7 @@ ret_with_reschedule:
 
         pta     restore_all, tr1
 
-        movi    _TIF_SIGPENDING, r8
+        movi    (_TIF_SIGPENDING|_TIF_NOTIFY_RESUME), r8
         and     r8, r7, r8
         pta     work_notifysig, tr0
         bne     r8, ZERO, tr0
diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index f67601cb3f1f..b96489d8b27d 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -139,7 +139,7 @@ work_pending:
         ! r8: current_thread_info
         ! t:  result of "tst    #_TIF_NEED_RESCHED, r0"
         bf/s    work_resched
-         tst    #_TIF_SIGPENDING, r0
+         tst    #(_TIF_SIGPENDING | _TIF_NOTIFY_RESUME), r0
 work_notifysig:
         bt/s    __restore_all
          mov    r15, r4
diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
index 15e0a1693976..f1ddc0d23679 100644
--- a/arch/sparc/kernel/module.c
+++ b/arch/sparc/kernel/module.c
@@ -48,9 +48,7 @@ void *module_alloc(unsigned long size)
                 return NULL;
 
         ret = module_map(size);
-        if (!ret)
-                ret = ERR_PTR(-ENOMEM);
-        else
+        if (ret)
                 memset(ret, 0, size);
 
         return ret;
@@ -116,6 +114,10 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                 v = sym->st_value + rel[i].r_addend;
 
                 switch (ELF_R_TYPE(rel[i].r_info) & 0xff) {
+                case R_SPARC_DISP32:
+                        v -= (Elf_Addr) location;
+                        *loc32 = v;
+                        break;
 #ifdef CONFIG_SPARC64
                 case R_SPARC_64:
                         location[0] = v >> 56;
@@ -128,11 +130,6 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                         location[7] = v >>  0;
                         break;
 
-                case R_SPARC_DISP32:
-                        v -= (Elf_Addr) location;
-                        *loc32 = v;
-                        break;
-
                 case R_SPARC_WDISP19:
                         v -= (Elf_Addr) location;
                         *loc32 = (*loc32 & ~0x7ffff) |
diff --git a/arch/tile/include/gxio/iorpc_trio.h b/arch/tile/include/gxio/iorpc_trio.h
index 15fb77992083..58105c31228b 100644
--- a/arch/tile/include/gxio/iorpc_trio.h
+++ b/arch/tile/include/gxio/iorpc_trio.h
@@ -25,21 +25,23 @@
 #include <linux/module.h>
 #include <asm/pgtable.h>
 
-#define GXIO_TRIO_OP_ALLOC_ASIDS       IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1400)
+#define GXIO_TRIO_OP_DEALLOC_ASID      IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1400)
+#define GXIO_TRIO_OP_ALLOC_ASIDS       IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1401)
 
-#define GXIO_TRIO_OP_ALLOC_MEMORY_MAPS IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1402)
+#define GXIO_TRIO_OP_ALLOC_MEMORY_MAPS IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1404)
 
-#define GXIO_TRIO_OP_ALLOC_PIO_REGIONS IORPC_OPCODE(IORPC_FORMAT_NONE, 0x140e)
-#define GXIO_TRIO_OP_INIT_PIO_REGION_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x140f)
+#define GXIO_TRIO_OP_ALLOC_PIO_REGIONS IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1412)
 
-#define GXIO_TRIO_OP_INIT_MEMORY_MAP_MMU_AUX IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x1417)
-#define GXIO_TRIO_OP_GET_PORT_PROPERTY IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x1418)
-#define GXIO_TRIO_OP_CONFIG_LEGACY_INTR IORPC_OPCODE(IORPC_FORMAT_KERNEL_INTERRUPT, 0x1419)
-#define GXIO_TRIO_OP_CONFIG_MSI_INTR   IORPC_OPCODE(IORPC_FORMAT_KERNEL_INTERRUPT, 0x141a)
+#define GXIO_TRIO_OP_INIT_PIO_REGION_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1414)
 
-#define GXIO_TRIO_OP_SET_MPS_MRS       IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x141c)
-#define GXIO_TRIO_OP_FORCE_RC_LINK_UP  IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x141d)
-#define GXIO_TRIO_OP_FORCE_EP_LINK_UP  IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x141e)
+#define GXIO_TRIO_OP_INIT_MEMORY_MAP_MMU_AUX IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x141e)
+#define GXIO_TRIO_OP_GET_PORT_PROPERTY IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x141f)
+#define GXIO_TRIO_OP_CONFIG_LEGACY_INTR IORPC_OPCODE(IORPC_FORMAT_KERNEL_INTERRUPT, 0x1420)
+#define GXIO_TRIO_OP_CONFIG_MSI_INTR   IORPC_OPCODE(IORPC_FORMAT_KERNEL_INTERRUPT, 0x1421)
+
+#define GXIO_TRIO_OP_SET_MPS_MRS       IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x1423)
+#define GXIO_TRIO_OP_FORCE_RC_LINK_UP  IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x1424)
+#define GXIO_TRIO_OP_FORCE_EP_LINK_UP  IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x1425)
 #define GXIO_TRIO_OP_GET_MMIO_BASE     IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8000)
 #define GXIO_TRIO_OP_CHECK_MMIO_OFFSET IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8001)
 
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 664a60e8dfb4..c17de0db6736 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -705,6 +705,7 @@ static void stack_proc(void *arg)
         struct task_struct *from = current, *to = arg;
 
         to->thread.saved_task = from;
+        rcu_switch(from, to);
         switch_to(from, to, from);
 }
 
diff --git a/arch/um/include/asm/processor-generic.h b/arch/um/include/asm/processor-generic.h
index 69f1c57a8d0d..33a6a2423bd2 100644
--- a/arch/um/include/asm/processor-generic.h
+++ b/arch/um/include/asm/processor-generic.h
@@ -20,14 +20,6 @@ struct mm_struct;
 
 struct thread_struct {
         struct task_struct *saved_task;
-        /*
-         * This flag is set to 1 before calling do_fork (and analyzed in
-         * copy_thread) to mark that we are begin called from userspace (fork /
-         * vfork / clone), and reset to 0 after. It is left to 0 when called
-         * from kernelspace (i.e. kernel_thread() or fork_idle(),
-         * as of 2.6.11).
-         */
-        int forking;
         struct pt_regs regs;
         int singlestep_syscall;
         void *fault_addr;
@@ -58,7 +50,6 @@ struct thread_struct {
 
 #define INIT_THREAD \
 { \
-        .forking                = 0, \
         .regs                   = EMPTY_REGS,   \
         .fault_addr             = NULL, \
         .prev_sched             = NULL, \
diff --git a/arch/um/include/shared/common-offsets.h b/arch/um/include/shared/common-offsets.h
index 40db8f71deae..2df313b6a586 100644
--- a/arch/um/include/shared/common-offsets.h
+++ b/arch/um/include/shared/common-offsets.h
@@ -7,16 +7,6 @@ DEFINE(UM_KERN_PAGE_MASK, PAGE_MASK);
 DEFINE(UM_KERN_PAGE_SHIFT, PAGE_SHIFT);
 DEFINE(UM_NSEC_PER_SEC, NSEC_PER_SEC);
 
-DEFINE_STR(UM_KERN_EMERG, KERN_EMERG);
-DEFINE_STR(UM_KERN_ALERT, KERN_ALERT);
-DEFINE_STR(UM_KERN_CRIT, KERN_CRIT);
-DEFINE_STR(UM_KERN_ERR, KERN_ERR);
-DEFINE_STR(UM_KERN_WARNING, KERN_WARNING);
-DEFINE_STR(UM_KERN_NOTICE, KERN_NOTICE);
-DEFINE_STR(UM_KERN_INFO, KERN_INFO);
-DEFINE_STR(UM_KERN_DEBUG, KERN_DEBUG);
-DEFINE_STR(UM_KERN_CONT, KERN_CONT);
-
 DEFINE(UM_ELF_CLASS, ELF_CLASS);
 DEFINE(UM_ELFCLASS32, ELFCLASS32);
 DEFINE(UM_ELFCLASS64, ELFCLASS64);
diff --git a/arch/um/include/shared/user.h b/arch/um/include/shared/user.h
index 4fa82c055aab..cef068563336 100644
--- a/arch/um/include/shared/user.h
+++ b/arch/um/include/shared/user.h
@@ -26,6 +26,17 @@
 extern void panic(const char *fmt, ...)
         __attribute__ ((format (printf, 1, 2)));
 
+/* Requires preincluding include/linux/kern_levels.h */
+#define UM_KERN_EMERG   KERN_EMERG
+#define UM_KERN_ALERT   KERN_ALERT
+#define UM_KERN_CRIT    KERN_CRIT
+#define UM_KERN_ERR     KERN_ERR
+#define UM_KERN_WARNING KERN_WARNING
+#define UM_KERN_NOTICE  KERN_NOTICE
+#define UM_KERN_INFO    KERN_INFO
+#define UM_KERN_DEBUG   KERN_DEBUG
+#define UM_KERN_CONT    KERN_CONT
+
 #ifdef UML_CONFIG_PRINTK
 extern int printk(const char *fmt, ...)
         __attribute__ ((format (printf, 1, 2)));
diff --git a/arch/um/kernel/exec.c b/arch/um/kernel/exec.c
index 6cade9366364..8c82786da823 100644
--- a/arch/um/kernel/exec.c
+++ b/arch/um/kernel/exec.c
@@ -39,34 +39,21 @@ void flush_thread(void)
 
 void start_thread(struct pt_regs *regs, unsigned long eip, unsigned long esp)
 {
+        get_safe_registers(regs->regs.gp, regs->regs.fp);
         PT_REGS_IP(regs) = eip;
         PT_REGS_SP(regs) = esp;
-}
-EXPORT_SYMBOL(start_thread);
-
-static long execve1(const char *file,
-                    const char __user *const __user *argv,
-                    const char __user *const __user *env)
-{
-        long error;
-
-        error = do_execve(file, argv, env, &current->thread.regs);
-        if (error == 0) {
-                task_lock(current);
-                current->ptrace &= ~PT_DTRACE;
+        current->ptrace &= ~PT_DTRACE;
 #ifdef SUBARCH_EXECVE1
-                SUBARCH_EXECVE1(&current->thread.regs.regs);
+        SUBARCH_EXECVE1(regs->regs);
 #endif
-                task_unlock(current);
-        }
-        return error;
 }
+EXPORT_SYMBOL(start_thread);
 
 long um_execve(const char *file, const char __user *const __user *argv, const char __user *const __user *env)
 {
         long err;
 
-        err = execve1(file, argv, env);
+        err = do_execve(file, argv, env, &current->thread.regs);
         if (!err)
                 UML_LONGJMP(current->thread.exec_buf, 1);
         return err;
@@ -81,7 +68,7 @@ long sys_execve(const char __user *file, const char __user *const __user *argv,
         filename = getname(file);
         error = PTR_ERR(filename);
         if (IS_ERR(filename)) goto out;
-        error = execve1(filename, argv, env);
+        error = do_execve(filename, argv, env, &current->thread.regs);
         putname(filename);
  out:
         return error;
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index 57fc7028714a..c5f5afa50745 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -181,11 +181,12 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
                 struct pt_regs *regs)
 {
         void (*handler)(void);
+        int kthread = current->flags & PF_KTHREAD;
         int ret = 0;
 
         p->thread = (struct thread_struct) INIT_THREAD;
 
-        if (current->thread.forking) {
+        if (!kthread) {
                 memcpy(&p->thread.regs.regs, &regs->regs,
                        sizeof(p->thread.regs.regs));
                 PT_REGS_SET_SYSCALL_RETURN(&p->thread.regs, 0);
@@ -195,8 +196,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
                 handler = fork_handler;
 
                 arch_copy_thread(&current->thread.arch, &p->thread.arch);
-        }
-        else {
+        } else {
                 get_safe_registers(p->thread.regs.regs.gp, p->thread.regs.regs.fp);
                 p->thread.request.u.thread = current->thread.request.u.thread;
                 handler = new_thread_handler;
@@ -204,7 +204,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
 
         new_thread(task_stack_page(p), &p->thread.switch_buf, handler);
 
-        if (current->thread.forking) {
+        if (!kthread) {
                 clear_flushed_tls(p);
 
                 /*
diff --git a/arch/um/kernel/signal.c b/arch/um/kernel/signal.c
index 7362d58efc29..cc9c2350e417 100644
--- a/arch/um/kernel/signal.c
+++ b/arch/um/kernel/signal.c
@@ -22,9 +22,13 @@ static void handle_signal(struct pt_regs *regs, unsigned long signr,
                          struct k_sigaction *ka, siginfo_t *info)
 {
         sigset_t *oldset = sigmask_to_save();
+        int singlestep = 0;
         unsigned long sp;
         int err;
 
+        if ((current->ptrace & PT_DTRACE) && (current->ptrace & PT_PTRACED))
+                singlestep = 1;
+
         /* Did we come from a system call? */
         if (PT_REGS_SYSCALL_NR(regs) >= 0) {
                 /* If so, check system call restarting.. */
@@ -61,7 +65,7 @@ static void handle_signal(struct pt_regs *regs, unsigned long signr,
         if (err)
                 force_sigsegv(signr, current);
         else
-                signal_delivered(signr, info, ka, regs, 0);
+                signal_delivered(signr, info, ka, regs, singlestep);
 }
 
 static int kern_do_signal(struct pt_regs *regs)
diff --git a/arch/um/kernel/syscall.c b/arch/um/kernel/syscall.c
index f958cb876ee3..a4c6d8eee74c 100644
--- a/arch/um/kernel/syscall.c
+++ b/arch/um/kernel/syscall.c
@@ -17,25 +17,25 @@
 
 long sys_fork(void)
 {
-        long ret;
-
-        current->thread.forking = 1;
-        ret = do_fork(SIGCHLD, UPT_SP(&current->thread.regs.regs),
+        return do_fork(SIGCHLD, UPT_SP(&current->thread.regs.regs),
                       &current->thread.regs, 0, NULL, NULL);
-        current->thread.forking = 0;
-        return ret;
 }
 
 long sys_vfork(void)
 {
-        long ret;
-
-        current->thread.forking = 1;
-        ret = do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD,
+        return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD,
                       UPT_SP(&current->thread.regs.regs),
                       &current->thread.regs, 0, NULL, NULL);
-        current->thread.forking = 0;
-        return ret;
+}
+
+long sys_clone(unsigned long clone_flags, unsigned long newsp,
+               void __user *parent_tid, void __user *child_tid)
+{
+        if (!newsp)
+                newsp = UPT_SP(&current->thread.regs.regs);
+
+        return do_fork(clone_flags, newsp, &current->thread.regs, 0, parent_tid,
+                      child_tid);
 }
 
 long old_mmap(unsigned long addr, unsigned long len,
diff --git a/arch/um/scripts/Makefile.rules b/arch/um/scripts/Makefile.rules
index d50270d26b42..15889df9b466 100644
--- a/arch/um/scripts/Makefile.rules
+++ b/arch/um/scripts/Makefile.rules
@@ -8,7 +8,7 @@ USER_OBJS += $(filter %_user.o,$(obj-y) $(obj-m)  $(USER_SINGLE_OBJS))
 USER_OBJS := $(foreach file,$(USER_OBJS),$(obj)/$(file))
 
 $(USER_OBJS:.o=.%): \
-        c_flags = -Wp,-MD,$(depfile) $(USER_CFLAGS) -include user.h $(CFLAGS_$(basetarget).o)
+        c_flags = -Wp,-MD,$(depfile) $(USER_CFLAGS) -include $(srctree)/include/linux/kern_levels.h -include user.h $(CFLAGS_$(basetarget).o)
 
 # These are like USER_OBJS but filter USER_CFLAGS through unprofile instead of
 # using it directly.
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 28dd891a0a16..8ff1f56a0188 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -100,6 +100,7 @@ config X86
         select KTIME_SCALAR if X86_32
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
+        select HAVE_RCU_USER_QS if X86_64
 
 config INSTRUCTION_DECODER
         def_bool (KPROBES || PERF_EVENTS || UPROBES)
@@ -749,10 +750,10 @@ config SWIOTLB
         def_bool y if X86_64
         ---help---
           Support for software bounce buffers used on x86-64 systems
-          which don't have a hardware IOMMU (e.g. the current generation
-          of Intel's x86-64 CPUs). Using this PCI devices which can only
-          access 32-bits of memory can be used on systems with more than
-          3 GB of memory. If unsure, say Y.
+          which don't have a hardware IOMMU. Using this PCI devices
+          which can only access 32-bits of memory can be used on systems
+          with more than 3 GB of memory.
+          If unsure, say Y.
 
 config IOMMU_HELPER
         def_bool (CALGARY_IOMMU || GART_IOMMU || SWIOTLB || AMD_IOMMU)
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 682e9c210baa..474ca35b1bce 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -142,7 +142,7 @@ KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
 KBUILD_CFLAGS += $(mflags-y)
 KBUILD_AFLAGS += $(mflags-y)
 
-archscripts:
+archscripts: scripts_basic
         $(Q)$(MAKE) $(build)=arch/x86/tools relocs
 
 ###
diff --git a/arch/x86/include/asm/hpet.h b/arch/x86/include/asm/hpet.h
index 2c392d663dce..434e2106cc87 100644
--- a/arch/x86/include/asm/hpet.h
+++ b/arch/x86/include/asm/hpet.h
@@ -35,8 +35,6 @@
 #define HPET_ID_NUMBER_SHIFT    8
 #define HPET_ID_VENDOR_SHIFT    16
 
-#define HPET_ID_VENDOR_8086     0x8086
-
 #define HPET_CFG_ENABLE         0x001
 #define HPET_CFG_LEGACY         0x002
 #define HPET_LEGACY_8254        2
diff --git a/arch/x86/include/asm/rcu.h b/arch/x86/include/asm/rcu.h
new file mode 100644
index 000000000000..d1ac07a23979
--- /dev/null
+++ b/arch/x86/include/asm/rcu.h
@@ -0,0 +1,32 @@
+#ifndef _ASM_X86_RCU_H
+#define _ASM_X86_RCU_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/rcupdate.h>
+#include <asm/ptrace.h>
+
+static inline void exception_enter(struct pt_regs *regs)
+{
+        rcu_user_exit();
+}
+
+static inline void exception_exit(struct pt_regs *regs)
+{
+#ifdef CONFIG_RCU_USER_QS
+        if (user_mode(regs))
+                rcu_user_enter();
+#endif
+}
+
+#else /* __ASSEMBLY__ */
+
+#ifdef CONFIG_RCU_USER_QS
+# define SCHEDULE_USER call schedule_user
+#else
+# define SCHEDULE_USER call schedule
+#endif
+
+#endif /* !__ASSEMBLY__ */
+
+#endif
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 89f794f007ec..c535d847e3b5 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -89,6 +89,7 @@ struct thread_info {
 #define TIF_NOTSC               16      /* TSC is not accessible in userland */
 #define TIF_IA32                17      /* IA32 compatibility process */
 #define TIF_FORK                18      /* ret_from_fork */
+#define TIF_NOHZ                19      /* in adaptive nohz mode */
 #define TIF_MEMDIE              20      /* is terminating due to OOM killer */
 #define TIF_DEBUG               21      /* uses debug registers */
 #define TIF_IO_BITMAP           22      /* uses I/O bitmap */
@@ -114,6 +115,7 @@ struct thread_info {
 #define _TIF_NOTSC              (1 << TIF_NOTSC)
 #define _TIF_IA32               (1 << TIF_IA32)
 #define _TIF_FORK               (1 << TIF_FORK)
+#define _TIF_NOHZ               (1 << TIF_NOHZ)
 #define _TIF_DEBUG              (1 << TIF_DEBUG)
 #define _TIF_IO_BITMAP          (1 << TIF_IO_BITMAP)
 #define _TIF_FORCED_TF          (1 << TIF_FORCED_TF)
@@ -126,12 +128,13 @@ struct thread_info {
 /* work to do in syscall_trace_enter() */
 #define _TIF_WORK_SYSCALL_ENTRY \
         (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT |   \
-         _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT)
+         _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT |     \
+         _TIF_NOHZ)
 
 /* work to do in syscall_trace_leave() */
 #define _TIF_WORK_SYSCALL_EXIT  \
         (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP |    \
-         _TIF_SYSCALL_TRACEPOINT)
+         _TIF_SYSCALL_TRACEPOINT | _TIF_NOHZ)
 
 /* work to do on interrupt/exception return */
 #define _TIF_WORK_MASK                                                  \
@@ -141,7 +144,8 @@ struct thread_info {
 
 /* work to do on any return to user space */
 #define _TIF_ALLWORK_MASK                                               \
-        ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT)
+        ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT |       \
+        _TIF_NOHZ)
 
 /* Only used for 64 bit */
 #define _TIF_DO_NOTIFY_MASK                                             \
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 93971e841dd5..472b9b783019 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -51,7 +51,8 @@ extern unsigned long set_phys_range_identity(unsigned long pfn_s,
 
 extern int m2p_add_override(unsigned long mfn, struct page *page,
                             struct gnttab_map_grant_ref *kmap_op);
-extern int m2p_remove_override(struct page *page, bool clear_pte);
+extern int m2p_remove_override(struct page *page,
+                                struct gnttab_map_grant_ref *kmap_op);
 extern struct page *m2p_find_override(unsigned long mfn);
 extern unsigned long m2p_find_override_pfn(unsigned long mfn, unsigned long pfn);
 
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 6605a81ba339..8b6defe7eefc 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -586,6 +586,8 @@ extern struct event_constraint intel_westmere_pebs_event_constraints[];
 
 extern struct event_constraint intel_snb_pebs_event_constraints[];
 
+extern struct event_constraint intel_ivb_pebs_event_constraints[];
+
 struct event_constraint *intel_pebs_constraints(struct perf_event *event);
 
 void intel_pmu_pebs_enable(struct perf_event *event);
diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
index 7bfb5bec8630..eebd5ffe1bba 100644
--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
@@ -209,6 +209,15 @@ static int perf_ibs_precise_event(struct perf_event *event, u64 *config)
         return -EOPNOTSUPP;
 }
 
+static const struct perf_event_attr ibs_notsupp = {
+        .exclude_user   = 1,
+        .exclude_kernel = 1,
+        .exclude_hv     = 1,
+        .exclude_idle   = 1,
+        .exclude_host   = 1,
+        .exclude_guest  = 1,
+};
+
 static int perf_ibs_init(struct perf_event *event)
 {
         struct hw_perf_event *hwc = &event->hw;
@@ -229,6 +238,9 @@ static int perf_ibs_init(struct perf_event *event)
         if (event->pmu != &perf_ibs->pmu)
                 return -ENOENT;
 
+        if (perf_flags(&event->attr) & perf_flags(&ibs_notsupp))
+                return -EINVAL;
+
         if (config & ~perf_ibs->config_mask)
                 return -EINVAL;
 
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 7f2739e03e79..6bca492b8547 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2008,6 +2008,7 @@ __init int intel_pmu_init(void)
                 break;
 
         case 28: /* Atom */
+        case 54: /* Cedariew */
                 memcpy(hw_cache_event_ids, atom_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
 
@@ -2047,7 +2048,6 @@ __init int intel_pmu_init(void)
         case 42: /* SandyBridge */
         case 45: /* SandyBridge, "Romely-EP" */
                 x86_add_quirk(intel_sandybridge_quirk);
-        case 58: /* IvyBridge */
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
                 memcpy(hw_cache_extra_regs, snb_hw_cache_extra_regs,
@@ -2072,6 +2072,29 @@ __init int intel_pmu_init(void)
 
                 pr_cont("SandyBridge events, ");
                 break;
+        case 58: /* IvyBridge */
+                memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
+                       sizeof(hw_cache_event_ids));
+                memcpy(hw_cache_extra_regs, snb_hw_cache_extra_regs,
+                       sizeof(hw_cache_extra_regs));
+
+                intel_pmu_lbr_init_snb();
+
+                x86_pmu.event_constraints = intel_snb_event_constraints;
+                x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints;
+                x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
+                x86_pmu.extra_regs = intel_snb_extra_regs;
+                /* all extra regs are per-cpu when HT is on */
+                x86_pmu.er_flags |= ERF_HAS_RSP_1;
+                x86_pmu.er_flags |= ERF_NO_HT_SHARING;
+
+                /* UOPS_ISSUED.ANY,c=1,i=1 to count stall cycles */
+                intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] =
+                        X86_CONFIG(.event=0x0e, .umask=0x01, .inv=1, .cmask=1);
+
+                pr_cont("IvyBridge events, ");
+                break;
+
 
         default:
                 switch (x86_pmu.version) {
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index e38d97bf4259..826054a4f2ee 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -407,6 +407,20 @@ struct event_constraint intel_snb_pebs_event_constraints[] = {
         EVENT_CONSTRAINT_END
 };
 
+struct event_constraint intel_ivb_pebs_event_constraints[] = {
+        INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PRECDIST */
+        INTEL_UEVENT_CONSTRAINT(0x01c2, 0xf), /* UOPS_RETIRED.ALL */
+        INTEL_UEVENT_CONSTRAINT(0x02c2, 0xf), /* UOPS_RETIRED.RETIRE_SLOTS */
+        INTEL_EVENT_CONSTRAINT(0xc4, 0xf),    /* BR_INST_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xc5, 0xf),    /* BR_MISP_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xcd, 0x8),    /* MEM_TRANS_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd0, 0xf),    /* MEM_UOP_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd1, 0xf),    /* MEM_LOAD_UOPS_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd2, 0xf),    /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd3, 0xf),    /* MEM_LOAD_UOPS_LLC_MISS_RETIRED.* */
+        EVENT_CONSTRAINT_END
+};
+
 struct event_constraint *intel_pebs_constraints(struct perf_event *event)
 {
         struct event_constraint *c;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
index 520b4265fcd2..da02e9cc3754 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
@@ -686,7 +686,8 @@ void intel_pmu_lbr_init_atom(void)
          * to have an operational LBR which can freeze
          * on PMU interrupt
          */
-        if (boot_cpu_data.x86_mask < 10) {
+        if (boot_cpu_data.x86_model == 28
+            && boot_cpu_data.x86_mask < 10) {
                 pr_cont("LBR disabled due to erratum");
                 return;
         }
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 62ec3e6af7ea..db917ec89040 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -661,6 +661,11 @@ static void snb_uncore_msr_init_box(struct intel_uncore_box *box)
         }
 }
 
+static struct uncore_event_desc snb_uncore_events[] = {
+        INTEL_UNCORE_EVENT_DESC(clockticks, "event=0xff,umask=0x00"),
+        { /* end: all zeroes */ },
+};
+
 static struct attribute *snb_uncore_formats_attr[] = {
         &format_attr_event.attr,
         &format_attr_umask.attr,
@@ -704,6 +709,7 @@ static struct intel_uncore_type snb_uncore_cbox = {
         .constraints    = snb_uncore_cbox_constraints,
         .ops            = &snb_uncore_msr_ops,
         .format_group   = &snb_uncore_format_group,
+        .event_descs    = snb_uncore_events,
 };
 
 static struct intel_uncore_type *snb_msr_uncores[] = {
diff --git a/arch/x86/kernel/cpuid.c b/arch/x86/kernel/cpuid.c
index 39472dd2323f..60c78917190c 100644
--- a/arch/x86/kernel/cpuid.c
+++ b/arch/x86/kernel/cpuid.c
@@ -199,12 +199,14 @@ static int __init cpuid_init(void)
                 goto out_chrdev;
         }
         cpuid_class->devnode = cpuid_devnode;
+        get_online_cpus();
         for_each_online_cpu(i) {
                 err = cpuid_device_create(i);
                 if (err != 0)
                         goto out_class;
         }
         register_hotcpu_notifier(&cpuid_class_cpu_notifier);
+        put_online_cpus();
 
         err = 0;
         goto out;
@@ -214,6 +216,7 @@ out_class:
         for_each_online_cpu(i) {
                 cpuid_device_destroy(i);
         }
+        put_online_cpus();
         class_destroy(cpuid_class);
 out_chrdev:
         __unregister_chrdev(CPUID_MAJOR, 0, NR_CPUS, "cpu/cpuid");
@@ -225,11 +228,13 @@ static void __exit cpuid_exit(void)
 {
         int cpu = 0;
 
+        get_online_cpus();
         for_each_online_cpu(cpu)
                 cpuid_device_destroy(cpu);
         class_destroy(cpuid_class);
         __unregister_chrdev(CPUID_MAJOR, 0, NR_CPUS, "cpu/cpuid");
         unregister_hotcpu_notifier(&cpuid_class_cpu_notifier);
+        put_online_cpus();
 }
 
 module_init(cpuid_init);
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index e9cc2b32bdf4..4f0322e4ecee 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -56,6 +56,7 @@
 #include <asm/ftrace.h>
 #include <asm/percpu.h>
 #include <asm/asm.h>
+#include <asm/rcu.h>
 #include <linux/err.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
@@ -667,7 +668,7 @@ sysret_careful:
         TRACE_IRQS_ON
         ENABLE_INTERRUPTS(CLBR_NONE)
         pushq_cfi %rdi
-        call schedule
+        SCHEDULE_USER
         popq_cfi %rdi
         jmp sysret_check
 
@@ -780,7 +781,7 @@ int_careful:
         TRACE_IRQS_ON
         ENABLE_INTERRUPTS(CLBR_NONE)
         pushq_cfi %rdi
-        call schedule
+        SCHEDULE_USER
         popq_cfi %rdi
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
@@ -1076,7 +1077,7 @@ retint_careful:
         TRACE_IRQS_ON
         ENABLE_INTERRUPTS(CLBR_NONE)
         pushq_cfi %rdi
-        call  schedule
+        SCHEDULE_USER
         popq_cfi %rdi
         GET_THREAD_INFO(%rcx)
         DISABLE_INTERRUPTS(CLBR_NONE)
@@ -1551,7 +1552,7 @@ paranoid_userspace:
 paranoid_schedule:
         TRACE_IRQS_ON
         ENABLE_INTERRUPTS(CLBR_ANY)
-        call schedule
+        SCHEDULE_USER
         DISABLE_INTERRUPTS(CLBR_ANY)
         TRACE_IRQS_OFF
         jmp paranoid_userspace
diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
index eb113693f043..a7c5661f8496 100644
--- a/arch/x86/kernel/msr.c
+++ b/arch/x86/kernel/msr.c
@@ -257,12 +257,14 @@ static int __init msr_init(void)
                 goto out_chrdev;
         }
         msr_class->devnode = msr_devnode;
+        get_online_cpus();
         for_each_online_cpu(i) {
                 err = msr_device_create(i);
                 if (err != 0)
                         goto out_class;
         }
         register_hotcpu_notifier(&msr_class_cpu_notifier);
+        put_online_cpus();
 
         err = 0;
         goto out;
@@ -271,6 +273,7 @@ out_class:
         i = 0;
         for_each_online_cpu(i)
                 msr_device_destroy(i);
+        put_online_cpus();
         class_destroy(msr_class);
 out_chrdev:
         __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
@@ -281,11 +284,13 @@ out:
 static void __exit msr_exit(void)
 {
         int cpu = 0;
+        get_online_cpus();
         for_each_online_cpu(cpu)
                 msr_device_destroy(cpu);
         class_destroy(msr_class);
         __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
         unregister_hotcpu_notifier(&msr_class_cpu_notifier);
+        put_online_cpus();
 }
 
 module_init(msr_init);
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index c4c6a5c2bf0f..9f94f8ec26e4 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -21,6 +21,7 @@
 #include <linux/signal.h>
 #include <linux/perf_event.h>
 #include <linux/hw_breakpoint.h>
+#include <linux/rcupdate.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -1463,6 +1464,8 @@ long syscall_trace_enter(struct pt_regs *regs)
 {
         long ret = 0;
 
+        rcu_user_exit();
+
         /*
          * If we stepped into a sysenter/syscall insn, it trapped in
          * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
@@ -1526,4 +1529,6 @@ void syscall_trace_leave(struct pt_regs *regs)
                         !test_thread_flag(TIF_SYSCALL_EMU);
         if (step || test_thread_flag(TIF_SYSCALL_TRACE))
                 tracehook_report_syscall_exit(regs, step);
+
+        rcu_user_enter();
 }
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index b280908a376e..bca0ab903e57 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -779,6 +779,8 @@ static void do_signal(struct pt_regs *regs)
 void
 do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
 {
+        rcu_user_exit();
+
 #ifdef CONFIG_X86_MCE
         /* notify userspace of pending MCEs */
         if (thread_info_flags & _TIF_MCE_NOTIFY)
@@ -804,6 +806,8 @@ do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
 #ifdef CONFIG_X86_32
         clear_thread_flag(TIF_IRET);
 #endif /* CONFIG_X86_32 */
+
+        rcu_user_enter();
 }
 
 void signal_fault(struct pt_regs *regs, void __user *frame, char *where)
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index b481341c9369..378967578f22 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -55,6 +55,7 @@
 #include <asm/i387.h>
 #include <asm/fpu-internal.h>
 #include <asm/mce.h>
+#include <asm/rcu.h>
 
 #include <asm/mach_traps.h>
 
@@ -180,11 +181,15 @@ vm86_trap:
 #define DO_ERROR(trapnr, signr, str, name)                              \
 dotraplinkage void do_##name(struct pt_regs *regs, long error_code)     \
 {                                                                       \
-        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
-                                                        == NOTIFY_STOP) \
+        exception_enter(regs);                                          \
+        if (notify_die(DIE_TRAP, str, regs, error_code,                 \
+                        trapnr, signr) == NOTIFY_STOP) {                \
+                exception_exit(regs);                                   \
                 return;                                                 \
+        }                                                               \
         conditional_sti(regs);                                          \
         do_trap(trapnr, signr, str, regs, error_code, NULL);            \
+        exception_exit(regs);                                           \
 }
 
 #define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr)         \
@@ -195,11 +200,15 @@ dotraplinkage void do_##name(struct pt_regs *regs, long error_code)	\
         info.si_errno = 0;                                              \
         info.si_code = sicode;                                          \
         info.si_addr = (void __user *)siaddr;                           \
-        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
-                                                        == NOTIFY_STOP) \
+        exception_enter(regs);                                          \
+        if (notify_die(DIE_TRAP, str, regs, error_code,                 \
+                        trapnr, signr) == NOTIFY_STOP) {                \
+                exception_exit(regs);                                   \
                 return;                                                 \
+        }                                                               \
         conditional_sti(regs);                                          \
         do_trap(trapnr, signr, str, regs, error_code, &info);           \
+        exception_exit(regs);                                           \
 }
 
 DO_ERROR_INFO(X86_TRAP_DE, SIGFPE, "divide error", divide_error, FPE_INTDIV,
@@ -222,12 +231,14 @@ DO_ERROR_INFO(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check,
 /* Runs on IST stack */
 dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code)
 {
+        exception_enter(regs);
         if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
-                        X86_TRAP_SS, SIGBUS) == NOTIFY_STOP)
-                return;
-        preempt_conditional_sti(regs);
-        do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL);
-        preempt_conditional_cli(regs);
+                       X86_TRAP_SS, SIGBUS) != NOTIFY_STOP) {
+                preempt_conditional_sti(regs);
+                do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL);
+                preempt_conditional_cli(regs);
+        }
+        exception_exit(regs);
 }
 
 dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
@@ -235,6 +246,7 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
         static const char str[] = "double fault";
         struct task_struct *tsk = current;
 
+        exception_enter(regs);
         /* Return not checked because double check cannot be ignored */
         notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
 
@@ -255,16 +267,29 @@ do_general_protection(struct pt_regs *regs, long error_code)
 {
         struct task_struct *tsk;
 
+        exception_enter(regs);
         conditional_sti(regs);
 
 #ifdef CONFIG_X86_32
-        if (regs->flags & X86_VM_MASK)
-                goto gp_in_vm86;
+        if (regs->flags & X86_VM_MASK) {
+                local_irq_enable();
+                handle_vm86_fault((struct kernel_vm86_regs *) regs, error_code);
+                goto exit;
+        }
 #endif
 
         tsk = current;
-        if (!user_mode(regs))
-                goto gp_in_kernel;
+        if (!user_mode(regs)) {
+                if (fixup_exception(regs))
+                        goto exit;
+
+                tsk->thread.error_code = error_code;
+                tsk->thread.trap_nr = X86_TRAP_GP;
+                if (notify_die(DIE_GPF, "general protection fault", regs, error_code,
+                               X86_TRAP_GP, SIGSEGV) != NOTIFY_STOP)
+                        die("general protection fault", regs, error_code);
+                goto exit;
+        }
 
         tsk->thread.error_code = error_code;
         tsk->thread.trap_nr = X86_TRAP_GP;
@@ -279,25 +304,8 @@ do_general_protection(struct pt_regs *regs, long error_code)
         }
 
         force_sig(SIGSEGV, tsk);
-        return;
-
-#ifdef CONFIG_X86_32
-gp_in_vm86:
-        local_irq_enable();
-        handle_vm86_fault((struct kernel_vm86_regs *) regs, error_code);
-        return;
-#endif
-
-gp_in_kernel:
-        if (fixup_exception(regs))
-                return;
-
-        tsk->thread.error_code = error_code;
-        tsk->thread.trap_nr = X86_TRAP_GP;
-        if (notify_die(DIE_GPF, "general protection fault", regs, error_code,
-                        X86_TRAP_GP, SIGSEGV) == NOTIFY_STOP)
-                return;
-        die("general protection fault", regs, error_code);
+exit:
+        exception_exit(regs);
 }
 
 /* May run on IST stack. */
@@ -312,15 +320,16 @@ dotraplinkage void __kprobes notrace do_int3(struct pt_regs *regs, long error_co
             ftrace_int3_handler(regs))
                 return;
 #endif
+        exception_enter(regs);
 #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
         if (kgdb_ll_trap(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP,
                                 SIGTRAP) == NOTIFY_STOP)
-                return;
+                goto exit;
 #endif /* CONFIG_KGDB_LOW_LEVEL_TRAP */
 
         if (notify_die(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP,
                         SIGTRAP) == NOTIFY_STOP)
-                return;
+                goto exit;
 
         /*
          * Let others (NMI) know that the debug stack is in use
@@ -331,6 +340,8 @@ dotraplinkage void __kprobes notrace do_int3(struct pt_regs *regs, long error_co
         do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, NULL);
         preempt_conditional_cli(regs);
         debug_stack_usage_dec();
+exit:
+        exception_exit(regs);
 }
 
 #ifdef CONFIG_X86_64
@@ -391,6 +402,8 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
         unsigned long dr6;
         int si_code;
 
+        exception_enter(regs);
+
         get_debugreg(dr6, 6);
 
         /* Filter out all the reserved bits which are preset to 1 */
@@ -406,7 +419,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
 
         /* Catch kmemcheck conditions first of all! */
         if ((dr6 & DR_STEP) && kmemcheck_trap(regs))
-                return;
+                goto exit;
 
         /* DR6 may or may not be cleared by the CPU */
         set_debugreg(0, 6);
@@ -421,7 +434,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
 
         if (notify_die(DIE_DEBUG, "debug", regs, PTR_ERR(&dr6), error_code,
                                                         SIGTRAP) == NOTIFY_STOP)
-                return;
+                goto exit;
 
         /*
          * Let others (NMI) know that the debug stack is in use
@@ -437,7 +450,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
                                         X86_TRAP_DB);
                 preempt_conditional_cli(regs);
                 debug_stack_usage_dec();
-                return;
+                goto exit;
         }
 
         /*
@@ -458,7 +471,8 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
         preempt_conditional_cli(regs);
         debug_stack_usage_dec();
 
-        return;
+exit:
+        exception_exit(regs);
 }
 
 /*
@@ -555,14 +569,17 @@ dotraplinkage void do_coprocessor_error(struct pt_regs *regs, long error_code)
 #ifdef CONFIG_X86_32
         ignore_fpu_irq = 1;
 #endif
-
+        exception_enter(regs);
         math_error(regs, error_code, X86_TRAP_MF);
+        exception_exit(regs);
 }
 
 dotraplinkage void
 do_simd_coprocessor_error(struct pt_regs *regs, long error_code)
 {
+        exception_enter(regs);
         math_error(regs, error_code, X86_TRAP_XF);
+        exception_exit(regs);
 }
 
 dotraplinkage void
@@ -629,6 +646,7 @@ EXPORT_SYMBOL_GPL(math_state_restore);
 dotraplinkage void __kprobes
 do_device_not_available(struct pt_regs *regs, long error_code)
 {
+        exception_enter(regs);
 #ifdef CONFIG_MATH_EMULATION
         if (read_cr0() & X86_CR0_EM) {
                 struct math_emu_info info = { };
@@ -637,6 +655,7 @@ do_device_not_available(struct pt_regs *regs, long error_code)
 
                 info.regs = regs;
                 math_emulate(&info);
+                exception_exit(regs);
                 return;
         }
 #endif
@@ -644,12 +663,15 @@ do_device_not_available(struct pt_regs *regs, long error_code)
 #ifdef CONFIG_X86_32
         conditional_sti(regs);
 #endif
+        exception_exit(regs);
 }
 
 #ifdef CONFIG_X86_32
 dotraplinkage void do_iret_error(struct pt_regs *regs, long error_code)
 {
         siginfo_t info;
+
+        exception_enter(regs);
         local_irq_enable();
 
         info.si_signo = SIGILL;
@@ -657,10 +679,11 @@ dotraplinkage void do_iret_error(struct pt_regs *regs, long error_code)
         info.si_code = ILL_BADSTK;
         info.si_addr = NULL;
         if (notify_die(DIE_TRAP, "iret exception", regs, error_code,
-                        X86_TRAP_IRET, SIGILL) == NOTIFY_STOP)
-                return;
-        do_trap(X86_TRAP_IRET, SIGILL, "iret exception", regs, error_code,
-                &info);
+                        X86_TRAP_IRET, SIGILL) != NOTIFY_STOP) {
+                do_trap(X86_TRAP_IRET, SIGILL, "iret exception", regs, error_code,
+                        &info);
+        }
+        exception_exit(regs);
 }
 #endif
 
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index e498b18f010c..9fc9aa7ac703 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -318,7 +318,7 @@ static void pic_ioport_write(void *opaque, u32 addr, u32 val)
                 if (val & 0x10) {
                         u8 edge_irr = s->irr & ~s->elcr;
                         int i;
-                        bool found;
+                        bool found = false;
                         struct kvm_vcpu *vcpu;
 
                         s->init4 = val & 1;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c00f03de1b79..b1eb202ee76a 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3619,6 +3619,7 @@ static void seg_setup(int seg)
 
 static int alloc_apic_access_page(struct kvm *kvm)
 {
+        struct page *page;
         struct kvm_userspace_memory_region kvm_userspace_mem;
         int r = 0;
 
@@ -3633,7 +3634,13 @@ static int alloc_apic_access_page(struct kvm *kvm)
         if (r)
                 goto out;
 
-        kvm->arch.apic_access_page = gfn_to_page(kvm, 0xfee00);
+        page = gfn_to_page(kvm, 0xfee00);
+        if (is_error_page(page)) {
+                r = -EFAULT;
+                goto out;
+        }
+
+        kvm->arch.apic_access_page = page;
 out:
         mutex_unlock(&kvm->slots_lock);
         return r;
@@ -3641,6 +3648,7 @@ out:
 
 static int alloc_identity_pagetable(struct kvm *kvm)
 {
+        struct page *page;
         struct kvm_userspace_memory_region kvm_userspace_mem;
         int r = 0;
 
@@ -3656,8 +3664,13 @@ static int alloc_identity_pagetable(struct kvm *kvm)
         if (r)
                 goto out;
 
-        kvm->arch.ept_identity_pagetable = gfn_to_page(kvm,
-                        kvm->arch.ept_identity_map_addr >> PAGE_SHIFT);
+        page = gfn_to_page(kvm, kvm->arch.ept_identity_map_addr >> PAGE_SHIFT);
+        if (is_error_page(page)) {
+                r = -EFAULT;
+                goto out;
+        }
+
+        kvm->arch.ept_identity_pagetable = page;
 out:
         mutex_unlock(&kvm->slots_lock);
         return r;
@@ -6575,7 +6588,7 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
         /* Exposing INVPCID only when PCID is exposed */
         best = kvm_find_cpuid_entry(vcpu, 0x7, 0);
         if (vmx_invpcid_supported() &&
-            best && (best->ecx & bit(X86_FEATURE_INVPCID)) &&
+            best && (best->ebx & bit(X86_FEATURE_INVPCID)) &&
             guest_cpuid_has_pcid(vcpu)) {
                 exec_control |= SECONDARY_EXEC_ENABLE_INVPCID;
                 vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
@@ -6585,7 +6598,7 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
                 vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
                              exec_control);
                 if (best)
-                        best->ecx &= ~bit(X86_FEATURE_INVPCID);
+                        best->ebx &= ~bit(X86_FEATURE_INVPCID);
         }
 }
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 148ed666e311..2966c847d489 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5113,17 +5113,20 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu)
                         !kvm_event_needs_reinjection(vcpu);
 }
 
-static void vapic_enter(struct kvm_vcpu *vcpu)
+static int vapic_enter(struct kvm_vcpu *vcpu)
 {
         struct kvm_lapic *apic = vcpu->arch.apic;
         struct page *page;
 
         if (!apic || !apic->vapic_addr)
-                return;
+                return 0;
 
         page = gfn_to_page(vcpu->kvm, apic->vapic_addr >> PAGE_SHIFT);
+        if (is_error_page(page))
+                return -EFAULT;
 
         vcpu->arch.apic->vapic_page = page;
+        return 0;
 }
 
 static void vapic_exit(struct kvm_vcpu *vcpu)
@@ -5430,7 +5433,11 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
         }
 
         vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
-        vapic_enter(vcpu);
+        r = vapic_enter(vcpu);
+        if (r) {
+                srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
+                return r;
+        }
 
         r = 1;
         while (r > 0) {
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 76dcd9d8e0bc..7dde46d68a25 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -18,6 +18,7 @@
 #include <asm/pgalloc.h>                /* pgd_*(), ...                 */
 #include <asm/kmemcheck.h>              /* kmemcheck_*(), ...           */
 #include <asm/fixmap.h>                 /* VSYSCALL_START               */
+#include <asm/rcu.h>                    /* exception_enter(), ...       */
 
 /*
  * Page fault error code bits:
@@ -1000,8 +1001,8 @@ static int fault_in_kernel_space(unsigned long address)
  * and the problem, and then passes it off to one of the appropriate
  * routines.
  */
-dotraplinkage void __kprobes
-do_page_fault(struct pt_regs *regs, unsigned long error_code)
+static void __kprobes
+__do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
         struct vm_area_struct *vma;
         struct task_struct *tsk;
@@ -1209,3 +1210,11 @@ good_area:
 
         up_read(&mm->mmap_sem);
 }
+
+dotraplinkage void __kprobes
+do_page_fault(struct pt_regs *regs, unsigned long error_code)
+{
+        exception_enter(regs);
+        __do_page_fault(regs, error_code);
+        exception_exit(regs);
+}
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index e0e6990723e9..ab1f6a93b527 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -319,7 +319,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
  */
 int devmem_is_allowed(unsigned long pagenr)
 {
-        if (pagenr <= 256)
+        if (pagenr < 256)
                 return 1;
         if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
                 return 0;
diff --git a/arch/x86/um/Kconfig b/arch/x86/um/Kconfig
index 9926e11a772d..aeaff8bef2f1 100644
--- a/arch/x86/um/Kconfig
+++ b/arch/x86/um/Kconfig
@@ -21,6 +21,7 @@ config 64BIT
 config X86_32
         def_bool !64BIT
         select HAVE_AOUT
+        select ARCH_WANT_IPC_PARSE_VERSION
 
 config X86_64
         def_bool 64BIT
diff --git a/arch/x86/um/shared/sysdep/kernel-offsets.h b/arch/x86/um/shared/sysdep/kernel-offsets.h
index 5868526b5eef..46a9df99f3c5 100644
--- a/arch/x86/um/shared/sysdep/kernel-offsets.h
+++ b/arch/x86/um/shared/sysdep/kernel-offsets.h
@@ -7,9 +7,6 @@
 #define DEFINE(sym, val) \
         asm volatile("\n->" #sym " %0 " #val : : "i" (val))
 
-#define STR(x) #x
-#define DEFINE_STR(sym, val) asm volatile("\n->" #sym " " STR(val) " " #val: : )
-
 #define BLANK() asm volatile("\n->" : : )
 
 #define OFFSET(sym, str, mem) \
diff --git a/arch/x86/um/shared/sysdep/syscalls.h b/arch/x86/um/shared/sysdep/syscalls.h
index bd9a89b67e41..ca255a805ed9 100644
--- a/arch/x86/um/shared/sysdep/syscalls.h
+++ b/arch/x86/um/shared/sysdep/syscalls.h
@@ -1,3 +1,5 @@
+extern long sys_clone(unsigned long clone_flags, unsigned long newsp,
+               void __user *parent_tid, void __user *child_tid);
 #ifdef __i386__
 #include "syscalls_32.h"
 #else
diff --git a/arch/x86/um/signal.c b/arch/x86/um/signal.c
index a508cea13503..ba7363ecf896 100644
--- a/arch/x86/um/signal.c
+++ b/arch/x86/um/signal.c
@@ -416,9 +416,6 @@ int setup_signal_stack_sc(unsigned long stack_top, int sig,
         PT_REGS_AX(regs) = (unsigned long) sig;
         PT_REGS_DX(regs) = (unsigned long) 0;
         PT_REGS_CX(regs) = (unsigned long) 0;
-
-        if ((current->ptrace & PT_DTRACE) && (current->ptrace & PT_PTRACED))
-                ptrace_notify(SIGTRAP);
         return 0;
 }
 
@@ -466,9 +463,6 @@ int setup_signal_stack_si(unsigned long stack_top, int sig,
         PT_REGS_AX(regs) = (unsigned long) sig;
         PT_REGS_DX(regs) = (unsigned long) &frame->info;
         PT_REGS_CX(regs) = (unsigned long) &frame->uc;
-
-        if ((current->ptrace & PT_DTRACE) && (current->ptrace & PT_PTRACED))
-                ptrace_notify(SIGTRAP);
         return 0;
 }
 
diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
index 68d1dc91b37b..b5408cecac6c 100644
--- a/arch/x86/um/sys_call_table_32.c
+++ b/arch/x86/um/sys_call_table_32.c
@@ -28,7 +28,7 @@
 #define ptregs_execve sys_execve
 #define ptregs_iopl sys_iopl
 #define ptregs_vm86old sys_vm86old
-#define ptregs_clone sys_clone
+#define ptregs_clone i386_clone
 #define ptregs_vm86 sys_vm86
 #define ptregs_sigaltstack sys_sigaltstack
 #define ptregs_vfork sys_vfork
diff --git a/arch/x86/um/syscalls_32.c b/arch/x86/um/syscalls_32.c
index b853e8600b9d..db444c7218fe 100644
--- a/arch/x86/um/syscalls_32.c
+++ b/arch/x86/um/syscalls_32.c
@@ -3,37 +3,24 @@
  * Licensed under the GPL
  */
 
-#include "linux/sched.h"
-#include "linux/shm.h"
-#include "linux/ipc.h"
-#include "linux/syscalls.h"
-#include "asm/mman.h"
-#include "asm/uaccess.h"
-#include "asm/unistd.h"
+#include <linux/syscalls.h>
+#include <sysdep/syscalls.h>
 
 /*
  * The prototype on i386 is:
  *
- *     int clone(int flags, void * child_stack, int * parent_tidptr, struct user_desc * newtls, int * child_tidptr)
+ *     int clone(int flags, void * child_stack, int * parent_tidptr, struct user_desc * newtls
  *
  * and the "newtls" arg. on i386 is read by copy_thread directly from the
  * register saved on the stack.
  */
-long sys_clone(unsigned long clone_flags, unsigned long newsp,
-               int __user *parent_tid, void *newtls, int __user *child_tid)
+long i386_clone(unsigned long clone_flags, unsigned long newsp,
+                int __user *parent_tid, void *newtls, int __user *child_tid)
 {
-        long ret;
-
-        if (!newsp)
-                newsp = UPT_SP(&current->thread.regs.regs);
-
-        current->thread.forking = 1;
-        ret = do_fork(clone_flags, newsp, &current->thread.regs, 0, parent_tid,
-                      child_tid);
-        current->thread.forking = 0;
-        return ret;
+        return sys_clone(clone_flags, newsp, parent_tid, child_tid);
 }
 
+
 long sys_sigaction(int sig, const struct old_sigaction __user *act,
                          struct old_sigaction __user *oact)
 {
diff --git a/arch/x86/um/syscalls_64.c b/arch/x86/um/syscalls_64.c
index f3d82bb6e15a..adb08eb5c22a 100644
--- a/arch/x86/um/syscalls_64.c
+++ b/arch/x86/um/syscalls_64.c
@@ -5,12 +5,9 @@
  * Licensed under the GPL
  */
 
-#include "linux/linkage.h"
-#include "linux/personality.h"
-#include "linux/utsname.h"
-#include "asm/prctl.h" /* XXX This should get the constants from libc */
-#include "asm/uaccess.h"
-#include "os.h"
+#include <linux/sched.h>
+#include <asm/prctl.h> /* XXX This should get the constants from libc */
+#include <os.h>
 
 long arch_prctl(struct task_struct *task, int code, unsigned long __user *addr)
 {
@@ -79,20 +76,6 @@ long sys_arch_prctl(int code, unsigned long addr)
         return arch_prctl(current, code, (unsigned long __user *) addr);
 }
 
-long sys_clone(unsigned long clone_flags, unsigned long newsp,
-               void __user *parent_tid, void __user *child_tid)
-{
-        long ret;
-
-        if (!newsp)
-                newsp = UPT_SP(&current->thread.regs.regs);
-        current->thread.forking = 1;
-        ret = do_fork(clone_flags, newsp, &current->thread.regs, 0, parent_tid,
-                      child_tid);
-        current->thread.forking = 0;
-        return ret;
-}
-
 void arch_switch_to(struct task_struct *to)
 {
         if ((to->thread.arch.fs == 0) || (to->mm == NULL))
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 9642d4a38602..1fbe75a95f15 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1452,6 +1452,10 @@ asmlinkage void __init xen_start_kernel(void)
                 pci_request_acs();
 
                 xen_acpi_sleep_register();
+
+                /* Avoid searching for BIOS MP tables */
+                x86_init.mpparse.find_smp_config = x86_init_noop;
+                x86_init.mpparse.get_smp_config = x86_init_uint_noop;
         }
 #ifdef CONFIG_PCI
         /* PCI BIOS service won't work from a PV guest. */
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 76ba0e97e530..72213da605f5 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -828,9 +828,6 @@ int m2p_add_override(unsigned long mfn, struct page *page,
 
                         xen_mc_issue(PARAVIRT_LAZY_MMU);
                 }
-                /* let's use dev_bus_addr to record the old mfn instead */
-                kmap_op->dev_bus_addr = page->index;
-                page->index = (unsigned long) kmap_op;
         }
         spin_lock_irqsave(&m2p_override_lock, flags);
         list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
@@ -857,7 +854,8 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_add_override);
-int m2p_remove_override(struct page *page, bool clear_pte)
+int m2p_remove_override(struct page *page,
+                struct gnttab_map_grant_ref *kmap_op)
 {
         unsigned long flags;
         unsigned long mfn;
@@ -887,10 +885,8 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         WARN_ON(!PagePrivate(page));
         ClearPagePrivate(page);
 
-        if (clear_pte) {
-                struct gnttab_map_grant_ref *map_op =
-                        (struct gnttab_map_grant_ref *) page->index;
-                set_phys_to_machine(pfn, map_op->dev_bus_addr);
+        set_phys_to_machine(pfn, page->index);
+        if (kmap_op != NULL) {
                 if (!PageHighMem(page)) {
                         struct multicall_space mcs;
                         struct gnttab_unmap_grant_ref *unmap_op;
@@ -902,13 +898,13 @@ int m2p_remove_override(struct page *page, bool clear_pte)
                          * issued. In this case handle is going to -1 because
                          * it hasn't been modified yet.
                          */
-                        if (map_op->handle == -1)
+                        if (kmap_op->handle == -1)
                                 xen_mc_flush();
                         /*
-                         * Now if map_op->handle is negative it means that the
+                         * Now if kmap_op->handle is negative it means that the
                          * hypercall actually returned an error.
                          */
-                        if (map_op->handle == GNTST_general_error) {
+                        if (kmap_op->handle == GNTST_general_error) {
                                 printk(KERN_WARNING "m2p_remove_override: "
                                                 "pfn %lx mfn %lx, failed to modify kernel mappings",
                                                 pfn, mfn);
@@ -918,8 +914,8 @@ int m2p_remove_override(struct page *page, bool clear_pte)
                         mcs = xen_mc_entry(
                                         sizeof(struct gnttab_unmap_grant_ref));
                         unmap_op = mcs.args;
-                        unmap_op->host_addr = map_op->host_addr;
-                        unmap_op->handle = map_op->handle;
+                        unmap_op->host_addr = kmap_op->host_addr;
+                        unmap_op->handle = kmap_op->handle;
                         unmap_op->dev_bus_addr = 0;
 
                         MULTI_grant_table_op(mcs.mc,
@@ -930,10 +926,9 @@ int m2p_remove_override(struct page *page, bool clear_pte)
                         set_pte_at(&init_mm, address, ptep,
                                         pfn_pte(pfn, PAGE_KERNEL));
                         __flush_tlb_single(address);
-                        map_op->host_addr = 0;
+                        kmap_op->host_addr = 0;
                 }
-        } else
-                set_phys_to_machine(pfn, page->index);
+        }
 
         /* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
          * somewhere in this domain, even before being added to the
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index d11ca11d14fc..e2d62d697b5d 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -17,6 +17,7 @@
 #include <asm/e820.h>
 #include <asm/setup.h>
 #include <asm/acpi.h>
+#include <asm/numa.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
 
@@ -544,4 +545,7 @@ void __init xen_arch_setup(void)
         disable_cpufreq();
         WARN_ON(set_pm_idle_to_default());
         fiddle_vdso();
+#ifdef CONFIG_NUMA
+        numa_off = 1;
+#endif
 }
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 2c8d6a3d250a..bc44311aa18c 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -31,6 +31,7 @@
 #include <linux/mqueue.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/rcupdate.h>
 
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
@@ -110,8 +111,10 @@ void cpu_idle(void)
 
         /* endless idle loop with no priority at all */
         while (1) {
+                rcu_idle_enter();
                 while (!need_resched())
                         platform_idle();
+                rcu_idle_exit();
                 schedule_preempt_disabled();
         }
 }
diff --git a/block/blk-core.c b/block/blk-core.c
index 4b4dbdfbca89..ee3cb3a5e278 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2254,9 +2254,11 @@ bool blk_update_request(struct request *req, int error, unsigned int nr_bytes)
                         error_type = "I/O";
                         break;
                 }
-                printk(KERN_ERR "end_request: %s error, dev %s, sector %llu\n",
-                       error_type, req->rq_disk ? req->rq_disk->disk_name : "?",
-                       (unsigned long long)blk_rq_pos(req));
+                printk_ratelimited(KERN_ERR "end_request: %s error, dev %s, sector %llu\n",
+                                   error_type, req->rq_disk ?
+                                   req->rq_disk->disk_name : "?",
+                                   (unsigned long long)blk_rq_pos(req));
+
         }
 
         blk_account_io_completion(req, nr_bytes);
diff --git a/block/ioctl.c b/block/ioctl.c
index 4476e0e85d16..4a85096f5410 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -41,7 +41,7 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user
                             sizeof(long long) > sizeof(long)) {
                                 long pstart = start, plength = length;
                                 if (pstart != start || plength != length
-                                    || pstart < 0 || plength < 0)
+                                    || pstart < 0 || plength < 0 || partno > 65535)
                                         return -EINVAL;
                         }
 
diff --git a/crypto/authenc.c b/crypto/authenc.c
index 5ef7ba6b6a76..d0583a4489e6 100644
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -336,7 +336,7 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv,
                 cryptlen += ivsize;
         }
 
-        if (sg_is_last(assoc)) {
+        if (req->assoclen && sg_is_last(assoc)) {
                 authenc_ahash_fn = crypto_authenc_ahash;
                 sg_init_table(asg, 2);
                 sg_set_page(asg, sg_page(assoc), assoc->length, assoc->offset);
@@ -490,7 +490,7 @@ static int crypto_authenc_iverify(struct aead_request *req, u8 *iv,
                 cryptlen += ivsize;
         }
 
-        if (sg_is_last(assoc)) {
+        if (req->assoclen && sg_is_last(assoc)) {
                 authenc_ahash_fn = crypto_authenc_ahash;
                 sg_init_table(asg, 2);
                 sg_set_page(asg, sg_page(assoc), assoc->length, assoc->offset);
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 9628652e080c..e0596954290b 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -237,6 +237,16 @@ static int __acpi_bus_get_power(struct acpi_device *device, int *state)
         } else if (result == ACPI_STATE_D3_HOT) {
                 result = ACPI_STATE_D3;
         }
+
+        /*
+         * If we were unsure about the device parent's power state up to this
+         * point, the fact that the device is in D0 implies that the parent has
+         * to be in D0 too.
+         */
+        if (device->parent && device->parent->power.state == ACPI_STATE_UNKNOWN
+            && result == ACPI_STATE_D0)
+                device->parent->power.state = ACPI_STATE_D0;
+
         *state = result;
 
  out:
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index fc1803414629..40e38a06ba85 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -107,6 +107,7 @@ struct acpi_power_resource {
 
         /* List of devices relying on this power resource */
         struct acpi_power_resource_device *devices;
+        struct mutex devices_lock;
 };
 
 static struct list_head acpi_power_resource_list;
@@ -225,7 +226,6 @@ static void acpi_power_on_device(struct acpi_power_managed_device *device)
 
 static int __acpi_power_on(struct acpi_power_resource *resource)
 {
-        struct acpi_power_resource_device *device_list = resource->devices;
         acpi_status status = AE_OK;
 
         status = acpi_evaluate_object(resource->device->handle, "_ON", NULL, NULL);
@@ -238,19 +238,15 @@ static int __acpi_power_on(struct acpi_power_resource *resource)
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Power resource [%s] turned on\n",
                           resource->name));
 
-        while (device_list) {
-                acpi_power_on_device(device_list->device);
-
-                device_list = device_list->next;
-        }
-
         return 0;
 }
 
 static int acpi_power_on(acpi_handle handle)
 {
         int result = 0;
+        bool resume_device = false;
         struct acpi_power_resource *resource = NULL;
+        struct acpi_power_resource_device *device_list;
 
         result = acpi_power_get_context(handle, &resource);
         if (result)
@@ -266,10 +262,25 @@ static int acpi_power_on(acpi_handle handle)
                 result = __acpi_power_on(resource);
                 if (result)
                         resource->ref_count--;
+                else
+                        resume_device = true;
         }
 
         mutex_unlock(&resource->resource_lock);
 
+        if (!resume_device)
+                return result;
+
+        mutex_lock(&resource->devices_lock);
+
+        device_list = resource->devices;
+        while (device_list) {
+                acpi_power_on_device(device_list->device);
+                device_list = device_list->next;
+        }
+
+        mutex_unlock(&resource->devices_lock);
+
         return result;
 }
 
@@ -355,7 +366,7 @@ static void __acpi_power_resource_unregister_device(struct device *dev,
         if (acpi_power_get_context(res_handle, &resource))
                 return;
 
-        mutex_lock(&resource->resource_lock);
+        mutex_lock(&resource->devices_lock);
         prev = NULL;
         curr = resource->devices;
         while (curr) {
@@ -372,7 +383,7 @@ static void __acpi_power_resource_unregister_device(struct device *dev,
                 prev = curr;
                 curr = curr->next;
         }
-        mutex_unlock(&resource->resource_lock);
+        mutex_unlock(&resource->devices_lock);
 }
 
 /* Unlink dev from all power resources in _PR0 */
@@ -414,10 +425,10 @@ static int __acpi_power_resource_register_device(
 
         power_resource_device->device = powered_device;
 
-        mutex_lock(&resource->resource_lock);
+        mutex_lock(&resource->devices_lock);
         power_resource_device->next = resource->devices;
         resource->devices = power_resource_device;
-        mutex_unlock(&resource->resource_lock);
+        mutex_unlock(&resource->devices_lock);
 
         return 0;
 }
@@ -462,7 +473,7 @@ int acpi_power_resource_register_device(struct device *dev, acpi_handle handle)
         return ret;
 
 no_power_resource:
-        printk(KERN_WARNING PREFIX "Invalid Power Resource to register!");
+        printk(KERN_DEBUG PREFIX "Invalid Power Resource to register!");
         return -ENODEV;
 }
 EXPORT_SYMBOL_GPL(acpi_power_resource_register_device);
@@ -721,6 +732,7 @@ static int acpi_power_add(struct acpi_device *device)
 
         resource->device = device;
         mutex_init(&resource->resource_lock);
+        mutex_init(&resource->devices_lock);
         strcpy(resource->name, device->pnp.bus_id);
         strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_POWER_CLASS);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 50d5dea0ff59..7862d17976b7 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -268,6 +268,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
           PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci_ign_iferr },
+        /* JMicron 362B and 362C have an AHCI function with IDE class code */
+        { PCI_VDEVICE(JMICRON, 0x2362), board_ahci_ign_iferr },
+        { PCI_VDEVICE(JMICRON, 0x236f), board_ahci_ign_iferr },
 
         /* ATI */
         { PCI_VDEVICE(ATI, 0x4380), board_ahci_sb600 }, /* ATI SB600 */
@@ -393,6 +396,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
         { PCI_DEVICE(0x1b4b, 0x917a),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
+        { PCI_DEVICE(0x1b4b, 0x9192),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 on some Gigabyte */
         { PCI_DEVICE(0x1b4b, 0x91a3),
           .driver_data = board_ahci_yes_fbs },
 
@@ -400,7 +405,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
 
         /* Asmedia */
-        { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1061 */
+        { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },   /* ASM1060 */
+        { PCI_VDEVICE(ASMEDIA, 0x0602), board_ahci },   /* ASM1060 */
+        { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },   /* ASM1061 */
+        { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
         /* Generic, PCI class code for AHCI */
         { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index a89734621e51..5b6b1d8e6cc0 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -16,12 +16,14 @@
 #include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/irqdomain.h>
+#include <linux/pm_runtime.h>
 #include <linux/slab.h>
 
 #include "internal.h"
 
 struct regmap_irq_chip_data {
         struct mutex lock;
+        struct irq_chip irq_chip;
 
         struct regmap *map;
         const struct regmap_irq_chip *chip;
@@ -59,6 +61,14 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
         struct regmap_irq_chip_data *d = irq_data_get_irq_chip_data(data);
         struct regmap *map = d->map;
         int i, ret;
+        u32 reg;
+
+        if (d->chip->runtime_pm) {
+                ret = pm_runtime_get_sync(map->dev);
+                if (ret < 0)
+                        dev_err(map->dev, "IRQ sync failed to resume: %d\n",
+                                ret);
+        }
 
         /*
          * If there's been a change in the mask write it back to the
@@ -66,15 +76,22 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
          * suppress pointless writes.
          */
         for (i = 0; i < d->chip->num_regs; i++) {
-                ret = regmap_update_bits(d->map, d->chip->mask_base +
-                                                (i * map->reg_stride *
-                                                d->irq_reg_stride),
+                reg = d->chip->mask_base +
+                        (i * map->reg_stride * d->irq_reg_stride);
+                if (d->chip->mask_invert)
+                        ret = regmap_update_bits(d->map, reg,
+                                         d->mask_buf_def[i], ~d->mask_buf[i]);
+                else
+                        ret = regmap_update_bits(d->map, reg,
                                          d->mask_buf_def[i], d->mask_buf[i]);
                 if (ret != 0)
                         dev_err(d->map->dev, "Failed to sync masks in %x\n",
-                                d->chip->mask_base + (i * map->reg_stride));
+                                reg);
         }
 
+        if (d->chip->runtime_pm)
+                pm_runtime_put(map->dev);
+
         /* If we've changed our wakeup count propagate it to the parent */
         if (d->wake_count < 0)
                 for (i = d->wake_count; i < 0; i++)
@@ -128,8 +145,7 @@ static int regmap_irq_set_wake(struct irq_data *data, unsigned int on)
         return 0;
 }
 
-static struct irq_chip regmap_irq_chip = {
-        .name                   = "regmap",
+static const struct irq_chip regmap_irq_chip = {
         .irq_bus_lock           = regmap_irq_lock,
         .irq_bus_sync_unlock    = regmap_irq_sync_unlock,
         .irq_disable            = regmap_irq_disable,
@@ -144,6 +160,16 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
         struct regmap *map = data->map;
         int ret, i;
         bool handled = false;
+        u32 reg;
+
+        if (chip->runtime_pm) {
+                ret = pm_runtime_get_sync(map->dev);
+                if (ret < 0) {
+                        dev_err(map->dev, "IRQ thread failed to resume: %d\n",
+                                ret);
+                        return IRQ_NONE;
+                }
+        }
 
         /*
          * Ignore masked IRQs and ack if we need to; we ack early so
@@ -160,20 +186,20 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
                 if (ret != 0) {
                         dev_err(map->dev, "Failed to read IRQ status: %d\n",
                                         ret);
+                        if (chip->runtime_pm)
+                                pm_runtime_put(map->dev);
                         return IRQ_NONE;
                 }
 
                 data->status_buf[i] &= ~data->mask_buf[i];
 
                 if (data->status_buf[i] && chip->ack_base) {
-                        ret = regmap_write(map, chip->ack_base +
-                                                (i * map->reg_stride *
-                                                data->irq_reg_stride),
-                                           data->status_buf[i]);
+                        reg = chip->ack_base +
+                                (i * map->reg_stride * data->irq_reg_stride);
+                        ret = regmap_write(map, reg, data->status_buf[i]);
                         if (ret != 0)
                                 dev_err(map->dev, "Failed to ack 0x%x: %d\n",
-                                        chip->ack_base + (i * map->reg_stride),
-                                        ret);
+                                        reg, ret);
                 }
         }
 
@@ -185,6 +211,9 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
                 }
         }
 
+        if (chip->runtime_pm)
+                pm_runtime_put(map->dev);
+
         if (handled)
                 return IRQ_HANDLED;
         else
@@ -197,7 +226,7 @@ static int regmap_irq_map(struct irq_domain *h, unsigned int virq,
         struct regmap_irq_chip_data *data = h->host_data;
 
         irq_set_chip_data(virq, data);
-        irq_set_chip_and_handler(virq, &regmap_irq_chip, handle_edge_irq);
+        irq_set_chip(virq, &data->irq_chip);
         irq_set_nested_thread(virq, 1);
 
         /* ARM needs us to explicitly flag the IRQ as valid
@@ -238,6 +267,7 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
         struct regmap_irq_chip_data *d;
         int i;
         int ret = -ENOMEM;
+        u32 reg;
 
         for (i = 0; i < chip->num_irqs; i++) {
                 if (chip->irqs[i].reg_offset % map->reg_stride)
@@ -284,6 +314,13 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                         goto err_alloc;
         }
 
+        d->irq_chip = regmap_irq_chip;
+        d->irq_chip.name = chip->name;
+        if (!chip->wake_base) {
+                d->irq_chip.irq_set_wake = NULL;
+                d->irq_chip.flags |= IRQCHIP_MASK_ON_SUSPEND |
+                                     IRQCHIP_SKIP_SET_WAKE;
+        }
         d->irq = irq;
         d->map = map;
         d->chip = chip;
@@ -303,16 +340,37 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
         /* Mask all the interrupts by default */
         for (i = 0; i < chip->num_regs; i++) {
                 d->mask_buf[i] = d->mask_buf_def[i];
-                ret = regmap_write(map, chip->mask_base + (i * map->reg_stride
-                                   * d->irq_reg_stride),
-                                   d->mask_buf[i]);
+                reg = chip->mask_base +
+                        (i * map->reg_stride * d->irq_reg_stride);
+                if (chip->mask_invert)
+                        ret = regmap_update_bits(map, reg,
+                                         d->mask_buf[i], ~d->mask_buf[i]);
+                else
+                        ret = regmap_update_bits(map, reg,
+                                         d->mask_buf[i], d->mask_buf[i]);
                 if (ret != 0) {
                         dev_err(map->dev, "Failed to set masks in 0x%x: %d\n",
-                                chip->mask_base + (i * map->reg_stride), ret);
+                                reg, ret);
                         goto err_alloc;
                 }
         }
 
+        /* Wake is disabled by default */
+        if (d->wake_buf) {
+                for (i = 0; i < chip->num_regs; i++) {
+                        d->wake_buf[i] = d->mask_buf_def[i];
+                        reg = chip->wake_base +
+                                (i * map->reg_stride * d->irq_reg_stride);
+                        ret = regmap_update_bits(map, reg, d->wake_buf[i],
+                                                 d->wake_buf[i]);
+                        if (ret != 0) {
+                                dev_err(map->dev, "Failed to set masks in 0x%x: %d\n",
+                                        reg, ret);
+                                goto err_alloc;
+                        }
+                }
+        }
+
         if (irq_base)
                 d->domain = irq_domain_add_legacy(map->dev->of_node,
                                                   chip->num_irqs, irq_base, 0,
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index c241ae2f2f10..52069d29ff12 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -659,13 +659,12 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
  * new cache.  This can be used to restore the cache to defaults or to
  * update the cache configuration to reflect runtime discovery of the
  * hardware.
+ *
+ * No explicit locking is done here, the user needs to ensure that
+ * this function will not race with other calls to regmap.
  */
 int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 {
-        int ret;
-
-        map->lock(map);
-
         regcache_exit(map);
         regmap_debugfs_exit(map);
 
@@ -681,11 +680,7 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
         map->cache_bypass = false;
         map->cache_only = false;
 
-        ret = regcache_init(map, config);
-
-        map->unlock(map);
-
-        return ret;
+        return regcache_init(map, config);
 }
 EXPORT_SYMBOL_GPL(regmap_reinit_cache);
 
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index de0435e63b02..887f68f6d79a 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -35,6 +35,7 @@ new_skb(ulong len)
                 skb_reset_mac_header(skb);
                 skb_reset_network_header(skb);
                 skb->protocol = __constant_htons(ETH_P_AOE);
+                skb_checksum_none_assert(skb);
         }
         return skb;
 }
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 38aa6dda6b81..da3311129a0c 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -795,6 +795,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout,
                                 }
                         break;
                         case CMD_PROTOCOL_ERR:
+                                cmd->result = DID_ERROR << 16;
                                 dev_warn(&h->pdev->dev,
                                         "%p has protocol error\n", c);
                         break;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index a8fddeb3d638..f946d31d6917 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -1148,11 +1148,15 @@ static bool mtip_pause_ncq(struct mtip_port *port,
         reply = port->rxfis + RX_FIS_D2H_REG;
         task_file_data = readl(port->mmio+PORT_TFDATA);
 
-        if ((task_file_data & 1) || (fis->command == ATA_CMD_SEC_ERASE_UNIT))
+        if (fis->command == ATA_CMD_SEC_ERASE_UNIT)
+                clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
+
+        if ((task_file_data & 1))
                 return false;
 
         if (fis->command == ATA_CMD_SEC_ERASE_PREP) {
                 set_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+                set_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
                 port->ic_pause_timer = jiffies;
                 return true;
         } else if ((fis->command == ATA_CMD_DOWNLOAD_MICRO) &&
@@ -1900,7 +1904,7 @@ static int exec_drive_command(struct mtip_port *port, u8 *command,
         int rv = 0, xfer_sz = command[3];
 
         if (xfer_sz) {
-                if (user_buffer)
+                if (!user_buffer)
                         return -EFAULT;
 
                 buf = dmam_alloc_coherent(&port->dd->pdev->dev,
@@ -2043,7 +2047,7 @@ static void mtip_set_timeout(struct host_to_dev_fis *fis, unsigned int *timeout)
                 *timeout = 240000; /* 4 minutes */
                 break;
         case ATA_CMD_STANDBYNOW1:
-                *timeout = 10000;  /* 10 seconds */
+                *timeout = 120000;  /* 2 minutes */
                 break;
         case 0xF7:
         case 0xFA:
@@ -2588,9 +2592,6 @@ static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
         if (!len || size)
                 return 0;
 
-        if (size < 0)
-                return -EINVAL;
-
         size += sprintf(&buf[size], "H/ S ACTive      : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
@@ -2660,9 +2661,6 @@ static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
         if (!len || size)
                 return 0;
 
-        if (size < 0)
-                return -EINVAL;
-
         size += sprintf(&buf[size], "Flag-port : [ %08lX ]\n",
                                                         dd->port->flags);
         size += sprintf(&buf[size], "Flag-dd   : [ %08lX ]\n",
@@ -3214,8 +3212,8 @@ static int mtip_hw_init(struct driver_data *dd)
                                 "Unable to check write protect progress\n");
         else
                 dev_info(&dd->pdev->dev,
-                                "Write protect progress: %d%% (%d blocks)\n",
-                                attr242.cur, attr242.data);
+                                "Write protect progress: %u%% (%u blocks)\n",
+                                attr242.cur, le32_to_cpu(attr242.data));
         return rv;
 
 out3:
@@ -3619,6 +3617,10 @@ static void mtip_make_request(struct request_queue *queue, struct bio *bio)
                         bio_endio(bio, -ENODATA);
                         return;
                 }
+                if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag))) {
+                        bio_endio(bio, -ENODATA);
+                        return;
+                }
         }
 
         if (unlikely(!bio_has_data(bio))) {
@@ -4168,7 +4170,13 @@ static void mtip_pci_shutdown(struct pci_dev *pdev)
 
 /* Table of device ids supported by this driver. */
 static DEFINE_PCI_DEVICE_TABLE(mtip_pci_tbl) = {
-        {  PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320H_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320S_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P325M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P420H_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P420M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P425M_DEVICE_ID) },
         { 0 }
 };
 
@@ -4199,12 +4207,12 @@ static int __init mtip_init(void)
 {
         int error;
 
-        printk(KERN_INFO MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
+        pr_info(MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
 
         /* Allocate a major block device number to use with this driver. */
         error = register_blkdev(0, MTIP_DRV_NAME);
         if (error <= 0) {
-                printk(KERN_ERR "Unable to register block device (%d)\n",
+                pr_err("Unable to register block device (%d)\n",
                 error);
                 return -EBUSY;
         }
@@ -4213,7 +4221,7 @@ static int __init mtip_init(void)
         if (!dfs_parent) {
                 dfs_parent = debugfs_create_dir("rssd", NULL);
                 if (IS_ERR_OR_NULL(dfs_parent)) {
-                        printk(KERN_WARNING "Error creating debugfs parent\n");
+                        pr_warn("Error creating debugfs parent\n");
                         dfs_parent = NULL;
                 }
         }
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index f51fc23d17bb..18627a1d04c5 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -76,7 +76,13 @@
 
 /* Micron Vendor ID & P320x SSD Device ID */
 #define PCI_VENDOR_ID_MICRON    0x1344
-#define P320_DEVICE_ID          0x5150
+#define P320H_DEVICE_ID         0x5150
+#define P320M_DEVICE_ID         0x5151
+#define P320S_DEVICE_ID         0x5152
+#define P325M_DEVICE_ID         0x5153
+#define P420H_DEVICE_ID         0x5160
+#define P420M_DEVICE_ID         0x5161
+#define P425M_DEVICE_ID         0x5163
 
 /* Driver name and version strings */
 #define MTIP_DRV_NAME           "mtip32xx"
@@ -131,10 +137,12 @@ enum {
         MTIP_PF_SVC_THD_STOP_BIT    = 8,
 
         /* below are bit numbers in 'dd_flag' defined in driver_data */
+        MTIP_DDF_SEC_LOCK_BIT       = 0,
         MTIP_DDF_REMOVE_PENDING_BIT = 1,
         MTIP_DDF_OVER_TEMP_BIT      = 2,
         MTIP_DDF_WRITE_PROTECT_BIT  = 3,
         MTIP_DDF_STOP_IO      = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | \
+                                (1 << MTIP_DDF_SEC_LOCK_BIT) | \
                                 (1 << MTIP_DDF_OVER_TEMP_BIT) | \
                                 (1 << MTIP_DDF_WRITE_PROTECT_BIT)),
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index d07c9f7fded6..0c03411c59eb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -449,6 +449,14 @@ static void nbd_clear_que(struct nbd_device *nbd)
                 req->errors++;
                 nbd_end_request(req);
         }
+
+        while (!list_empty(&nbd->waiting_queue)) {
+                req = list_entry(nbd->waiting_queue.next, struct request,
+                                 queuelist);
+                list_del_init(&req->queuelist);
+                req->errors++;
+                nbd_end_request(req);
+        }
 }
 
 
@@ -598,6 +606,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd->file = NULL;
                 nbd_clear_que(nbd);
                 BUG_ON(!list_empty(&nbd->queue_head));
+                BUG_ON(!list_empty(&nbd->waiting_queue));
                 if (file)
                         fput(file);
                 return 0;
diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index 38a2d0631882..ad16c68c8645 100644
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -79,6 +79,7 @@ struct nvme_dev {
         char serial[20];
         char model[40];
         char firmware_rev[8];
+        u32 max_hw_sectors;
 };
 
 /*
@@ -835,15 +836,15 @@ static int nvme_identify(struct nvme_dev *dev, unsigned nsid, unsigned cns,
 }
 
 static int nvme_get_features(struct nvme_dev *dev, unsigned fid,
-                                unsigned dword11, dma_addr_t dma_addr)
+                                unsigned nsid, dma_addr_t dma_addr)
 {
         struct nvme_command c;
 
         memset(&c, 0, sizeof(c));
         c.features.opcode = nvme_admin_get_features;
+        c.features.nsid = cpu_to_le32(nsid);
         c.features.prp1 = cpu_to_le64(dma_addr);
         c.features.fid = cpu_to_le32(fid);
-        c.features.dword11 = cpu_to_le32(dword11);
 
         return nvme_submit_admin_cmd(dev, &c, NULL);
 }
@@ -862,11 +863,51 @@ static int nvme_set_features(struct nvme_dev *dev, unsigned fid,
         return nvme_submit_admin_cmd(dev, &c, result);
 }
 
+/**
+ * nvme_cancel_ios - Cancel outstanding I/Os
+ * @queue: The queue to cancel I/Os on
+ * @timeout: True to only cancel I/Os which have timed out
+ */
+static void nvme_cancel_ios(struct nvme_queue *nvmeq, bool timeout)
+{
+        int depth = nvmeq->q_depth - 1;
+        struct nvme_cmd_info *info = nvme_cmd_info(nvmeq);
+        unsigned long now = jiffies;
+        int cmdid;
+
+        for_each_set_bit(cmdid, nvmeq->cmdid_data, depth) {
+                void *ctx;
+                nvme_completion_fn fn;
+                static struct nvme_completion cqe = {
+                        .status = cpu_to_le16(NVME_SC_ABORT_REQ) << 1,
+                };
+
+                if (timeout && !time_after(now, info[cmdid].timeout))
+                        continue;
+                dev_warn(nvmeq->q_dmadev, "Cancelling I/O %d\n", cmdid);
+                ctx = cancel_cmdid(nvmeq, cmdid, &fn);
+                fn(nvmeq->dev, ctx, &cqe);
+        }
+}
+
+static void nvme_free_queue_mem(struct nvme_queue *nvmeq)
+{
+        dma_free_coherent(nvmeq->q_dmadev, CQ_SIZE(nvmeq->q_depth),
+                                (void *)nvmeq->cqes, nvmeq->cq_dma_addr);
+        dma_free_coherent(nvmeq->q_dmadev, SQ_SIZE(nvmeq->q_depth),
+                                        nvmeq->sq_cmds, nvmeq->sq_dma_addr);
+        kfree(nvmeq);
+}
+
 static void nvme_free_queue(struct nvme_dev *dev, int qid)
 {
         struct nvme_queue *nvmeq = dev->queues[qid];
         int vector = dev->entry[nvmeq->cq_vector].vector;
 
+        spin_lock_irq(&nvmeq->q_lock);
+        nvme_cancel_ios(nvmeq, false);
+        spin_unlock_irq(&nvmeq->q_lock);
+
         irq_set_affinity_hint(vector, NULL);
         free_irq(vector, nvmeq);
 
@@ -876,18 +917,15 @@ static void nvme_free_queue(struct nvme_dev *dev, int qid)
                 adapter_delete_cq(dev, qid);
         }
 
-        dma_free_coherent(nvmeq->q_dmadev, CQ_SIZE(nvmeq->q_depth),
-                                (void *)nvmeq->cqes, nvmeq->cq_dma_addr);
-        dma_free_coherent(nvmeq->q_dmadev, SQ_SIZE(nvmeq->q_depth),
-                                        nvmeq->sq_cmds, nvmeq->sq_dma_addr);
-        kfree(nvmeq);
+        nvme_free_queue_mem(nvmeq);
 }
 
 static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid,
                                                         int depth, int vector)
 {
         struct device *dmadev = &dev->pci_dev->dev;
-        unsigned extra = (depth / 8) + (depth * sizeof(struct nvme_cmd_info));
+        unsigned extra = DIV_ROUND_UP(depth, 8) + (depth *
+                                                sizeof(struct nvme_cmd_info));
         struct nvme_queue *nvmeq = kzalloc(sizeof(*nvmeq) + extra, GFP_KERNEL);
         if (!nvmeq)
                 return NULL;
@@ -975,7 +1013,7 @@ static __devinit struct nvme_queue *nvme_create_queue(struct nvme_dev *dev,
 
 static int __devinit nvme_configure_admin_queue(struct nvme_dev *dev)
 {
-        int result;
+        int result = 0;
         u32 aqa;
         u64 cap;
         unsigned long timeout;
@@ -1005,17 +1043,22 @@ static int __devinit nvme_configure_admin_queue(struct nvme_dev *dev)
         timeout = ((NVME_CAP_TIMEOUT(cap) + 1) * HZ / 2) + jiffies;
         dev->db_stride = NVME_CAP_STRIDE(cap);
 
-        while (!(readl(&dev->bar->csts) & NVME_CSTS_RDY)) {
+        while (!result && !(readl(&dev->bar->csts) & NVME_CSTS_RDY)) {
                 msleep(100);
                 if (fatal_signal_pending(current))
-                        return -EINTR;
+                        result = -EINTR;
                 if (time_after(jiffies, timeout)) {
                         dev_err(&dev->pci_dev->dev,
                                 "Device not ready; aborting initialisation\n");
-                        return -ENODEV;
+                        result = -ENODEV;
                 }
         }
 
+        if (result) {
+                nvme_free_queue_mem(nvmeq);
+                return result;
+        }
+
         result = queue_request_irq(dev, nvmeq, "nvme admin");
         dev->queues[0] = nvmeq;
         return result;
@@ -1037,6 +1080,8 @@ static struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
         offset = offset_in_page(addr);
         count = DIV_ROUND_UP(offset + length, PAGE_SIZE);
         pages = kcalloc(count, sizeof(*pages), GFP_KERNEL);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
 
         err = get_user_pages_fast(addr, count, 1, pages);
         if (err < count) {
@@ -1146,14 +1191,13 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
         return status;
 }
 
-static int nvme_user_admin_cmd(struct nvme_ns *ns,
+static int nvme_user_admin_cmd(struct nvme_dev *dev,
                                         struct nvme_admin_cmd __user *ucmd)
 {
-        struct nvme_dev *dev = ns->dev;
         struct nvme_admin_cmd cmd;
         struct nvme_command c;
         int status, length;
-        struct nvme_iod *iod;
+        struct nvme_iod *uninitialized_var(iod);
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -1204,7 +1248,7 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
         case NVME_IOCTL_ID:
                 return ns->ns_id;
         case NVME_IOCTL_ADMIN_CMD:
-                return nvme_user_admin_cmd(ns, (void __user *)arg);
+                return nvme_user_admin_cmd(ns->dev, (void __user *)arg);
         case NVME_IOCTL_SUBMIT_IO:
                 return nvme_submit_io(ns, (void __user *)arg);
         default:
@@ -1218,26 +1262,6 @@ static const struct block_device_operations nvme_fops = {
         .compat_ioctl   = nvme_ioctl,
 };
 
-static void nvme_timeout_ios(struct nvme_queue *nvmeq)
-{
-        int depth = nvmeq->q_depth - 1;
-        struct nvme_cmd_info *info = nvme_cmd_info(nvmeq);
-        unsigned long now = jiffies;
-        int cmdid;
-
-        for_each_set_bit(cmdid, nvmeq->cmdid_data, depth) {
-                void *ctx;
-                nvme_completion_fn fn;
-                static struct nvme_completion cqe = { .status = cpu_to_le16(NVME_SC_ABORT_REQ) << 1, };
-
-                if (!time_after(now, info[cmdid].timeout))
-                        continue;
-                dev_warn(nvmeq->q_dmadev, "Timing out I/O %d\n", cmdid);
-                ctx = cancel_cmdid(nvmeq, cmdid, &fn);
-                fn(nvmeq->dev, ctx, &cqe);
-        }
-}
-
 static void nvme_resubmit_bios(struct nvme_queue *nvmeq)
 {
         while (bio_list_peek(&nvmeq->sq_cong)) {
@@ -1269,7 +1293,7 @@ static int nvme_kthread(void *data)
                                 spin_lock_irq(&nvmeq->q_lock);
                                 if (nvme_process_cq(nvmeq))
                                         printk("process_cq did something\n");
-                                nvme_timeout_ios(nvmeq);
+                                nvme_cancel_ios(nvmeq, true);
                                 nvme_resubmit_bios(nvmeq);
                                 spin_unlock_irq(&nvmeq->q_lock);
                         }
@@ -1339,6 +1363,9 @@ static struct nvme_ns *nvme_alloc_ns(struct nvme_dev *dev, int nsid,
         ns->disk = disk;
         lbaf = id->flbas & 0xf;
         ns->lba_shift = id->lbaf[lbaf].ds;
+        blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
+        if (dev->max_hw_sectors)
+                blk_queue_max_hw_sectors(ns->queue, dev->max_hw_sectors);
 
         disk->major = nvme_major;
         disk->minors = NVME_MINORS;
@@ -1383,7 +1410,7 @@ static int set_queue_count(struct nvme_dev *dev, int count)
 
 static int __devinit nvme_setup_io_queues(struct nvme_dev *dev)
 {
-        int result, cpu, i, nr_io_queues, db_bar_size;
+        int result, cpu, i, nr_io_queues, db_bar_size, q_depth;
 
         nr_io_queues = num_online_cpus();
         result = set_queue_count(dev, nr_io_queues);
@@ -1429,9 +1456,10 @@ static int __devinit nvme_setup_io_queues(struct nvme_dev *dev)
                 cpu = cpumask_next(cpu, cpu_online_mask);
         }
 
+        q_depth = min_t(int, NVME_CAP_MQES(readq(&dev->bar->cap)) + 1,
+                                                                NVME_Q_DEPTH);
         for (i = 0; i < nr_io_queues; i++) {
-                dev->queues[i + 1] = nvme_create_queue(dev, i + 1,
-                                                        NVME_Q_DEPTH, i);
+                dev->queues[i + 1] = nvme_create_queue(dev, i + 1, q_depth, i);
                 if (IS_ERR(dev->queues[i + 1]))
                         return PTR_ERR(dev->queues[i + 1]);
                 dev->queue_count++;
@@ -1480,6 +1508,10 @@ static int __devinit nvme_dev_add(struct nvme_dev *dev)
         memcpy(dev->serial, ctrl->sn, sizeof(ctrl->sn));
         memcpy(dev->model, ctrl->mn, sizeof(ctrl->mn));
         memcpy(dev->firmware_rev, ctrl->fr, sizeof(ctrl->fr));
+        if (ctrl->mdts) {
+                int shift = NVME_CAP_MPSMIN(readq(&dev->bar->cap)) + 12;
+                dev->max_hw_sectors = 1 << (ctrl->mdts + shift - 9);
+        }
 
         id_ns = mem;
         for (i = 1; i <= nn; i++) {
@@ -1523,8 +1555,6 @@ static int nvme_dev_remove(struct nvme_dev *dev)
         list_del(&dev->node);
         spin_unlock(&dev_list_lock);
 
-        /* TODO: wait all I/O finished or cancel them */
-
         list_for_each_entry_safe(ns, next, &dev->namespaces, list) {
                 list_del(&ns->list);
                 del_gendisk(ns->disk);
@@ -1560,15 +1590,33 @@ static void nvme_release_prp_pools(struct nvme_dev *dev)
         dma_pool_destroy(dev->prp_small_pool);
 }
 
-/* XXX: Use an ida or something to let remove / add work correctly */
-static void nvme_set_instance(struct nvme_dev *dev)
+static DEFINE_IDA(nvme_instance_ida);
+
+static int nvme_set_instance(struct nvme_dev *dev)
 {
-        static int instance;
-        dev->instance = instance++;
+        int instance, error;
+
+        do {
+                if (!ida_pre_get(&nvme_instance_ida, GFP_KERNEL))
+                        return -ENODEV;
+
+                spin_lock(&dev_list_lock);
+                error = ida_get_new(&nvme_instance_ida, &instance);
+                spin_unlock(&dev_list_lock);
+        } while (error == -EAGAIN);
+
+        if (error)
+                return -ENODEV;
+
+        dev->instance = instance;
+        return 0;
 }
 
 static void nvme_release_instance(struct nvme_dev *dev)
 {
+        spin_lock(&dev_list_lock);
+        ida_remove(&nvme_instance_ida, dev->instance);
+        spin_unlock(&dev_list_lock);
 }
 
 static int __devinit nvme_probe(struct pci_dev *pdev,
@@ -1601,7 +1649,10 @@ static int __devinit nvme_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, dev);
         dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
         dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
-        nvme_set_instance(dev);
+        result = nvme_set_instance(dev);
+        if (result)
+                goto disable;
+
         dev->entry[0].vector = pdev->irq;
 
         result = nvme_setup_prp_pools(dev);
@@ -1704,15 +1755,17 @@ static struct pci_driver nvme_driver = {
 
 static int __init nvme_init(void)
 {
-        int result = -EBUSY;
+        int result;
 
         nvme_thread = kthread_run(nvme_kthread, NULL, "nvme");
         if (IS_ERR(nvme_thread))
                 return PTR_ERR(nvme_thread);
 
-        nvme_major = register_blkdev(nvme_major, "nvme");
-        if (nvme_major <= 0)
+        result = register_blkdev(nvme_major, "nvme");
+        if (result < 0)
                 goto kill_kthread;
+        else if (result > 0)
+                nvme_major = result;
 
         result = pci_register_driver(&nvme_driver);
         if (result)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 9917943a3572..54a55f03115d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -246,13 +246,12 @@ static int rbd_open(struct block_device *bdev, fmode_t mode)
 {
         struct rbd_device *rbd_dev = bdev->bd_disk->private_data;
 
-        rbd_get_dev(rbd_dev);
-
-        set_device_ro(bdev, rbd_dev->read_only);
-
         if ((mode & FMODE_WRITE) && rbd_dev->read_only)
                 return -EROFS;
 
+        rbd_get_dev(rbd_dev);
+        set_device_ro(bdev, rbd_dev->read_only);
+
         return 0;
 }
 
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 73f196ca713f..c6decb901e5e 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -337,7 +337,7 @@ static void xen_blkbk_unmap(struct pending_req *req)
                 invcount++;
         }
 
-        ret = gnttab_unmap_refs(unmap, pages, invcount, false);
+        ret = gnttab_unmap_refs(unmap, NULL, pages, invcount);
         BUG_ON(ret);
 }
 
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 11f36e502136..fc2de5528dcc 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -86,6 +86,7 @@ static struct usb_device_id ath3k_table[] = {
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C) },
+        { USB_DEVICE(0x0489, 0xE036) },
 
         { }     /* Terminating entry */
 };
@@ -109,6 +110,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
 
         { }     /* Terminating entry */
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index cef3bac1a543..654e248763ef 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -52,6 +52,9 @@ static struct usb_device_id btusb_table[] = {
         /* Generic Bluetooth USB device */
         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
 
+        /* Apple-specific (Broadcom) devices */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
+
         /* Broadcom SoftSailing reporting vendor specific */
         { USB_DEVICE(0x0a5c, 0x21e1) },
 
@@ -94,16 +97,14 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0489, 0xe042) },
-        { USB_DEVICE(0x0a5c, 0x21e3) },
-        { USB_DEVICE(0x0a5c, 0x21e6) },
-        { USB_DEVICE(0x0a5c, 0x21e8) },
-        { USB_DEVICE(0x0a5c, 0x21f3) },
-        { USB_DEVICE(0x0a5c, 0x21f4) },
         { USB_DEVICE(0x413c, 0x8197) },
 
         /* Foxconn - Hon Hai */
         { USB_DEVICE(0x0489, 0xe033) },
 
+        /*Broadcom devices with vendor specific id */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
+
         { }     /* Terminating entry */
 };
 
@@ -141,6 +142,7 @@ static struct usb_device_id blacklist_table[] = {
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 
         /* Broadcom BCM2035 */
         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index 5869ea387054..72ce247a0e8d 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -1,4 +1,5 @@
 # common clock types
+obj-$(CONFIG_HAVE_CLK)          += clk-devres.o
 obj-$(CONFIG_CLKDEV_LOOKUP)     += clkdev.o
 obj-$(CONFIG_COMMON_CLK)        += clk.o clk-fixed-rate.o clk-gate.o \
                                    clk-mux.o clk-divider.o clk-fixed-factor.o
diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c
new file mode 100644
index 000000000000..8f571548870f
--- /dev/null
+++ b/drivers/clk/clk-devres.c
@@ -0,0 +1,55 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/export.h>
+#include <linux/gfp.h>
+
+static void devm_clk_release(struct device *dev, void *res)
+{
+        clk_put(*(struct clk **)res);
+}
+
+struct clk *devm_clk_get(struct device *dev, const char *id)
+{
+        struct clk **ptr, *clk;
+
+        ptr = devres_alloc(devm_clk_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return ERR_PTR(-ENOMEM);
+
+        clk = clk_get(dev, id);
+        if (!IS_ERR(clk)) {
+                *ptr = clk;
+                devres_add(dev, ptr);
+        } else {
+                devres_free(ptr);
+        }
+
+        return clk;
+}
+EXPORT_SYMBOL(devm_clk_get);
+
+static int devm_clk_match(struct device *dev, void *res, void *data)
+{
+        struct clk **c = res;
+        if (!c || !*c) {
+                WARN_ON(!c || !*c);
+                return 0;
+        }
+        return *c == data;
+}
+
+void devm_clk_put(struct device *dev, struct clk *clk)
+{
+        int ret;
+
+        ret = devres_release(dev, devm_clk_release, devm_clk_match, clk);
+
+        WARN_ON(ret);
+}
+EXPORT_SYMBOL(devm_clk_put);
diff --git a/drivers/clk/clkdev.c b/drivers/clk/clkdev.c
index d423c9bdd71a..442a31363873 100644
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -171,51 +171,6 @@ void clk_put(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_put);
 
-static void devm_clk_release(struct device *dev, void *res)
-{
-        clk_put(*(struct clk **)res);
-}
-
-struct clk *devm_clk_get(struct device *dev, const char *id)
-{
-        struct clk **ptr, *clk;
-
-        ptr = devres_alloc(devm_clk_release, sizeof(*ptr), GFP_KERNEL);
-        if (!ptr)
-                return ERR_PTR(-ENOMEM);
-
-        clk = clk_get(dev, id);
-        if (!IS_ERR(clk)) {
-                *ptr = clk;
-                devres_add(dev, ptr);
-        } else {
-                devres_free(ptr);
-        }
-
-        return clk;
-}
-EXPORT_SYMBOL(devm_clk_get);
-
-static int devm_clk_match(struct device *dev, void *res, void *data)
-{
-        struct clk **c = res;
-        if (!c || !*c) {
-                WARN_ON(!c || !*c);
-                return 0;
-        }
-        return *c == data;
-}
-
-void devm_clk_put(struct device *dev, struct clk *clk)
-{
-        int ret;
-
-        ret = devres_destroy(dev, devm_clk_release, devm_clk_match, clk);
-
-        WARN_ON(ret);
-}
-EXPORT_SYMBOL(devm_clk_put);
-
 void clkdev_add(struct clk_lookup *cl)
 {
         mutex_lock(&clocks_mutex);
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index c0e816468e30..1a40935c85fd 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -35,7 +35,6 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/cpumask.h>
-#include <linux/sched.h>        /* for current / set_cpus_allowed() */
 #include <linux/io.h>
 #include <linux/delay.h>
 
@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(struct powernow_k8_data *data,
         return res;
 }
 
-/* Driver entry point to switch to the target frequency */
-static int powernowk8_target(struct cpufreq_policy *pol,
-                unsigned targfreq, unsigned relation)
+struct powernowk8_target_arg {
+        struct cpufreq_policy           *pol;
+        unsigned                        targfreq;
+        unsigned                        relation;
+};
+
+static long powernowk8_target_fn(void *arg)
 {
-        cpumask_var_t oldmask;
+        struct powernowk8_target_arg *pta = arg;
+        struct cpufreq_policy *pol = pta->pol;
+        unsigned targfreq = pta->targfreq;
+        unsigned relation = pta->relation;
         struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
         u32 checkfid;
         u32 checkvid;
         unsigned int newstate;
-        int ret = -EIO;
+        int ret;
 
         if (!data)
                 return -EINVAL;
@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpufreq_policy *pol,
         checkfid = data->currfid;
         checkvid = data->currvid;
 
-        /* only run on specific CPU from here on. */
-        /* This is poor form: use a workqueue or smp_call_function_single */
-        if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
-                return -ENOMEM;
-
-        cpumask_copy(oldmask, tsk_cpus_allowed(current));
-        set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
-
-        if (smp_processor_id() != pol->cpu) {
-                printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
-                goto err_out;
-        }
-
         if (pending_bit_stuck()) {
                 printk(KERN_ERR PFX "failing targ, change pending bit set\n");
-                goto err_out;
+                return -EIO;
         }
 
         pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
                 pol->cpu, targfreq, pol->min, pol->max, relation);
 
         if (query_current_values_with_pending_wait(data))
-                goto err_out;
+                return -EIO;
 
         if (cpu_family != CPU_HW_PSTATE) {
                 pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
 
         if (cpufreq_frequency_table_target(pol, data->powernow_table,
                                 targfreq, relation, &newstate))
-                goto err_out;
+                return -EIO;
 
         mutex_lock(&fidvid_mutex);
 
@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpufreq_policy *pol,
                 ret = transition_frequency_fidvid(data, newstate);
         if (ret) {
                 printk(KERN_ERR PFX "transition frequency failed\n");
-                ret = 1;
                 mutex_unlock(&fidvid_mutex);
-                goto err_out;
+                return 1;
         }
         mutex_unlock(&fidvid_mutex);
 
@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpufreq_policy *pol,
                                 data->powernow_table[newstate].index);
         else
                 pol->cur = find_khz_freq_from_fid(data->currfid);
-        ret = 0;
 
-err_out:
-        set_cpus_allowed_ptr(current, oldmask);
-        free_cpumask_var(oldmask);
-        return ret;
+        return 0;
+}
+
+/* Driver entry point to switch to the target frequency */
+static int powernowk8_target(struct cpufreq_policy *pol,
+                unsigned targfreq, unsigned relation)
+{
+        struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
+                                             .relation = relation };
+
+        /*
+         * Must run on @pol->cpu.  cpufreq core is responsible for ensuring
+         * that we're bound to the current CPU and pol->cpu stays online.
+         */
+        if (smp_processor_id() == pol->cpu)
+                return powernowk8_target_fn(&pta);
+        else
+                return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
 }
 
 /* Driver entry point to verify the policy and range of frequencies */
diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c
index 002888185f17..d216cd3cc569 100644
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -120,3 +120,4 @@ u32 gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
 
         return ret;
 }
+EXPORT_SYMBOL(gen_split_key);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 3934fcc4e00b..17d6958342e7 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -168,9 +168,9 @@ static void atc_desc_put(struct at_dma_chan *atchan, struct at_desc *desc)
 }
 
 /**
- * atc_desc_chain - build chain adding a descripor
- * @first: address of first descripor of the chain
- * @prev: address of previous descripor of the chain
+ * atc_desc_chain - build chain adding a descriptor
+ * @first: address of first descriptor of the chain
+ * @prev: address of previous descriptor of the chain
  * @desc: descriptor to queue
  *
  * Called from prep_* functions
@@ -661,7 +661,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                         flags);
 
         if (unlikely(!atslave || !sg_len)) {
-                dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
+                dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n");
                 return NULL;
         }
 
@@ -689,6 +689,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
                         mem = sg_dma_address(sg);
                         len = sg_dma_len(sg);
+                        if (unlikely(!len)) {
+                                dev_dbg(chan2dev(chan),
+                                        "prep_slave_sg: sg(%d) data length is zero\n", i);
+                                goto err;
+                        }
                         mem_width = 2;
                         if (unlikely(mem & 3 || len & 3))
                                 mem_width = 0;
@@ -724,6 +729,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
                         mem = sg_dma_address(sg);
                         len = sg_dma_len(sg);
+                        if (unlikely(!len)) {
+                                dev_dbg(chan2dev(chan),
+                                        "prep_slave_sg: sg(%d) data length is zero\n", i);
+                                goto err;
+                        }
                         mem_width = 2;
                         if (unlikely(mem & 3 || len & 3))
                                 mem_width = 0;
@@ -757,6 +767,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
 err_desc_get:
         dev_err(chan2dev(chan), "not enough descriptors available\n");
+err:
         atc_desc_put(atchan, first);
         return NULL;
 }
@@ -785,7 +796,7 @@ err_out:
 }
 
 /**
- * atc_dma_cyclic_fill_desc - Fill one period decriptor
+ * atc_dma_cyclic_fill_desc - Fill one period descriptor
  */
 static int
 atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index c64917ec313d..bb02fd981afb 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -1118,7 +1118,7 @@ fail:
  * @chan: channel
  * @dma_addr: DMA mapped address of the buffer
  * @buf_len: length of the buffer (in bytes)
- * @period_len: lenght of a single period
+ * @period_len: length of a single period
  * @dir: direction of the operation
  * @context: operation context (ignored)
  *
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 8f84761f98ba..094437b9d823 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1015,7 +1015,7 @@ static irqreturn_t fsldma_chan_irq(int irq, void *data)
         /*
          * Programming Error
          * The DMA_INTERRUPT async_tx is a NULL transfer, which will
-         * triger a PE interrupt.
+         * trigger a PE interrupt.
          */
         if (stat & FSL_DMA_SR_PE) {
                 chan_dbg(chan, "irq: Programming Error INT\n");
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index 5084975d793c..54f580bb993c 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -572,8 +572,8 @@ static void imxdma_tasklet(unsigned long data)
         if (desc->desc.callback)
                 desc->desc.callback(desc->desc.callback_param);
 
-        /* If we are dealing with a cyclic descriptor keep it on ld_active
-         * and dont mark the descripor as complete.
+        /* If we are dealing with a cyclic descriptor, keep it on ld_active
+         * and dont mark the descriptor as complete.
          * Only in non-cyclic cases it would be marked as complete
          */
         if (imxdma_chan_is_doing_cyclic(imxdmac))
diff --git a/drivers/dma/intel_mid_dma.c b/drivers/dma/intel_mid_dma.c
index 222e907bfaaa..02b21d7d38e5 100644
--- a/drivers/dma/intel_mid_dma.c
+++ b/drivers/dma/intel_mid_dma.c
@@ -427,7 +427,7 @@ DMA engine callback Functions*/
  * intel_mid_dma_tx_submit -    callback to submit DMA transaction
  * @tx: dma engine descriptor
  *
- * Submit the DMA trasaction for this descriptor, start if ch idle
+ * Submit the DMA transaction for this descriptor, start if ch idle
  */
 static dma_cookie_t intel_mid_dma_tx_submit(struct dma_async_tx_descriptor *tx)
 {
diff --git a/drivers/dma/intel_mid_dma_regs.h b/drivers/dma/intel_mid_dma_regs.h
index 1bfa9268feaf..17b42192ea58 100644
--- a/drivers/dma/intel_mid_dma_regs.h
+++ b/drivers/dma/intel_mid_dma_regs.h
@@ -168,9 +168,9 @@ union intel_mid_dma_cfg_hi {
  * @active_list: current active descriptors
  * @queue: current queued up descriptors
  * @free_list: current free descriptors
- * @slave: dma slave struture
- * @descs_allocated: total number of decsiptors allocated
- * @dma: dma device struture pointer
+ * @slave: dma slave structure
+ * @descs_allocated: total number of descriptors allocated
+ * @dma: dma device structure pointer
  * @busy: bool representing if ch is busy (active txn) or not
  * @in_use: bool representing if ch is in use or not
  * @raw_tfr: raw trf interrupt received
diff --git a/drivers/dma/ioat/hw.h b/drivers/dma/ioat/hw.h
index 60e675455b6a..d2ff3fda0b18 100644
--- a/drivers/dma/ioat/hw.h
+++ b/drivers/dma/ioat/hw.h
@@ -22,7 +22,6 @@
 #define _IOAT_HW_H_
 
 /* PCI Configuration Space Values */
-#define IOAT_PCI_VID            0x8086
 #define IOAT_MMIO_BAR           0
 
 /* CB device ID's */
@@ -31,9 +30,6 @@
 #define IOAT_PCI_DID_SCNB       0x65FF
 #define IOAT_PCI_DID_SNB        0x402F
 
-#define IOAT_PCI_RID            0x00
-#define IOAT_PCI_SVID           0x8086
-#define IOAT_PCI_SID            0x8086
 #define IOAT_VER_1_2            0x12    /* Version 1.2 */
 #define IOAT_VER_2_0            0x20    /* Version 2.0 */
 #define IOAT_VER_3_0            0x30    /* Version 3.0 */
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index e4feba6b03c0..5d3bbcd279b4 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -522,7 +522,7 @@ enum desc_status {
         /* In the DMAC pool */
         FREE,
         /*
-         * Allocted to some channel during prep_xxx
+         * Allocated to some channel during prep_xxx
          * Also may be sitting on the work_list.
          */
         PREP,
@@ -1567,17 +1567,19 @@ static int pl330_submit_req(void *ch_id, struct pl330_req *r)
                 goto xfer_exit;
         }
 
-        /* Prefer Secure Channel */
-        if (!_manager_ns(thrd))
-                r->cfg->nonsecure = 0;
-        else
-                r->cfg->nonsecure = 1;
 
         /* Use last settings, if not provided */
-        if (r->cfg)
+        if (r->cfg) {
+                /* Prefer Secure Channel */
+                if (!_manager_ns(thrd))
+                        r->cfg->nonsecure = 0;
+                else
+                        r->cfg->nonsecure = 1;
+
                 ccr = _prepare_ccr(r->cfg);
-        else
+        } else {
                 ccr = readl(regs + CC(thrd->id));
+        }
 
         /* If this req doesn't have valid xfer settings */
         if (!_is_valid(ccr)) {
@@ -2928,6 +2930,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                 num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
 
         pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
+        if (!pdmac->peripherals) {
+                ret = -ENOMEM;
+                dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
+                goto probe_err5;
+        }
 
         for (i = 0; i < num_chan; i++) {
                 pch = &pdmac->peripherals[i];
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index ced98826684a..f72348d0bc41 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -4446,7 +4446,7 @@ static int __devinit ppc440spe_adma_probe(struct platform_device *ofdev)
                 ret = -ENOMEM;
                 goto err_dma_alloc;
         }
-        dev_dbg(&ofdev->dev, "allocted descriptor pool virt 0x%p phys 0x%llx\n",
+        dev_dbg(&ofdev->dev, "allocated descriptor pool virt 0x%p phys 0x%llx\n",
                 adev->dma_desc_pool_virt, (u64)adev->dma_desc_pool);
 
         regs = ioremap(res.start, resource_size(&res));
diff --git a/drivers/dma/ste_dma40_ll.h b/drivers/dma/ste_dma40_ll.h
index 51e8e5396e9b..6d47373f3f58 100644
--- a/drivers/dma/ste_dma40_ll.h
+++ b/drivers/dma/ste_dma40_ll.h
@@ -202,7 +202,7 @@
 /* LLI related structures */
 
 /**
- * struct d40_phy_lli - The basic configration register for each physical
+ * struct d40_phy_lli - The basic configuration register for each physical
  * channel.
  *
  * @reg_cfg: The configuration register.
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 616d90bcb3a4..d5dc9da7f99f 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -199,6 +199,36 @@ void *edac_align_ptr(void **p, unsigned size, int n_elems)
         return (void *)(((unsigned long)ptr) + align - r);
 }
 
+static void _edac_mc_free(struct mem_ctl_info *mci)
+{
+        int i, chn, row;
+        struct csrow_info *csr;
+        const unsigned int tot_dimms = mci->tot_dimms;
+        const unsigned int tot_channels = mci->num_cschannel;
+        const unsigned int tot_csrows = mci->nr_csrows;
+
+        if (mci->dimms) {
+                for (i = 0; i < tot_dimms; i++)
+                        kfree(mci->dimms[i]);
+                kfree(mci->dimms);
+        }
+        if (mci->csrows) {
+                for (row = 0; row < tot_csrows; row++) {
+                        csr = mci->csrows[row];
+                        if (csr) {
+                                if (csr->channels) {
+                                        for (chn = 0; chn < tot_channels; chn++)
+                                                kfree(csr->channels[chn]);
+                                        kfree(csr->channels);
+                                }
+                                kfree(csr);
+                        }
+                }
+                kfree(mci->csrows);
+        }
+        kfree(mci);
+}
+
 /**
  * edac_mc_alloc: Allocate and partially fill a struct mem_ctl_info structure
  * @mc_num:             Memory controller number
@@ -413,24 +443,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
         return mci;
 
 error:
-        if (mci->dimms) {
-                for (i = 0; i < tot_dimms; i++)
-                        kfree(mci->dimms[i]);
-                kfree(mci->dimms);
-        }
-        if (mci->csrows) {
-                for (chn = 0; chn < tot_channels; chn++) {
-                        csr = mci->csrows[chn];
-                        if (csr) {
-                                for (chn = 0; chn < tot_channels; chn++)
-                                        kfree(csr->channels[chn]);
-                                kfree(csr);
-                        }
-                        kfree(mci->csrows[i]);
-                }
-                kfree(mci->csrows);
-        }
-        kfree(mci);
+        _edac_mc_free(mci);
 
         return NULL;
 }
@@ -445,6 +458,14 @@ void edac_mc_free(struct mem_ctl_info *mci)
 {
         edac_dbg(1, "\n");
 
+        /* If we're not yet registered with sysfs free only what was allocated
+         * in edac_mc_alloc().
+         */
+        if (!device_is_registered(&mci->dev)) {
+                _edac_mc_free(mci);
+                return;
+        }
+
         /* the mci instance is freed here, when the sysfs object is dropped */
         edac_unregister_sysfs(mci);
 }
diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
index 47180a08edad..b6653a6fc5d5 100644
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -391,7 +391,7 @@ static int i3200_probe1(struct pci_dev *pdev, int dev_idx)
                 for (j = 0; j < nr_channels; j++) {
                         struct dimm_info *dimm = csrow->channels[j]->dimm;
 
-                        dimm->nr_pages = nr_pages / nr_channels;
+                        dimm->nr_pages = nr_pages;
                         dimm->grain = nr_pages << PAGE_SHIFT;
                         dimm->mtype = MEM_DDR2;
                         dimm->dtype = DEV_UNKNOWN;
diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
index 39c63757c2a1..6a49dd00b81b 100644
--- a/drivers/edac/i5000_edac.c
+++ b/drivers/edac/i5000_edac.c
@@ -1012,6 +1012,10 @@ static void handle_channel(struct i5000_pvt *pvt, int slot, int channel,
                         /* add the number of COLUMN bits */
                         addrBits += MTR_DIMM_COLS_ADDR_BITS(mtr);
 
+                        /* Dual-rank memories have twice the size */
+                        if (dinfo->dual_rank)
+                                addrBits++;
+
                         addrBits += 6;  /* add 64 bits per DIMM */
                         addrBits -= 20; /* divide by 2^^20 */
                         addrBits -= 3;  /* 8 bits per bytes */
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index f3b1f9fafa4b..5715b7c2c517 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -513,7 +513,8 @@ static int get_dimm_config(struct mem_ctl_info *mci)
 {
         struct sbridge_pvt *pvt = mci->pvt_info;
         struct dimm_info *dimm;
-        int i, j, banks, ranks, rows, cols, size, npages;
+        unsigned i, j, banks, ranks, rows, cols, npages;
+        u64 size;
         u32 reg;
         enum edac_type mode;
         enum mem_type mtype;
@@ -585,10 +586,10 @@ static int get_dimm_config(struct mem_ctl_info *mci)
                                 cols = numcol(mtr);
 
                                 /* DDR3 has 8 I/O banks */
-                                size = (rows * cols * banks * ranks) >> (20 - 3);
+                                size = ((u64)rows * cols * banks * ranks) >> (20 - 3);
                                 npages = MiB_TO_PAGES(size);
 
-                                edac_dbg(0, "mc#%d: channel %d, dimm %d, %d Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+                                edac_dbg(0, "mc#%d: channel %d, dimm %d, %Ld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
                                          pvt->sbridge_dev->mc, i, j,
                                          size, npages,
                                          banks, ranks, rows, cols);
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index 427a289f32a5..6c19833ed2d0 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -434,6 +434,11 @@ static int __devinit arizona_extcon_probe(struct platform_device *pdev)
         regmap_update_bits(arizona->regmap, ARIZONA_JACK_DETECT_ANALOGUE,
                            ARIZONA_JD1_ENA, ARIZONA_JD1_ENA);
 
+        ret = regulator_allow_bypass(info->micvdd, true);
+        if (ret != 0)
+                dev_warn(arizona->dev, "Failed to set MICVDD to bypass: %d\n",
+                         ret);
+
         pm_runtime_put(&pdev->dev);
 
         return 0;
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index 920a609b2c35..38f9e52f358b 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -669,13 +669,18 @@ static int __devinit max77693_muic_probe(struct platform_device *pdev)
         }
         info->dev = &pdev->dev;
         info->max77693 = max77693;
-        info->max77693->regmap_muic = regmap_init_i2c(info->max77693->muic,
-                                         &max77693_muic_regmap_config);
-        if (IS_ERR(info->max77693->regmap_muic)) {
-                ret = PTR_ERR(info->max77693->regmap_muic);
-                dev_err(max77693->dev,
-                        "failed to allocate register map: %d\n", ret);
-                goto err_regmap;
+        if (info->max77693->regmap_muic)
+                dev_dbg(&pdev->dev, "allocate register map\n");
+        else {
+                info->max77693->regmap_muic = devm_regmap_init_i2c(
+                                                info->max77693->muic,
+                                                &max77693_muic_regmap_config);
+                if (IS_ERR(info->max77693->regmap_muic)) {
+                        ret = PTR_ERR(info->max77693->regmap_muic);
+                        dev_err(max77693->dev,
+                                "failed to allocate register map: %d\n", ret);
+                        goto err_regmap;
+                }
         }
         platform_set_drvdata(pdev, info);
         mutex_init(&info->mutex);
diff --git a/drivers/gpio/gpio-lpc32xx.c b/drivers/gpio/gpio-lpc32xx.c
index 8a420f13905e..ed94b4ea72e9 100644
--- a/drivers/gpio/gpio-lpc32xx.c
+++ b/drivers/gpio/gpio-lpc32xx.c
@@ -308,6 +308,7 @@ static int lpc32xx_gpio_dir_output_p012(struct gpio_chip *chip, unsigned pin,
 {
         struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+        __set_gpio_level_p012(group, pin, value);
         __set_gpio_dir_p012(group, pin, 0);
 
         return 0;
@@ -318,6 +319,7 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
 {
         struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+        __set_gpio_level_p3(group, pin, value);
         __set_gpio_dir_p3(group, pin, 0);
 
         return 0;
@@ -326,6 +328,9 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
 static int lpc32xx_gpio_dir_out_always(struct gpio_chip *chip, unsigned pin,
         int value)
 {
+        struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
+
+        __set_gpo_level_p3(group, pin, value);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index d0c4574ef49c..36164806b9d4 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -193,6 +193,9 @@ static const struct file_operations ast_fops = {
         .mmap = ast_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .read = drm_read,
 };
 
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 7282c081fb53..a712cafcfa1d 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -841,7 +841,7 @@ int ast_cursor_init(struct drm_device *dev)
 
         ast->cursor_cache = obj;
         ast->cursor_cache_gpu_addr = gpu_addr;
-        DRM_ERROR("pinned cursor cache at %llx\n", ast->cursor_cache_gpu_addr);
+        DRM_DEBUG_KMS("pinned cursor cache at %llx\n", ast->cursor_cache_gpu_addr);
         return 0;
 fail:
         return ret;
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
index 7053140c6596..b83a2d7ddd1a 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
@@ -74,6 +74,9 @@ static const struct file_operations cirrus_driver_fops = {
         .unlocked_ioctl = drm_ioctl,
         .mmap = cirrus_mmap,
         .poll = drm_poll,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .fasync = drm_fasync,
 };
 static struct drm_driver driver = {
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 7f5096763b7d..59a26e577b57 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -36,6 +36,6 @@ config DRM_EXYNOS_VIDI
 
 config DRM_EXYNOS_G2D
         bool "Exynos DRM G2D"
-        depends on DRM_EXYNOS
+        depends on DRM_EXYNOS && !VIDEO_SAMSUNG_S5P_G2D
         help
           Choose this option if you want to use Exynos G2D for DRM.
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index 613bf8a5d9b2..ae13febe0eaa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -163,6 +163,12 @@ static void exynos_gem_dmabuf_kunmap(struct dma_buf *dma_buf,
         /* TODO */
 }
 
+static int exynos_gem_dmabuf_mmap(struct dma_buf *dma_buf,
+        struct vm_area_struct *vma)
+{
+        return -ENOTTY;
+}
+
 static struct dma_buf_ops exynos_dmabuf_ops = {
         .map_dma_buf            = exynos_gem_map_dma_buf,
         .unmap_dma_buf          = exynos_gem_unmap_dma_buf,
@@ -170,6 +176,7 @@ static struct dma_buf_ops exynos_dmabuf_ops = {
         .kmap_atomic            = exynos_gem_dmabuf_kmap_atomic,
         .kunmap                 = exynos_gem_dmabuf_kunmap,
         .kunmap_atomic          = exynos_gem_dmabuf_kunmap_atomic,
+        .mmap                   = exynos_gem_dmabuf_mmap,
         .release                = exynos_dmabuf_release,
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index ebacec6f1e48..d07071937453 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -160,7 +160,6 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
         if (!file_priv)
                 return -ENOMEM;
 
-        drm_prime_init_file_private(&file->prime);
         file->driver_priv = file_priv;
 
         return exynos_drm_subdrv_open(dev, file);
@@ -184,7 +183,6 @@ static void exynos_drm_preclose(struct drm_device *dev,
                         e->base.destroy(&e->base);
                 }
         }
-        drm_prime_destroy_file_private(&file->prime);
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
         exynos_drm_subdrv_close(dev, file);
@@ -241,6 +239,9 @@ static const struct file_operations exynos_drm_driver_fops = {
         .poll           = drm_poll,
         .read           = drm_read,
         .unlocked_ioctl = drm_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .release        = drm_release,
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index a68d2b313f03..b19cd93e7047 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -831,11 +831,6 @@ static int __devinit fimd_probe(struct platform_device *pdev)
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(dev, "failed to find registers\n");
-                ret = -ENOENT;
-                goto err_clk;
-        }
 
         ctx->regs = devm_request_and_ioremap(&pdev->dev, res);
         if (!ctx->regs) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index d2d88f22a037..1065e90d0919 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -129,7 +129,6 @@ struct g2d_runqueue_node {
 struct g2d_data {
         struct device                   *dev;
         struct clk                      *gate_clk;
-        struct resource                 *regs_res;
         void __iomem                    *regs;
         int                             irq;
         struct workqueue_struct         *g2d_workq;
@@ -751,7 +750,7 @@ static int __devinit g2d_probe(struct platform_device *pdev)
         struct exynos_drm_subdrv *subdrv;
         int ret;
 
-        g2d = kzalloc(sizeof(*g2d), GFP_KERNEL);
+        g2d = devm_kzalloc(&pdev->dev, sizeof(*g2d), GFP_KERNEL);
         if (!g2d) {
                 dev_err(dev, "failed to allocate driver data\n");
                 return -ENOMEM;
@@ -759,10 +758,8 @@ static int __devinit g2d_probe(struct platform_device *pdev)
 
         g2d->runqueue_slab = kmem_cache_create("g2d_runqueue_slab",
                         sizeof(struct g2d_runqueue_node), 0, 0, NULL);
-        if (!g2d->runqueue_slab) {
-                ret = -ENOMEM;
-                goto err_free_mem;
-        }
+        if (!g2d->runqueue_slab)
+                return -ENOMEM;
 
         g2d->dev = dev;
 
@@ -794,38 +791,26 @@ static int __devinit g2d_probe(struct platform_device *pdev)
         pm_runtime_enable(dev);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(dev, "failed to get I/O memory\n");
-                ret = -ENOENT;
-                goto err_put_clk;
-        }
 
-        g2d->regs_res = request_mem_region(res->start, resource_size(res),
-                                           dev_name(dev));
-        if (!g2d->regs_res) {
-                dev_err(dev, "failed to request I/O memory\n");
-                ret = -ENOENT;
-                goto err_put_clk;
-        }
-
-        g2d->regs = ioremap(res->start, resource_size(res));
+        g2d->regs = devm_request_and_ioremap(&pdev->dev, res);
         if (!g2d->regs) {
                 dev_err(dev, "failed to remap I/O memory\n");
                 ret = -ENXIO;
-                goto err_release_res;
+                goto err_put_clk;
         }
 
         g2d->irq = platform_get_irq(pdev, 0);
         if (g2d->irq < 0) {
                 dev_err(dev, "failed to get irq\n");
                 ret = g2d->irq;
-                goto err_unmap_base;
+                goto err_put_clk;
         }
 
-        ret = request_irq(g2d->irq, g2d_irq_handler, 0, "drm_g2d", g2d);
+        ret = devm_request_irq(&pdev->dev, g2d->irq, g2d_irq_handler, 0,
+                                                                "drm_g2d", g2d);
         if (ret < 0) {
                 dev_err(dev, "irq request failed\n");
-                goto err_unmap_base;
+                goto err_put_clk;
         }
 
         platform_set_drvdata(pdev, g2d);
@@ -838,7 +823,7 @@ static int __devinit g2d_probe(struct platform_device *pdev)
         ret = exynos_drm_subdrv_register(subdrv);
         if (ret < 0) {
                 dev_err(dev, "failed to register drm g2d device\n");
-                goto err_free_irq;
+                goto err_put_clk;
         }
 
         dev_info(dev, "The exynos g2d(ver %d.%d) successfully probed\n",
@@ -846,13 +831,6 @@ static int __devinit g2d_probe(struct platform_device *pdev)
 
         return 0;
 
-err_free_irq:
-        free_irq(g2d->irq, g2d);
-err_unmap_base:
-        iounmap(g2d->regs);
-err_release_res:
-        release_resource(g2d->regs_res);
-        kfree(g2d->regs_res);
 err_put_clk:
         pm_runtime_disable(dev);
         clk_put(g2d->gate_clk);
@@ -862,8 +840,6 @@ err_destroy_workqueue:
         destroy_workqueue(g2d->g2d_workq);
 err_destroy_slab:
         kmem_cache_destroy(g2d->runqueue_slab);
-err_free_mem:
-        kfree(g2d);
         return ret;
 }
 
@@ -873,24 +849,18 @@ static int __devexit g2d_remove(struct platform_device *pdev)
 
         cancel_work_sync(&g2d->runqueue_work);
         exynos_drm_subdrv_unregister(&g2d->subdrv);
-        free_irq(g2d->irq, g2d);
 
         while (g2d->runqueue_node) {
                 g2d_free_runqueue_node(g2d, g2d->runqueue_node);
                 g2d->runqueue_node = g2d_get_runqueue_node(g2d);
         }
 
-        iounmap(g2d->regs);
-        release_resource(g2d->regs_res);
-        kfree(g2d->regs_res);
-
         pm_runtime_disable(&pdev->dev);
         clk_put(g2d->gate_clk);
 
         g2d_fini_cmdlist(g2d);
         destroy_workqueue(g2d->g2d_workq);
         kmem_cache_destroy(g2d->runqueue_slab);
-        kfree(g2d);
 
         return 0;
 }
@@ -924,7 +894,7 @@ static int g2d_resume(struct device *dev)
 }
 #endif
 
-SIMPLE_DEV_PM_OPS(g2d_pm_ops, g2d_suspend, g2d_resume);
+static SIMPLE_DEV_PM_OPS(g2d_pm_ops, g2d_suspend, g2d_resume);
 
 struct platform_driver g2d_driver = {
         .probe          = g2d_probe,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index f9efde40c097..a38051c95ec4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -122,7 +122,7 @@ fail:
                 __free_page(pages[i]);
 
         drm_free_large(pages);
-        return ERR_PTR(PTR_ERR(p));
+        return ERR_CAST(p);
 }
 
 static void exynos_gem_put_pages(struct drm_gem_object *obj,
@@ -662,7 +662,7 @@ int exynos_drm_gem_dumb_create(struct drm_file *file_priv,
          */
 
         args->pitch = args->width * ((args->bpp + 7) / 8);
-        args->size = PAGE_ALIGN(args->pitch * args->height);
+        args->size = args->pitch * args->height;
 
         exynos_gem_obj = exynos_drm_gem_create(dev, args->flags, args->size);
         if (IS_ERR(exynos_gem_obj))
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 8ffcdf8b9e22..3fdf0b65f47e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -345,7 +345,7 @@ static int __devinit exynos_drm_hdmi_probe(struct platform_device *pdev)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
         if (!ctx) {
                 DRM_LOG_KMS("failed to alloc common hdmi context.\n");
                 return -ENOMEM;
@@ -371,7 +371,6 @@ static int __devexit exynos_drm_hdmi_remove(struct platform_device *pdev)
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         exynos_drm_subdrv_unregister(&ctx->subdrv);
-        kfree(ctx);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index b89829e5043a..e1f94b746bd7 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -29,7 +29,6 @@ static const uint32_t formats[] = {
         DRM_FORMAT_XRGB8888,
         DRM_FORMAT_ARGB8888,
         DRM_FORMAT_NV12,
-        DRM_FORMAT_NV12M,
         DRM_FORMAT_NV12MT,
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index bb1550c4dd57..537027a74fd5 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -633,7 +633,7 @@ static int __devinit vidi_probe(struct platform_device *pdev)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
         if (!ctx)
                 return -ENOMEM;
 
@@ -673,8 +673,6 @@ static int __devexit vidi_remove(struct platform_device *pdev)
                 ctx->raw_edid = NULL;
         }
 
-        kfree(ctx);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 409e2ec1207c..a6aea6f3ea1a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2172,7 +2172,7 @@ static int __devinit hdmi_resources_init(struct hdmi_context *hdata)
 
         DRM_DEBUG_KMS("HDMI resource init\n");
 
-        memset(res, 0, sizeof *res);
+        memset(res, 0, sizeof(*res));
 
         /* get clocks, power */
         res->hdmi = clk_get(dev, "hdmi");
@@ -2204,7 +2204,7 @@ static int __devinit hdmi_resources_init(struct hdmi_context *hdata)
         clk_set_parent(res->sclk_hdmi, res->sclk_pixel);
 
         res->regul_bulk = kzalloc(ARRAY_SIZE(supply) *
-                sizeof res->regul_bulk[0], GFP_KERNEL);
+                sizeof(res->regul_bulk[0]), GFP_KERNEL);
         if (!res->regul_bulk) {
                 DRM_ERROR("failed to get memory for regulators\n");
                 goto fail;
@@ -2243,7 +2243,7 @@ static int hdmi_resources_cleanup(struct hdmi_context *hdata)
                 clk_put(res->sclk_hdmi);
         if (!IS_ERR_OR_NULL(res->hdmi))
                 clk_put(res->hdmi);
-        memset(res, 0, sizeof *res);
+        memset(res, 0, sizeof(*res));
 
         return 0;
 }
@@ -2312,11 +2312,6 @@ static int __devinit hdmi_probe(struct platform_device *pdev)
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                DRM_ERROR("failed to find registers\n");
-                ret = -ENOENT;
-                goto err_resource;
-        }
 
         hdata->regs = devm_request_and_ioremap(&pdev->dev, res);
         if (!hdata->regs) {
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 30fcc12f81dd..25b97d5e5fcb 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -236,11 +236,11 @@ static inline void vp_filter_set(struct mixer_resources *res,
 static void vp_default_filter(struct mixer_resources *res)
 {
         vp_filter_set(res, VP_POLY8_Y0_LL,
-                filter_y_horiz_tap8, sizeof filter_y_horiz_tap8);
+                filter_y_horiz_tap8, sizeof(filter_y_horiz_tap8));
         vp_filter_set(res, VP_POLY4_Y0_LL,
-                filter_y_vert_tap4, sizeof filter_y_vert_tap4);
+                filter_y_vert_tap4, sizeof(filter_y_vert_tap4));
         vp_filter_set(res, VP_POLY4_C0_LL,
-                filter_cr_horiz_tap4, sizeof filter_cr_horiz_tap4);
+                filter_cr_horiz_tap4, sizeof(filter_cr_horiz_tap4));
 }
 
 static void mixer_vsync_set_update(struct mixer_context *ctx, bool enable)
diff --git a/drivers/gpu/drm/gma500/oaktrail_device.c b/drivers/gpu/drm/gma500/oaktrail_device.c
index 0f9b7db80f6b..cf49ba5a54bf 100644
--- a/drivers/gpu/drm/gma500/oaktrail_device.c
+++ b/drivers/gpu/drm/gma500/oaktrail_device.c
@@ -476,6 +476,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
                 .pos = DSPAPOS,
                 .surf = DSPASURF,
                 .addr = MRST_DSPABASE,
+                .base = MRST_DSPABASE,
                 .status = PIPEASTAT,
                 .linoff = DSPALINOFF,
                 .tileoff = DSPATILEOFF,
@@ -499,6 +500,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
                 .pos = DSPBPOS,
                 .surf = DSPBSURF,
                 .addr = DSPBBASE,
+                .base = DSPBBASE,
                 .status = PIPEBSTAT,
                 .linoff = DSPBLINOFF,
                 .tileoff = DSPBTILEOFF,
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 57d892eaaa6e..463ec6871fe9 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -115,6 +115,9 @@ static const struct file_operations i810_buffer_fops = {
         .unlocked_ioctl = drm_ioctl,
         .mmap = i810_mmap_buffers,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/i810/i810_drv.c b/drivers/gpu/drm/i810/i810_drv.c
index f9924ad04d09..48cfcca2b350 100644
--- a/drivers/gpu/drm/i810/i810_drv.c
+++ b/drivers/gpu/drm/i810/i810_drv.c
@@ -51,6 +51,9 @@ static const struct file_operations i810_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9cf7dfe022b9..914c0dfabe60 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1587,6 +1587,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         spin_lock_init(&dev_priv->irq_lock);
         spin_lock_init(&dev_priv->error_lock);
         spin_lock_init(&dev_priv->rps_lock);
+        spin_lock_init(&dev_priv->dpio_lock);
 
         if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
                 dev_priv->num_pipe = 3;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 489e2b162b27..274d25de521e 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3242,7 +3242,8 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
 {
         int ret;
 
-        BUG_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT);
+        if (WARN_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
+                return -EBUSY;
 
         if (obj->gtt_space != NULL) {
                 if ((alignment && obj->gtt_offset & (alignment - 1)) ||
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 8a3828528b9d..5249640cce13 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2700,9 +2700,6 @@ void intel_irq_init(struct drm_device *dev)
                         dev->driver->irq_handler = i8xx_irq_handler;
                         dev->driver->irq_uninstall = i8xx_irq_uninstall;
                 } else if (INTEL_INFO(dev)->gen == 3) {
-                        /* IIR "flip pending" means done if this bit is set */
-                        I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
-
                         dev->driver->irq_preinstall = i915_irq_preinstall;
                         dev->driver->irq_postinstall = i915_irq_postinstall;
                         dev->driver->irq_uninstall = i915_irq_uninstall;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2dfa6cf4886b..c040aee1341c 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1376,7 +1376,8 @@ static void assert_pch_dp_disabled(struct drm_i915_private *dev_priv,
              "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
              reg, pipe_name(pipe));
 
-        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & SDVO_PIPE_B_SELECT),
+        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & DP_PORT_EN) == 0
+             && (val & DP_PIPEB_SELECT),
              "IBX PCH dp port still using transcoder B\n");
 }
 
@@ -1388,7 +1389,8 @@ static void assert_pch_hdmi_disabled(struct drm_i915_private *dev_priv,
              "PCH HDMI (0x%08x) enabled on transcoder %c, should be disabled\n",
              reg, pipe_name(pipe));
 
-        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & SDVO_PIPE_B_SELECT),
+        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & PORT_ENABLE) == 0
+             && (val & SDVO_PIPE_B_SELECT),
              "IBX PCH hdmi port still using transcoder B\n");
 }
 
@@ -4189,12 +4191,6 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
         POSTING_READ(DPLL(pipe));
         udelay(150);
 
-        I915_WRITE(DPLL(pipe), dpll);
-
-        /* Wait for the clocks to stabilize. */
-        POSTING_READ(DPLL(pipe));
-        udelay(150);
-
         /* The LVDS pin pair needs to be on before the DPLLs are enabled.
          * This is an exception to the general rule that mode_set doesn't turn
          * things on.
@@ -4202,6 +4198,12 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
         if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
                 intel_update_lvds(crtc, clock, adjusted_mode);
 
+        I915_WRITE(DPLL(pipe), dpll);
+
+        /* Wait for the clocks to stabilize. */
+        POSTING_READ(DPLL(pipe));
+        udelay(150);
+
         /* The pixel multiplier can only be updated once the
          * DPLL is enabled and the clocks are stable.
          *
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index a6c426afaa7a..ace757af9133 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2533,14 +2533,10 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                         break;
         }
 
-        intel_dp_i2c_init(intel_dp, intel_connector, name);
-
         /* Cache some DPCD data in the eDP case */
         if (is_edp(intel_dp)) {
-                bool ret;
                 struct edp_power_seq    cur, vbt;
                 u32 pp_on, pp_off, pp_div;
-                struct edid *edid;
 
                 pp_on = I915_READ(PCH_PP_ON_DELAYS);
                 pp_off = I915_READ(PCH_PP_OFF_DELAYS);
@@ -2591,6 +2587,13 @@ intel_dp_init(struct drm_device *dev, int output_reg)
 
                 DRM_DEBUG_KMS("backlight on delay %d, off delay %d\n",
                               intel_dp->backlight_on_delay, intel_dp->backlight_off_delay);
+        }
+
+        intel_dp_i2c_init(intel_dp, intel_connector, name);
+
+        if (is_edp(intel_dp)) {
+                bool ret;
+                struct edid *edid;
 
                 ironlake_edp_panel_vdd_on(intel_dp);
                 ret = intel_dp_get_dpcd(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 98f602427eb8..12dc3308ab8c 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -609,7 +609,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
         u32 temp;
         u32 enable_bits = SDVO_ENABLE;
 
-        if (intel_hdmi->has_audio)
+        if (intel_hdmi->has_audio || mode != DRM_MODE_DPMS_ON)
                 enable_bits |= SDVO_AUDIO_ENABLE;
 
         temp = I915_READ(intel_hdmi->sdvox_reg);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 3df4f5fa892a..e019b2369861 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -162,19 +162,12 @@ static u32 i915_read_blc_pwm_ctl(struct drm_i915_private *dev_priv)
         return val;
 }
 
-u32 intel_panel_get_max_backlight(struct drm_device *dev)
+static u32 _intel_panel_get_max_backlight(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 max;
 
         max = i915_read_blc_pwm_ctl(dev_priv);
-        if (max == 0) {
-                /* XXX add code here to query mode clock or hardware clock
-                 * and program max PWM appropriately.
-                 */
-                pr_warn_once("fixme: max PWM is zero\n");
-                return 1;
-        }
 
         if (HAS_PCH_SPLIT(dev)) {
                 max >>= 16;
@@ -188,6 +181,22 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
                         max *= 0xff;
         }
 
+        return max;
+}
+
+u32 intel_panel_get_max_backlight(struct drm_device *dev)
+{
+        u32 max;
+
+        max = _intel_panel_get_max_backlight(dev);
+        if (max == 0) {
+                /* XXX add code here to query mode clock or hardware clock
+                 * and program max PWM appropriately.
+                 */
+                pr_warn_once("fixme: max PWM is zero\n");
+                return 1;
+        }
+
         DRM_DEBUG_DRIVER("max backlight PWM = %d\n", max);
         return max;
 }
@@ -424,7 +433,11 @@ int intel_panel_setup_backlight(struct drm_device *dev)
 
         memset(&props, 0, sizeof(props));
         props.type = BACKLIGHT_RAW;
-        props.max_brightness = intel_panel_get_max_backlight(dev);
+        props.max_brightness = _intel_panel_get_max_backlight(dev);
+        if (props.max_brightness == 0) {
+                DRM_ERROR("Failed to get maximum backlight value\n");
+                return -ENODEV;
+        }
         dev_priv->backlight =
                 backlight_device_register("intel_backlight",
                                           &connector->kdev, dev,
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 1881c8c83f0e..ba8a27b1757a 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3672,6 +3672,9 @@ static void gen3_init_clock_gating(struct drm_device *dev)
 
         if (IS_PINEVIEW(dev))
                 I915_WRITE(ECOSKPD, _MASKED_BIT_ENABLE(ECO_GATING_CX_ONLY));
+
+        /* IIR "flip pending" means done if this bit is set */
+        I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
 }
 
 static void i85x_init_clock_gating(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index d81bb0bf2885..123afd357611 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2573,7 +2573,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                 hotplug_mask = intel_sdvo->is_sdvob ?
                         SDVOB_HOTPLUG_INT_STATUS_I915 : SDVOC_HOTPLUG_INT_STATUS_I915;
         }
-        dev_priv->hotplug_supported_mask |= hotplug_mask;
 
         drm_encoder_helper_add(&intel_encoder->base, &intel_sdvo_helper_funcs);
 
@@ -2581,14 +2580,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
         if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
                 goto err;
 
-        /* Set up hotplug command - note paranoia about contents of reply.
-         * We assume that the hardware is in a sane state, and only touch
-         * the bits we think we understand.
-         */
-        intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
-                             &intel_sdvo->hotplug_active, 2);
-        intel_sdvo->hotplug_active[0] &= ~0x3;
-
         if (intel_sdvo_output_setup(intel_sdvo,
                                     intel_sdvo->caps.output_flags) != true) {
                 DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
@@ -2596,6 +2587,12 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                 goto err;
         }
 
+        /* Only enable the hotplug irq if we need it, to work around noisy
+         * hotplug lines.
+         */
+        if (intel_sdvo->hotplug_active[0])
+                dev_priv->hotplug_supported_mask |= hotplug_mask;
+
         intel_sdvo_select_ddc_bus(dev_priv, intel_sdvo, sdvo_reg);
 
         /* Set the input timing to the screen. Assume always input 0. */
diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.c b/drivers/gpu/drm/mgag200/mgag200_drv.c
index ea1024d79974..e5f145d2cb3b 100644
--- a/drivers/gpu/drm/mgag200/mgag200_drv.c
+++ b/drivers/gpu/drm/mgag200/mgag200_drv.c
@@ -84,6 +84,9 @@ static const struct file_operations mgag200_driver_fops = {
         .mmap = mgag200_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .read = drm_read,
 };
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index ff23d88880e5..3ca240b4413d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -179,7 +179,7 @@ nouveau_abi16_ioctl_grobj_alloc(ABI16_IOCTL_ARGS)
                         return 0;
         } else
         if (init->class == 0x906e) {
-                NV_ERROR(dev, "906e not supported yet\n");
+                NV_DEBUG(dev, "906e not supported yet\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 69688ef5cf46..7e16dc5e6467 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -598,7 +598,7 @@ nouveau_display_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
         args->size = args->pitch * args->height;
         args->size = roundup(args->size, PAGE_SIZE);
 
-        ret = nouveau_gem_new(dev, args->size, 0, TTM_PL_FLAG_VRAM, 0, 0, &bo);
+        ret = nouveau_gem_new(dev, args->size, 0, NOUVEAU_GEM_DOMAIN_VRAM, 0, 0, &bo);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
index f429e6a8ca7a..c399d510b27a 100644
--- a/drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
@@ -22,6 +22,7 @@
  * Authors: Ben Skeggs
  */
 
+#include <linux/dmi.h>
 #include "drmP.h"
 #include "nouveau_drv.h"
 #include "nouveau_hw.h"
@@ -110,11 +111,26 @@ nv50_gpio_isr(struct drm_device *dev)
                 nv_wr32(dev, 0xe074, intr1);
 }
 
+static struct dmi_system_id gpio_reset_ids[] = {
+        {
+                .ident = "Apple Macbook 10,1",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro10,1"),
+                }
+        },
+        { }
+};
+
 int
 nv50_gpio_init(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
 
+        /* initialise gpios and routing to vbios defaults */
+        if (dmi_check_system(gpio_reset_ids))
+                nouveau_gpio_reset(dev);
+
         /* disable, and ack any pending gpio interrupts */
         nv_wr32(dev, 0xe050, 0x00000000);
         nv_wr32(dev, 0xe054, 0xffffffff);
diff --git a/drivers/gpu/drm/nouveau/nvc0_fb.c b/drivers/gpu/drm/nouveau/nvc0_fb.c
index f704e942372e..f376c39310df 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fb.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fb.c
@@ -124,6 +124,7 @@ nvc0_fb_init(struct drm_device *dev)
         priv = dev_priv->engine.fb.priv;
 
         nv_wr32(dev, 0x100c10, priv->r100c10 >> 8);
+        nv_mask(dev, 0x17e820, 0x00100000, 0x00000000); /* NV_PLTCG_INTR_EN */
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvc0_fifo.c b/drivers/gpu/drm/nouveau/nvc0_fifo.c
index 7d85553d518c..cd39eb99f5b1 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fifo.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fifo.c
@@ -373,7 +373,8 @@ nvc0_fifo_isr_subfifo_intr(struct drm_device *dev, int unit)
 static void
 nvc0_fifo_isr(struct drm_device *dev)
 {
-        u32 stat = nv_rd32(dev, 0x002100);
+        u32 mask = nv_rd32(dev, 0x002140);
+        u32 stat = nv_rd32(dev, 0x002100) & mask;
 
         if (stat & 0x00000100) {
                 NV_INFO(dev, "PFIFO: unknown status 0x00000100\n");
diff --git a/drivers/gpu/drm/nouveau/nvd0_display.c b/drivers/gpu/drm/nouveau/nvd0_display.c
index dac525b2994e..8a2fc89b7763 100644
--- a/drivers/gpu/drm/nouveau/nvd0_display.c
+++ b/drivers/gpu/drm/nouveau/nvd0_display.c
@@ -1510,10 +1510,10 @@ nvd0_sor_mode_set(struct drm_encoder *encoder, struct drm_display_mode *umode,
         case OUTPUT_DP:
                 if (nv_connector->base.display_info.bpc == 6) {
                         nv_encoder->dp.datarate = mode->clock * 18 / 8;
-                        syncs |= 0x00000140;
+                        syncs |= 0x00000002 << 6;
                 } else {
                         nv_encoder->dp.datarate = mode->clock * 24 / 8;
-                        syncs |= 0x00000180;
+                        syncs |= 0x00000005 << 6;
                 }
 
                 if (nv_encoder->dcb->sorconf.link & 1)
diff --git a/drivers/gpu/drm/nouveau/nve0_fifo.c b/drivers/gpu/drm/nouveau/nve0_fifo.c
index e98d144e6eb9..281bece751b6 100644
--- a/drivers/gpu/drm/nouveau/nve0_fifo.c
+++ b/drivers/gpu/drm/nouveau/nve0_fifo.c
@@ -345,7 +345,8 @@ nve0_fifo_isr_subfifo_intr(struct drm_device *dev, int unit)
 static void
 nve0_fifo_isr(struct drm_device *dev)
 {
-        u32 stat = nv_rd32(dev, 0x002100);
+        u32 mask = nv_rd32(dev, 0x002140);
+        u32 stat = nv_rd32(dev, 0x002100) & mask;
 
         if (stat & 0x00000100) {
                 NV_INFO(dev, "PFIFO: unknown status 0x00000100\n");
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 8acb34fd3fd5..8d7e33a0b243 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1182,7 +1182,8 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
         ring->ready = true;
         radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
 
-        if (radeon_ring_supports_scratch_reg(rdev, ring)) {
+        if (!ring->rptr_save_reg /* not resuming from suspend */
+            && radeon_ring_supports_scratch_reg(rdev, ring)) {
                 r = radeon_scratch_get(rdev, &ring->rptr_save_reg);
                 if (r) {
                         DRM_ERROR("failed to get scratch reg for rptr save (%d).\n", r);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 7b737b9339ad..2a59375dbe52 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -131,7 +131,7 @@ int radeon_fence_emit(struct radeon_device *rdev,
  */
 void radeon_fence_process(struct radeon_device *rdev, int ring)
 {
-        uint64_t seq, last_seq;
+        uint64_t seq, last_seq, last_emitted;
         unsigned count_loop = 0;
         bool wake = false;
 
@@ -158,13 +158,15 @@ void radeon_fence_process(struct radeon_device *rdev, int ring)
          */
         last_seq = atomic64_read(&rdev->fence_drv[ring].last_seq);
         do {
+                last_emitted = rdev->fence_drv[ring].sync_seq[ring];
                 seq = radeon_fence_read(rdev, ring);
                 seq |= last_seq & 0xffffffff00000000LL;
                 if (seq < last_seq) {
-                        seq += 0x100000000LL;
+                        seq &= 0xffffffff;
+                        seq |= last_emitted & 0xffffffff00000000LL;
                 }
 
-                if (seq == last_seq) {
+                if (seq <= last_seq || seq > last_emitted) {
                         break;
                 }
                 /* If we loop over we don't want to return without
diff --git a/drivers/gpu/drm/savage/savage_drv.c b/drivers/gpu/drm/savage/savage_drv.c
index d31d4cca9a4c..c5a164337bd5 100644
--- a/drivers/gpu/drm/savage/savage_drv.c
+++ b/drivers/gpu/drm/savage/savage_drv.c
@@ -43,6 +43,9 @@ static const struct file_operations savage_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/sis/sis_drv.c b/drivers/gpu/drm/sis/sis_drv.c
index 7f119870147c..867dc03000e6 100644
--- a/drivers/gpu/drm/sis/sis_drv.c
+++ b/drivers/gpu/drm/sis/sis_drv.c
@@ -74,6 +74,9 @@ static const struct file_operations sis_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/tdfx/tdfx_drv.c b/drivers/gpu/drm/tdfx/tdfx_drv.c
index 90f6b13acfac..a7f4d6bd1330 100644
--- a/drivers/gpu/drm/tdfx/tdfx_drv.c
+++ b/drivers/gpu/drm/tdfx/tdfx_drv.c
@@ -49,6 +49,9 @@ static const struct file_operations tdfx_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index ba055e9ca007..8d9dc44f1f94 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -69,6 +69,13 @@ static int udl_get_modes(struct drm_connector *connector)
 static int udl_mode_valid(struct drm_connector *connector,
                           struct drm_display_mode *mode)
 {
+        struct udl_device *udl = connector->dev->dev_private;
+        if (!udl->sku_pixel_limit)
+                return 0;
+
+        if (mode->vdisplay * mode->hdisplay > udl->sku_pixel_limit)
+                return MODE_VIRTUAL_Y;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 6e52069894b3..9f84128505bb 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -66,6 +66,9 @@ static const struct file_operations udl_driver_fops = {
         .unlocked_ioctl = drm_ioctl,
         .release = drm_release,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/via/via_drv.c b/drivers/gpu/drm/via/via_drv.c
index e927b4c052f5..af1b914b17e3 100644
--- a/drivers/gpu/drm/via/via_drv.c
+++ b/drivers/gpu/drm/via/via_drv.c
@@ -65,6 +65,9 @@ static const struct file_operations via_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/vmwgfx/Kconfig b/drivers/gpu/drm/vmwgfx/Kconfig
index 794ff67c5701..b71bcd0bfbbf 100644
--- a/drivers/gpu/drm/vmwgfx/Kconfig
+++ b/drivers/gpu/drm/vmwgfx/Kconfig
@@ -12,3 +12,11 @@ config DRM_VMWGFX
           This is a KMS enabled DRM driver for the VMware SVGA2
           virtual hardware.
           The compiled module will be called "vmwgfx.ko".
+
+config DRM_VMWGFX_FBCON
+        depends on DRM_VMWGFX
+        bool "Enable framebuffer console under vmwgfx by default"
+        help
+           Choose this option if you are shipping a new vmwgfx
+           userspace driver that supports using the kernel driver.
+
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 4d9edead01ac..ba2c35dbf10e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -182,8 +182,9 @@ static struct pci_device_id vmw_pci_id_list[] = {
         {0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII},
         {0, 0, 0}
 };
+MODULE_DEVICE_TABLE(pci, vmw_pci_id_list);
 
-static int enable_fbdev;
+static int enable_fbdev = IS_ENABLED(CONFIG_DRM_VMWGFX_FBCON);
 
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
@@ -1154,6 +1155,11 @@ static struct drm_driver driver = {
         .open = vmw_driver_open,
         .preclose = vmw_preclose,
         .postclose = vmw_postclose,
+
+        .dumb_create = vmw_dumb_create,
+        .dumb_map_offset = vmw_dumb_map_offset,
+        .dumb_destroy = vmw_dumb_destroy,
+
         .fops = &vmwgfx_driver_fops,
         .name = VMWGFX_DRIVER_NAME,
         .desc = VMWGFX_DRIVER_DESC,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index d0f2c079ee27..29c984ff7f23 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_private *dev_priv,
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
 
+int vmw_dumb_create(struct drm_file *file_priv,
+                    struct drm_device *dev,
+                    struct drm_mode_create_dumb *args);
+
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+                        struct drm_device *dev, uint32_t handle,
+                        uint64_t *offset);
+int vmw_dumb_destroy(struct drm_file *file_priv,
+                     struct drm_device *dev,
+                     uint32_t handle);
 /**
  * Overlay control - vmwgfx_overlay.c
  */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index f2fb8f15e2f1..7e0743358dff 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -1018,7 +1018,7 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
         }
 
 
-        event = kzalloc(sizeof(event->event), GFP_KERNEL);
+        event = kzalloc(sizeof(*event), GFP_KERNEL);
         if (unlikely(event == NULL)) {
                 DRM_ERROR("Failed to allocate an event.\n");
                 ret = -ENOMEM;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 22bf9a21ec71..2c6ffe0e2c07 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -1917,3 +1917,76 @@ err_ref:
         vmw_resource_unreference(&res);
         return ret;
 }
+
+
+int vmw_dumb_create(struct drm_file *file_priv,
+                    struct drm_device *dev,
+                    struct drm_mode_create_dumb *args)
+{
+        struct vmw_private *dev_priv = vmw_priv(dev);
+        struct vmw_master *vmaster = vmw_master(file_priv->master);
+        struct vmw_user_dma_buffer *vmw_user_bo;
+        struct ttm_buffer_object *tmp;
+        int ret;
+
+        args->pitch = args->width * ((args->bpp + 7) / 8);
+        args->size = args->pitch * args->height;
+
+        vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
+        if (vmw_user_bo == NULL)
+                return -ENOMEM;
+
+        ret = ttm_read_lock(&vmaster->lock, true);
+        if (ret != 0) {
+                kfree(vmw_user_bo);
+                return ret;
+        }
+
+        ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
+                              &vmw_vram_sys_placement, true,
+                              &vmw_user_dmabuf_destroy);
+        if (ret != 0)
+                goto out_no_dmabuf;
+
+        tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
+        ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
+                                   &vmw_user_bo->base,
+                                   false,
+                                   ttm_buffer_type,
+                                   &vmw_user_dmabuf_release, NULL);
+        if (unlikely(ret != 0))
+                goto out_no_base_object;
+
+        args->handle = vmw_user_bo->base.hash.key;
+
+out_no_base_object:
+        ttm_bo_unref(&tmp);
+out_no_dmabuf:
+        ttm_read_unlock(&vmaster->lock);
+        return ret;
+}
+
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+                        struct drm_device *dev, uint32_t handle,
+                        uint64_t *offset)
+{
+        struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+        struct vmw_dma_buffer *out_buf;
+        int ret;
+
+        ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
+        if (ret != 0)
+                return -EINVAL;
+
+        *offset = out_buf->base.addr_space_offset;
+        vmw_dmabuf_unreference(&out_buf);
+        return 0;
+}
+
+int vmw_dumb_destroy(struct drm_file *file_priv,
+                     struct drm_device *dev,
+                     uint32_t handle)
+{
+        return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
+                                         handle, TTM_REF_USAGE);
+}
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index fbf49503508d..2af774ad1060 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -307,7 +307,6 @@ config HID_LOGITECH
 config HID_LOGITECH_DJ
         tristate "Logitech Unifying receivers full support"
         depends on HID_LOGITECH
-        default m
         ---help---
         Say Y if you want support for Logitech Unifying receivers and devices.
         Unifying receivers are capable of pairing up to 6 Logitech compliant
@@ -527,6 +526,14 @@ config HID_PICOLCD_LEDS
         ---help---
           Provide access to PicoLCD's GPO pins via leds class.
 
+config HID_PICOLCD_CIR
+        bool "CIR via RC class" if EXPERT
+        default !EXPERT
+        depends on HID_PICOLCD
+        depends on HID_PICOLCD=RC_CORE || RC_CORE=y
+        ---help---
+          Provide access to PicoLCD's CIR interface via remote control (LIRC).
+
 config HID_PRIMAX
         tristate "Primax non-fully HID-compliant devices"
         depends on USB_HID
@@ -534,6 +541,15 @@ config HID_PRIMAX
         Support for Primax devices that are not fully compliant with the
         HID standard.
 
+config HID_PS3REMOTE
+        tristate "Sony PS3 BD Remote Control"
+        depends on BT_HIDP
+        ---help---
+        Support for the Sony PS3 Blue-ray Disk Remote Control and Logitech
+        Harmony Adapter for PS3, which connect over Bluetooth.
+
+        Support for the 6-axis controllers is provided by HID_SONY.
+
 config HID_ROCCAT
         tristate "Roccat device support"
         depends on USB_HID
@@ -561,7 +577,9 @@ config HID_SONY
         tristate "Sony PS3 controller"
         depends on USB_HID
         ---help---
-        Support for Sony PS3 controller.
+        Support for Sony PS3 6-axis controllers.
+
+        Support for the Sony PS3 BD Remote is provided by HID_PS3REMOTE.
 
 config HID_SPEEDLINK
         tristate "Speedlink VAD Cezanne mouse support"
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index f975485f88b2..5a3690ff9bf2 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -69,7 +69,28 @@ obj-$(CONFIG_HID_PRODIKEYS)	+= hid-prodikeys.o
 obj-$(CONFIG_HID_PANTHERLORD)   += hid-pl.o
 obj-$(CONFIG_HID_PETALYNX)      += hid-petalynx.o
 obj-$(CONFIG_HID_PICOLCD)       += hid-picolcd.o
+hid-picolcd-y                   += hid-picolcd_core.o
+ifdef CONFIG_HID_PICOLCD_FB
+hid-picolcd-y                   += hid-picolcd_fb.o
+endif
+ifdef CONFIG_HID_PICOLCD_BACKLIGHT
+hid-picolcd-y                   += hid-picolcd_backlight.o
+endif
+ifdef CONFIG_HID_PICOLCD_LCD
+hid-picolcd-y                   += hid-picolcd_lcd.o
+endif
+ifdef CONFIG_HID_PICOLCD_LEDS
+hid-picolcd-y                   += hid-picolcd_leds.o
+endif
+ifdef CONFIG_HID_PICOLCD_CIR
+hid-picolcd-y                   += hid-picolcd_cir.o
+endif
+ifdef CONFIG_DEBUG_FS
+hid-picolcd-y                   += hid-picolcd_debugfs.o
+endif
+
 obj-$(CONFIG_HID_PRIMAX)        += hid-primax.o
+obj-$(CONFIG_HID_PS3REMOTE)     += hid-ps3remote.o
 obj-$(CONFIG_HID_ROCCAT)        += hid-roccat.o hid-roccat-common.o \
         hid-roccat-arvo.o hid-roccat-isku.o hid-roccat-kone.o \
         hid-roccat-koneplus.o hid-roccat-kovaplus.o hid-roccat-pyra.o \
diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
index 902d1dfeb1b5..0a239885e67c 100644
--- a/drivers/hid/hid-a4tech.c
+++ b/drivers/hid/hid-a4tech.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 585344b6d338..06ebdbb6ea02 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby <jirislaby@gmail.com>
  */
 
diff --git a/drivers/hid/hid-aureal.c b/drivers/hid/hid-aureal.c
index ba64b041b8bf..7968187ddf7b 100644
--- a/drivers/hid/hid-aureal.c
+++ b/drivers/hid/hid-aureal.c
@@ -9,7 +9,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 #include <linux/device.h>
diff --git a/drivers/hid/hid-belkin.c b/drivers/hid/hid-belkin.c
index a1a765a5b08a..a1a5a12c3a6b 100644
--- a/drivers/hid/hid-belkin.c
+++ b/drivers/hid/hid-belkin.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
index 888ece68a47c..af034d3d9256 100644
--- a/drivers/hid/hid-cherry.c
+++ b/drivers/hid/hid-cherry.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8bcd168fffae..2cd6880b6b17 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -126,7 +126,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
 
         if (parser->collection_stack_ptr == HID_COLLECTION_STACK_SIZE) {
                 hid_err(parser->device, "collection stack overflow\n");
-                return -1;
+                return -EINVAL;
         }
 
         if (parser->device->maxcollection == parser->device->collection_size) {
@@ -134,7 +134,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
                                 parser->device->collection_size * 2, GFP_KERNEL);
                 if (collection == NULL) {
                         hid_err(parser->device, "failed to reallocate collection array\n");
-                        return -1;
+                        return -ENOMEM;
                 }
                 memcpy(collection, parser->device->collection,
                         sizeof(struct hid_collection) *
@@ -170,7 +170,7 @@ static int close_collection(struct hid_parser *parser)
 {
         if (!parser->collection_stack_ptr) {
                 hid_err(parser->device, "collection stack underflow\n");
-                return -1;
+                return -EINVAL;
         }
         parser->collection_stack_ptr--;
         return 0;
@@ -374,7 +374,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
 
         case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
                 parser->global.report_size = item_udata(item);
-                if (parser->global.report_size > 96) {
+                if (parser->global.report_size > 128) {
                         hid_err(parser->device, "invalid report_size %d\n",
                                         parser->global.report_size);
                         return -1;
@@ -757,6 +757,7 @@ int hid_open_report(struct hid_device *device)
         struct hid_item item;
         unsigned int size;
         __u8 *start;
+        __u8 *buf;
         __u8 *end;
         int ret;
         static int (*dispatch_type[])(struct hid_parser *parser,
@@ -775,12 +776,21 @@ int hid_open_report(struct hid_device *device)
                 return -ENODEV;
         size = device->dev_rsize;
 
+        buf = kmemdup(start, size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
         if (device->driver->report_fixup)
-                start = device->driver->report_fixup(device, start, &size);
+                start = device->driver->report_fixup(device, buf, &size);
+        else
+                start = buf;
 
-        device->rdesc = kmemdup(start, size, GFP_KERNEL);
-        if (device->rdesc == NULL)
+        start = kmemdup(start, size, GFP_KERNEL);
+        kfree(buf);
+        if (start == NULL)
                 return -ENOMEM;
+
+        device->rdesc = start;
         device->rsize = size;
 
         parser = vzalloc(sizeof(struct hid_parser));
@@ -1448,7 +1458,14 @@ void hid_disconnect(struct hid_device *hdev)
 }
 EXPORT_SYMBOL_GPL(hid_disconnect);
 
-/* a list of devices for which there is a specialized driver on HID bus */
+/*
+ * A list of devices for which there is a specialized driver on HID bus.
+ *
+ * Please note that for multitouch devices (driven by hid-multitouch driver),
+ * there is a proper autodetection and autoloading in place (based on presence
+ * of HID_DG_CONTACTID), so those devices don't need to be added to this list,
+ * as we are doing the right thing in hid_scan_usage().
+ */
 static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
@@ -1566,6 +1583,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RECEIVER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_DESKTOP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_EDGE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_MINI) },
@@ -1627,6 +1645,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
+#if IS_ENABLED(CONFIG_HID_ROCCAT)
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
@@ -1635,10 +1654,12 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_SAVU) },
+#endif
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_BDREMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
@@ -1663,6 +1684,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP1062) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
index 9e43aaca9774..3e159a50dac7 100644
--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 01dd9a7daf7a..933fff0fff1f 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -911,15 +911,21 @@ static void hid_dump_input_mapping(struct hid_device *hid, struct seq_file *f)
 
 }
 
-
 static int hid_debug_rdesc_show(struct seq_file *f, void *p)
 {
         struct hid_device *hdev = f->private;
+        const __u8 *rdesc = hdev->rdesc;
+        unsigned rsize = hdev->rsize;
         int i;
 
+        if (!rdesc) {
+                rdesc = hdev->dev_rdesc;
+                rsize = hdev->dev_rsize;
+        }
+
         /* dump HID report descriptor */
-        for (i = 0; i < hdev->rsize; i++)
-                seq_printf(f, "%02x ", hdev->rdesc[i]);
+        for (i = 0; i < rsize; i++)
+                seq_printf(f, "%02x ", rdesc[i]);
         seq_printf(f, "\n\n");
 
         /* dump parsed data and input mappings */
diff --git a/drivers/hid/hid-ezkey.c b/drivers/hid/hid-ezkey.c
index ca1163e9d42d..6540af2871a7 100644
--- a/drivers/hid/hid-ezkey.c
+++ b/drivers/hid/hid-ezkey.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-gyration.c b/drivers/hid/hid-gyration.c
index e88b951cd10d..4442c30ef531 100644
--- a/drivers/hid/hid-gyration.c
+++ b/drivers/hid/hid-gyration.c
@@ -4,7 +4,6 @@
  *  Copyright (c) 1999 Andreas Gal
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2006-2008 Jiri Kosina
  */
diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c
index 4e7542151e22..ff295e60059b 100644
--- a/drivers/hid/hid-holtekff.c
+++ b/drivers/hid/hid-holtekff.c
@@ -100,8 +100,7 @@ static void holtekff_send(struct holtekff_device *holtekff,
                 holtekff->field->value[i] = data[i];
         }
 
-        dbg_hid("sending %02x %02x %02x %02x %02x %02x %02x\n", data[0],
-                data[1], data[2], data[3], data[4], data[5], data[6]);
+        dbg_hid("sending %*ph\n", 7, data);
 
         usbhid_submit_report(hid, holtekff->field->report, USB_DIR_OUT);
 }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 1dcb76ff51e3..ca4d83e6e387 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  */
 
 /*
@@ -269,7 +268,11 @@
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA       0x72fa
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302       0x7302
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349       0x7349
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7       0x73f7
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001       0xa001
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7224      0x7224
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72D0      0x72d0
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72C4      0x72c4
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
@@ -283,6 +286,9 @@
 #define USB_VENDOR_ID_EMS               0x2006
 #define USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II 0x0118
 
+#define USB_VENDOR_ID_FLATFROG          0x25b5
+#define USB_DEVICE_ID_MULTITOUCH_3200   0x0002
+
 #define USB_VENDOR_ID_ESSENTIAL_REALITY 0x0d7f
 #define USB_DEVICE_ID_ESSENTIAL_REALITY_P5 0x0100
 
@@ -296,6 +302,9 @@
 #define USB_VENDOR_ID_EZKEY             0x0518
 #define USB_DEVICE_ID_BTC_8193          0x0002
 
+#define USB_VENDOR_ID_FREESCALE         0x15A2
+#define USB_DEVICE_ID_FREESCALE_MX28    0x004F
+
 #define USB_VENDOR_ID_FRUCTEL   0x25B6
 #define USB_DEVICE_ID_GAMETEL_MT_MODE   0x0002
 
@@ -305,6 +314,7 @@
 
 #define USB_VENDOR_ID_GENERAL_TOUCH     0x0dfc
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003
+#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS 0x0100
 
 #define USB_VENDOR_ID_GLAB              0x06c2
 #define USB_DEVICE_ID_4_PHIDGETSERVO_30 0x0038
@@ -496,6 +506,7 @@
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
+#define USB_DEVICE_ID_LOGITECH_HARMONY_PS3 0x0306
 #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD   0xc20a
 #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD        0xc211
 #define USB_DEVICE_ID_LOGITECH_EXTREME_3D       0xc215
@@ -652,7 +663,6 @@
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH              0x3000
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001         0x3001
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008         0x3008
-#define USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN   0x3001
 
 #define USB_VENDOR_ID_ROCCAT            0x1e7d
 #define USB_DEVICE_ID_ROCCAT_ARVO       0x30d4
@@ -683,6 +693,7 @@
 
 #define USB_VENDOR_ID_SONY                      0x054c
 #define USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE       0x024b
+#define USB_DEVICE_ID_SONY_PS3_BDREMOTE         0x0306
 #define USB_DEVICE_ID_SONY_PS3_CONTROLLER       0x0268
 #define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER        0x042f
 
@@ -758,6 +769,7 @@
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U    0x0005
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP1062     0x0064
 #define USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850   0x0522
+#define USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60     0x0781
 
 #define USB_VENDOR_ID_UNITEC    0x227d
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0709     0x0709
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 811bfad64609..d917c0d53685 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1154,6 +1154,7 @@ static void report_features(struct hid_device *hid)
 
 int hidinput_connect(struct hid_device *hid, unsigned int force)
 {
+        struct hid_driver *drv = hid->driver;
         struct hid_report *report;
         struct hid_input *hidinput = NULL;
         struct input_dev *input_dev;
@@ -1228,6 +1229,8 @@ int hidinput_connect(struct hid_device *hid, unsigned int force)
                                  * UGCI) cram a lot of unrelated inputs into the
                                  * same interface. */
                                 hidinput->report = report;
+                                if (drv->input_configured)
+                                        drv->input_configured(hid, hidinput);
                                 if (input_register_device(hidinput->input))
                                         goto out_cleanup;
                                 hidinput = NULL;
@@ -1235,8 +1238,12 @@ int hidinput_connect(struct hid_device *hid, unsigned int force)
                 }
         }
 
-        if (hidinput && input_register_device(hidinput->input))
-                goto out_cleanup;
+        if (hidinput) {
+                if (drv->input_configured)
+                        drv->input_configured(hid, hidinput);
+                if (input_register_device(hidinput->input))
+                        goto out_cleanup;
+        }
 
         return 0;
 
diff --git a/drivers/hid/hid-lcpower.c b/drivers/hid/hid-lcpower.c
index c4fe9bd095b7..22bc14abdfa3 100644
--- a/drivers/hid/hid-lcpower.c
+++ b/drivers/hid/hid-lcpower.c
@@ -24,7 +24,7 @@ static int ts_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        if ((usage->hid & HID_USAGE_PAGE) != 0x0ffbc0000)
+        if ((usage->hid & HID_USAGE_PAGE) != HID_UP_LOGIVENDOR)
                 return 0;
 
         switch (usage->hid & HID_USAGE) {
diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
index 77d2df04c97b..cea016e94f43 100644
--- a/drivers/hid/hid-lenovo-tpkbd.c
+++ b/drivers/hid/hid-lenovo-tpkbd.c
@@ -56,9 +56,8 @@ static int tpkbd_input_mapping(struct hid_device *hdev,
 static int tpkbd_features_set(struct hid_device *hdev)
 {
         struct hid_report *report;
-        struct tpkbd_data_pointer *data_pointer;
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
         report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[4];
 
         report->field[0]->value[0]  = data_pointer->press_to_select   ? 0x01 : 0x02;
@@ -77,14 +76,8 @@ static ssize_t pointer_press_to_select_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->press_to_select);
 }
@@ -94,16 +87,10 @@ static ssize_t pointer_press_to_select_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -119,14 +106,8 @@ static ssize_t pointer_dragging_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->dragging);
 }
@@ -136,16 +117,10 @@ static ssize_t pointer_dragging_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -161,14 +136,8 @@ static ssize_t pointer_release_to_select_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->release_to_select);
 }
@@ -178,16 +147,10 @@ static ssize_t pointer_release_to_select_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -203,14 +166,8 @@ static ssize_t pointer_select_right_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->select_right);
 }
@@ -220,16 +177,10 @@ static ssize_t pointer_select_right_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -245,14 +196,8 @@ static ssize_t pointer_sensitivity_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n",
                 data_pointer->sensitivity);
@@ -263,16 +208,10 @@ static ssize_t pointer_sensitivity_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value) || value < 1 || value > 255)
                 return -EINVAL;
 
@@ -286,14 +225,10 @@ static ssize_t pointer_press_speed_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n",
                 data_pointer->press_speed);
@@ -304,16 +239,10 @@ static ssize_t pointer_press_speed_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value) || value < 1 || value > 255)
                 return -EINVAL;
 
@@ -370,15 +299,11 @@ static const struct attribute_group tpkbd_attr_group_pointer = {
 static enum led_brightness tpkbd_led_brightness_get(
                         struct led_classdev *led_cdev)
 {
-        struct device *dev;
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct device *dev = led_cdev->dev->parent;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int led_nr = 0;
 
-        dev = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (led_cdev == &data_pointer->led_micmute)
                 led_nr = 1;
 
@@ -390,16 +315,12 @@ static enum led_brightness tpkbd_led_brightness_get(
 static void tpkbd_led_brightness_set(struct led_classdev *led_cdev,
                         enum led_brightness value)
 {
-        struct device *dev;
-        struct hid_device *hdev;
+        struct device *dev = led_cdev->dev->parent;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         struct hid_report *report;
-        struct tpkbd_data_pointer *data_pointer;
         int led_nr = 0;
 
-        dev = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (led_cdev == &data_pointer->led_micmute)
                 led_nr = 1;
 
@@ -508,17 +429,17 @@ err_free:
 
 static void tpkbd_remove_tp(struct hid_device *hdev)
 {
-        struct tpkbd_data_pointer *data_pointer;
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         sysfs_remove_group(&hdev->dev.kobj,
                         &tpkbd_attr_group_pointer);
 
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         led_classdev_unregister(&data_pointer->led_micmute);
         led_classdev_unregister(&data_pointer->led_mute);
 
         hid_set_drvdata(hdev, NULL);
+        kfree(data_pointer->led_micmute.name);
+        kfree(data_pointer->led_mute.name);
         kfree(data_pointer);
 }
 
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index fc37ed6b108c..a2f8e88b9fa2 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2010 Hendrik Iben
  */
@@ -109,7 +108,7 @@ static __u8 dfp_rdesc_fixed[] = {
 static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
 
         if ((drv_data->quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
                         rdesc[84] == 0x8c && rdesc[85] == 0x02) {
@@ -278,7 +277,7 @@ static int lg_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                   0,  0,  0,  0,  0,183,184,185,186,187,
                 188,189,190,191,192,193,194,  0,  0,  0
         };
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
         unsigned int hid = usage->hid;
 
         if (hdev->product == USB_DEVICE_ID_LOGITECH_RECEIVER &&
@@ -319,7 +318,7 @@ static int lg_input_mapped(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
 
         if ((drv_data->quirks & LG_BAD_RELATIVE_KEYS) && usage->type == EV_KEY &&
                         (field->flags & HID_MAIN_ITEM_RELATIVE))
@@ -335,13 +334,16 @@ static int lg_input_mapped(struct hid_device *hdev, struct hid_input *hi,
 static int lg_event(struct hid_device *hdev, struct hid_field *field,
                 struct hid_usage *usage, __s32 value)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
 
         if ((drv_data->quirks & LG_INVERT_HWHEEL) && usage->code == REL_HWHEEL) {
                 input_event(field->hidinput->input, usage->type, usage->code,
                                 -value);
                 return 1;
         }
+        if (drv_data->quirks & LG_FF4) {
+                return lg4ff_adjust_input_event(hdev, field, usage, value, drv_data);
+        }
 
         return 0;
 }
@@ -358,7 +360,7 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 return -ENOMEM;
         }
         drv_data->quirks = id->driver_data;
-        
+
         hid_set_drvdata(hdev, (void *)drv_data);
 
         if (drv_data->quirks & LG_NOGET)
@@ -380,7 +382,7 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
         }
 
         /* Setup wireless link with Logitech Wii wheel */
-        if(hdev->product == USB_DEVICE_ID_LOGITECH_WII_WHEEL) {
+        if (hdev->product == USB_DEVICE_ID_LOGITECH_WII_WHEEL) {
                 unsigned char buf[] = { 0x00, 0xAF,  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
                 ret = hdev->hid_output_raw_report(hdev, buf, sizeof(buf), HID_FEATURE_REPORT);
@@ -416,7 +418,7 @@ err_free:
 
 static void lg_remove(struct hid_device *hdev)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
         if (drv_data->quirks & LG_FF4)
                 lg4ff_deinit(hdev);
 
@@ -476,7 +478,7 @@ static const struct hid_device_id lg_devices[] = {
                 .driver_data = LG_NOGET | LG_FF4 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WII_WHEEL),
                 .driver_data = LG_FF4 },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG ),
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
                 .driver_data = LG_FF },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
                 .driver_data = LG_FF2 },
diff --git a/drivers/hid/hid-lg.h b/drivers/hid/hid-lg.h
index d64cf8d2751e..142ce3f5f055 100644
--- a/drivers/hid/hid-lg.h
+++ b/drivers/hid/hid-lg.h
@@ -25,9 +25,13 @@ static inline int lg3ff_init(struct hid_device *hdev) { return -1; }
 #endif
 
 #ifdef CONFIG_LOGIWHEELS_FF
+int lg4ff_adjust_input_event(struct hid_device *hid, struct hid_field *field,
+                             struct hid_usage *usage, __s32 value, struct lg_drv_data *drv_data);
 int lg4ff_init(struct hid_device *hdev);
 int lg4ff_deinit(struct hid_device *hdev);
 #else
+static inline int lg4ff_adjust_input_event(struct hid_device *hid, struct hid_field *field,
+                                           struct hid_usage *usage, __s32 value, struct lg_drv_data *drv_data) { return 0; }
 static inline int lg4ff_init(struct hid_device *hdev) { return -1; }
 static inline int lg4ff_deinit(struct hid_device *hdev) { return -1; }
 #endif
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index f3390ee6105c..d7947c701f30 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -43,6 +43,11 @@
 #define G27_REV_MAJ 0x12
 #define G27_REV_MIN 0x38
 
+#define DFP_X_MIN 0
+#define DFP_X_MAX 16383
+#define DFP_PEDAL_MIN 0
+#define DFP_PEDAL_MAX 255
+
 #define to_hid_device(pdev) container_of(pdev, struct hid_device, dev)
 
 static void hid_lg4ff_set_range_dfp(struct hid_device *hid, u16 range);
@@ -53,6 +58,7 @@ static ssize_t lg4ff_range_store(struct device *dev, struct device_attribute *at
 static DEVICE_ATTR(range, S_IRWXU | S_IRWXG | S_IRWXO, lg4ff_range_show, lg4ff_range_store);
 
 struct lg4ff_device_entry {
+        __u32 product_id;
         __u16 range;
         __u16 min_range;
         __u16 max_range;
@@ -129,26 +135,77 @@ static const struct lg4ff_usb_revision lg4ff_revs[] = {
         {G27_REV_MAJ,  G27_REV_MIN,  &native_g27},      /* G27 */
 };
 
+/* Recalculates X axis value accordingly to currently selected range */
+static __s32 lg4ff_adjust_dfp_x_axis(__s32 value, __u16 range)
+{
+        __u16 max_range;
+        __s32 new_value;
+
+        if (range == 900)
+                return value;
+        else if (range == 200)
+                return value;
+        else if (range < 200)
+                max_range = 200;
+        else
+                max_range = 900;
+
+        new_value = 8192 + mult_frac(value - 8192, max_range, range);
+        if (new_value < 0)
+                return 0;
+        else if (new_value > 16383)
+                return 16383;
+        else
+                return new_value;
+}
+
+int lg4ff_adjust_input_event(struct hid_device *hid, struct hid_field *field,
+                             struct hid_usage *usage, __s32 value, struct lg_drv_data *drv_data)
+{
+        struct lg4ff_device_entry *entry = drv_data->device_props;
+        __s32 new_value = 0;
+
+        if (!entry) {
+                hid_err(hid, "Device properties not found");
+                return 0;
+        }
+
+        switch (entry->product_id) {
+        case USB_DEVICE_ID_LOGITECH_DFP_WHEEL:
+                switch (usage->code) {
+                case ABS_X:
+                        new_value = lg4ff_adjust_dfp_x_axis(value, entry->range);
+                        input_event(field->hidinput->input, usage->type, usage->code, new_value);
+                        return 1;
+                default:
+                        return 0;
+                }
+        default:
+                return 0;
+        }
+}
+
 static int hid_lg4ff_play(struct input_dev *dev, void *data, struct ff_effect *effect)
 {
         struct hid_device *hid = input_get_drvdata(dev);
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
         int x;
 
-#define CLAMP(x) if (x < 0) x = 0; if (x > 0xff) x = 0xff
+#define CLAMP(x) do { if (x < 0) x = 0; else if (x > 0xff) x = 0xff; } while (0)
 
         switch (effect->type) {
         case FF_CONSTANT:
                 x = effect->u.ramp.start_level + 0x80;  /* 0x80 is no force */
                 CLAMP(x);
-                report->field[0]->value[0] = 0x11;      /* Slot 1 */
-                report->field[0]->value[1] = 0x08;
-                report->field[0]->value[2] = x;
-                report->field[0]->value[3] = 0x80;
-                report->field[0]->value[4] = 0x00;
-                report->field[0]->value[5] = 0x00;
-                report->field[0]->value[6] = 0x00;
+                value[0] = 0x11;        /* Slot 1 */
+                value[1] = 0x08;
+                value[2] = x;
+                value[3] = 0x80;
+                value[4] = 0x00;
+                value[5] = 0x00;
+                value[6] = 0x00;
 
                 usbhid_submit_report(hid, report, USB_DIR_OUT);
                 break;
@@ -163,14 +220,15 @@ static void hid_lg4ff_set_autocenter_default(struct input_dev *dev, u16 magnitud
         struct hid_device *hid = input_get_drvdata(dev);
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
 
-        report->field[0]->value[0] = 0xfe;
-        report->field[0]->value[1] = 0x0d;
-        report->field[0]->value[2] = magnitude >> 13;
-        report->field[0]->value[3] = magnitude >> 13;
-        report->field[0]->value[4] = magnitude >> 8;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xfe;
+        value[1] = 0x0d;
+        value[2] = magnitude >> 13;
+        value[3] = magnitude >> 13;
+        value[4] = magnitude >> 8;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -181,16 +239,16 @@ static void hid_lg4ff_set_autocenter_ffex(struct input_dev *dev, u16 magnitude)
         struct hid_device *hid = input_get_drvdata(dev);
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
         magnitude = magnitude * 90 / 65535;
-        
 
-        report->field[0]->value[0] = 0xfe;
-        report->field[0]->value[1] = 0x03;
-        report->field[0]->value[2] = magnitude >> 14;
-        report->field[0]->value[3] = magnitude >> 14;
-        report->field[0]->value[4] = magnitude;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xfe;
+        value[1] = 0x03;
+        value[2] = magnitude >> 14;
+        value[3] = magnitude >> 14;
+        value[4] = magnitude;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -200,15 +258,17 @@ static void hid_lg4ff_set_range_g25(struct hid_device *hid, u16 range)
 {
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
+
         dbg_hid("G25/G27/DFGT: setting range to %u\n", range);
 
-        report->field[0]->value[0] = 0xf8;
-        report->field[0]->value[1] = 0x81;
-        report->field[0]->value[2] = range & 0x00ff;
-        report->field[0]->value[3] = (range & 0xff00) >> 8;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xf8;
+        value[1] = 0x81;
+        value[2] = range & 0x00ff;
+        value[3] = (range & 0xff00) >> 8;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -219,16 +279,18 @@ static void hid_lg4ff_set_range_dfp(struct hid_device *hid, __u16 range)
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
         int start_left, start_right, full_range;
+        __s32 *value = report->field[0]->value;
+
         dbg_hid("Driving Force Pro: setting range to %u\n", range);
 
         /* Prepare "coarse" limit command */
-        report->field[0]->value[0] = 0xf8;
-        report->field[0]->value[1] = 0x00;      /* Set later */
-        report->field[0]->value[2] = 0x00;
-        report->field[0]->value[3] = 0x00;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xf8;
+        value[1] = 0x00;        /* Set later */
+        value[2] = 0x00;
+        value[3] = 0x00;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         if (range > 200) {
                 report->field[0]->value[1] = 0x03;
@@ -240,13 +302,13 @@ static void hid_lg4ff_set_range_dfp(struct hid_device *hid, __u16 range)
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 
         /* Prepare "fine" limit command */
-        report->field[0]->value[0] = 0x81;
-        report->field[0]->value[1] = 0x0b;
-        report->field[0]->value[2] = 0x00;
-        report->field[0]->value[3] = 0x00;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0x81;
+        value[1] = 0x0b;
+        value[2] = 0x00;
+        value[3] = 0x00;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         if (range == 200 || range == 900) {     /* Do not apply any fine limit */
                 usbhid_submit_report(hid, report, USB_DIR_OUT);
@@ -257,11 +319,11 @@ static void hid_lg4ff_set_range_dfp(struct hid_device *hid, __u16 range)
         start_left = (((full_range - range + 1) * 2047) / full_range);
         start_right = 0xfff - start_left;
 
-        report->field[0]->value[2] = start_left >> 4;
-        report->field[0]->value[3] = start_right >> 4;
-        report->field[0]->value[4] = 0xff;
-        report->field[0]->value[5] = (start_right & 0xe) << 4 | (start_left & 0xe);
-        report->field[0]->value[6] = 0xff;
+        value[2] = start_left >> 4;
+        value[3] = start_right >> 4;
+        value[4] = 0xff;
+        value[5] = (start_right & 0xe) << 4 | (start_left & 0xe);
+        value[6] = 0xff;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -344,14 +406,15 @@ static void lg4ff_set_leds(struct hid_device *hid, __u8 leds)
 {
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
-
-        report->field[0]->value[0] = 0xf8;
-        report->field[0]->value[1] = 0x12;
-        report->field[0]->value[2] = leds;
-        report->field[0]->value[3] = 0x00;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        __s32 *value = report->field[0]->value;
+
+        value[0] = 0xf8;
+        value[1] = 0x12;
+        value[2] = leds;
+        value[3] = 0x00;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
 
@@ -360,7 +423,7 @@ static void lg4ff_led_set_brightness(struct led_classdev *led_cdev,
 {
         struct device *dev = led_cdev->dev->parent;
         struct hid_device *hid = container_of(dev, struct hid_device, dev);
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hid);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hid);
         struct lg4ff_device_entry *entry;
         int i, state = 0;
 
@@ -395,7 +458,7 @@ static enum led_brightness lg4ff_led_get_brightness(struct led_classdev *led_cde
 {
         struct device *dev = led_cdev->dev->parent;
         struct hid_device *hid = container_of(dev, struct hid_device, dev);
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hid);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hid);
         struct lg4ff_device_entry *entry;
         int i, value = 0;
 
@@ -501,7 +564,7 @@ int lg4ff_init(struct hid_device *hid)
         /* Check if autocentering is available and
          * set the centering force to zero by default */
         if (test_bit(FF_AUTOCENTER, dev->ffbit)) {
-                if(rev_maj == FFEX_REV_MAJ && rev_min == FFEX_REV_MIN)  /* Formula Force EX expects different autocentering command */
+                if (rev_maj == FFEX_REV_MAJ && rev_min == FFEX_REV_MIN) /* Formula Force EX expects different autocentering command */
                         dev->ff->set_autocenter = hid_lg4ff_set_autocenter_ffex;
                 else
                         dev->ff->set_autocenter = hid_lg4ff_set_autocenter_default;
@@ -524,6 +587,7 @@ int lg4ff_init(struct hid_device *hid)
         }
         drv_data->device_props = entry;
 
+        entry->product_id = lg4ff_devices[i].product_id;
         entry->min_range = lg4ff_devices[i].min_range;
         entry->max_range = lg4ff_devices[i].max_range;
         entry->set_range = lg4ff_devices[i].set_range;
@@ -534,6 +598,18 @@ int lg4ff_init(struct hid_device *hid)
                 return error;
         dbg_hid("sysfs interface created\n");
 
+        /* Set default axes parameters */
+        switch (lg4ff_devices[i].product_id) {
+        case USB_DEVICE_ID_LOGITECH_DFP_WHEEL:
+                dbg_hid("Setting axes parameters for Driving Force Pro\n");
+                input_set_abs_params(dev, ABS_X, DFP_X_MIN, DFP_X_MAX, 0, 0);
+                input_set_abs_params(dev, ABS_Y, DFP_PEDAL_MIN, DFP_PEDAL_MAX, 0, 0);
+                input_set_abs_params(dev, ABS_RZ, DFP_PEDAL_MIN, DFP_PEDAL_MAX, 0, 0);
+                break;
+        default:
+                break;
+        }
+
         /* Set the maximum range to start with */
         entry->range = entry->max_range;
         if (entry->set_range != NULL)
@@ -594,6 +670,8 @@ out:
         return 0;
 }
 
+
+
 int lg4ff_deinit(struct hid_device *hid)
 {
         struct lg4ff_device_entry *entry;
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 4d524b5f52f5..9500f2f3f8fe 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -193,6 +193,7 @@ static struct hid_ll_driver logi_dj_ll_driver;
 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
                                         size_t count,
                                         unsigned char report_type);
+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
 
 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                                 struct dj_report *dj_report)
@@ -233,6 +234,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
         if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
             SPFUNCTION_DEVICE_LIST_EMPTY) {
                 dbg_hid("%s: device list is empty\n", __func__);
+                djrcv_dev->querying_devices = false;
                 return;
         }
 
@@ -243,6 +245,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                 return;
         }
 
+        if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+                /* The device is already known. No need to reallocate it. */
+                dbg_hid("%s: device is already known\n", __func__);
+                return;
+        }
+
         dj_hiddev = hid_allocate_device();
         if (IS_ERR(dj_hiddev)) {
                 dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -306,6 +314,7 @@ static void delayedwork_callback(struct work_struct *work)
         struct dj_report dj_report;
         unsigned long flags;
         int count;
+        int retval;
 
         dbg_hid("%s\n", __func__);
 
@@ -338,6 +347,25 @@ static void delayedwork_callback(struct work_struct *work)
                 logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
                 break;
         default:
+        /* A normal report (i. e. not belonging to a pair/unpair notification)
+         * arriving here, means that the report arrived but we did not have a
+         * paired dj_device associated to the report's device_index, this
+         * means that the original "device paired" notification corresponding
+         * to this dj_device never arrived to this driver. The reason is that
+         * hid-core discards all packets coming from a device while probe() is
+         * executing. */
+        if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
+                /* ok, we don't know the device, just re-ask the
+                 * receiver for the list of connected devices. */
+                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+                if (!retval) {
+                        /* everything went fine, so just leave */
+                        break;
+                }
+                dev_err(&djrcv_dev->hdev->dev,
+                        "%s:logi_dj_recv_query_paired_devices "
+                        "error:%d\n", __func__, retval);
+                }
                 dbg_hid("%s: unexpected report type\n", __func__);
         }
 }
@@ -368,6 +396,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
         if (!djdev) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -398,6 +432,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
         if (dj_device == NULL) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -439,6 +479,10 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         struct dj_report *dj_report;
         int retval;
 
+        /* no need to protect djrcv_dev->querying_devices */
+        if (djrcv_dev->querying_devices)
+                return 0;
+
         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
         if (!dj_report)
                 return -ENOMEM;
@@ -450,6 +494,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         return retval;
 }
 
+
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                           unsigned timeout)
 {
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
index fd28a5e0ca3b..4a4000340ce1 100644
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -101,6 +101,7 @@ struct dj_receiver_dev {
         struct work_struct work;
         struct kfifo notif_fifo;
         spinlock_t lock;
+        bool querying_devices;
 };
 
 struct dj_device {
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 73647266daad..25ddf3e3aec6 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -392,7 +392,7 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
 
         __set_bit(EV_ABS, input->evbit);
 
-        error = input_mt_init_slots(input, 16);
+        error = input_mt_init_slots(input, 16, 0);
         if (error)
                 return error;
         input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 255 << 2,
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index e5c699b6c6f3..3acdcfcc17df 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
index dedf757781ae..cd3643e06fa6 100644
--- a/drivers/hid/hid-monterey.c
+++ b/drivers/hid/hid-monterey.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 59c8b5c1d2de..3eb02b94fc87 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -51,12 +51,12 @@ MODULE_LICENSE("GPL");
 #define MT_QUIRK_VALID_IS_INRANGE       (1 << 5)
 #define MT_QUIRK_VALID_IS_CONFIDENCE    (1 << 6)
 #define MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE    (1 << 8)
+#define MT_QUIRK_NO_AREA                (1 << 9)
 
 struct mt_slot {
         __s32 x, y, p, w, h;
         __s32 contactid;        /* the device ContactID assigned to this slot */
         bool touch_state;       /* is the touch valid? */
-        bool seen_in_this_frame;/* has this slot been updated */
 };
 
 struct mt_class {
@@ -92,8 +92,9 @@ struct mt_device {
         __u8 touches_by_report; /* how many touches are present in one report:
                                 * 1 means we should use a serial protocol
                                 * > 1 means hybrid (multitouch) protocol */
+        bool serial_maybe;      /* need to check for serial protocol */
         bool curvalid;          /* is the current contact valid? */
-        struct mt_slot *slots;
+        unsigned mt_flags;      /* flags to pass to input-mt */
 };
 
 /* classes of device behavior */
@@ -115,6 +116,9 @@ struct mt_device {
 #define MT_CLS_EGALAX_SERIAL                    0x0104
 #define MT_CLS_TOPSEED                          0x0105
 #define MT_CLS_PANASONIC                        0x0106
+#define MT_CLS_FLATFROG                         0x0107
+#define MT_CLS_GENERALTOUCH_TWOFINGERS          0x0108
+#define MT_CLS_GENERALTOUCH_PWT_TENFINGERS      0x0109
 
 #define MT_DEFAULT_MAXCONTACT   10
 
@@ -134,25 +138,6 @@ static int cypress_compute_slot(struct mt_device *td)
                 return -1;
 }
 
-static int find_slot_from_contactid(struct mt_device *td)
-{
-        int i;
-        for (i = 0; i < td->maxcontacts; ++i) {
-                if (td->slots[i].contactid == td->curdata.contactid &&
-                        td->slots[i].touch_state)
-                        return i;
-        }
-        for (i = 0; i < td->maxcontacts; ++i) {
-                if (!td->slots[i].seen_in_this_frame &&
-                        !td->slots[i].touch_state)
-                        return i;
-        }
-        /* should not occurs. If this happens that means
-         * that the device sent more touches that it says
-         * in the report descriptor. It is ignored then. */
-        return -1;
-}
-
 static struct mt_class mt_classes[] = {
         { .name = MT_CLS_DEFAULT,
                 .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP },
@@ -190,7 +175,9 @@ static struct mt_class mt_classes[] = {
                         MT_QUIRK_SLOT_IS_CONTACTID,
                 .sn_move = 2048,
                 .sn_width = 128,
-                .sn_height = 128 },
+                .sn_height = 128,
+                .maxcontacts = 60,
+        },
         { .name = MT_CLS_CYPRESS,
                 .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
                         MT_QUIRK_CYPRESS,
@@ -215,7 +202,24 @@ static struct mt_class mt_classes[] = {
         { .name = MT_CLS_PANASONIC,
                 .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP,
                 .maxcontacts = 4 },
+        { .name = MT_CLS_GENERALTOUCH_TWOFINGERS,
+                .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+                        MT_QUIRK_VALID_IS_INRANGE |
+                        MT_QUIRK_SLOT_IS_CONTACTNUMBER,
+                .maxcontacts = 2
+        },
+        { .name = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+                .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+                        MT_QUIRK_SLOT_IS_CONTACTNUMBER,
+                .maxcontacts = 10
+        },
 
+        { .name = MT_CLS_FLATFROG,
+                .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+                        MT_QUIRK_NO_AREA,
+                .sn_move = 2048,
+                .maxcontacts = 40,
+        },
         { }
 };
 
@@ -319,24 +323,16 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
         * We need to ignore fields that belong to other collections
         * such as Mouse that might have the same GenericDesktop usages. */
         if (field->application == HID_DG_TOUCHSCREEN)
-                set_bit(INPUT_PROP_DIRECT, hi->input->propbit);
+                td->mt_flags |= INPUT_MT_DIRECT;
         else if (field->application != HID_DG_TOUCHPAD)
                 return 0;
 
-        /* In case of an indirect device (touchpad), we need to add
-         * specific BTN_TOOL_* to be handled by the synaptics xorg
-         * driver.
-         * We also consider that touchscreens providing buttons are touchpads.
+        /*
+         * Model touchscreens providing buttons as touchpads.
          */
         if (field->application == HID_DG_TOUCHPAD ||
-            (usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON ||
-            cls->is_indirect) {
-                set_bit(INPUT_PROP_POINTER, hi->input->propbit);
-                set_bit(BTN_TOOL_FINGER, hi->input->keybit);
-                set_bit(BTN_TOOL_DOUBLETAP, hi->input->keybit);
-                set_bit(BTN_TOOL_TRIPLETAP, hi->input->keybit);
-                set_bit(BTN_TOOL_QUADTAP, hi->input->keybit);
-        }
+            (usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON)
+                td->mt_flags |= INPUT_MT_POINTER;
 
         /* eGalax devices provide a Digitizer.Stylus input which overrides
          * the correct Digitizers.Finger X/Y ranges.
@@ -353,8 +349,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                         EV_ABS, ABS_MT_POSITION_X);
                         set_abs(hi->input, ABS_MT_POSITION_X, field,
                                 cls->sn_move);
-                        /* touchscreen emulation */
-                        set_abs(hi->input, ABS_X, field, cls->sn_move);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -363,8 +357,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                         EV_ABS, ABS_MT_POSITION_Y);
                         set_abs(hi->input, ABS_MT_POSITION_Y, field,
                                 cls->sn_move);
-                        /* touchscreen emulation */
-                        set_abs(hi->input, ABS_Y, field, cls->sn_move);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -388,9 +380,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         td->last_field_index = field->index;
                         return 1;
                 case HID_DG_CONTACTID:
-                        if (!td->maxcontacts)
-                                td->maxcontacts = MT_DEFAULT_MAXCONTACT;
-                        input_mt_init_slots(hi->input, td->maxcontacts);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         td->touches_by_report++;
@@ -398,18 +387,21 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 case HID_DG_WIDTH:
                         hid_map_usage(hi, usage, bit, max,
                                         EV_ABS, ABS_MT_TOUCH_MAJOR);
-                        set_abs(hi->input, ABS_MT_TOUCH_MAJOR, field,
-                                cls->sn_width);
+                        if (!(cls->quirks & MT_QUIRK_NO_AREA))
+                                set_abs(hi->input, ABS_MT_TOUCH_MAJOR, field,
+                                        cls->sn_width);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
                 case HID_DG_HEIGHT:
                         hid_map_usage(hi, usage, bit, max,
                                         EV_ABS, ABS_MT_TOUCH_MINOR);
-                        set_abs(hi->input, ABS_MT_TOUCH_MINOR, field,
-                                cls->sn_height);
-                        input_set_abs_params(hi->input,
+                        if (!(cls->quirks & MT_QUIRK_NO_AREA)) {
+                                set_abs(hi->input, ABS_MT_TOUCH_MINOR, field,
+                                        cls->sn_height);
+                                input_set_abs_params(hi->input,
                                         ABS_MT_ORIENTATION, 0, 1, 0, 0);
+                        }
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -418,9 +410,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                         EV_ABS, ABS_MT_PRESSURE);
                         set_abs(hi->input, ABS_MT_PRESSURE, field,
                                 cls->sn_pressure);
-                        /* touchscreen emulation */
-                        set_abs(hi->input, ABS_PRESSURE, field,
-                                cls->sn_pressure);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -464,7 +453,7 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
         return -1;
 }
 
-static int mt_compute_slot(struct mt_device *td)
+static int mt_compute_slot(struct mt_device *td, struct input_dev *input)
 {
         __s32 quirks = td->mtclass.quirks;
 
@@ -480,42 +469,23 @@ static int mt_compute_slot(struct mt_device *td)
         if (quirks & MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE)
                 return td->curdata.contactid - 1;
 
-        return find_slot_from_contactid(td);
+        return input_mt_get_slot_by_key(input, td->curdata.contactid);
 }
 
 /*
  * this function is called when a whole contact has been processed,
  * so that it can assign it to a slot and store the data there
  */
-static void mt_complete_slot(struct mt_device *td)
+static void mt_complete_slot(struct mt_device *td, struct input_dev *input)
 {
-        td->curdata.seen_in_this_frame = true;
         if (td->curvalid) {
-                int slotnum = mt_compute_slot(td);
-
-                if (slotnum >= 0 && slotnum < td->maxcontacts)
-                        td->slots[slotnum] = td->curdata;
-        }
-        td->num_received++;
-}
+                int slotnum = mt_compute_slot(td, input);
+                struct mt_slot *s = &td->curdata;
 
+                if (slotnum < 0 || slotnum >= td->maxcontacts)
+                        return;
 
-/*
- * this function is called when a whole packet has been received and processed,
- * so that it can decide what to send to the input layer.
- */
-static void mt_emit_event(struct mt_device *td, struct input_dev *input)
-{
-        int i;
-
-        for (i = 0; i < td->maxcontacts; ++i) {
-                struct mt_slot *s = &(td->slots[i]);
-                if ((td->mtclass.quirks & MT_QUIRK_NOT_SEEN_MEANS_UP) &&
-                        !s->seen_in_this_frame) {
-                        s->touch_state = false;
-                }
-
-                input_mt_slot(input, i);
+                input_mt_slot(input, slotnum);
                 input_mt_report_slot_state(input, MT_TOOL_FINGER,
                         s->touch_state);
                 if (s->touch_state) {
@@ -532,24 +502,29 @@ static void mt_emit_event(struct mt_device *td, struct input_dev *input)
                         input_event(input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
                         input_event(input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
                 }
-                s->seen_in_this_frame = false;
-
         }
 
-        input_mt_report_pointer_emulation(input, true);
+        td->num_received++;
+}
+
+/*
+ * this function is called when a whole packet has been received and processed,
+ * so that it can decide what to send to the input layer.
+ */
+static void mt_sync_frame(struct mt_device *td, struct input_dev *input)
+{
+        input_mt_sync_frame(input);
         input_sync(input);
         td->num_received = 0;
 }
 
-
-
 static int mt_event(struct hid_device *hid, struct hid_field *field,
                                 struct hid_usage *usage, __s32 value)
 {
         struct mt_device *td = hid_get_drvdata(hid);
         __s32 quirks = td->mtclass.quirks;
 
-        if (hid->claimed & HID_CLAIMED_INPUT && td->slots) {
+        if (hid->claimed & HID_CLAIMED_INPUT) {
                 switch (usage->hid) {
                 case HID_DG_INRANGE:
                         if (quirks & MT_QUIRK_ALWAYS_VALID)
@@ -602,11 +577,11 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,
                 }
 
                 if (usage->hid == td->last_slot_field)
-                        mt_complete_slot(td);
+                        mt_complete_slot(td, field->hidinput->input);
 
                 if (field->index == td->last_field_index
                         && td->num_received >= td->num_expected)
-                        mt_emit_event(td, field->hidinput->input);
+                        mt_sync_frame(td, field->hidinput->input);
 
         }
 
@@ -685,18 +660,45 @@ static void mt_post_parse(struct mt_device *td)
         }
 }
 
+static void mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+
+{
+        struct mt_device *td = hid_get_drvdata(hdev);
+        struct mt_class *cls = &td->mtclass;
+        struct input_dev *input = hi->input;
+
+        /* Only initialize slots for MT input devices */
+        if (!test_bit(ABS_MT_POSITION_X, input->absbit))
+                return;
+
+        if (!td->maxcontacts)
+                td->maxcontacts = MT_DEFAULT_MAXCONTACT;
+
+        mt_post_parse(td);
+        if (td->serial_maybe)
+                mt_post_parse_default_settings(td);
+
+        if (cls->is_indirect)
+                td->mt_flags |= INPUT_MT_POINTER;
+
+        if (cls->quirks & MT_QUIRK_NOT_SEEN_MEANS_UP)
+                td->mt_flags |= INPUT_MT_DROP_UNUSED;
+
+        input_mt_init_slots(input, td->maxcontacts, td->mt_flags);
+
+        td->mt_flags = 0;
+}
+
 static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
 {
         int ret, i;
         struct mt_device *td;
         struct mt_class *mtclass = mt_classes; /* MT_CLS_DEFAULT */
 
-        if (id) {
-                for (i = 0; mt_classes[i].name ; i++) {
-                        if (id->driver_data == mt_classes[i].name) {
-                                mtclass = &(mt_classes[i]);
-                                break;
-                        }
+        for (i = 0; mt_classes[i].name ; i++) {
+                if (id->driver_data == mt_classes[i].name) {
+                        mtclass = &(mt_classes[i]);
+                        break;
                 }
         }
 
@@ -722,6 +724,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 goto fail;
         }
 
+        if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID)
+                td->serial_maybe = true;
+
         ret = hid_parse(hdev);
         if (ret != 0)
                 goto fail;
@@ -730,20 +735,6 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
         if (ret)
                 goto fail;
 
-        mt_post_parse(td);
-
-        if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID)
-                mt_post_parse_default_settings(td);
-
-        td->slots = kzalloc(td->maxcontacts * sizeof(struct mt_slot),
-                                GFP_KERNEL);
-        if (!td->slots) {
-                dev_err(&hdev->dev, "cannot allocate multitouch slots\n");
-                hid_hw_stop(hdev);
-                ret = -ENOMEM;
-                goto fail;
-        }
-
         ret = sysfs_create_group(&hdev->dev.kobj, &mt_attribute_group);
 
         mt_set_maxcontacts(hdev);
@@ -767,6 +758,32 @@ static int mt_reset_resume(struct hid_device *hdev)
         mt_set_input_mode(hdev);
         return 0;
 }
+
+static int mt_resume(struct hid_device *hdev)
+{
+        struct usb_interface *intf;
+        struct usb_host_interface *interface;
+        struct usb_device *dev;
+
+        if (hdev->bus != BUS_USB)
+                return 0;
+
+        intf = to_usb_interface(hdev->dev.parent);
+        interface = intf->cur_altsetting;
+        dev = hid_to_usb_dev(hdev);
+
+        /* Some Elan legacy devices require SET_IDLE to be set on resume.
+         * It should be safe to send it to other devices too.
+         * Tested on 3M, Stantum, Cypress, Zytronic, eGalax, and Elan panels. */
+
+        usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+                        HID_REQ_SET_IDLE,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        0, interface->desc.bInterfaceNumber,
+                        NULL, 0, USB_CTRL_SET_TIMEOUT);
+
+        return 0;
+}
 #endif
 
 static void mt_remove(struct hid_device *hdev)
@@ -774,7 +791,6 @@ static void mt_remove(struct hid_device *hdev)
         struct mt_device *td = hid_get_drvdata(hdev);
         sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
         hid_hw_stop(hdev);
-        kfree(td->slots);
         kfree(td);
         hid_set_drvdata(hdev, NULL);
 }
@@ -885,17 +901,37 @@ static const struct hid_device_id mt_devices[] = {
                         USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349) },
         { .driver_data = MT_CLS_EGALAX_SERIAL,
                 MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7) },
+        { .driver_data = MT_CLS_EGALAX_SERIAL,
+                MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
                         USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+        { .driver_data = MT_CLS_EGALAX,
+                HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7224) },
+        { .driver_data = MT_CLS_EGALAX,
+                HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72D0) },
+        { .driver_data = MT_CLS_EGALAX,
+                HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72C4) },
 
         /* Elo TouchSystems IntelliTouch Plus panel */
         { .driver_data = MT_CLS_DUAL_NSMU_CONTACTID,
                 MT_USB_DEVICE(USB_VENDOR_ID_ELO,
                         USB_DEVICE_ID_ELO_TS2515) },
 
+        /* Flatfrog Panels */
+        { .driver_data = MT_CLS_FLATFROG,
+                MT_USB_DEVICE(USB_VENDOR_ID_FLATFROG,
+                        USB_DEVICE_ID_MULTITOUCH_3200) },
+
         /* GeneralTouch panel */
-        { .driver_data = MT_CLS_DUAL_INRANGE_CONTACTNUMBER,
+        { .driver_data = MT_CLS_GENERALTOUCH_TWOFINGERS,
                 MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
                         USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS) },
+        { .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+                MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
+                        USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS) },
 
         /* Gametel game controller */
         { .driver_data = MT_CLS_DEFAULT,
@@ -1087,11 +1123,13 @@ static struct hid_driver mt_driver = {
         .remove = mt_remove,
         .input_mapping = mt_input_mapping,
         .input_mapped = mt_input_mapped,
+        .input_configured = mt_input_configured,
         .feature_mapping = mt_feature_mapping,
         .usage_table = mt_grabbed_usages,
         .event = mt_event,
 #ifdef CONFIG_PM
         .reset_resume = mt_reset_resume,
+        .resume = mt_resume,
 #endif
 };
 
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index 9fae2ebdd758..86a969f63292 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -882,10 +882,10 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
         nd->activate_slack = activate_slack;
         nd->act_state = activate_slack;
         nd->deactivate_slack = -deactivate_slack;
-        nd->sensor_logical_width = 0;
-        nd->sensor_logical_height = 0;
-        nd->sensor_physical_width = 0;
-        nd->sensor_physical_height = 0;
+        nd->sensor_logical_width = 1;
+        nd->sensor_logical_height = 1;
+        nd->sensor_physical_width = 1;
+        nd->sensor_physical_height = 1;
 
         hid_set_drvdata(hdev, nd);
 
diff --git a/drivers/hid/hid-petalynx.c b/drivers/hid/hid-petalynx.c
index f1ea3ff8a98d..4c521de4e7e6 100644
--- a/drivers/hid/hid-petalynx.c
+++ b/drivers/hid/hid-petalynx.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-picolcd.c b/drivers/hid/hid-picolcd.c
deleted file mode 100644
index 27c8ebdfad01..000000000000
--- a/drivers/hid/hid-picolcd.c
+++ /dev/null
@@ -1,2748 +0,0 @@
-/***************************************************************************
- *   Copyright (C) 2010 by Bruno Prémont <bonbons@linux-vserver.org>       *
- *                                                                         *
- *   Based on Logitech G13 driver (v0.4)                                   *
- *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
- *                                                                         *
- *   This program is free software: you can redistribute it and/or modify  *
- *   it under the terms of the GNU General Public License as published by  *
- *   the Free Software Foundation, version 2 of the License.               *
- *                                                                         *
- *   This driver is distributed in the hope that it will be useful, but    *
- *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
- *   General Public License for more details.                              *
- *                                                                         *
- *   You should have received a copy of the GNU General Public License     *
- *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
- ***************************************************************************/
-
-#include <linux/hid.h>
-#include <linux/hid-debug.h>
-#include <linux/input.h>
-#include "hid-ids.h"
-#include "usbhid/usbhid.h"
-#include <linux/usb.h>
-
-#include <linux/fb.h>
-#include <linux/vmalloc.h>
-#include <linux/backlight.h>
-#include <linux/lcd.h>
-
-#include <linux/leds.h>
-
-#include <linux/seq_file.h>
-#include <linux/debugfs.h>
-
-#include <linux/completion.h>
-#include <linux/uaccess.h>
-#include <linux/module.h>
-
-#define PICOLCD_NAME "PicoLCD (graphic)"
-
-/* Report numbers */
-#define REPORT_ERROR_CODE      0x10 /* LCD: IN[16]  */
-#define   ERR_SUCCESS            0x00
-#define   ERR_PARAMETER_MISSING  0x01
-#define   ERR_DATA_MISSING       0x02
-#define   ERR_BLOCK_READ_ONLY    0x03
-#define   ERR_BLOCK_NOT_ERASABLE 0x04
-#define   ERR_BLOCK_TOO_BIG      0x05
-#define   ERR_SECTION_OVERFLOW   0x06
-#define   ERR_INVALID_CMD_LEN    0x07
-#define   ERR_INVALID_DATA_LEN   0x08
-#define REPORT_KEY_STATE       0x11 /* LCD: IN[2]   */
-#define REPORT_IR_DATA         0x21 /* LCD: IN[63]  */
-#define REPORT_EE_DATA         0x32 /* LCD: IN[63]  */
-#define REPORT_MEMORY          0x41 /* LCD: IN[63]  */
-#define REPORT_LED_STATE       0x81 /* LCD: OUT[1]  */
-#define REPORT_BRIGHTNESS      0x91 /* LCD: OUT[1]  */
-#define REPORT_CONTRAST        0x92 /* LCD: OUT[1]  */
-#define REPORT_RESET           0x93 /* LCD: OUT[2]  */
-#define REPORT_LCD_CMD         0x94 /* LCD: OUT[63] */
-#define REPORT_LCD_DATA        0x95 /* LCD: OUT[63] */
-#define REPORT_LCD_CMD_DATA    0x96 /* LCD: OUT[63] */
-#define REPORT_EE_READ         0xa3 /* LCD: OUT[63] */
-#define REPORT_EE_WRITE        0xa4 /* LCD: OUT[63] */
-#define REPORT_ERASE_MEMORY    0xb2 /* LCD: OUT[2]  */
-#define REPORT_READ_MEMORY     0xb3 /* LCD: OUT[3]  */
-#define REPORT_WRITE_MEMORY    0xb4 /* LCD: OUT[63] */
-#define REPORT_SPLASH_RESTART  0xc1 /* LCD: OUT[1]  */
-#define REPORT_EXIT_KEYBOARD   0xef /* LCD: OUT[2]  */
-#define REPORT_VERSION         0xf1 /* LCD: IN[2],OUT[1]    Bootloader: IN[2],OUT[1]   */
-#define REPORT_BL_ERASE_MEMORY 0xf2 /*                      Bootloader: IN[36],OUT[4]  */
-#define REPORT_BL_READ_MEMORY  0xf3 /*                      Bootloader: IN[36],OUT[4]  */
-#define REPORT_BL_WRITE_MEMORY 0xf4 /*                      Bootloader: IN[36],OUT[36] */
-#define REPORT_DEVID           0xf5 /* LCD: IN[5], OUT[1]   Bootloader: IN[5],OUT[1]   */
-#define REPORT_SPLASH_SIZE     0xf6 /* LCD: IN[4], OUT[1]   */
-#define REPORT_HOOK_VERSION    0xf7 /* LCD: IN[2], OUT[1]   */
-#define REPORT_EXIT_FLASHER    0xff /*                      Bootloader: OUT[2]         */
-
-#ifdef CONFIG_HID_PICOLCD_FB
-/* Framebuffer
- *
- * The PicoLCD use a Topway LCD module of 256x64 pixel
- * This display area is tiled over 4 controllers with 8 tiles
- * each. Each tile has 8x64 pixel, each data byte representing
- * a 1-bit wide vertical line of the tile.
- *
- * The display can be updated at a tile granularity.
- *
- *       Chip 1           Chip 2           Chip 3           Chip 4
- * +----------------+----------------+----------------+----------------+
- * |     Tile 1     |     Tile 1     |     Tile 1     |     Tile 1     |
- * +----------------+----------------+----------------+----------------+
- * |     Tile 2     |     Tile 2     |     Tile 2     |     Tile 2     |
- * +----------------+----------------+----------------+----------------+
- *                                  ...
- * +----------------+----------------+----------------+----------------+
- * |     Tile 8     |     Tile 8     |     Tile 8     |     Tile 8     |
- * +----------------+----------------+----------------+----------------+
- */
-#define PICOLCDFB_NAME "picolcdfb"
-#define PICOLCDFB_WIDTH (256)
-#define PICOLCDFB_HEIGHT (64)
-#define PICOLCDFB_SIZE (PICOLCDFB_WIDTH * PICOLCDFB_HEIGHT / 8)
-
-#define PICOLCDFB_UPDATE_RATE_LIMIT   10
-#define PICOLCDFB_UPDATE_RATE_DEFAULT  2
-
-/* Framebuffer visual structures */
-static const struct fb_fix_screeninfo picolcdfb_fix = {
-        .id          = PICOLCDFB_NAME,
-        .type        = FB_TYPE_PACKED_PIXELS,
-        .visual      = FB_VISUAL_MONO01,
-        .xpanstep    = 0,
-        .ypanstep    = 0,
-        .ywrapstep   = 0,
-        .line_length = PICOLCDFB_WIDTH / 8,
-        .accel       = FB_ACCEL_NONE,
-};
-
-static const struct fb_var_screeninfo picolcdfb_var = {
-        .xres           = PICOLCDFB_WIDTH,
-        .yres           = PICOLCDFB_HEIGHT,
-        .xres_virtual   = PICOLCDFB_WIDTH,
-        .yres_virtual   = PICOLCDFB_HEIGHT,
-        .width          = 103,
-        .height         = 26,
-        .bits_per_pixel = 1,
-        .grayscale      = 1,
-        .red            = {
-                .offset = 0,
-                .length = 1,
-                .msb_right = 0,
-        },
-        .green          = {
-                .offset = 0,
-                .length = 1,
-                .msb_right = 0,
-        },
-        .blue           = {
-                .offset = 0,
-                .length = 1,
-                .msb_right = 0,
-        },
-        .transp         = {
-                .offset = 0,
-                .length = 0,
-                .msb_right = 0,
-        },
-};
-#endif /* CONFIG_HID_PICOLCD_FB */
-
-/* Input device
- *
- * The PicoLCD has an IR receiver header, a built-in keypad with 5 keys
- * and header for 4x4 key matrix. The built-in keys are part of the matrix.
- */
-static const unsigned short def_keymap[] = {
-        KEY_RESERVED,   /* none */
-        KEY_BACK,       /* col 4 + row 1 */
-        KEY_HOMEPAGE,   /* col 3 + row 1 */
-        KEY_RESERVED,   /* col 2 + row 1 */
-        KEY_RESERVED,   /* col 1 + row 1 */
-        KEY_SCROLLUP,   /* col 4 + row 2 */
-        KEY_OK,         /* col 3 + row 2 */
-        KEY_SCROLLDOWN, /* col 2 + row 2 */
-        KEY_RESERVED,   /* col 1 + row 2 */
-        KEY_RESERVED,   /* col 4 + row 3 */
-        KEY_RESERVED,   /* col 3 + row 3 */
-        KEY_RESERVED,   /* col 2 + row 3 */
-        KEY_RESERVED,   /* col 1 + row 3 */
-        KEY_RESERVED,   /* col 4 + row 4 */
-        KEY_RESERVED,   /* col 3 + row 4 */
-        KEY_RESERVED,   /* col 2 + row 4 */
-        KEY_RESERVED,   /* col 1 + row 4 */
-};
-#define PICOLCD_KEYS ARRAY_SIZE(def_keymap)
-
-/* Description of in-progress IO operation, used for operations
- * that trigger response from device */
-struct picolcd_pending {
-        struct hid_report *out_report;
-        struct hid_report *in_report;
-        struct completion ready;
-        int raw_size;
-        u8 raw_data[64];
-};
-
-/* Per device data structure */
-struct picolcd_data {
-        struct hid_device *hdev;
-#ifdef CONFIG_DEBUG_FS
-        struct dentry *debug_reset;
-        struct dentry *debug_eeprom;
-        struct dentry *debug_flash;
-        struct mutex mutex_flash;
-        int addr_sz;
-#endif
-        u8 version[2];
-        unsigned short opmode_delay;
-        /* input stuff */
-        u8 pressed_keys[2];
-        struct input_dev *input_keys;
-        struct input_dev *input_cir;
-        unsigned short keycode[PICOLCD_KEYS];
-
-#ifdef CONFIG_HID_PICOLCD_FB
-        /* Framebuffer stuff */
-        u8 fb_update_rate;
-        u8 fb_bpp;
-        u8 fb_force;
-        u8 *fb_vbitmap;         /* local copy of what was sent to PicoLCD */
-        u8 *fb_bitmap;          /* framebuffer */
-        struct fb_info *fb_info;
-        struct fb_deferred_io fb_defio;
-#endif /* CONFIG_HID_PICOLCD_FB */
-#ifdef CONFIG_HID_PICOLCD_LCD
-        struct lcd_device *lcd;
-        u8 lcd_contrast;
-#endif /* CONFIG_HID_PICOLCD_LCD */
-#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
-        struct backlight_device *backlight;
-        u8 lcd_brightness;
-        u8 lcd_power;
-#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
-#ifdef CONFIG_HID_PICOLCD_LEDS
-        /* LED stuff */
-        u8 led_state;
-        struct led_classdev *led[8];
-#endif /* CONFIG_HID_PICOLCD_LEDS */
-
-        /* Housekeeping stuff */
-        spinlock_t lock;
-        struct mutex mutex;
-        struct picolcd_pending *pending;
-        int status;
-#define PICOLCD_BOOTLOADER 1
-#define PICOLCD_FAILED 2
-#define PICOLCD_READY_FB 4
-};
-
-
-/* Find a given report */
-#define picolcd_in_report(id, dev) picolcd_report(id, dev, HID_INPUT_REPORT)
-#define picolcd_out_report(id, dev) picolcd_report(id, dev, HID_OUTPUT_REPORT)
-
-static struct hid_report *picolcd_report(int id, struct hid_device *hdev, int dir)
-{
-        struct list_head *feature_report_list = &hdev->report_enum[dir].report_list;
-        struct hid_report *report = NULL;
-
-        list_for_each_entry(report, feature_report_list, list) {
-                if (report->id == id)
-                        return report;
-        }
-        hid_warn(hdev, "No report with id 0x%x found\n", id);
-        return NULL;
-}
-
-#ifdef CONFIG_DEBUG_FS
-static void picolcd_debug_out_report(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report);
-#define usbhid_submit_report(a, b, c) \
-        do { \
-                picolcd_debug_out_report(hid_get_drvdata(a), a, b); \
-                usbhid_submit_report(a, b, c); \
-        } while (0)
-#endif
-
-/* Submit a report and wait for a reply from device - if device fades away
- * or does not respond in time, return NULL */
-static struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
-                int report_id, const u8 *raw_data, int size)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct picolcd_pending *work;
-        struct hid_report *report = picolcd_out_report(report_id, hdev);
-        unsigned long flags;
-        int i, j, k;
-
-        if (!report || !data)
-                return NULL;
-        if (data->status & PICOLCD_FAILED)
-                return NULL;
-        work = kzalloc(sizeof(*work), GFP_KERNEL);
-        if (!work)
-                return NULL;
-
-        init_completion(&work->ready);
-        work->out_report = report;
-        work->in_report  = NULL;
-        work->raw_size   = 0;
-
-        mutex_lock(&data->mutex);
-        spin_lock_irqsave(&data->lock, flags);
-        for (i = k = 0; i < report->maxfield; i++)
-                for (j = 0; j < report->field[i]->report_count; j++) {
-                        hid_set_field(report->field[i], j, k < size ? raw_data[k] : 0);
-                        k++;
-                }
-        data->pending = work;
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        wait_for_completion_interruptible_timeout(&work->ready, HZ*2);
-        spin_lock_irqsave(&data->lock, flags);
-        data->pending = NULL;
-        spin_unlock_irqrestore(&data->lock, flags);
-        mutex_unlock(&data->mutex);
-        return work;
-}
-
-#ifdef CONFIG_HID_PICOLCD_FB
-/* Send a given tile to PicoLCD */
-static int picolcd_fb_send_tile(struct hid_device *hdev, int chip, int tile)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct hid_report *report1 = picolcd_out_report(REPORT_LCD_CMD_DATA, hdev);
-        struct hid_report *report2 = picolcd_out_report(REPORT_LCD_DATA, hdev);
-        unsigned long flags;
-        u8 *tdata;
-        int i;
-
-        if (!report1 || report1->maxfield != 1 || !report2 || report2->maxfield != 1)
-                return -ENODEV;
-
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report1->field[0],  0, chip << 2);
-        hid_set_field(report1->field[0],  1, 0x02);
-        hid_set_field(report1->field[0],  2, 0x00);
-        hid_set_field(report1->field[0],  3, 0x00);
-        hid_set_field(report1->field[0],  4, 0xb8 | tile);
-        hid_set_field(report1->field[0],  5, 0x00);
-        hid_set_field(report1->field[0],  6, 0x00);
-        hid_set_field(report1->field[0],  7, 0x40);
-        hid_set_field(report1->field[0],  8, 0x00);
-        hid_set_field(report1->field[0],  9, 0x00);
-        hid_set_field(report1->field[0], 10,   32);
-
-        hid_set_field(report2->field[0],  0, (chip << 2) | 0x01);
-        hid_set_field(report2->field[0],  1, 0x00);
-        hid_set_field(report2->field[0],  2, 0x00);
-        hid_set_field(report2->field[0],  3,   32);
-
-        tdata = data->fb_vbitmap + (tile * 4 + chip) * 64;
-        for (i = 0; i < 64; i++)
-                if (i < 32)
-                        hid_set_field(report1->field[0], 11 + i, tdata[i]);
-                else
-                        hid_set_field(report2->field[0], 4 + i - 32, tdata[i]);
-
-        usbhid_submit_report(data->hdev, report1, USB_DIR_OUT);
-        usbhid_submit_report(data->hdev, report2, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return 0;
-}
-
-/* Translate a single tile*/
-static int picolcd_fb_update_tile(u8 *vbitmap, const u8 *bitmap, int bpp,
-                int chip, int tile)
-{
-        int i, b, changed = 0;
-        u8 tdata[64];
-        u8 *vdata = vbitmap + (tile * 4 + chip) * 64;
-
-        if (bpp == 1) {
-                for (b = 7; b >= 0; b--) {
-                        const u8 *bdata = bitmap + tile * 256 + chip * 8 + b * 32;
-                        for (i = 0; i < 64; i++) {
-                                tdata[i] <<= 1;
-                                tdata[i] |= (bdata[i/8] >> (i % 8)) & 0x01;
-                        }
-                }
-        } else if (bpp == 8) {
-                for (b = 7; b >= 0; b--) {
-                        const u8 *bdata = bitmap + (tile * 256 + chip * 8 + b * 32) * 8;
-                        for (i = 0; i < 64; i++) {
-                                tdata[i] <<= 1;
-                                tdata[i] |= (bdata[i] & 0x80) ? 0x01 : 0x00;
-                        }
-                }
-        } else {
-                /* Oops, we should never get here! */
-                WARN_ON(1);
-                return 0;
-        }
-
-        for (i = 0; i < 64; i++)
-                if (tdata[i] != vdata[i]) {
-                        changed = 1;
-                        vdata[i] = tdata[i];
-                }
-        return changed;
-}
-
-/* Reconfigure LCD display */
-static int picolcd_fb_reset(struct picolcd_data *data, int clear)
-{
-        struct hid_report *report = picolcd_out_report(REPORT_LCD_CMD, data->hdev);
-        int i, j;
-        unsigned long flags;
-        static const u8 mapcmd[8] = { 0x00, 0x02, 0x00, 0x64, 0x3f, 0x00, 0x64, 0xc0 };
-
-        if (!report || report->maxfield != 1)
-                return -ENODEV;
-
-        spin_lock_irqsave(&data->lock, flags);
-        for (i = 0; i < 4; i++) {
-                for (j = 0; j < report->field[0]->maxusage; j++)
-                        if (j == 0)
-                                hid_set_field(report->field[0], j, i << 2);
-                        else if (j < sizeof(mapcmd))
-                                hid_set_field(report->field[0], j, mapcmd[j]);
-                        else
-                                hid_set_field(report->field[0], j, 0);
-                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        }
-
-        data->status |= PICOLCD_READY_FB;
-        spin_unlock_irqrestore(&data->lock, flags);
-
-        if (data->fb_bitmap) {
-                if (clear) {
-                        memset(data->fb_vbitmap, 0, PICOLCDFB_SIZE);
-                        memset(data->fb_bitmap, 0, PICOLCDFB_SIZE*data->fb_bpp);
-                }
-                data->fb_force = 1;
-        }
-
-        /* schedule first output of framebuffer */
-        if (data->fb_info)
-                schedule_delayed_work(&data->fb_info->deferred_work, 0);
-
-        return 0;
-}
-
-/* Update fb_vbitmap from the screen_base and send changed tiles to device */
-static void picolcd_fb_update(struct picolcd_data *data)
-{
-        int chip, tile, n;
-        unsigned long flags;
-
-        if (!data)
-                return;
-
-        spin_lock_irqsave(&data->lock, flags);
-        if (!(data->status & PICOLCD_READY_FB)) {
-                spin_unlock_irqrestore(&data->lock, flags);
-                picolcd_fb_reset(data, 0);
-        } else {
-                spin_unlock_irqrestore(&data->lock, flags);
-        }
-
-        /*
-         * Translate the framebuffer into the format needed by the PicoLCD.
-         * See display layout above.
-         * Do this one tile after the other and push those tiles that changed.
-         *
-         * Wait for our IO to complete as otherwise we might flood the queue!
-         */
-        n = 0;
-        for (chip = 0; chip < 4; chip++)
-                for (tile = 0; tile < 8; tile++)
-                        if (picolcd_fb_update_tile(data->fb_vbitmap,
-                                        data->fb_bitmap, data->fb_bpp, chip, tile) ||
-                                data->fb_force) {
-                                n += 2;
-                                if (!data->fb_info->par)
-                                        return; /* device lost! */
-                                if (n >= HID_OUTPUT_FIFO_SIZE / 2) {
-                                        usbhid_wait_io(data->hdev);
-                                        n = 0;
-                                }
-                                picolcd_fb_send_tile(data->hdev, chip, tile);
-                        }
-        data->fb_force = false;
-        if (n)
-                usbhid_wait_io(data->hdev);
-}
-
-/* Stub to call the system default and update the image on the picoLCD */
-static void picolcd_fb_fillrect(struct fb_info *info,
-                const struct fb_fillrect *rect)
-{
-        if (!info->par)
-                return;
-        sys_fillrect(info, rect);
-
-        schedule_delayed_work(&info->deferred_work, 0);
-}
-
-/* Stub to call the system default and update the image on the picoLCD */
-static void picolcd_fb_copyarea(struct fb_info *info,
-                const struct fb_copyarea *area)
-{
-        if (!info->par)
-                return;
-        sys_copyarea(info, area);
-
-        schedule_delayed_work(&info->deferred_work, 0);
-}
-
-/* Stub to call the system default and update the image on the picoLCD */
-static void picolcd_fb_imageblit(struct fb_info *info, const struct fb_image *image)
-{
-        if (!info->par)
-                return;
-        sys_imageblit(info, image);
-
-        schedule_delayed_work(&info->deferred_work, 0);
-}
-
-/*
- * this is the slow path from userspace. they can seek and write to
- * the fb. it's inefficient to do anything less than a full screen draw
- */
-static ssize_t picolcd_fb_write(struct fb_info *info, const char __user *buf,
-                size_t count, loff_t *ppos)
-{
-        ssize_t ret;
-        if (!info->par)
-                return -ENODEV;
-        ret = fb_sys_write(info, buf, count, ppos);
-        if (ret >= 0)
-                schedule_delayed_work(&info->deferred_work, 0);
-        return ret;
-}
-
-static int picolcd_fb_blank(int blank, struct fb_info *info)
-{
-        if (!info->par)
-                return -ENODEV;
-        /* We let fb notification do this for us via lcd/backlight device */
-        return 0;
-}
-
-static void picolcd_fb_destroy(struct fb_info *info)
-{
-        struct picolcd_data *data = info->par;
-        u32 *ref_cnt = info->pseudo_palette;
-        int may_release;
-
-        info->par = NULL;
-        if (data)
-                data->fb_info = NULL;
-        fb_deferred_io_cleanup(info);
-
-        ref_cnt--;
-        mutex_lock(&info->lock);
-        (*ref_cnt)--;
-        may_release = !*ref_cnt;
-        mutex_unlock(&info->lock);
-        if (may_release) {
-                vfree((u8 *)info->fix.smem_start);
-                framebuffer_release(info);
-        }
-}
-
-static int picolcd_fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
-{
-        __u32 bpp      = var->bits_per_pixel;
-        __u32 activate = var->activate;
-
-        /* only allow 1/8 bit depth (8-bit is grayscale) */
-        *var = picolcdfb_var;
-        var->activate = activate;
-        if (bpp >= 8) {
-                var->bits_per_pixel = 8;
-                var->red.length     = 8;
-                var->green.length   = 8;
-                var->blue.length    = 8;
-        } else {
-                var->bits_per_pixel = 1;
-                var->red.length     = 1;
-                var->green.length   = 1;
-                var->blue.length    = 1;
-        }
-        return 0;
-}
-
-static int picolcd_set_par(struct fb_info *info)
-{
-        struct picolcd_data *data = info->par;
-        u8 *tmp_fb, *o_fb;
-        if (!data)
-                return -ENODEV;
-        if (info->var.bits_per_pixel == data->fb_bpp)
-                return 0;
-        /* switch between 1/8 bit depths */
-        if (info->var.bits_per_pixel != 1 && info->var.bits_per_pixel != 8)
-                return -EINVAL;
-
-        o_fb   = data->fb_bitmap;
-        tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL);
-        if (!tmp_fb)
-                return -ENOMEM;
-
-        /* translate FB content to new bits-per-pixel */
-        if (info->var.bits_per_pixel == 1) {
-                int i, b;
-                for (i = 0; i < PICOLCDFB_SIZE; i++) {
-                        u8 p = 0;
-                        for (b = 0; b < 8; b++) {
-                                p <<= 1;
-                                p |= o_fb[i*8+b] ? 0x01 : 0x00;
-                        }
-                        tmp_fb[i] = p;
-                }
-                memcpy(o_fb, tmp_fb, PICOLCDFB_SIZE);
-                info->fix.visual = FB_VISUAL_MONO01;
-                info->fix.line_length = PICOLCDFB_WIDTH / 8;
-        } else {
-                int i;
-                memcpy(tmp_fb, o_fb, PICOLCDFB_SIZE);
-                for (i = 0; i < PICOLCDFB_SIZE * 8; i++)
-                        o_fb[i] = tmp_fb[i/8] & (0x01 << (7 - i % 8)) ? 0xff : 0x00;
-                info->fix.visual = FB_VISUAL_DIRECTCOLOR;
-                info->fix.line_length = PICOLCDFB_WIDTH;
-        }
-
-        kfree(tmp_fb);
-        data->fb_bpp      = info->var.bits_per_pixel;
-        return 0;
-}
-
-/* Do refcounting on our FB and cleanup per worker if FB is
- * closed after unplug of our device
- * (fb_release holds info->lock and still touches info after
- *  we return so we can't release it immediately.
- */
-struct picolcd_fb_cleanup_item {
-        struct fb_info *info;
-        struct picolcd_fb_cleanup_item *next;
-};
-static struct picolcd_fb_cleanup_item *fb_pending;
-static DEFINE_SPINLOCK(fb_pending_lock);
-
-static void picolcd_fb_do_cleanup(struct work_struct *data)
-{
-        struct picolcd_fb_cleanup_item *item;
-        unsigned long flags;
-
-        do {
-                spin_lock_irqsave(&fb_pending_lock, flags);
-                item = fb_pending;
-                fb_pending = item ? item->next : NULL;
-                spin_unlock_irqrestore(&fb_pending_lock, flags);
-
-                if (item) {
-                        u8 *fb = (u8 *)item->info->fix.smem_start;
-                        /* make sure we do not race against fb core when
-                         * releasing */
-                        mutex_lock(&item->info->lock);
-                        mutex_unlock(&item->info->lock);
-                        framebuffer_release(item->info);
-                        vfree(fb);
-                }
-        } while (item);
-}
-
-static DECLARE_WORK(picolcd_fb_cleanup, picolcd_fb_do_cleanup);
-
-static int picolcd_fb_open(struct fb_info *info, int u)
-{
-        u32 *ref_cnt = info->pseudo_palette;
-        ref_cnt--;
-
-        (*ref_cnt)++;
-        return 0;
-}
-
-static int picolcd_fb_release(struct fb_info *info, int u)
-{
-        u32 *ref_cnt = info->pseudo_palette;
-        ref_cnt--;
-
-        (*ref_cnt)++;
-        if (!*ref_cnt) {
-                unsigned long flags;
-                struct picolcd_fb_cleanup_item *item = (struct picolcd_fb_cleanup_item *)ref_cnt;
-                item--;
-                spin_lock_irqsave(&fb_pending_lock, flags);
-                item->next = fb_pending;
-                fb_pending = item;
-                spin_unlock_irqrestore(&fb_pending_lock, flags);
-                schedule_work(&picolcd_fb_cleanup);
-        }
-        return 0;
-}
-
-/* Note this can't be const because of struct fb_info definition */
-static struct fb_ops picolcdfb_ops = {
-        .owner        = THIS_MODULE,
-        .fb_destroy   = picolcd_fb_destroy,
-        .fb_open      = picolcd_fb_open,
-        .fb_release   = picolcd_fb_release,
-        .fb_read      = fb_sys_read,
-        .fb_write     = picolcd_fb_write,
-        .fb_blank     = picolcd_fb_blank,
-        .fb_fillrect  = picolcd_fb_fillrect,
-        .fb_copyarea  = picolcd_fb_copyarea,
-        .fb_imageblit = picolcd_fb_imageblit,
-        .fb_check_var = picolcd_fb_check_var,
-        .fb_set_par   = picolcd_set_par,
-};
-
-
-/* Callback from deferred IO workqueue */
-static void picolcd_fb_deferred_io(struct fb_info *info, struct list_head *pagelist)
-{
-        picolcd_fb_update(info->par);
-}
-
-static const struct fb_deferred_io picolcd_fb_defio = {
-        .delay = HZ / PICOLCDFB_UPDATE_RATE_DEFAULT,
-        .deferred_io = picolcd_fb_deferred_io,
-};
-
-
-/*
- * The "fb_update_rate" sysfs attribute
- */
-static ssize_t picolcd_fb_update_rate_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        unsigned i, fb_update_rate = data->fb_update_rate;
-        size_t ret = 0;
-
-        for (i = 1; i <= PICOLCDFB_UPDATE_RATE_LIMIT; i++)
-                if (ret >= PAGE_SIZE)
-                        break;
-                else if (i == fb_update_rate)
-                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "[%u] ", i);
-                else
-                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "%u ", i);
-        if (ret > 0)
-                buf[min(ret, (size_t)PAGE_SIZE)-1] = '\n';
-        return ret;
-}
-
-static ssize_t picolcd_fb_update_rate_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        int i;
-        unsigned u;
-
-        if (count < 1 || count > 10)
-                return -EINVAL;
-
-        i = sscanf(buf, "%u", &u);
-        if (i != 1)
-                return -EINVAL;
-
-        if (u > PICOLCDFB_UPDATE_RATE_LIMIT)
-                return -ERANGE;
-        else if (u == 0)
-                u = PICOLCDFB_UPDATE_RATE_DEFAULT;
-
-        data->fb_update_rate = u;
-        data->fb_defio.delay = HZ / data->fb_update_rate;
-        return count;
-}
-
-static DEVICE_ATTR(fb_update_rate, 0666, picolcd_fb_update_rate_show,
-                picolcd_fb_update_rate_store);
-
-/* initialize Framebuffer device */
-static int picolcd_init_framebuffer(struct picolcd_data *data)
-{
-        struct device *dev = &data->hdev->dev;
-        struct fb_info *info = NULL;
-        int i, error = -ENOMEM;
-        u8 *fb_vbitmap = NULL;
-        u8 *fb_bitmap  = NULL;
-        u32 *palette;
-
-        fb_bitmap = vmalloc(PICOLCDFB_SIZE*8);
-        if (fb_bitmap == NULL) {
-                dev_err(dev, "can't get a free page for framebuffer\n");
-                goto err_nomem;
-        }
-
-        fb_vbitmap = kmalloc(PICOLCDFB_SIZE, GFP_KERNEL);
-        if (fb_vbitmap == NULL) {
-                dev_err(dev, "can't alloc vbitmap image buffer\n");
-                goto err_nomem;
-        }
-
-        data->fb_update_rate = PICOLCDFB_UPDATE_RATE_DEFAULT;
-        data->fb_defio = picolcd_fb_defio;
-        /* The extra memory is:
-         * - struct picolcd_fb_cleanup_item
-         * - u32 for ref_count
-         * - 256*u32 for pseudo_palette
-         */
-        info = framebuffer_alloc(257 * sizeof(u32) + sizeof(struct picolcd_fb_cleanup_item), dev);
-        if (info == NULL) {
-                dev_err(dev, "failed to allocate a framebuffer\n");
-                goto err_nomem;
-        }
-
-        palette  = info->par + sizeof(struct picolcd_fb_cleanup_item);
-        *palette = 1;
-        palette++;
-        for (i = 0; i < 256; i++)
-                palette[i] = i > 0 && i < 16 ? 0xff : 0;
-        info->pseudo_palette = palette;
-        info->fbdefio = &data->fb_defio;
-        info->screen_base = (char __force __iomem *)fb_bitmap;
-        info->fbops = &picolcdfb_ops;
-        info->var = picolcdfb_var;
-        info->fix = picolcdfb_fix;
-        info->fix.smem_len   = PICOLCDFB_SIZE*8;
-        info->fix.smem_start = (unsigned long)fb_bitmap;
-        info->par = data;
-        info->flags = FBINFO_FLAG_DEFAULT;
-
-        data->fb_vbitmap = fb_vbitmap;
-        data->fb_bitmap  = fb_bitmap;
-        data->fb_bpp     = picolcdfb_var.bits_per_pixel;
-        error = picolcd_fb_reset(data, 1);
-        if (error) {
-                dev_err(dev, "failed to configure display\n");
-                goto err_cleanup;
-        }
-        error = device_create_file(dev, &dev_attr_fb_update_rate);
-        if (error) {
-                dev_err(dev, "failed to create sysfs attributes\n");
-                goto err_cleanup;
-        }
-        fb_deferred_io_init(info);
-        data->fb_info    = info;
-        error = register_framebuffer(info);
-        if (error) {
-                dev_err(dev, "failed to register framebuffer\n");
-                goto err_sysfs;
-        }
-        /* schedule first output of framebuffer */
-        data->fb_force = 1;
-        schedule_delayed_work(&info->deferred_work, 0);
-        return 0;
-
-err_sysfs:
-        fb_deferred_io_cleanup(info);
-        device_remove_file(dev, &dev_attr_fb_update_rate);
-err_cleanup:
-        data->fb_vbitmap = NULL;
-        data->fb_bitmap  = NULL;
-        data->fb_bpp     = 0;
-        data->fb_info    = NULL;
-
-err_nomem:
-        framebuffer_release(info);
-        vfree(fb_bitmap);
-        kfree(fb_vbitmap);
-        return error;
-}
-
-static void picolcd_exit_framebuffer(struct picolcd_data *data)
-{
-        struct fb_info *info = data->fb_info;
-        u8 *fb_vbitmap = data->fb_vbitmap;
-
-        if (!info)
-                return;
-
-        info->par = NULL;
-        device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
-        unregister_framebuffer(info);
-        data->fb_vbitmap = NULL;
-        data->fb_bitmap  = NULL;
-        data->fb_bpp     = 0;
-        data->fb_info    = NULL;
-        kfree(fb_vbitmap);
-}
-
-#define picolcd_fbinfo(d) ((d)->fb_info)
-#else
-static inline int picolcd_fb_reset(struct picolcd_data *data, int clear)
-{
-        return 0;
-}
-static inline int picolcd_init_framebuffer(struct picolcd_data *data)
-{
-        return 0;
-}
-static inline void picolcd_exit_framebuffer(struct picolcd_data *data)
-{
-}
-#define picolcd_fbinfo(d) NULL
-#endif /* CONFIG_HID_PICOLCD_FB */
-
-#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
-/*
- * backlight class device
- */
-static int picolcd_get_brightness(struct backlight_device *bdev)
-{
-        struct picolcd_data *data = bl_get_data(bdev);
-        return data->lcd_brightness;
-}
-
-static int picolcd_set_brightness(struct backlight_device *bdev)
-{
-        struct picolcd_data *data = bl_get_data(bdev);
-        struct hid_report *report = picolcd_out_report(REPORT_BRIGHTNESS, data->hdev);
-        unsigned long flags;
-
-        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
-                return -ENODEV;
-
-        data->lcd_brightness = bdev->props.brightness & 0x0ff;
-        data->lcd_power      = bdev->props.power;
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, data->lcd_power == FB_BLANK_UNBLANK ? data->lcd_brightness : 0);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return 0;
-}
-
-static int picolcd_check_bl_fb(struct backlight_device *bdev, struct fb_info *fb)
-{
-        return fb && fb == picolcd_fbinfo((struct picolcd_data *)bl_get_data(bdev));
-}
-
-static const struct backlight_ops picolcd_blops = {
-        .update_status  = picolcd_set_brightness,
-        .get_brightness = picolcd_get_brightness,
-        .check_fb       = picolcd_check_bl_fb,
-};
-
-static int picolcd_init_backlight(struct picolcd_data *data, struct hid_report *report)
-{
-        struct device *dev = &data->hdev->dev;
-        struct backlight_device *bdev;
-        struct backlight_properties props;
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
-                        report->field[0]->report_size != 8) {
-                dev_err(dev, "unsupported BRIGHTNESS report");
-                return -EINVAL;
-        }
-
-        memset(&props, 0, sizeof(props));
-        props.type = BACKLIGHT_RAW;
-        props.max_brightness = 0xff;
-        bdev = backlight_device_register(dev_name(dev), dev, data,
-                        &picolcd_blops, &props);
-        if (IS_ERR(bdev)) {
-                dev_err(dev, "failed to register backlight\n");
-                return PTR_ERR(bdev);
-        }
-        bdev->props.brightness     = 0xff;
-        data->lcd_brightness       = 0xff;
-        data->backlight            = bdev;
-        picolcd_set_brightness(bdev);
-        return 0;
-}
-
-static void picolcd_exit_backlight(struct picolcd_data *data)
-{
-        struct backlight_device *bdev = data->backlight;
-
-        data->backlight = NULL;
-        if (bdev)
-                backlight_device_unregister(bdev);
-}
-
-static inline int picolcd_resume_backlight(struct picolcd_data *data)
-{
-        if (!data->backlight)
-                return 0;
-        return picolcd_set_brightness(data->backlight);
-}
-
-#ifdef CONFIG_PM
-static void picolcd_suspend_backlight(struct picolcd_data *data)
-{
-        int bl_power = data->lcd_power;
-        if (!data->backlight)
-                return;
-
-        data->backlight->props.power = FB_BLANK_POWERDOWN;
-        picolcd_set_brightness(data->backlight);
-        data->lcd_power = data->backlight->props.power = bl_power;
-}
-#endif /* CONFIG_PM */
-#else
-static inline int picolcd_init_backlight(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        return 0;
-}
-static inline void picolcd_exit_backlight(struct picolcd_data *data)
-{
-}
-static inline int picolcd_resume_backlight(struct picolcd_data *data)
-{
-        return 0;
-}
-static inline void picolcd_suspend_backlight(struct picolcd_data *data)
-{
-}
-#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
-
-#ifdef CONFIG_HID_PICOLCD_LCD
-/*
- * lcd class device
- */
-static int picolcd_get_contrast(struct lcd_device *ldev)
-{
-        struct picolcd_data *data = lcd_get_data(ldev);
-        return data->lcd_contrast;
-}
-
-static int picolcd_set_contrast(struct lcd_device *ldev, int contrast)
-{
-        struct picolcd_data *data = lcd_get_data(ldev);
-        struct hid_report *report = picolcd_out_report(REPORT_CONTRAST, data->hdev);
-        unsigned long flags;
-
-        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
-                return -ENODEV;
-
-        data->lcd_contrast = contrast & 0x0ff;
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, data->lcd_contrast);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return 0;
-}
-
-static int picolcd_check_lcd_fb(struct lcd_device *ldev, struct fb_info *fb)
-{
-        return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
-}
-
-static struct lcd_ops picolcd_lcdops = {
-        .get_contrast   = picolcd_get_contrast,
-        .set_contrast   = picolcd_set_contrast,
-        .check_fb       = picolcd_check_lcd_fb,
-};
-
-static int picolcd_init_lcd(struct picolcd_data *data, struct hid_report *report)
-{
-        struct device *dev = &data->hdev->dev;
-        struct lcd_device *ldev;
-
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
-                        report->field[0]->report_size != 8) {
-                dev_err(dev, "unsupported CONTRAST report");
-                return -EINVAL;
-        }
-
-        ldev = lcd_device_register(dev_name(dev), dev, data, &picolcd_lcdops);
-        if (IS_ERR(ldev)) {
-                dev_err(dev, "failed to register LCD\n");
-                return PTR_ERR(ldev);
-        }
-        ldev->props.max_contrast = 0x0ff;
-        data->lcd_contrast = 0xe5;
-        data->lcd = ldev;
-        picolcd_set_contrast(ldev, 0xe5);
-        return 0;
-}
-
-static void picolcd_exit_lcd(struct picolcd_data *data)
-{
-        struct lcd_device *ldev = data->lcd;
-
-        data->lcd = NULL;
-        if (ldev)
-                lcd_device_unregister(ldev);
-}
-
-static inline int picolcd_resume_lcd(struct picolcd_data *data)
-{
-        if (!data->lcd)
-                return 0;
-        return picolcd_set_contrast(data->lcd, data->lcd_contrast);
-}
-#else
-static inline int picolcd_init_lcd(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        return 0;
-}
-static inline void picolcd_exit_lcd(struct picolcd_data *data)
-{
-}
-static inline int picolcd_resume_lcd(struct picolcd_data *data)
-{
-        return 0;
-}
-#endif /* CONFIG_HID_PICOLCD_LCD */
-
-#ifdef CONFIG_HID_PICOLCD_LEDS
-/**
- * LED class device
- */
-static void picolcd_leds_set(struct picolcd_data *data)
-{
-        struct hid_report *report;
-        unsigned long flags;
-
-        if (!data->led[0])
-                return;
-        report = picolcd_out_report(REPORT_LED_STATE, data->hdev);
-        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
-                return;
-
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, data->led_state);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-}
-
-static void picolcd_led_set_brightness(struct led_classdev *led_cdev,
-                        enum led_brightness value)
-{
-        struct device *dev;
-        struct hid_device *hdev;
-        struct picolcd_data *data;
-        int i, state = 0;
-
-        dev  = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data = hid_get_drvdata(hdev);
-        for (i = 0; i < 8; i++) {
-                if (led_cdev != data->led[i])
-                        continue;
-                state = (data->led_state >> i) & 1;
-                if (value == LED_OFF && state) {
-                        data->led_state &= ~(1 << i);
-                        picolcd_leds_set(data);
-                } else if (value != LED_OFF && !state) {
-                        data->led_state |= 1 << i;
-                        picolcd_leds_set(data);
-                }
-                break;
-        }
-}
-
-static enum led_brightness picolcd_led_get_brightness(struct led_classdev *led_cdev)
-{
-        struct device *dev;
-        struct hid_device *hdev;
-        struct picolcd_data *data;
-        int i, value = 0;
-
-        dev  = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data = hid_get_drvdata(hdev);
-        for (i = 0; i < 8; i++)
-                if (led_cdev == data->led[i]) {
-                        value = (data->led_state >> i) & 1;
-                        break;
-                }
-        return value ? LED_FULL : LED_OFF;
-}
-
-static int picolcd_init_leds(struct picolcd_data *data, struct hid_report *report)
-{
-        struct device *dev = &data->hdev->dev;
-        struct led_classdev *led;
-        size_t name_sz = strlen(dev_name(dev)) + 8;
-        char *name;
-        int i, ret = 0;
-
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
-                        report->field[0]->report_size != 8) {
-                dev_err(dev, "unsupported LED_STATE report");
-                return -EINVAL;
-        }
-
-        for (i = 0; i < 8; i++) {
-                led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
-                if (!led) {
-                        dev_err(dev, "can't allocate memory for LED %d\n", i);
-                        ret = -ENOMEM;
-                        goto err;
-                }
-                name = (void *)(&led[1]);
-                snprintf(name, name_sz, "%s::GPO%d", dev_name(dev), i);
-                led->name = name;
-                led->brightness = 0;
-                led->max_brightness = 1;
-                led->brightness_get = picolcd_led_get_brightness;
-                led->brightness_set = picolcd_led_set_brightness;
-
-                data->led[i] = led;
-                ret = led_classdev_register(dev, data->led[i]);
-                if (ret) {
-                        data->led[i] = NULL;
-                        kfree(led);
-                        dev_err(dev, "can't register LED %d\n", i);
-                        goto err;
-                }
-        }
-        return 0;
-err:
-        for (i = 0; i < 8; i++)
-                if (data->led[i]) {
-                        led = data->led[i];
-                        data->led[i] = NULL;
-                        led_classdev_unregister(led);
-                        kfree(led);
-                }
-        return ret;
-}
-
-static void picolcd_exit_leds(struct picolcd_data *data)
-{
-        struct led_classdev *led;
-        int i;
-
-        for (i = 0; i < 8; i++) {
-                led = data->led[i];
-                data->led[i] = NULL;
-                if (!led)
-                        continue;
-                led_classdev_unregister(led);
-                kfree(led);
-        }
-}
-
-#else
-static inline int picolcd_init_leds(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        return 0;
-}
-static inline void picolcd_exit_leds(struct picolcd_data *data)
-{
-}
-static inline int picolcd_leds_set(struct picolcd_data *data)
-{
-        return 0;
-}
-#endif /* CONFIG_HID_PICOLCD_LEDS */
-
-/*
- * input class device
- */
-static int picolcd_raw_keypad(struct picolcd_data *data,
-                struct hid_report *report, u8 *raw_data, int size)
-{
-        /*
-         * Keypad event
-         * First and second data bytes list currently pressed keys,
-         * 0x00 means no key and at most 2 keys may be pressed at same time
-         */
-        int i, j;
-
-        /* determine newly pressed keys */
-        for (i = 0; i < size; i++) {
-                unsigned int key_code;
-                if (raw_data[i] == 0)
-                        continue;
-                for (j = 0; j < sizeof(data->pressed_keys); j++)
-                        if (data->pressed_keys[j] == raw_data[i])
-                                goto key_already_down;
-                for (j = 0; j < sizeof(data->pressed_keys); j++)
-                        if (data->pressed_keys[j] == 0) {
-                                data->pressed_keys[j] = raw_data[i];
-                                break;
-                        }
-                input_event(data->input_keys, EV_MSC, MSC_SCAN, raw_data[i]);
-                if (raw_data[i] < PICOLCD_KEYS)
-                        key_code = data->keycode[raw_data[i]];
-                else
-                        key_code = KEY_UNKNOWN;
-                if (key_code != KEY_UNKNOWN) {
-                        dbg_hid(PICOLCD_NAME " got key press for %u:%d",
-                                        raw_data[i], key_code);
-                        input_report_key(data->input_keys, key_code, 1);
-                }
-                input_sync(data->input_keys);
-key_already_down:
-                continue;
-        }
-
-        /* determine newly released keys */
-        for (j = 0; j < sizeof(data->pressed_keys); j++) {
-                unsigned int key_code;
-                if (data->pressed_keys[j] == 0)
-                        continue;
-                for (i = 0; i < size; i++)
-                        if (data->pressed_keys[j] == raw_data[i])
-                                goto key_still_down;
-                input_event(data->input_keys, EV_MSC, MSC_SCAN, data->pressed_keys[j]);
-                if (data->pressed_keys[j] < PICOLCD_KEYS)
-                        key_code = data->keycode[data->pressed_keys[j]];
-                else
-                        key_code = KEY_UNKNOWN;
-                if (key_code != KEY_UNKNOWN) {
-                        dbg_hid(PICOLCD_NAME " got key release for %u:%d",
-                                        data->pressed_keys[j], key_code);
-                        input_report_key(data->input_keys, key_code, 0);
-                }
-                input_sync(data->input_keys);
-                data->pressed_keys[j] = 0;
-key_still_down:
-                continue;
-        }
-        return 1;
-}
-
-static int picolcd_raw_cir(struct picolcd_data *data,
-                struct hid_report *report, u8 *raw_data, int size)
-{
-        /* Need understanding of CIR data format to implement ... */
-        return 1;
-}
-
-static int picolcd_check_version(struct hid_device *hdev)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct picolcd_pending *verinfo;
-        int ret = 0;
-
-        if (!data)
-                return -ENODEV;
-
-        verinfo = picolcd_send_and_wait(hdev, REPORT_VERSION, NULL, 0);
-        if (!verinfo) {
-                hid_err(hdev, "no version response from PicoLCD\n");
-                return -ENODEV;
-        }
-
-        if (verinfo->raw_size == 2) {
-                data->version[0] = verinfo->raw_data[1];
-                data->version[1] = verinfo->raw_data[0];
-                if (data->status & PICOLCD_BOOTLOADER) {
-                        hid_info(hdev, "PicoLCD, bootloader version %d.%d\n",
-                                 verinfo->raw_data[1], verinfo->raw_data[0]);
-                } else {
-                        hid_info(hdev, "PicoLCD, firmware version %d.%d\n",
-                                 verinfo->raw_data[1], verinfo->raw_data[0]);
-                }
-        } else {
-                hid_err(hdev, "confused, got unexpected version response from PicoLCD\n");
-                ret = -EINVAL;
-        }
-        kfree(verinfo);
-        return ret;
-}
-
-/*
- * Reset our device and wait for answer to VERSION request
- */
-static int picolcd_reset(struct hid_device *hdev)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct hid_report *report = picolcd_out_report(REPORT_RESET, hdev);
-        unsigned long flags;
-        int error;
-
-        if (!data || !report || report->maxfield != 1)
-                return -ENODEV;
-
-        spin_lock_irqsave(&data->lock, flags);
-        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
-                data->status |= PICOLCD_BOOTLOADER;
-
-        /* perform the reset */
-        hid_set_field(report->field[0], 0, 1);
-        usbhid_submit_report(hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-
-        error = picolcd_check_version(hdev);
-        if (error)
-                return error;
-
-        picolcd_resume_lcd(data);
-        picolcd_resume_backlight(data);
-#ifdef CONFIG_HID_PICOLCD_FB
-        if (data->fb_info)
-                schedule_delayed_work(&data->fb_info->deferred_work, 0);
-#endif /* CONFIG_HID_PICOLCD_FB */
-
-        picolcd_leds_set(data);
-        return 0;
-}
-
-/*
- * The "operation_mode" sysfs attribute
- */
-static ssize_t picolcd_operation_mode_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-
-        if (data->status & PICOLCD_BOOTLOADER)
-                return snprintf(buf, PAGE_SIZE, "[bootloader] lcd\n");
-        else
-                return snprintf(buf, PAGE_SIZE, "bootloader [lcd]\n");
-}
-
-static ssize_t picolcd_operation_mode_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        struct hid_report *report = NULL;
-        size_t cnt = count;
-        int timeout = data->opmode_delay;
-        unsigned long flags;
-
-        if (cnt >= 3 && strncmp("lcd", buf, 3) == 0) {
-                if (data->status & PICOLCD_BOOTLOADER)
-                        report = picolcd_out_report(REPORT_EXIT_FLASHER, data->hdev);
-                buf += 3;
-                cnt -= 3;
-        } else if (cnt >= 10 && strncmp("bootloader", buf, 10) == 0) {
-                if (!(data->status & PICOLCD_BOOTLOADER))
-                        report = picolcd_out_report(REPORT_EXIT_KEYBOARD, data->hdev);
-                buf += 10;
-                cnt -= 10;
-        }
-        if (!report)
-                return -EINVAL;
-
-        while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
-                cnt--;
-        if (cnt != 0)
-                return -EINVAL;
-
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, timeout & 0xff);
-        hid_set_field(report->field[0], 1, (timeout >> 8) & 0xff);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return count;
-}
-
-static DEVICE_ATTR(operation_mode, 0644, picolcd_operation_mode_show,
-                picolcd_operation_mode_store);
-
-/*
- * The "operation_mode_delay" sysfs attribute
- */
-static ssize_t picolcd_operation_mode_delay_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-
-        return snprintf(buf, PAGE_SIZE, "%hu\n", data->opmode_delay);
-}
-
-static ssize_t picolcd_operation_mode_delay_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        unsigned u;
-        if (sscanf(buf, "%u", &u) != 1)
-                return -EINVAL;
-        if (u > 30000)
-                return -EINVAL;
-        else
-                data->opmode_delay = u;
-        return count;
-}
-
-static DEVICE_ATTR(operation_mode_delay, 0644, picolcd_operation_mode_delay_show,
-                picolcd_operation_mode_delay_store);
-
-
-#ifdef CONFIG_DEBUG_FS
-/*
- * The "reset" file
- */
-static int picolcd_debug_reset_show(struct seq_file *f, void *p)
-{
-        if (picolcd_fbinfo((struct picolcd_data *)f->private))
-                seq_printf(f, "all fb\n");
-        else
-                seq_printf(f, "all\n");
-        return 0;
-}
-
-static int picolcd_debug_reset_open(struct inode *inode, struct file *f)
-{
-        return single_open(f, picolcd_debug_reset_show, inode->i_private);
-}
-
-static ssize_t picolcd_debug_reset_write(struct file *f, const char __user *user_buf,
-                size_t count, loff_t *ppos)
-{
-        struct picolcd_data *data = ((struct seq_file *)f->private_data)->private;
-        char buf[32];
-        size_t cnt = min(count, sizeof(buf)-1);
-        if (copy_from_user(buf, user_buf, cnt))
-                return -EFAULT;
-
-        while (cnt > 0 && (buf[cnt-1] == ' ' || buf[cnt-1] == '\n'))
-                cnt--;
-        buf[cnt] = '\0';
-        if (strcmp(buf, "all") == 0) {
-                picolcd_reset(data->hdev);
-                picolcd_fb_reset(data, 1);
-        } else if (strcmp(buf, "fb") == 0) {
-                picolcd_fb_reset(data, 1);
-        } else {
-                return -EINVAL;
-        }
-        return count;
-}
-
-static const struct file_operations picolcd_debug_reset_fops = {
-        .owner    = THIS_MODULE,
-        .open     = picolcd_debug_reset_open,
-        .read     = seq_read,
-        .llseek   = seq_lseek,
-        .write    = picolcd_debug_reset_write,
-        .release  = single_release,
-};
-
-/*
- * The "eeprom" file
- */
-static ssize_t picolcd_debug_eeprom_read(struct file *f, char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-        struct picolcd_pending *resp;
-        u8 raw_data[3];
-        ssize_t ret = -EIO;
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x0ff)
-                return 0;
-
-        /* prepare buffer with info about what we want to read (addr & len) */
-        raw_data[0] = *off & 0xff;
-        raw_data[1] = (*off >> 8) & 0xff;
-        raw_data[2] = s < 20 ? s : 20;
-        if (*off + raw_data[2] > 0xff)
-                raw_data[2] = 0x100 - *off;
-        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_READ, raw_data,
-                        sizeof(raw_data));
-        if (!resp)
-                return -EIO;
-
-        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
-                /* successful read :) */
-                ret = resp->raw_data[2];
-                if (ret > s)
-                        ret = s;
-                if (copy_to_user(u, resp->raw_data+3, ret))
-                        ret = -EFAULT;
-                else
-                        *off += ret;
-        } /* anything else is some kind of IO error */
-
-        kfree(resp);
-        return ret;
-}
-
-static ssize_t picolcd_debug_eeprom_write(struct file *f, const char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-        struct picolcd_pending *resp;
-        ssize_t ret = -EIO;
-        u8 raw_data[23];
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x0ff)
-                return -ENOSPC;
-
-        memset(raw_data, 0, sizeof(raw_data));
-        raw_data[0] = *off & 0xff;
-        raw_data[1] = (*off >> 8) & 0xff;
-        raw_data[2] = min((size_t)20, s);
-        if (*off + raw_data[2] > 0xff)
-                raw_data[2] = 0x100 - *off;
-
-        if (copy_from_user(raw_data+3, u, min((u8)20, raw_data[2])))
-                return -EFAULT;
-        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_WRITE, raw_data,
-                        sizeof(raw_data));
-
-        if (!resp)
-                return -EIO;
-
-        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
-                /* check if written data matches */
-                if (memcmp(raw_data, resp->raw_data, 3+raw_data[2]) == 0) {
-                        *off += raw_data[2];
-                        ret = raw_data[2];
-                }
-        }
-        kfree(resp);
-        return ret;
-}
-
-/*
- * Notes:
- * - read/write happens in chunks of at most 20 bytes, it's up to userspace
- *   to loop in order to get more data.
- * - on write errors on otherwise correct write request the bytes
- *   that should have been written are in undefined state.
- */
-static const struct file_operations picolcd_debug_eeprom_fops = {
-        .owner    = THIS_MODULE,
-        .open     = simple_open,
-        .read     = picolcd_debug_eeprom_read,
-        .write    = picolcd_debug_eeprom_write,
-        .llseek   = generic_file_llseek,
-};
-
-/*
- * The "flash" file
- */
-/* record a flash address to buf (bounds check to be done by caller) */
-static int _picolcd_flash_setaddr(struct picolcd_data *data, u8 *buf, long off)
-{
-        buf[0] = off & 0xff;
-        buf[1] = (off >> 8) & 0xff;
-        if (data->addr_sz == 3)
-                buf[2] = (off >> 16) & 0xff;
-        return data->addr_sz == 2 ? 2 : 3;
-}
-
-/* read a given size of data (bounds check to be done by caller) */
-static ssize_t _picolcd_flash_read(struct picolcd_data *data, int report_id,
-                char __user *u, size_t s, loff_t *off)
-{
-        struct picolcd_pending *resp;
-        u8 raw_data[4];
-        ssize_t ret = 0;
-        int len_off, err = -EIO;
-
-        while (s > 0) {
-                err = -EIO;
-                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
-                raw_data[len_off] = s > 32 ? 32 : s;
-                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off+1);
-                if (!resp || !resp->in_report)
-                        goto skip;
-                if (resp->in_report->id == REPORT_MEMORY ||
-                        resp->in_report->id == REPORT_BL_READ_MEMORY) {
-                        if (memcmp(raw_data, resp->raw_data, len_off+1) != 0)
-                                goto skip;
-                        if (copy_to_user(u+ret, resp->raw_data+len_off+1, raw_data[len_off])) {
-                                err = -EFAULT;
-                                goto skip;
-                        }
-                        *off += raw_data[len_off];
-                        s    -= raw_data[len_off];
-                        ret  += raw_data[len_off];
-                        err   = 0;
-                }
-skip:
-                kfree(resp);
-                if (err)
-                        return ret > 0 ? ret : err;
-        }
-        return ret;
-}
-
-static ssize_t picolcd_debug_flash_read(struct file *f, char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x05fff)
-                return 0;
-        if (*off + s > 0x05fff)
-                s = 0x06000 - *off;
-
-        if (data->status & PICOLCD_BOOTLOADER)
-                return _picolcd_flash_read(data, REPORT_BL_READ_MEMORY, u, s, off);
-        else
-                return _picolcd_flash_read(data, REPORT_READ_MEMORY, u, s, off);
-}
-
-/* erase block aligned to 64bytes boundary */
-static ssize_t _picolcd_flash_erase64(struct picolcd_data *data, int report_id,
-                loff_t *off)
-{
-        struct picolcd_pending *resp;
-        u8 raw_data[3];
-        int len_off;
-        ssize_t ret = -EIO;
-
-        if (*off & 0x3f)
-                return -EINVAL;
-
-        len_off = _picolcd_flash_setaddr(data, raw_data, *off);
-        resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off);
-        if (!resp || !resp->in_report)
-                goto skip;
-        if (resp->in_report->id == REPORT_MEMORY ||
-                resp->in_report->id == REPORT_BL_ERASE_MEMORY) {
-                if (memcmp(raw_data, resp->raw_data, len_off) != 0)
-                        goto skip;
-                ret = 0;
-        }
-skip:
-        kfree(resp);
-        return ret;
-}
-
-/* write a given size of data (bounds check to be done by caller) */
-static ssize_t _picolcd_flash_write(struct picolcd_data *data, int report_id,
-                const char __user *u, size_t s, loff_t *off)
-{
-        struct picolcd_pending *resp;
-        u8 raw_data[36];
-        ssize_t ret = 0;
-        int len_off, err = -EIO;
-
-        while (s > 0) {
-                err = -EIO;
-                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
-                raw_data[len_off] = s > 32 ? 32 : s;
-                if (copy_from_user(raw_data+len_off+1, u, raw_data[len_off])) {
-                        err = -EFAULT;
-                        break;
-                }
-                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data,
-                                len_off+1+raw_data[len_off]);
-                if (!resp || !resp->in_report)
-                        goto skip;
-                if (resp->in_report->id == REPORT_MEMORY ||
-                        resp->in_report->id == REPORT_BL_WRITE_MEMORY) {
-                        if (memcmp(raw_data, resp->raw_data, len_off+1+raw_data[len_off]) != 0)
-                                goto skip;
-                        *off += raw_data[len_off];
-                        s    -= raw_data[len_off];
-                        ret  += raw_data[len_off];
-                        err   = 0;
-                }
-skip:
-                kfree(resp);
-                if (err)
-                        break;
-        }
-        return ret > 0 ? ret : err;
-}
-
-static ssize_t picolcd_debug_flash_write(struct file *f, const char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-        ssize_t err, ret = 0;
-        int report_erase, report_write;
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x5fff)
-                return -ENOSPC;
-        if (s & 0x3f)
-                return -EINVAL;
-        if (*off & 0x3f)
-                return -EINVAL;
-
-        if (data->status & PICOLCD_BOOTLOADER) {
-                report_erase = REPORT_BL_ERASE_MEMORY;
-                report_write = REPORT_BL_WRITE_MEMORY;
-        } else {
-                report_erase = REPORT_ERASE_MEMORY;
-                report_write = REPORT_WRITE_MEMORY;
-        }
-        mutex_lock(&data->mutex_flash);
-        while (s > 0) {
-                err = _picolcd_flash_erase64(data, report_erase, off);
-                if (err)
-                        break;
-                err = _picolcd_flash_write(data, report_write, u, 64, off);
-                if (err < 0)
-                        break;
-                ret += err;
-                *off += err;
-                s -= err;
-                if (err != 64)
-                        break;
-        }
-        mutex_unlock(&data->mutex_flash);
-        return ret > 0 ? ret : err;
-}
-
-/*
- * Notes:
- * - concurrent writing is prevented by mutex and all writes must be
- *   n*64 bytes and 64-byte aligned, each write being preceded by an
- *   ERASE which erases a 64byte block.
- *   If less than requested was written or an error is returned for an
- *   otherwise correct write request the next 64-byte block which should
- *   have been written is in undefined state (mostly: original, erased,
- *   (half-)written with write error)
- * - reading can happen without special restriction
- */
-static const struct file_operations picolcd_debug_flash_fops = {
-        .owner    = THIS_MODULE,
-        .open     = simple_open,
-        .read     = picolcd_debug_flash_read,
-        .write    = picolcd_debug_flash_write,
-        .llseek   = generic_file_llseek,
-};
-
-
-/*
- * Helper code for HID report level dumping/debugging
- */
-static const char *error_codes[] = {
-        "success", "parameter missing", "data_missing", "block readonly",
-        "block not erasable", "block too big", "section overflow",
-        "invalid command length", "invalid data length",
-};
-
-static void dump_buff_as_hex(char *dst, size_t dst_sz, const u8 *data,
-                const size_t data_len)
-{
-        int i, j;
-        for (i = j = 0; i < data_len && j + 3 < dst_sz; i++) {
-                dst[j++] = hex_asc[(data[i] >> 4) & 0x0f];
-                dst[j++] = hex_asc[data[i] & 0x0f];
-                dst[j++] = ' ';
-        }
-        if (j < dst_sz) {
-                dst[j--] = '\0';
-                dst[j] = '\n';
-        } else
-                dst[j] = '\0';
-}
-
-static void picolcd_debug_out_report(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report)
-{
-        u8 raw_data[70];
-        int raw_size = (report->size >> 3) + 1;
-        char *buff;
-#define BUFF_SZ 256
-
-        /* Avoid unnecessary overhead if debugfs is disabled */
-        if (list_empty(&hdev->debug_list))
-                return;
-
-        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
-        if (!buff)
-                return;
-
-        snprintf(buff, BUFF_SZ, "\nout report %d (size %d) =  ",
-                        report->id, raw_size);
-        hid_debug_event(hdev, buff);
-        if (raw_size + 5 > sizeof(raw_data)) {
-                kfree(buff);
-                hid_debug_event(hdev, " TOO BIG\n");
-                return;
-        } else {
-                raw_data[0] = report->id;
-                hid_output_report(report, raw_data);
-                dump_buff_as_hex(buff, BUFF_SZ, raw_data, raw_size);
-                hid_debug_event(hdev, buff);
-        }
-
-        switch (report->id) {
-        case REPORT_LED_STATE:
-                /* 1 data byte with GPO state */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LED_STATE", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tGPO state: 0x%02x\n", raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_BRIGHTNESS:
-                /* 1 data byte with brightness */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_BRIGHTNESS", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tBrightness: 0x%02x\n", raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_CONTRAST:
-                /* 1 data byte with contrast */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_CONTRAST", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tContrast: 0x%02x\n", raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_RESET:
-                /* 2 data bytes with reset duration in ms */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_RESET", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tDuration: 0x%02x%02x (%dms)\n",
-                                raw_data[2], raw_data[1], raw_data[2] << 8 | raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_LCD_CMD:
-                /* 63 data bytes with LCD commands */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LCD_CMD", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO: format decoding */
-                break;
-        case REPORT_LCD_DATA:
-                /* 63 data bytes with LCD data */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LCD_CMD", report->id, raw_size-1);
-                /* TODO: format decoding */
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_LCD_CMD_DATA:
-                /* 63 data bytes with LCD commands and data */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LCD_CMD", report->id, raw_size-1);
-                /* TODO: format decoding */
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_EE_READ:
-                /* 3 data bytes with read area description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_EE_READ", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_EE_WRITE:
-                /* 3+1..20 data bytes with write area description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_EE_WRITE", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                hid_debug_event(hdev, buff);
-                if (raw_data[3] == 0) {
-                        snprintf(buff, BUFF_SZ, "\tNo data\n");
-                } else if (raw_data[3] + 4 <= raw_size) {
-                        snprintf(buff, BUFF_SZ, "\tData: ");
-                        hid_debug_event(hdev, buff);
-                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                } else {
-                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_ERASE_MEMORY:
-        case REPORT_BL_ERASE_MEMORY:
-                /* 3 data bytes with pointer inside erase block */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_ERASE_MEMORY", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_READ_MEMORY:
-        case REPORT_BL_READ_MEMORY:
-                /* 4 data bytes with read area description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_READ_MEMORY", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_WRITE_MEMORY:
-        case REPORT_BL_WRITE_MEMORY:
-                /* 4+1..32 data bytes with write adrea description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_WRITE_MEMORY", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[3] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[3] + 4 <= raw_size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[4] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[4] + 5 <= raw_size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_SPLASH_RESTART:
-                /* TODO */
-                break;
-        case REPORT_EXIT_KEYBOARD:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_EXIT_KEYBOARD", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
-                                raw_data[1] | (raw_data[2] << 8),
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_VERSION:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_VERSION", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_DEVID:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_DEVID", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_SPLASH_SIZE:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_SPLASH_SIZE", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_HOOK_VERSION:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_HOOK_VERSION", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_EXIT_FLASHER:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_VERSION", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
-                                raw_data[1] | (raw_data[2] << 8),
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        default:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "<unknown>", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        }
-        wake_up_interruptible(&hdev->debug_wait);
-        kfree(buff);
-}
-
-static void picolcd_debug_raw_event(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report,
-                u8 *raw_data, int size)
-{
-        char *buff;
-
-#define BUFF_SZ 256
-        /* Avoid unnecessary overhead if debugfs is disabled */
-        if (!hdev->debug_events)
-                return;
-
-        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
-        if (!buff)
-                return;
-
-        switch (report->id) {
-        case REPORT_ERROR_CODE:
-                /* 2 data bytes with affected report and error code */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_ERROR_CODE", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                if (raw_data[2] < ARRAY_SIZE(error_codes))
-                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x (%s) in reply to report 0x%02x\n",
-                                        raw_data[2], error_codes[raw_data[2]], raw_data[1]);
-                else
-                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x in reply to report 0x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_KEY_STATE:
-                /* 2 data bytes with key state */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_KEY_STATE", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                if (raw_data[1] == 0)
-                        snprintf(buff, BUFF_SZ, "\tNo key pressed\n");
-                else if (raw_data[2] == 0)
-                        snprintf(buff, BUFF_SZ, "\tOne key pressed: 0x%02x (%d)\n",
-                                        raw_data[1], raw_data[1]);
-                else
-                        snprintf(buff, BUFF_SZ, "\tTwo keys pressed: 0x%02x (%d), 0x%02x (%d)\n",
-                                        raw_data[1], raw_data[1], raw_data[2], raw_data[2]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_IR_DATA:
-                /* Up to 20 byes of IR scancode data */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_IR_DATA", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                if (raw_data[1] == 0) {
-                        snprintf(buff, BUFF_SZ, "\tUnexpectedly 0 data length\n");
-                        hid_debug_event(hdev, buff);
-                } else if (raw_data[1] + 1 <= size) {
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n\tIR Data: ",
-                                        raw_data[1]-1);
-                        hid_debug_event(hdev, buff);
-                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+2, raw_data[1]-1);
-                        hid_debug_event(hdev, buff);
-                } else {
-                        snprintf(buff, BUFF_SZ, "\tOverflowing data length: %d\n",
-                                        raw_data[1]-1);
-                        hid_debug_event(hdev, buff);
-                }
-                break;
-        case REPORT_EE_DATA:
-                /* Data buffer in response to REPORT_EE_READ or REPORT_EE_WRITE */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_EE_DATA", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                hid_debug_event(hdev, buff);
-                if (raw_data[3] == 0) {
-                        snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        hid_debug_event(hdev, buff);
-                } else if (raw_data[3] + 4 <= size) {
-                        snprintf(buff, BUFF_SZ, "\tData: ");
-                        hid_debug_event(hdev, buff);
-                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                        hid_debug_event(hdev, buff);
-                } else {
-                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        hid_debug_event(hdev, buff);
-                }
-                break;
-        case REPORT_MEMORY:
-                /* Data buffer in response to REPORT_READ_MEMORY or REPORT_WRTIE_MEMORY */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[3] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[3] + 4 <= size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[4] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[4] + 5 <= size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_VERSION:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_VERSION", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_BL_ERASE_MEMORY:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_BL_ERASE_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO */
-                break;
-        case REPORT_BL_READ_MEMORY:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_BL_READ_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO */
-                break;
-        case REPORT_BL_WRITE_MEMORY:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_BL_WRITE_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO */
-                break;
-        case REPORT_DEVID:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_DEVID", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tSerial: 0x%02x%02x%02x%02x\n",
-                                raw_data[1], raw_data[2], raw_data[3], raw_data[4]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tType: 0x%02x\n",
-                                raw_data[5]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_SPLASH_SIZE:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_SPLASH_SIZE", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tTotal splash space: %d\n",
-                                (raw_data[2] << 8) | raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tUsed splash space: %d\n",
-                                (raw_data[4] << 8) | raw_data[3]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_HOOK_VERSION:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_HOOK_VERSION", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
-                                raw_data[1], raw_data[2]);
-                hid_debug_event(hdev, buff);
-                break;
-        default:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "<unknown>", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        }
-        wake_up_interruptible(&hdev->debug_wait);
-        kfree(buff);
-}
-
-static void picolcd_init_devfs(struct picolcd_data *data,
-                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
-                struct hid_report *flash_r, struct hid_report *flash_w,
-                struct hid_report *reset)
-{
-        struct hid_device *hdev = data->hdev;
-
-        mutex_init(&data->mutex_flash);
-
-        /* reset */
-        if (reset)
-                data->debug_reset = debugfs_create_file("reset", 0600,
-                                hdev->debug_dir, data, &picolcd_debug_reset_fops);
-
-        /* eeprom */
-        if (eeprom_r || eeprom_w)
-                data->debug_eeprom = debugfs_create_file("eeprom",
-                        (eeprom_w ? S_IWUSR : 0) | (eeprom_r ? S_IRUSR : 0),
-                        hdev->debug_dir, data, &picolcd_debug_eeprom_fops);
-
-        /* flash */
-        if (flash_r && flash_r->maxfield == 1 && flash_r->field[0]->report_size == 8)
-                data->addr_sz = flash_r->field[0]->report_count - 1;
-        else
-                data->addr_sz = -1;
-        if (data->addr_sz == 2 || data->addr_sz == 3) {
-                data->debug_flash = debugfs_create_file("flash",
-                        (flash_w ? S_IWUSR : 0) | (flash_r ? S_IRUSR : 0),
-                        hdev->debug_dir, data, &picolcd_debug_flash_fops);
-        } else if (flash_r || flash_w)
-                hid_warn(hdev, "Unexpected FLASH access reports, please submit rdesc for review\n");
-}
-
-static void picolcd_exit_devfs(struct picolcd_data *data)
-{
-        struct dentry *dent;
-
-        dent = data->debug_reset;
-        data->debug_reset = NULL;
-        if (dent)
-                debugfs_remove(dent);
-        dent = data->debug_eeprom;
-        data->debug_eeprom = NULL;
-        if (dent)
-                debugfs_remove(dent);
-        dent = data->debug_flash;
-        data->debug_flash = NULL;
-        if (dent)
-                debugfs_remove(dent);
-        mutex_destroy(&data->mutex_flash);
-}
-#else
-static inline void picolcd_debug_raw_event(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report,
-                u8 *raw_data, int size)
-{
-}
-static inline void picolcd_init_devfs(struct picolcd_data *data,
-                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
-                struct hid_report *flash_r, struct hid_report *flash_w,
-                struct hid_report *reset)
-{
-}
-static inline void picolcd_exit_devfs(struct picolcd_data *data)
-{
-}
-#endif /* CONFIG_DEBUG_FS */
-
-/*
- * Handle raw report as sent by device
- */
-static int picolcd_raw_event(struct hid_device *hdev,
-                struct hid_report *report, u8 *raw_data, int size)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        unsigned long flags;
-        int ret = 0;
-
-        if (!data)
-                return 1;
-
-        if (report->id == REPORT_KEY_STATE) {
-                if (data->input_keys)
-                        ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
-        } else if (report->id == REPORT_IR_DATA) {
-                if (data->input_cir)
-                        ret = picolcd_raw_cir(data, report, raw_data+1, size-1);
-        } else {
-                spin_lock_irqsave(&data->lock, flags);
-                /*
-                 * We let the caller of picolcd_send_and_wait() check if the
-                 * report we got is one of the expected ones or not.
-                 */
-                if (data->pending) {
-                        memcpy(data->pending->raw_data, raw_data+1, size-1);
-                        data->pending->raw_size  = size-1;
-                        data->pending->in_report = report;
-                        complete(&data->pending->ready);
-                }
-                spin_unlock_irqrestore(&data->lock, flags);
-        }
-
-        picolcd_debug_raw_event(data, hdev, report, raw_data, size);
-        return 1;
-}
-
-#ifdef CONFIG_PM
-static int picolcd_suspend(struct hid_device *hdev, pm_message_t message)
-{
-        if (PMSG_IS_AUTO(message))
-                return 0;
-
-        picolcd_suspend_backlight(hid_get_drvdata(hdev));
-        dbg_hid(PICOLCD_NAME " device ready for suspend\n");
-        return 0;
-}
-
-static int picolcd_resume(struct hid_device *hdev)
-{
-        int ret;
-        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
-        return 0;
-}
-
-static int picolcd_reset_resume(struct hid_device *hdev)
-{
-        int ret;
-        ret = picolcd_reset(hdev);
-        if (ret)
-                dbg_hid(PICOLCD_NAME " resetting our device failed: %d\n", ret);
-        ret = picolcd_fb_reset(hid_get_drvdata(hdev), 0);
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring framebuffer content failed: %d\n", ret);
-        ret = picolcd_resume_lcd(hid_get_drvdata(hdev));
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring lcd failed: %d\n", ret);
-        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
-        picolcd_leds_set(hid_get_drvdata(hdev));
-        return 0;
-}
-#endif
-
-/* initialize keypad input device */
-static int picolcd_init_keys(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        struct hid_device *hdev = data->hdev;
-        struct input_dev *idev;
-        int error, i;
-
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 2 ||
-                        report->field[0]->report_size != 8) {
-                hid_err(hdev, "unsupported KEY_STATE report\n");
-                return -EINVAL;
-        }
-
-        idev = input_allocate_device();
-        if (idev == NULL) {
-                hid_err(hdev, "failed to allocate input device\n");
-                return -ENOMEM;
-        }
-        input_set_drvdata(idev, hdev);
-        memcpy(data->keycode, def_keymap, sizeof(def_keymap));
-        idev->name = hdev->name;
-        idev->phys = hdev->phys;
-        idev->uniq = hdev->uniq;
-        idev->id.bustype = hdev->bus;
-        idev->id.vendor  = hdev->vendor;
-        idev->id.product = hdev->product;
-        idev->id.version = hdev->version;
-        idev->dev.parent = hdev->dev.parent;
-        idev->keycode     = &data->keycode;
-        idev->keycodemax  = PICOLCD_KEYS;
-        idev->keycodesize = sizeof(data->keycode[0]);
-        input_set_capability(idev, EV_MSC, MSC_SCAN);
-        set_bit(EV_REP, idev->evbit);
-        for (i = 0; i < PICOLCD_KEYS; i++)
-                input_set_capability(idev, EV_KEY, data->keycode[i]);
-        error = input_register_device(idev);
-        if (error) {
-                hid_err(hdev, "error registering the input device\n");
-                input_free_device(idev);
-                return error;
-        }
-        data->input_keys = idev;
-        return 0;
-}
-
-static void picolcd_exit_keys(struct picolcd_data *data)
-{
-        struct input_dev *idev = data->input_keys;
-
-        data->input_keys = NULL;
-        if (idev)
-                input_unregister_device(idev);
-}
-
-/* initialize CIR input device */
-static inline int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report)
-{
-        /* support not implemented yet */
-        return 0;
-}
-
-static inline void picolcd_exit_cir(struct picolcd_data *data)
-{
-}
-
-static int picolcd_probe_lcd(struct hid_device *hdev, struct picolcd_data *data)
-{
-        int error;
-
-        error = picolcd_check_version(hdev);
-        if (error)
-                return error;
-
-        if (data->version[0] != 0 && data->version[1] != 3)
-                hid_info(hdev, "Device with untested firmware revision, please submit /sys/kernel/debug/hid/%s/rdesc for this device.\n",
-                         dev_name(&hdev->dev));
-
-        /* Setup keypad input device */
-        error = picolcd_init_keys(data, picolcd_in_report(REPORT_KEY_STATE, hdev));
-        if (error)
-                goto err;
-
-        /* Setup CIR input device */
-        error = picolcd_init_cir(data, picolcd_in_report(REPORT_IR_DATA, hdev));
-        if (error)
-                goto err;
-
-        /* Set up the framebuffer device */
-        error = picolcd_init_framebuffer(data);
-        if (error)
-                goto err;
-
-        /* Setup lcd class device */
-        error = picolcd_init_lcd(data, picolcd_out_report(REPORT_CONTRAST, hdev));
-        if (error)
-                goto err;
-
-        /* Setup backlight class device */
-        error = picolcd_init_backlight(data, picolcd_out_report(REPORT_BRIGHTNESS, hdev));
-        if (error)
-                goto err;
-
-        /* Setup the LED class devices */
-        error = picolcd_init_leds(data, picolcd_out_report(REPORT_LED_STATE, hdev));
-        if (error)
-                goto err;
-
-        picolcd_init_devfs(data, picolcd_out_report(REPORT_EE_READ, hdev),
-                        picolcd_out_report(REPORT_EE_WRITE, hdev),
-                        picolcd_out_report(REPORT_READ_MEMORY, hdev),
-                        picolcd_out_report(REPORT_WRITE_MEMORY, hdev),
-                        picolcd_out_report(REPORT_RESET, hdev));
-        return 0;
-err:
-        picolcd_exit_leds(data);
-        picolcd_exit_backlight(data);
-        picolcd_exit_lcd(data);
-        picolcd_exit_framebuffer(data);
-        picolcd_exit_cir(data);
-        picolcd_exit_keys(data);
-        return error;
-}
-
-static int picolcd_probe_bootloader(struct hid_device *hdev, struct picolcd_data *data)
-{
-        int error;
-
-        error = picolcd_check_version(hdev);
-        if (error)
-                return error;
-
-        if (data->version[0] != 1 && data->version[1] != 0)
-                hid_info(hdev, "Device with untested bootloader revision, please submit /sys/kernel/debug/hid/%s/rdesc for this device.\n",
-                         dev_name(&hdev->dev));
-
-        picolcd_init_devfs(data, NULL, NULL,
-                        picolcd_out_report(REPORT_BL_READ_MEMORY, hdev),
-                        picolcd_out_report(REPORT_BL_WRITE_MEMORY, hdev), NULL);
-        return 0;
-}
-
-static int picolcd_probe(struct hid_device *hdev,
-                     const struct hid_device_id *id)
-{
-        struct picolcd_data *data;
-        int error = -ENOMEM;
-
-        dbg_hid(PICOLCD_NAME " hardware probe...\n");
-
-        /*
-         * Let's allocate the picolcd data structure, set some reasonable
-         * defaults, and associate it with the device
-         */
-        data = kzalloc(sizeof(struct picolcd_data), GFP_KERNEL);
-        if (data == NULL) {
-                hid_err(hdev, "can't allocate space for Minibox PicoLCD device data\n");
-                error = -ENOMEM;
-                goto err_no_cleanup;
-        }
-
-        spin_lock_init(&data->lock);
-        mutex_init(&data->mutex);
-        data->hdev = hdev;
-        data->opmode_delay = 5000;
-        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
-                data->status |= PICOLCD_BOOTLOADER;
-        hid_set_drvdata(hdev, data);
-
-        /* Parse the device reports and start it up */
-        error = hid_parse(hdev);
-        if (error) {
-                hid_err(hdev, "device report parse failed\n");
-                goto err_cleanup_data;
-        }
-
-        error = hid_hw_start(hdev, 0);
-        if (error) {
-                hid_err(hdev, "hardware start failed\n");
-                goto err_cleanup_data;
-        }
-
-        error = hid_hw_open(hdev);
-        if (error) {
-                hid_err(hdev, "failed to open input interrupt pipe for key and IR events\n");
-                goto err_cleanup_hid_hw;
-        }
-
-        error = device_create_file(&hdev->dev, &dev_attr_operation_mode_delay);
-        if (error) {
-                hid_err(hdev, "failed to create sysfs attributes\n");
-                goto err_cleanup_hid_ll;
-        }
-
-        error = device_create_file(&hdev->dev, &dev_attr_operation_mode);
-        if (error) {
-                hid_err(hdev, "failed to create sysfs attributes\n");
-                goto err_cleanup_sysfs1;
-        }
-
-        if (data->status & PICOLCD_BOOTLOADER)
-                error = picolcd_probe_bootloader(hdev, data);
-        else
-                error = picolcd_probe_lcd(hdev, data);
-        if (error)
-                goto err_cleanup_sysfs2;
-
-        dbg_hid(PICOLCD_NAME " activated and initialized\n");
-        return 0;
-
-err_cleanup_sysfs2:
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
-err_cleanup_sysfs1:
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
-err_cleanup_hid_ll:
-        hid_hw_close(hdev);
-err_cleanup_hid_hw:
-        hid_hw_stop(hdev);
-err_cleanup_data:
-        kfree(data);
-err_no_cleanup:
-        hid_set_drvdata(hdev, NULL);
-
-        return error;
-}
-
-static void picolcd_remove(struct hid_device *hdev)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        unsigned long flags;
-
-        dbg_hid(PICOLCD_NAME " hardware remove...\n");
-        spin_lock_irqsave(&data->lock, flags);
-        data->status |= PICOLCD_FAILED;
-        spin_unlock_irqrestore(&data->lock, flags);
-#ifdef CONFIG_HID_PICOLCD_FB
-        /* short-circuit FB as early as possible in order to
-         * avoid long delays if we host console.
-         */
-        if (data->fb_info)
-                data->fb_info->par = NULL;
-#endif
-
-        picolcd_exit_devfs(data);
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
-        hid_hw_close(hdev);
-        hid_hw_stop(hdev);
-        hid_set_drvdata(hdev, NULL);
-
-        /* Shortcut potential pending reply that will never arrive */
-        spin_lock_irqsave(&data->lock, flags);
-        if (data->pending)
-                complete(&data->pending->ready);
-        spin_unlock_irqrestore(&data->lock, flags);
-
-        /* Cleanup LED */
-        picolcd_exit_leds(data);
-        /* Clean up the framebuffer */
-        picolcd_exit_backlight(data);
-        picolcd_exit_lcd(data);
-        picolcd_exit_framebuffer(data);
-        /* Cleanup input */
-        picolcd_exit_cir(data);
-        picolcd_exit_keys(data);
-
-        mutex_destroy(&data->mutex);
-        /* Finally, clean up the picolcd data itself */
-        kfree(data);
-}
-
-static const struct hid_device_id picolcd_devices[] = {
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
-        { }
-};
-MODULE_DEVICE_TABLE(hid, picolcd_devices);
-
-static struct hid_driver picolcd_driver = {
-        .name =          "hid-picolcd",
-        .id_table =      picolcd_devices,
-        .probe =         picolcd_probe,
-        .remove =        picolcd_remove,
-        .raw_event =     picolcd_raw_event,
-#ifdef CONFIG_PM
-        .suspend =       picolcd_suspend,
-        .resume =        picolcd_resume,
-        .reset_resume =  picolcd_reset_resume,
-#endif
-};
-
-static int __init picolcd_init(void)
-{
-        return hid_register_driver(&picolcd_driver);
-}
-
-static void __exit picolcd_exit(void)
-{
-        hid_unregister_driver(&picolcd_driver);
-#ifdef CONFIG_HID_PICOLCD_FB
-        flush_work_sync(&picolcd_fb_cleanup);
-        WARN_ON(fb_pending);
-#endif
-}
-
-module_init(picolcd_init);
-module_exit(picolcd_exit);
-MODULE_DESCRIPTION("Minibox graphics PicoLCD Driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/hid/hid-picolcd.h b/drivers/hid/hid-picolcd.h
new file mode 100644
index 000000000000..020cef69f6a1
--- /dev/null
+++ b/drivers/hid/hid-picolcd.h
@@ -0,0 +1,309 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#define PICOLCD_NAME "PicoLCD (graphic)"
+
+/* Report numbers */
+#define REPORT_ERROR_CODE      0x10 /* LCD: IN[16]  */
+#define   ERR_SUCCESS            0x00
+#define   ERR_PARAMETER_MISSING  0x01
+#define   ERR_DATA_MISSING       0x02
+#define   ERR_BLOCK_READ_ONLY    0x03
+#define   ERR_BLOCK_NOT_ERASABLE 0x04
+#define   ERR_BLOCK_TOO_BIG      0x05
+#define   ERR_SECTION_OVERFLOW   0x06
+#define   ERR_INVALID_CMD_LEN    0x07
+#define   ERR_INVALID_DATA_LEN   0x08
+#define REPORT_KEY_STATE       0x11 /* LCD: IN[2]   */
+#define REPORT_IR_DATA         0x21 /* LCD: IN[63]  */
+#define REPORT_EE_DATA         0x32 /* LCD: IN[63]  */
+#define REPORT_MEMORY          0x41 /* LCD: IN[63]  */
+#define REPORT_LED_STATE       0x81 /* LCD: OUT[1]  */
+#define REPORT_BRIGHTNESS      0x91 /* LCD: OUT[1]  */
+#define REPORT_CONTRAST        0x92 /* LCD: OUT[1]  */
+#define REPORT_RESET           0x93 /* LCD: OUT[2]  */
+#define REPORT_LCD_CMD         0x94 /* LCD: OUT[63] */
+#define REPORT_LCD_DATA        0x95 /* LCD: OUT[63] */
+#define REPORT_LCD_CMD_DATA    0x96 /* LCD: OUT[63] */
+#define REPORT_EE_READ         0xa3 /* LCD: OUT[63] */
+#define REPORT_EE_WRITE        0xa4 /* LCD: OUT[63] */
+#define REPORT_ERASE_MEMORY    0xb2 /* LCD: OUT[2]  */
+#define REPORT_READ_MEMORY     0xb3 /* LCD: OUT[3]  */
+#define REPORT_WRITE_MEMORY    0xb4 /* LCD: OUT[63] */
+#define REPORT_SPLASH_RESTART  0xc1 /* LCD: OUT[1]  */
+#define REPORT_EXIT_KEYBOARD   0xef /* LCD: OUT[2]  */
+#define REPORT_VERSION         0xf1 /* LCD: IN[2],OUT[1]    Bootloader: IN[2],OUT[1]   */
+#define REPORT_BL_ERASE_MEMORY 0xf2 /*                      Bootloader: IN[36],OUT[4]  */
+#define REPORT_BL_READ_MEMORY  0xf3 /*                      Bootloader: IN[36],OUT[4]  */
+#define REPORT_BL_WRITE_MEMORY 0xf4 /*                      Bootloader: IN[36],OUT[36] */
+#define REPORT_DEVID           0xf5 /* LCD: IN[5], OUT[1]   Bootloader: IN[5],OUT[1]   */
+#define REPORT_SPLASH_SIZE     0xf6 /* LCD: IN[4], OUT[1]   */
+#define REPORT_HOOK_VERSION    0xf7 /* LCD: IN[2], OUT[1]   */
+#define REPORT_EXIT_FLASHER    0xff /*                      Bootloader: OUT[2]         */
+
+/* Description of in-progress IO operation, used for operations
+ * that trigger response from device */
+struct picolcd_pending {
+        struct hid_report *out_report;
+        struct hid_report *in_report;
+        struct completion ready;
+        int raw_size;
+        u8 raw_data[64];
+};
+
+
+#define PICOLCD_KEYS 17
+
+/* Per device data structure */
+struct picolcd_data {
+        struct hid_device *hdev;
+#ifdef CONFIG_DEBUG_FS
+        struct dentry *debug_reset;
+        struct dentry *debug_eeprom;
+        struct dentry *debug_flash;
+        struct mutex mutex_flash;
+        int addr_sz;
+#endif
+        u8 version[2];
+        unsigned short opmode_delay;
+        /* input stuff */
+        u8 pressed_keys[2];
+        struct input_dev *input_keys;
+#ifdef CONFIG_HID_PICOLCD_CIR
+        struct rc_dev *rc_dev;
+#endif
+        unsigned short keycode[PICOLCD_KEYS];
+
+#ifdef CONFIG_HID_PICOLCD_FB
+        /* Framebuffer stuff */
+        struct fb_info *fb_info;
+#endif /* CONFIG_HID_PICOLCD_FB */
+#ifdef CONFIG_HID_PICOLCD_LCD
+        struct lcd_device *lcd;
+        u8 lcd_contrast;
+#endif /* CONFIG_HID_PICOLCD_LCD */
+#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
+        struct backlight_device *backlight;
+        u8 lcd_brightness;
+        u8 lcd_power;
+#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
+#ifdef CONFIG_HID_PICOLCD_LEDS
+        /* LED stuff */
+        u8 led_state;
+        struct led_classdev *led[8];
+#endif /* CONFIG_HID_PICOLCD_LEDS */
+
+        /* Housekeeping stuff */
+        spinlock_t lock;
+        struct mutex mutex;
+        struct picolcd_pending *pending;
+        int status;
+#define PICOLCD_BOOTLOADER 1
+#define PICOLCD_FAILED 2
+#define PICOLCD_CIR_SHUN 4
+};
+
+#ifdef CONFIG_HID_PICOLCD_FB
+struct picolcd_fb_data {
+        /* Framebuffer stuff */
+        spinlock_t lock;
+        struct picolcd_data *picolcd;
+        u8 update_rate;
+        u8 bpp;
+        u8 force;
+        u8 ready;
+        u8 *vbitmap;            /* local copy of what was sent to PicoLCD */
+        u8 *bitmap;             /* framebuffer */
+};
+#endif /* CONFIG_HID_PICOLCD_FB */
+
+/* Find a given report */
+#define picolcd_in_report(id, dev) picolcd_report(id, dev, HID_INPUT_REPORT)
+#define picolcd_out_report(id, dev) picolcd_report(id, dev, HID_OUTPUT_REPORT)
+
+struct hid_report *picolcd_report(int id, struct hid_device *hdev, int dir);
+
+#ifdef CONFIG_DEBUG_FS
+void picolcd_debug_out_report(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report);
+#define usbhid_submit_report(a, b, c) \
+        do { \
+                picolcd_debug_out_report(hid_get_drvdata(a), a, b); \
+                usbhid_submit_report(a, b, c); \
+        } while (0)
+
+void picolcd_debug_raw_event(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report,
+                u8 *raw_data, int size);
+
+void picolcd_init_devfs(struct picolcd_data *data,
+                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
+                struct hid_report *flash_r, struct hid_report *flash_w,
+                struct hid_report *reset);
+
+void picolcd_exit_devfs(struct picolcd_data *data);
+#else
+static inline void picolcd_debug_out_report(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report)
+{
+}
+static inline void picolcd_debug_raw_event(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report,
+                u8 *raw_data, int size)
+{
+}
+static inline void picolcd_init_devfs(struct picolcd_data *data,
+                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
+                struct hid_report *flash_r, struct hid_report *flash_w,
+                struct hid_report *reset)
+{
+}
+static inline void picolcd_exit_devfs(struct picolcd_data *data)
+{
+}
+#endif /* CONFIG_DEBUG_FS */
+
+
+#ifdef CONFIG_HID_PICOLCD_FB
+int picolcd_fb_reset(struct picolcd_data *data, int clear);
+
+int picolcd_init_framebuffer(struct picolcd_data *data);
+
+void picolcd_exit_framebuffer(struct picolcd_data *data);
+
+void picolcd_fb_refresh(struct picolcd_data *data);
+#define picolcd_fbinfo(d) ((d)->fb_info)
+#else
+static inline int picolcd_fb_reset(struct picolcd_data *data, int clear)
+{
+        return 0;
+}
+static inline int picolcd_init_framebuffer(struct picolcd_data *data)
+{
+        return 0;
+}
+static inline void picolcd_exit_framebuffer(struct picolcd_data *data)
+{
+}
+static inline void picolcd_fb_refresh(struct picolcd_data *data)
+{
+}
+#define picolcd_fbinfo(d) NULL
+#endif /* CONFIG_HID_PICOLCD_FB */
+
+
+#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
+int picolcd_init_backlight(struct picolcd_data *data,
+                struct hid_report *report);
+
+void picolcd_exit_backlight(struct picolcd_data *data);
+
+int picolcd_resume_backlight(struct picolcd_data *data);
+
+void picolcd_suspend_backlight(struct picolcd_data *data);
+#else
+static inline int picolcd_init_backlight(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_backlight(struct picolcd_data *data)
+{
+}
+static inline int picolcd_resume_backlight(struct picolcd_data *data)
+{
+        return 0;
+}
+static inline void picolcd_suspend_backlight(struct picolcd_data *data)
+{
+}
+
+#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
+
+
+#ifdef CONFIG_HID_PICOLCD_LCD
+int picolcd_init_lcd(struct picolcd_data *data,
+                struct hid_report *report);
+
+void picolcd_exit_lcd(struct picolcd_data *data);
+
+int picolcd_resume_lcd(struct picolcd_data *data);
+#else
+static inline int picolcd_init_lcd(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_lcd(struct picolcd_data *data)
+{
+}
+static inline int picolcd_resume_lcd(struct picolcd_data *data)
+{
+        return 0;
+}
+#endif /* CONFIG_HID_PICOLCD_LCD */
+
+
+#ifdef CONFIG_HID_PICOLCD_LEDS
+int picolcd_init_leds(struct picolcd_data *data,
+                struct hid_report *report);
+
+void picolcd_exit_leds(struct picolcd_data *data);
+
+void picolcd_leds_set(struct picolcd_data *data);
+#else
+static inline int picolcd_init_leds(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_leds(struct picolcd_data *data)
+{
+}
+static inline void picolcd_leds_set(struct picolcd_data *data)
+{
+}
+#endif /* CONFIG_HID_PICOLCD_LEDS */
+
+
+#ifdef CONFIG_HID_PICOLCD_CIR
+int picolcd_raw_cir(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size);
+
+int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report);
+
+void picolcd_exit_cir(struct picolcd_data *data);
+#else
+static inline int picolcd_raw_cir(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        return 1;
+}
+static inline int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_cir(struct picolcd_data *data)
+{
+}
+#endif /* CONFIG_HID_PICOLCD_LIRC */
+
+int picolcd_reset(struct hid_device *hdev);
+struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
+                        int report_id, const u8 *raw_data, int size);
diff --git a/drivers/hid/hid-picolcd_backlight.c b/drivers/hid/hid-picolcd_backlight.c
new file mode 100644
index 000000000000..b91f30945f9c
--- /dev/null
+++ b/drivers/hid/hid-picolcd_backlight.c
@@ -0,0 +1,122 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/backlight.h>
+
+#include "hid-picolcd.h"
+
+static int picolcd_get_brightness(struct backlight_device *bdev)
+{
+        struct picolcd_data *data = bl_get_data(bdev);
+        return data->lcd_brightness;
+}
+
+static int picolcd_set_brightness(struct backlight_device *bdev)
+{
+        struct picolcd_data *data = bl_get_data(bdev);
+        struct hid_report *report = picolcd_out_report(REPORT_BRIGHTNESS, data->hdev);
+        unsigned long flags;
+
+        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
+                return -ENODEV;
+
+        data->lcd_brightness = bdev->props.brightness & 0x0ff;
+        data->lcd_power      = bdev->props.power;
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, data->lcd_power == FB_BLANK_UNBLANK ? data->lcd_brightness : 0);
+        if (!(data->status & PICOLCD_FAILED))
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+static int picolcd_check_bl_fb(struct backlight_device *bdev, struct fb_info *fb)
+{
+        return fb && fb == picolcd_fbinfo((struct picolcd_data *)bl_get_data(bdev));
+}
+
+static const struct backlight_ops picolcd_blops = {
+        .update_status  = picolcd_set_brightness,
+        .get_brightness = picolcd_get_brightness,
+        .check_fb       = picolcd_check_bl_fb,
+};
+
+int picolcd_init_backlight(struct picolcd_data *data, struct hid_report *report)
+{
+        struct device *dev = &data->hdev->dev;
+        struct backlight_device *bdev;
+        struct backlight_properties props;
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
+                        report->field[0]->report_size != 8) {
+                dev_err(dev, "unsupported BRIGHTNESS report");
+                return -EINVAL;
+        }
+
+        memset(&props, 0, sizeof(props));
+        props.type = BACKLIGHT_RAW;
+        props.max_brightness = 0xff;
+        bdev = backlight_device_register(dev_name(dev), dev, data,
+                        &picolcd_blops, &props);
+        if (IS_ERR(bdev)) {
+                dev_err(dev, "failed to register backlight\n");
+                return PTR_ERR(bdev);
+        }
+        bdev->props.brightness     = 0xff;
+        data->lcd_brightness       = 0xff;
+        data->backlight            = bdev;
+        picolcd_set_brightness(bdev);
+        return 0;
+}
+
+void picolcd_exit_backlight(struct picolcd_data *data)
+{
+        struct backlight_device *bdev = data->backlight;
+
+        data->backlight = NULL;
+        if (bdev)
+                backlight_device_unregister(bdev);
+}
+
+int picolcd_resume_backlight(struct picolcd_data *data)
+{
+        if (!data->backlight)
+                return 0;
+        return picolcd_set_brightness(data->backlight);
+}
+
+#ifdef CONFIG_PM
+void picolcd_suspend_backlight(struct picolcd_data *data)
+{
+        int bl_power = data->lcd_power;
+        if (!data->backlight)
+                return;
+
+        data->backlight->props.power = FB_BLANK_POWERDOWN;
+        picolcd_set_brightness(data->backlight);
+        data->lcd_power = data->backlight->props.power = bl_power;
+}
+#endif /* CONFIG_PM */
+
diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
new file mode 100644
index 000000000000..13ca9191b630
--- /dev/null
+++ b/drivers/hid/hid-picolcd_cir.c
@@ -0,0 +1,152 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include <linux/input.h>
+#include "hid-ids.h"
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/vmalloc.h>
+#include <linux/backlight.h>
+#include <linux/lcd.h>
+
+#include <linux/leds.h>
+
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+#include <media/rc-core.h>
+
+#include "hid-picolcd.h"
+
+
+int picolcd_raw_cir(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        unsigned long flags;
+        int i, w, sz;
+        DEFINE_IR_RAW_EVENT(rawir);
+
+        /* ignore if rc_dev is NULL or status is shunned */
+        spin_lock_irqsave(&data->lock, flags);
+        if (!data->rc_dev || (data->status & PICOLCD_CIR_SHUN)) {
+                spin_unlock_irqrestore(&data->lock, flags);
+                return 1;
+        }
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        /* PicoLCD USB packets contain 16-bit intervals in network order,
+         * with value negated for pulse. Intervals are in microseconds.
+         *
+         * Note: some userspace LIRC code for PicoLCD says negated values
+         * for space - is it a matter of IR chip? (pulse for my TSOP2236)
+         *
+         * In addition, the first interval seems to be around 15000 + base
+         * interval for non-first report of IR data - thus the quirk below
+         * to get RC_CODE to understand Sony and JVC remotes I have at hand
+         */
+        sz = size > 0 ? min((int)raw_data[0], size-1) : 0;
+        for (i = 0; i+1 < sz; i += 2) {
+                init_ir_raw_event(&rawir);
+                w = (raw_data[i] << 8) | (raw_data[i+1]);
+                rawir.pulse = !!(w & 0x8000);
+                rawir.duration = US_TO_NS(rawir.pulse ? (65536 - w) : w);
+                /* Quirk!! - see above */
+                if (i == 0 && rawir.duration > 15000000)
+                        rawir.duration -= 15000000;
+                ir_raw_event_store(data->rc_dev, &rawir);
+        }
+        ir_raw_event_handle(data->rc_dev);
+
+        return 1;
+}
+
+static int picolcd_cir_open(struct rc_dev *dev)
+{
+        struct picolcd_data *data = dev->priv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&data->lock, flags);
+        data->status &= ~PICOLCD_CIR_SHUN;
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+static void picolcd_cir_close(struct rc_dev *dev)
+{
+        struct picolcd_data *data = dev->priv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&data->lock, flags);
+        data->status |= PICOLCD_CIR_SHUN;
+        spin_unlock_irqrestore(&data->lock, flags);
+}
+
+/* initialize CIR input device */
+int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report)
+{
+        struct rc_dev *rdev;
+        int ret = 0;
+
+        rdev = rc_allocate_device();
+        if (!rdev)
+                return -ENOMEM;
+
+        rdev->priv             = data;
+        rdev->driver_type      = RC_DRIVER_IR_RAW;
+        rdev->allowed_protos   = RC_TYPE_ALL;
+        rdev->open             = picolcd_cir_open;
+        rdev->close            = picolcd_cir_close;
+        rdev->input_name       = data->hdev->name;
+        rdev->input_phys       = data->hdev->phys;
+        rdev->input_id.bustype = data->hdev->bus;
+        rdev->input_id.vendor  = data->hdev->vendor;
+        rdev->input_id.product = data->hdev->product;
+        rdev->input_id.version = data->hdev->version;
+        rdev->dev.parent       = &data->hdev->dev;
+        rdev->driver_name      = PICOLCD_NAME;
+        rdev->map_name         = RC_MAP_RC6_MCE;
+        rdev->timeout          = MS_TO_NS(100);
+        rdev->rx_resolution    = US_TO_NS(1);
+
+        ret = rc_register_device(rdev);
+        if (ret)
+                goto err;
+        data->rc_dev = rdev;
+        return 0;
+
+err:
+        rc_free_device(rdev);
+        return ret;
+}
+
+void picolcd_exit_cir(struct picolcd_data *data)
+{
+        struct rc_dev *rdev = data->rc_dev;
+
+        data->rc_dev = NULL;
+        rc_unregister_device(rdev);
+}
+
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
new file mode 100644
index 000000000000..86df26e58aba
--- /dev/null
+++ b/drivers/hid/hid-picolcd_core.c
@@ -0,0 +1,689 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include <linux/input.h>
+#include "hid-ids.h"
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/vmalloc.h>
+
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+
+#include "hid-picolcd.h"
+
+
+/* Input device
+ *
+ * The PicoLCD has an IR receiver header, a built-in keypad with 5 keys
+ * and header for 4x4 key matrix. The built-in keys are part of the matrix.
+ */
+static const unsigned short def_keymap[PICOLCD_KEYS] = {
+        KEY_RESERVED,   /* none */
+        KEY_BACK,       /* col 4 + row 1 */
+        KEY_HOMEPAGE,   /* col 3 + row 1 */
+        KEY_RESERVED,   /* col 2 + row 1 */
+        KEY_RESERVED,   /* col 1 + row 1 */
+        KEY_SCROLLUP,   /* col 4 + row 2 */
+        KEY_OK,         /* col 3 + row 2 */
+        KEY_SCROLLDOWN, /* col 2 + row 2 */
+        KEY_RESERVED,   /* col 1 + row 2 */
+        KEY_RESERVED,   /* col 4 + row 3 */
+        KEY_RESERVED,   /* col 3 + row 3 */
+        KEY_RESERVED,   /* col 2 + row 3 */
+        KEY_RESERVED,   /* col 1 + row 3 */
+        KEY_RESERVED,   /* col 4 + row 4 */
+        KEY_RESERVED,   /* col 3 + row 4 */
+        KEY_RESERVED,   /* col 2 + row 4 */
+        KEY_RESERVED,   /* col 1 + row 4 */
+};
+
+
+/* Find a given report */
+struct hid_report *picolcd_report(int id, struct hid_device *hdev, int dir)
+{
+        struct list_head *feature_report_list = &hdev->report_enum[dir].report_list;
+        struct hid_report *report = NULL;
+
+        list_for_each_entry(report, feature_report_list, list) {
+                if (report->id == id)
+                        return report;
+        }
+        hid_warn(hdev, "No report with id 0x%x found\n", id);
+        return NULL;
+}
+
+/* Submit a report and wait for a reply from device - if device fades away
+ * or does not respond in time, return NULL */
+struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
+                int report_id, const u8 *raw_data, int size)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        struct picolcd_pending *work;
+        struct hid_report *report = picolcd_out_report(report_id, hdev);
+        unsigned long flags;
+        int i, j, k;
+
+        if (!report || !data)
+                return NULL;
+        if (data->status & PICOLCD_FAILED)
+                return NULL;
+        work = kzalloc(sizeof(*work), GFP_KERNEL);
+        if (!work)
+                return NULL;
+
+        init_completion(&work->ready);
+        work->out_report = report;
+        work->in_report  = NULL;
+        work->raw_size   = 0;
+
+        mutex_lock(&data->mutex);
+        spin_lock_irqsave(&data->lock, flags);
+        for (i = k = 0; i < report->maxfield; i++)
+                for (j = 0; j < report->field[i]->report_count; j++) {
+                        hid_set_field(report->field[i], j, k < size ? raw_data[k] : 0);
+                        k++;
+                }
+        if (data->status & PICOLCD_FAILED) {
+                kfree(work);
+                work = NULL;
+        } else {
+                data->pending = work;
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+                spin_unlock_irqrestore(&data->lock, flags);
+                wait_for_completion_interruptible_timeout(&work->ready, HZ*2);
+                spin_lock_irqsave(&data->lock, flags);
+                data->pending = NULL;
+        }
+        spin_unlock_irqrestore(&data->lock, flags);
+        mutex_unlock(&data->mutex);
+        return work;
+}
+
+/*
+ * input class device
+ */
+static int picolcd_raw_keypad(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        /*
+         * Keypad event
+         * First and second data bytes list currently pressed keys,
+         * 0x00 means no key and at most 2 keys may be pressed at same time
+         */
+        int i, j;
+
+        /* determine newly pressed keys */
+        for (i = 0; i < size; i++) {
+                unsigned int key_code;
+                if (raw_data[i] == 0)
+                        continue;
+                for (j = 0; j < sizeof(data->pressed_keys); j++)
+                        if (data->pressed_keys[j] == raw_data[i])
+                                goto key_already_down;
+                for (j = 0; j < sizeof(data->pressed_keys); j++)
+                        if (data->pressed_keys[j] == 0) {
+                                data->pressed_keys[j] = raw_data[i];
+                                break;
+                        }
+                input_event(data->input_keys, EV_MSC, MSC_SCAN, raw_data[i]);
+                if (raw_data[i] < PICOLCD_KEYS)
+                        key_code = data->keycode[raw_data[i]];
+                else
+                        key_code = KEY_UNKNOWN;
+                if (key_code != KEY_UNKNOWN) {
+                        dbg_hid(PICOLCD_NAME " got key press for %u:%d",
+                                        raw_data[i], key_code);
+                        input_report_key(data->input_keys, key_code, 1);
+                }
+                input_sync(data->input_keys);
+key_already_down:
+                continue;
+        }
+
+        /* determine newly released keys */
+        for (j = 0; j < sizeof(data->pressed_keys); j++) {
+                unsigned int key_code;
+                if (data->pressed_keys[j] == 0)
+                        continue;
+                for (i = 0; i < size; i++)
+                        if (data->pressed_keys[j] == raw_data[i])
+                                goto key_still_down;
+                input_event(data->input_keys, EV_MSC, MSC_SCAN, data->pressed_keys[j]);
+                if (data->pressed_keys[j] < PICOLCD_KEYS)
+                        key_code = data->keycode[data->pressed_keys[j]];
+                else
+                        key_code = KEY_UNKNOWN;
+                if (key_code != KEY_UNKNOWN) {
+                        dbg_hid(PICOLCD_NAME " got key release for %u:%d",
+                                        data->pressed_keys[j], key_code);
+                        input_report_key(data->input_keys, key_code, 0);
+                }
+                input_sync(data->input_keys);
+                data->pressed_keys[j] = 0;
+key_still_down:
+                continue;
+        }
+        return 1;
+}
+
+static int picolcd_check_version(struct hid_device *hdev)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        struct picolcd_pending *verinfo;
+        int ret = 0;
+
+        if (!data)
+                return -ENODEV;
+
+        verinfo = picolcd_send_and_wait(hdev, REPORT_VERSION, NULL, 0);
+        if (!verinfo) {
+                hid_err(hdev, "no version response from PicoLCD\n");
+                return -ENODEV;
+        }
+
+        if (verinfo->raw_size == 2) {
+                data->version[0] = verinfo->raw_data[1];
+                data->version[1] = verinfo->raw_data[0];
+                if (data->status & PICOLCD_BOOTLOADER) {
+                        hid_info(hdev, "PicoLCD, bootloader version %d.%d\n",
+                                 verinfo->raw_data[1], verinfo->raw_data[0]);
+                } else {
+                        hid_info(hdev, "PicoLCD, firmware version %d.%d\n",
+                                 verinfo->raw_data[1], verinfo->raw_data[0]);
+                }
+        } else {
+                hid_err(hdev, "confused, got unexpected version response from PicoLCD\n");
+                ret = -EINVAL;
+        }
+        kfree(verinfo);
+        return ret;
+}
+
+/*
+ * Reset our device and wait for answer to VERSION request
+ */
+int picolcd_reset(struct hid_device *hdev)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        struct hid_report *report = picolcd_out_report(REPORT_RESET, hdev);
+        unsigned long flags;
+        int error;
+
+        if (!data || !report || report->maxfield != 1)
+                return -ENODEV;
+
+        spin_lock_irqsave(&data->lock, flags);
+        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
+                data->status |= PICOLCD_BOOTLOADER;
+
+        /* perform the reset */
+        hid_set_field(report->field[0], 0, 1);
+        if (data->status & PICOLCD_FAILED) {
+                spin_unlock_irqrestore(&data->lock, flags);
+                return -ENODEV;
+        }
+        usbhid_submit_report(hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        error = picolcd_check_version(hdev);
+        if (error)
+                return error;
+
+        picolcd_resume_lcd(data);
+        picolcd_resume_backlight(data);
+        picolcd_fb_refresh(data);
+        picolcd_leds_set(data);
+        return 0;
+}
+
+/*
+ * The "operation_mode" sysfs attribute
+ */
+static ssize_t picolcd_operation_mode_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+
+        if (data->status & PICOLCD_BOOTLOADER)
+                return snprintf(buf, PAGE_SIZE, "[bootloader] lcd\n");
+        else
+                return snprintf(buf, PAGE_SIZE, "bootloader [lcd]\n");
+}
+
+static ssize_t picolcd_operation_mode_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        struct hid_report *report = NULL;
+        size_t cnt = count;
+        int timeout = data->opmode_delay;
+        unsigned long flags;
+
+        if (cnt >= 3 && strncmp("lcd", buf, 3) == 0) {
+                if (data->status & PICOLCD_BOOTLOADER)
+                        report = picolcd_out_report(REPORT_EXIT_FLASHER, data->hdev);
+                buf += 3;
+                cnt -= 3;
+        } else if (cnt >= 10 && strncmp("bootloader", buf, 10) == 0) {
+                if (!(data->status & PICOLCD_BOOTLOADER))
+                        report = picolcd_out_report(REPORT_EXIT_KEYBOARD, data->hdev);
+                buf += 10;
+                cnt -= 10;
+        }
+        if (!report)
+                return -EINVAL;
+
+        while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
+                cnt--;
+        if (cnt != 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, timeout & 0xff);
+        hid_set_field(report->field[0], 1, (timeout >> 8) & 0xff);
+        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return count;
+}
+
+static DEVICE_ATTR(operation_mode, 0644, picolcd_operation_mode_show,
+                picolcd_operation_mode_store);
+
+/*
+ * The "operation_mode_delay" sysfs attribute
+ */
+static ssize_t picolcd_operation_mode_delay_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+
+        return snprintf(buf, PAGE_SIZE, "%hu\n", data->opmode_delay);
+}
+
+static ssize_t picolcd_operation_mode_delay_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        unsigned u;
+        if (sscanf(buf, "%u", &u) != 1)
+                return -EINVAL;
+        if (u > 30000)
+                return -EINVAL;
+        else
+                data->opmode_delay = u;
+        return count;
+}
+
+static DEVICE_ATTR(operation_mode_delay, 0644, picolcd_operation_mode_delay_show,
+                picolcd_operation_mode_delay_store);
+
+/*
+ * Handle raw report as sent by device
+ */
+static int picolcd_raw_event(struct hid_device *hdev,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        unsigned long flags;
+        int ret = 0;
+
+        if (!data)
+                return 1;
+
+        if (report->id == REPORT_KEY_STATE) {
+                if (data->input_keys)
+                        ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
+        } else if (report->id == REPORT_IR_DATA) {
+                ret = picolcd_raw_cir(data, report, raw_data+1, size-1);
+        } else {
+                spin_lock_irqsave(&data->lock, flags);
+                /*
+                 * We let the caller of picolcd_send_and_wait() check if the
+                 * report we got is one of the expected ones or not.
+                 */
+                if (data->pending) {
+                        memcpy(data->pending->raw_data, raw_data+1, size-1);
+                        data->pending->raw_size  = size-1;
+                        data->pending->in_report = report;
+                        complete(&data->pending->ready);
+                }
+                spin_unlock_irqrestore(&data->lock, flags);
+        }
+
+        picolcd_debug_raw_event(data, hdev, report, raw_data, size);
+        return 1;
+}
+
+#ifdef CONFIG_PM
+static int picolcd_suspend(struct hid_device *hdev, pm_message_t message)
+{
+        if (PMSG_IS_AUTO(message))
+                return 0;
+
+        picolcd_suspend_backlight(hid_get_drvdata(hdev));
+        dbg_hid(PICOLCD_NAME " device ready for suspend\n");
+        return 0;
+}
+
+static int picolcd_resume(struct hid_device *hdev)
+{
+        int ret;
+        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
+        return 0;
+}
+
+static int picolcd_reset_resume(struct hid_device *hdev)
+{
+        int ret;
+        ret = picolcd_reset(hdev);
+        if (ret)
+                dbg_hid(PICOLCD_NAME " resetting our device failed: %d\n", ret);
+        ret = picolcd_fb_reset(hid_get_drvdata(hdev), 0);
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring framebuffer content failed: %d\n", ret);
+        ret = picolcd_resume_lcd(hid_get_drvdata(hdev));
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring lcd failed: %d\n", ret);
+        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
+        picolcd_leds_set(hid_get_drvdata(hdev));
+        return 0;
+}
+#endif
+
+/* initialize keypad input device */
+static int picolcd_init_keys(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        struct hid_device *hdev = data->hdev;
+        struct input_dev *idev;
+        int error, i;
+
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 2 ||
+                        report->field[0]->report_size != 8) {
+                hid_err(hdev, "unsupported KEY_STATE report\n");
+                return -EINVAL;
+        }
+
+        idev = input_allocate_device();
+        if (idev == NULL) {
+                hid_err(hdev, "failed to allocate input device\n");
+                return -ENOMEM;
+        }
+        input_set_drvdata(idev, hdev);
+        memcpy(data->keycode, def_keymap, sizeof(def_keymap));
+        idev->name = hdev->name;
+        idev->phys = hdev->phys;
+        idev->uniq = hdev->uniq;
+        idev->id.bustype = hdev->bus;
+        idev->id.vendor  = hdev->vendor;
+        idev->id.product = hdev->product;
+        idev->id.version = hdev->version;
+        idev->dev.parent = &hdev->dev;
+        idev->keycode     = &data->keycode;
+        idev->keycodemax  = PICOLCD_KEYS;
+        idev->keycodesize = sizeof(data->keycode[0]);
+        input_set_capability(idev, EV_MSC, MSC_SCAN);
+        set_bit(EV_REP, idev->evbit);
+        for (i = 0; i < PICOLCD_KEYS; i++)
+                input_set_capability(idev, EV_KEY, data->keycode[i]);
+        error = input_register_device(idev);
+        if (error) {
+                hid_err(hdev, "error registering the input device\n");
+                input_free_device(idev);
+                return error;
+        }
+        data->input_keys = idev;
+        return 0;
+}
+
+static void picolcd_exit_keys(struct picolcd_data *data)
+{
+        struct input_dev *idev = data->input_keys;
+
+        data->input_keys = NULL;
+        if (idev)
+                input_unregister_device(idev);
+}
+
+static int picolcd_probe_lcd(struct hid_device *hdev, struct picolcd_data *data)
+{
+        int error;
+
+        /* Setup keypad input device */
+        error = picolcd_init_keys(data, picolcd_in_report(REPORT_KEY_STATE, hdev));
+        if (error)
+                goto err;
+
+        /* Setup CIR input device */
+        error = picolcd_init_cir(data, picolcd_in_report(REPORT_IR_DATA, hdev));
+        if (error)
+                goto err;
+
+        /* Set up the framebuffer device */
+        error = picolcd_init_framebuffer(data);
+        if (error)
+                goto err;
+
+        /* Setup lcd class device */
+        error = picolcd_init_lcd(data, picolcd_out_report(REPORT_CONTRAST, hdev));
+        if (error)
+                goto err;
+
+        /* Setup backlight class device */
+        error = picolcd_init_backlight(data, picolcd_out_report(REPORT_BRIGHTNESS, hdev));
+        if (error)
+                goto err;
+
+        /* Setup the LED class devices */
+        error = picolcd_init_leds(data, picolcd_out_report(REPORT_LED_STATE, hdev));
+        if (error)
+                goto err;
+
+        picolcd_init_devfs(data, picolcd_out_report(REPORT_EE_READ, hdev),
+                        picolcd_out_report(REPORT_EE_WRITE, hdev),
+                        picolcd_out_report(REPORT_READ_MEMORY, hdev),
+                        picolcd_out_report(REPORT_WRITE_MEMORY, hdev),
+                        picolcd_out_report(REPORT_RESET, hdev));
+        return 0;
+err:
+        picolcd_exit_leds(data);
+        picolcd_exit_backlight(data);
+        picolcd_exit_lcd(data);
+        picolcd_exit_framebuffer(data);
+        picolcd_exit_cir(data);
+        picolcd_exit_keys(data);
+        return error;
+}
+
+static int picolcd_probe_bootloader(struct hid_device *hdev, struct picolcd_data *data)
+{
+        picolcd_init_devfs(data, NULL, NULL,
+                        picolcd_out_report(REPORT_BL_READ_MEMORY, hdev),
+                        picolcd_out_report(REPORT_BL_WRITE_MEMORY, hdev), NULL);
+        return 0;
+}
+
+static int picolcd_probe(struct hid_device *hdev,
+                     const struct hid_device_id *id)
+{
+        struct picolcd_data *data;
+        int error = -ENOMEM;
+
+        dbg_hid(PICOLCD_NAME " hardware probe...\n");
+
+        /*
+         * Let's allocate the picolcd data structure, set some reasonable
+         * defaults, and associate it with the device
+         */
+        data = kzalloc(sizeof(struct picolcd_data), GFP_KERNEL);
+        if (data == NULL) {
+                hid_err(hdev, "can't allocate space for Minibox PicoLCD device data\n");
+                error = -ENOMEM;
+                goto err_no_cleanup;
+        }
+
+        spin_lock_init(&data->lock);
+        mutex_init(&data->mutex);
+        data->hdev = hdev;
+        data->opmode_delay = 5000;
+        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
+                data->status |= PICOLCD_BOOTLOADER;
+        hid_set_drvdata(hdev, data);
+
+        /* Parse the device reports and start it up */
+        error = hid_parse(hdev);
+        if (error) {
+                hid_err(hdev, "device report parse failed\n");
+                goto err_cleanup_data;
+        }
+
+        error = hid_hw_start(hdev, 0);
+        if (error) {
+                hid_err(hdev, "hardware start failed\n");
+                goto err_cleanup_data;
+        }
+
+        error = hid_hw_open(hdev);
+        if (error) {
+                hid_err(hdev, "failed to open input interrupt pipe for key and IR events\n");
+                goto err_cleanup_hid_hw;
+        }
+
+        error = device_create_file(&hdev->dev, &dev_attr_operation_mode_delay);
+        if (error) {
+                hid_err(hdev, "failed to create sysfs attributes\n");
+                goto err_cleanup_hid_ll;
+        }
+
+        error = device_create_file(&hdev->dev, &dev_attr_operation_mode);
+        if (error) {
+                hid_err(hdev, "failed to create sysfs attributes\n");
+                goto err_cleanup_sysfs1;
+        }
+
+        if (data->status & PICOLCD_BOOTLOADER)
+                error = picolcd_probe_bootloader(hdev, data);
+        else
+                error = picolcd_probe_lcd(hdev, data);
+        if (error)
+                goto err_cleanup_sysfs2;
+
+        dbg_hid(PICOLCD_NAME " activated and initialized\n");
+        return 0;
+
+err_cleanup_sysfs2:
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
+err_cleanup_sysfs1:
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
+err_cleanup_hid_ll:
+        hid_hw_close(hdev);
+err_cleanup_hid_hw:
+        hid_hw_stop(hdev);
+err_cleanup_data:
+        kfree(data);
+err_no_cleanup:
+        hid_set_drvdata(hdev, NULL);
+
+        return error;
+}
+
+static void picolcd_remove(struct hid_device *hdev)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        unsigned long flags;
+
+        dbg_hid(PICOLCD_NAME " hardware remove...\n");
+        spin_lock_irqsave(&data->lock, flags);
+        data->status |= PICOLCD_FAILED;
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        picolcd_exit_devfs(data);
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
+        hid_hw_close(hdev);
+        hid_hw_stop(hdev);
+
+        /* Shortcut potential pending reply that will never arrive */
+        spin_lock_irqsave(&data->lock, flags);
+        if (data->pending)
+                complete(&data->pending->ready);
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        /* Cleanup LED */
+        picolcd_exit_leds(data);
+        /* Clean up the framebuffer */
+        picolcd_exit_backlight(data);
+        picolcd_exit_lcd(data);
+        picolcd_exit_framebuffer(data);
+        /* Cleanup input */
+        picolcd_exit_cir(data);
+        picolcd_exit_keys(data);
+
+        hid_set_drvdata(hdev, NULL);
+        mutex_destroy(&data->mutex);
+        /* Finally, clean up the picolcd data itself */
+        kfree(data);
+}
+
+static const struct hid_device_id picolcd_devices[] = {
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, picolcd_devices);
+
+static struct hid_driver picolcd_driver = {
+        .name =          "hid-picolcd",
+        .id_table =      picolcd_devices,
+        .probe =         picolcd_probe,
+        .remove =        picolcd_remove,
+        .raw_event =     picolcd_raw_event,
+#ifdef CONFIG_PM
+        .suspend =       picolcd_suspend,
+        .resume =        picolcd_resume,
+        .reset_resume =  picolcd_reset_resume,
+#endif
+};
+
+static int __init picolcd_init(void)
+{
+        return hid_register_driver(&picolcd_driver);
+}
+
+static void __exit picolcd_exit(void)
+{
+        hid_unregister_driver(&picolcd_driver);
+}
+
+module_init(picolcd_init);
+module_exit(picolcd_exit);
+MODULE_DESCRIPTION("Minibox graphics PicoLCD Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/hid/hid-picolcd_debugfs.c b/drivers/hid/hid-picolcd_debugfs.c
new file mode 100644
index 000000000000..4809aa1bdb9c
--- /dev/null
+++ b/drivers/hid/hid-picolcd_debugfs.c
@@ -0,0 +1,899 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+
+#include <linux/module.h>
+#include <linux/uaccess.h>
+
+#include "hid-picolcd.h"
+
+
+static int picolcd_debug_reset_show(struct seq_file *f, void *p)
+{
+        if (picolcd_fbinfo((struct picolcd_data *)f->private))
+                seq_printf(f, "all fb\n");
+        else
+                seq_printf(f, "all\n");
+        return 0;
+}
+
+static int picolcd_debug_reset_open(struct inode *inode, struct file *f)
+{
+        return single_open(f, picolcd_debug_reset_show, inode->i_private);
+}
+
+static ssize_t picolcd_debug_reset_write(struct file *f, const char __user *user_buf,
+                size_t count, loff_t *ppos)
+{
+        struct picolcd_data *data = ((struct seq_file *)f->private_data)->private;
+        char buf[32];
+        size_t cnt = min(count, sizeof(buf)-1);
+        if (copy_from_user(buf, user_buf, cnt))
+                return -EFAULT;
+
+        while (cnt > 0 && (buf[cnt-1] == ' ' || buf[cnt-1] == '\n'))
+                cnt--;
+        buf[cnt] = '\0';
+        if (strcmp(buf, "all") == 0) {
+                picolcd_reset(data->hdev);
+                picolcd_fb_reset(data, 1);
+        } else if (strcmp(buf, "fb") == 0) {
+                picolcd_fb_reset(data, 1);
+        } else {
+                return -EINVAL;
+        }
+        return count;
+}
+
+static const struct file_operations picolcd_debug_reset_fops = {
+        .owner    = THIS_MODULE,
+        .open     = picolcd_debug_reset_open,
+        .read     = seq_read,
+        .llseek   = seq_lseek,
+        .write    = picolcd_debug_reset_write,
+        .release  = single_release,
+};
+
+/*
+ * The "eeprom" file
+ */
+static ssize_t picolcd_debug_eeprom_read(struct file *f, char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+        struct picolcd_pending *resp;
+        u8 raw_data[3];
+        ssize_t ret = -EIO;
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x0ff)
+                return 0;
+
+        /* prepare buffer with info about what we want to read (addr & len) */
+        raw_data[0] = *off & 0xff;
+        raw_data[1] = (*off >> 8) & 0xff;
+        raw_data[2] = s < 20 ? s : 20;
+        if (*off + raw_data[2] > 0xff)
+                raw_data[2] = 0x100 - *off;
+        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_READ, raw_data,
+                        sizeof(raw_data));
+        if (!resp)
+                return -EIO;
+
+        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
+                /* successful read :) */
+                ret = resp->raw_data[2];
+                if (ret > s)
+                        ret = s;
+                if (copy_to_user(u, resp->raw_data+3, ret))
+                        ret = -EFAULT;
+                else
+                        *off += ret;
+        } /* anything else is some kind of IO error */
+
+        kfree(resp);
+        return ret;
+}
+
+static ssize_t picolcd_debug_eeprom_write(struct file *f, const char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+        struct picolcd_pending *resp;
+        ssize_t ret = -EIO;
+        u8 raw_data[23];
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x0ff)
+                return -ENOSPC;
+
+        memset(raw_data, 0, sizeof(raw_data));
+        raw_data[0] = *off & 0xff;
+        raw_data[1] = (*off >> 8) & 0xff;
+        raw_data[2] = min_t(size_t, 20, s);
+        if (*off + raw_data[2] > 0xff)
+                raw_data[2] = 0x100 - *off;
+
+        if (copy_from_user(raw_data+3, u, min((u8)20, raw_data[2])))
+                return -EFAULT;
+        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_WRITE, raw_data,
+                        sizeof(raw_data));
+
+        if (!resp)
+                return -EIO;
+
+        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
+                /* check if written data matches */
+                if (memcmp(raw_data, resp->raw_data, 3+raw_data[2]) == 0) {
+                        *off += raw_data[2];
+                        ret = raw_data[2];
+                }
+        }
+        kfree(resp);
+        return ret;
+}
+
+/*
+ * Notes:
+ * - read/write happens in chunks of at most 20 bytes, it's up to userspace
+ *   to loop in order to get more data.
+ * - on write errors on otherwise correct write request the bytes
+ *   that should have been written are in undefined state.
+ */
+static const struct file_operations picolcd_debug_eeprom_fops = {
+        .owner    = THIS_MODULE,
+        .open     = simple_open,
+        .read     = picolcd_debug_eeprom_read,
+        .write    = picolcd_debug_eeprom_write,
+        .llseek   = generic_file_llseek,
+};
+
+/*
+ * The "flash" file
+ */
+/* record a flash address to buf (bounds check to be done by caller) */
+static int _picolcd_flash_setaddr(struct picolcd_data *data, u8 *buf, long off)
+{
+        buf[0] = off & 0xff;
+        buf[1] = (off >> 8) & 0xff;
+        if (data->addr_sz == 3)
+                buf[2] = (off >> 16) & 0xff;
+        return data->addr_sz == 2 ? 2 : 3;
+}
+
+/* read a given size of data (bounds check to be done by caller) */
+static ssize_t _picolcd_flash_read(struct picolcd_data *data, int report_id,
+                char __user *u, size_t s, loff_t *off)
+{
+        struct picolcd_pending *resp;
+        u8 raw_data[4];
+        ssize_t ret = 0;
+        int len_off, err = -EIO;
+
+        while (s > 0) {
+                err = -EIO;
+                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
+                raw_data[len_off] = s > 32 ? 32 : s;
+                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off+1);
+                if (!resp || !resp->in_report)
+                        goto skip;
+                if (resp->in_report->id == REPORT_MEMORY ||
+                        resp->in_report->id == REPORT_BL_READ_MEMORY) {
+                        if (memcmp(raw_data, resp->raw_data, len_off+1) != 0)
+                                goto skip;
+                        if (copy_to_user(u+ret, resp->raw_data+len_off+1, raw_data[len_off])) {
+                                err = -EFAULT;
+                                goto skip;
+                        }
+                        *off += raw_data[len_off];
+                        s    -= raw_data[len_off];
+                        ret  += raw_data[len_off];
+                        err   = 0;
+                }
+skip:
+                kfree(resp);
+                if (err)
+                        return ret > 0 ? ret : err;
+        }
+        return ret;
+}
+
+static ssize_t picolcd_debug_flash_read(struct file *f, char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x05fff)
+                return 0;
+        if (*off + s > 0x05fff)
+                s = 0x06000 - *off;
+
+        if (data->status & PICOLCD_BOOTLOADER)
+                return _picolcd_flash_read(data, REPORT_BL_READ_MEMORY, u, s, off);
+        else
+                return _picolcd_flash_read(data, REPORT_READ_MEMORY, u, s, off);
+}
+
+/* erase block aligned to 64bytes boundary */
+static ssize_t _picolcd_flash_erase64(struct picolcd_data *data, int report_id,
+                loff_t *off)
+{
+        struct picolcd_pending *resp;
+        u8 raw_data[3];
+        int len_off;
+        ssize_t ret = -EIO;
+
+        if (*off & 0x3f)
+                return -EINVAL;
+
+        len_off = _picolcd_flash_setaddr(data, raw_data, *off);
+        resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off);
+        if (!resp || !resp->in_report)
+                goto skip;
+        if (resp->in_report->id == REPORT_MEMORY ||
+                resp->in_report->id == REPORT_BL_ERASE_MEMORY) {
+                if (memcmp(raw_data, resp->raw_data, len_off) != 0)
+                        goto skip;
+                ret = 0;
+        }
+skip:
+        kfree(resp);
+        return ret;
+}
+
+/* write a given size of data (bounds check to be done by caller) */
+static ssize_t _picolcd_flash_write(struct picolcd_data *data, int report_id,
+                const char __user *u, size_t s, loff_t *off)
+{
+        struct picolcd_pending *resp;
+        u8 raw_data[36];
+        ssize_t ret = 0;
+        int len_off, err = -EIO;
+
+        while (s > 0) {
+                err = -EIO;
+                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
+                raw_data[len_off] = s > 32 ? 32 : s;
+                if (copy_from_user(raw_data+len_off+1, u, raw_data[len_off])) {
+                        err = -EFAULT;
+                        break;
+                }
+                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data,
+                                len_off+1+raw_data[len_off]);
+                if (!resp || !resp->in_report)
+                        goto skip;
+                if (resp->in_report->id == REPORT_MEMORY ||
+                        resp->in_report->id == REPORT_BL_WRITE_MEMORY) {
+                        if (memcmp(raw_data, resp->raw_data, len_off+1+raw_data[len_off]) != 0)
+                                goto skip;
+                        *off += raw_data[len_off];
+                        s    -= raw_data[len_off];
+                        ret  += raw_data[len_off];
+                        err   = 0;
+                }
+skip:
+                kfree(resp);
+                if (err)
+                        break;
+        }
+        return ret > 0 ? ret : err;
+}
+
+static ssize_t picolcd_debug_flash_write(struct file *f, const char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+        ssize_t err, ret = 0;
+        int report_erase, report_write;
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x5fff)
+                return -ENOSPC;
+        if (s & 0x3f)
+                return -EINVAL;
+        if (*off & 0x3f)
+                return -EINVAL;
+
+        if (data->status & PICOLCD_BOOTLOADER) {
+                report_erase = REPORT_BL_ERASE_MEMORY;
+                report_write = REPORT_BL_WRITE_MEMORY;
+        } else {
+                report_erase = REPORT_ERASE_MEMORY;
+                report_write = REPORT_WRITE_MEMORY;
+        }
+        mutex_lock(&data->mutex_flash);
+        while (s > 0) {
+                err = _picolcd_flash_erase64(data, report_erase, off);
+                if (err)
+                        break;
+                err = _picolcd_flash_write(data, report_write, u, 64, off);
+                if (err < 0)
+                        break;
+                ret += err;
+                *off += err;
+                s -= err;
+                if (err != 64)
+                        break;
+        }
+        mutex_unlock(&data->mutex_flash);
+        return ret > 0 ? ret : err;
+}
+
+/*
+ * Notes:
+ * - concurrent writing is prevented by mutex and all writes must be
+ *   n*64 bytes and 64-byte aligned, each write being preceded by an
+ *   ERASE which erases a 64byte block.
+ *   If less than requested was written or an error is returned for an
+ *   otherwise correct write request the next 64-byte block which should
+ *   have been written is in undefined state (mostly: original, erased,
+ *   (half-)written with write error)
+ * - reading can happen without special restriction
+ */
+static const struct file_operations picolcd_debug_flash_fops = {
+        .owner    = THIS_MODULE,
+        .open     = simple_open,
+        .read     = picolcd_debug_flash_read,
+        .write    = picolcd_debug_flash_write,
+        .llseek   = generic_file_llseek,
+};
+
+
+/*
+ * Helper code for HID report level dumping/debugging
+ */
+static const char * const error_codes[] = {
+        "success", "parameter missing", "data_missing", "block readonly",
+        "block not erasable", "block too big", "section overflow",
+        "invalid command length", "invalid data length",
+};
+
+static void dump_buff_as_hex(char *dst, size_t dst_sz, const u8 *data,
+                const size_t data_len)
+{
+        int i, j;
+        for (i = j = 0; i < data_len && j + 4 < dst_sz; i++) {
+                dst[j++] = hex_asc[(data[i] >> 4) & 0x0f];
+                dst[j++] = hex_asc[data[i] & 0x0f];
+                dst[j++] = ' ';
+        }
+        dst[j]   = '\0';
+        if (j > 0)
+                dst[j-1] = '\n';
+        if (i < data_len && j > 2)
+                dst[j-2] = dst[j-3] = '.';
+}
+
+void picolcd_debug_out_report(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report)
+{
+        u8 raw_data[70];
+        int raw_size = (report->size >> 3) + 1;
+        char *buff;
+#define BUFF_SZ 256
+
+        /* Avoid unnecessary overhead if debugfs is disabled */
+        if (list_empty(&hdev->debug_list))
+                return;
+
+        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
+        if (!buff)
+                return;
+
+        snprintf(buff, BUFF_SZ, "\nout report %d (size %d) =  ",
+                        report->id, raw_size);
+        hid_debug_event(hdev, buff);
+        if (raw_size + 5 > sizeof(raw_data)) {
+                kfree(buff);
+                hid_debug_event(hdev, " TOO BIG\n");
+                return;
+        } else {
+                raw_data[0] = report->id;
+                hid_output_report(report, raw_data);
+                dump_buff_as_hex(buff, BUFF_SZ, raw_data, raw_size);
+                hid_debug_event(hdev, buff);
+        }
+
+        switch (report->id) {
+        case REPORT_LED_STATE:
+                /* 1 data byte with GPO state */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LED_STATE", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tGPO state: 0x%02x\n", raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_BRIGHTNESS:
+                /* 1 data byte with brightness */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_BRIGHTNESS", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tBrightness: 0x%02x\n", raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_CONTRAST:
+                /* 1 data byte with contrast */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_CONTRAST", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tContrast: 0x%02x\n", raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_RESET:
+                /* 2 data bytes with reset duration in ms */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_RESET", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tDuration: 0x%02x%02x (%dms)\n",
+                                raw_data[2], raw_data[1], raw_data[2] << 8 | raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_LCD_CMD:
+                /* 63 data bytes with LCD commands */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LCD_CMD", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO: format decoding */
+                break;
+        case REPORT_LCD_DATA:
+                /* 63 data bytes with LCD data */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LCD_CMD", report->id, raw_size-1);
+                /* TODO: format decoding */
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_LCD_CMD_DATA:
+                /* 63 data bytes with LCD commands and data */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LCD_CMD", report->id, raw_size-1);
+                /* TODO: format decoding */
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_EE_READ:
+                /* 3 data bytes with read area description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_EE_READ", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_EE_WRITE:
+                /* 3+1..20 data bytes with write area description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_EE_WRITE", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                hid_debug_event(hdev, buff);
+                if (raw_data[3] == 0) {
+                        snprintf(buff, BUFF_SZ, "\tNo data\n");
+                } else if (raw_data[3] + 4 <= raw_size) {
+                        snprintf(buff, BUFF_SZ, "\tData: ");
+                        hid_debug_event(hdev, buff);
+                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                } else {
+                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_ERASE_MEMORY:
+        case REPORT_BL_ERASE_MEMORY:
+                /* 3 data bytes with pointer inside erase block */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_ERASE_MEMORY", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_READ_MEMORY:
+        case REPORT_BL_READ_MEMORY:
+                /* 4 data bytes with read area description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_READ_MEMORY", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_WRITE_MEMORY:
+        case REPORT_BL_WRITE_MEMORY:
+                /* 4+1..32 data bytes with write adrea description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_WRITE_MEMORY", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[3] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[3] + 4 <= raw_size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[4] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[4] + 5 <= raw_size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_SPLASH_RESTART:
+                /* TODO */
+                break;
+        case REPORT_EXIT_KEYBOARD:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_EXIT_KEYBOARD", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
+                                raw_data[1] | (raw_data[2] << 8),
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_VERSION:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_VERSION", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_DEVID:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_DEVID", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_SPLASH_SIZE:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_SPLASH_SIZE", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_HOOK_VERSION:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_HOOK_VERSION", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_EXIT_FLASHER:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_VERSION", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
+                                raw_data[1] | (raw_data[2] << 8),
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        default:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "<unknown>", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        }
+        wake_up_interruptible(&hdev->debug_wait);
+        kfree(buff);
+}
+
+void picolcd_debug_raw_event(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report,
+                u8 *raw_data, int size)
+{
+        char *buff;
+
+#define BUFF_SZ 256
+        /* Avoid unnecessary overhead if debugfs is disabled */
+        if (list_empty(&hdev->debug_list))
+                return;
+
+        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
+        if (!buff)
+                return;
+
+        switch (report->id) {
+        case REPORT_ERROR_CODE:
+                /* 2 data bytes with affected report and error code */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_ERROR_CODE", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                if (raw_data[2] < ARRAY_SIZE(error_codes))
+                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x (%s) in reply to report 0x%02x\n",
+                                        raw_data[2], error_codes[raw_data[2]], raw_data[1]);
+                else
+                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x in reply to report 0x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_KEY_STATE:
+                /* 2 data bytes with key state */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_KEY_STATE", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                if (raw_data[1] == 0)
+                        snprintf(buff, BUFF_SZ, "\tNo key pressed\n");
+                else if (raw_data[2] == 0)
+                        snprintf(buff, BUFF_SZ, "\tOne key pressed: 0x%02x (%d)\n",
+                                        raw_data[1], raw_data[1]);
+                else
+                        snprintf(buff, BUFF_SZ, "\tTwo keys pressed: 0x%02x (%d), 0x%02x (%d)\n",
+                                        raw_data[1], raw_data[1], raw_data[2], raw_data[2]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_IR_DATA:
+                /* Up to 20 byes of IR scancode data */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_IR_DATA", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                if (raw_data[1] == 0) {
+                        snprintf(buff, BUFF_SZ, "\tUnexpectedly 0 data length\n");
+                        hid_debug_event(hdev, buff);
+                } else if (raw_data[1] + 1 <= size) {
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n\tIR Data: ",
+                                        raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+2, raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                } else {
+                        snprintf(buff, BUFF_SZ, "\tOverflowing data length: %d\n",
+                                        raw_data[1]-1);
+                        hid_debug_event(hdev, buff);
+                }
+                break;
+        case REPORT_EE_DATA:
+                /* Data buffer in response to REPORT_EE_READ or REPORT_EE_WRITE */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_EE_DATA", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                hid_debug_event(hdev, buff);
+                if (raw_data[3] == 0) {
+                        snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        hid_debug_event(hdev, buff);
+                } else if (raw_data[3] + 4 <= size) {
+                        snprintf(buff, BUFF_SZ, "\tData: ");
+                        hid_debug_event(hdev, buff);
+                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                        hid_debug_event(hdev, buff);
+                } else {
+                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        hid_debug_event(hdev, buff);
+                }
+                break;
+        case REPORT_MEMORY:
+                /* Data buffer in response to REPORT_READ_MEMORY or REPORT_WRTIE_MEMORY */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[3] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[3] + 4 <= size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[4] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[4] + 5 <= size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_VERSION:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_VERSION", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_BL_ERASE_MEMORY:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_BL_ERASE_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO */
+                break;
+        case REPORT_BL_READ_MEMORY:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_BL_READ_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO */
+                break;
+        case REPORT_BL_WRITE_MEMORY:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_BL_WRITE_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO */
+                break;
+        case REPORT_DEVID:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_DEVID", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tSerial: 0x%02x%02x%02x%02x\n",
+                                raw_data[1], raw_data[2], raw_data[3], raw_data[4]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tType: 0x%02x\n",
+                                raw_data[5]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_SPLASH_SIZE:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_SPLASH_SIZE", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tTotal splash space: %d\n",
+                                (raw_data[2] << 8) | raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tUsed splash space: %d\n",
+                                (raw_data[4] << 8) | raw_data[3]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_HOOK_VERSION:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_HOOK_VERSION", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
+                                raw_data[1], raw_data[2]);
+                hid_debug_event(hdev, buff);
+                break;
+        default:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "<unknown>", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        }
+        wake_up_interruptible(&hdev->debug_wait);
+        kfree(buff);
+}
+
+void picolcd_init_devfs(struct picolcd_data *data,
+                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
+                struct hid_report *flash_r, struct hid_report *flash_w,
+                struct hid_report *reset)
+{
+        struct hid_device *hdev = data->hdev;
+
+        mutex_init(&data->mutex_flash);
+
+        /* reset */
+        if (reset)
+                data->debug_reset = debugfs_create_file("reset", 0600,
+                                hdev->debug_dir, data, &picolcd_debug_reset_fops);
+
+        /* eeprom */
+        if (eeprom_r || eeprom_w)
+                data->debug_eeprom = debugfs_create_file("eeprom",
+                        (eeprom_w ? S_IWUSR : 0) | (eeprom_r ? S_IRUSR : 0),
+                        hdev->debug_dir, data, &picolcd_debug_eeprom_fops);
+
+        /* flash */
+        if (flash_r && flash_r->maxfield == 1 && flash_r->field[0]->report_size == 8)
+                data->addr_sz = flash_r->field[0]->report_count - 1;
+        else
+                data->addr_sz = -1;
+        if (data->addr_sz == 2 || data->addr_sz == 3) {
+                data->debug_flash = debugfs_create_file("flash",
+                        (flash_w ? S_IWUSR : 0) | (flash_r ? S_IRUSR : 0),
+                        hdev->debug_dir, data, &picolcd_debug_flash_fops);
+        } else if (flash_r || flash_w)
+                hid_warn(hdev, "Unexpected FLASH access reports, please submit rdesc for review\n");
+}
+
+void picolcd_exit_devfs(struct picolcd_data *data)
+{
+        struct dentry *dent;
+
+        dent = data->debug_reset;
+        data->debug_reset = NULL;
+        if (dent)
+                debugfs_remove(dent);
+        dent = data->debug_eeprom;
+        data->debug_eeprom = NULL;
+        if (dent)
+                debugfs_remove(dent);
+        dent = data->debug_flash;
+        data->debug_flash = NULL;
+        if (dent)
+                debugfs_remove(dent);
+        mutex_destroy(&data->mutex_flash);
+}
+
diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
new file mode 100644
index 000000000000..0008a512211d
--- /dev/null
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -0,0 +1,615 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/vmalloc.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/module.h>
+
+#include "hid-picolcd.h"
+
+/* Framebuffer
+ *
+ * The PicoLCD use a Topway LCD module of 256x64 pixel
+ * This display area is tiled over 4 controllers with 8 tiles
+ * each. Each tile has 8x64 pixel, each data byte representing
+ * a 1-bit wide vertical line of the tile.
+ *
+ * The display can be updated at a tile granularity.
+ *
+ *       Chip 1           Chip 2           Chip 3           Chip 4
+ * +----------------+----------------+----------------+----------------+
+ * |     Tile 1     |     Tile 1     |     Tile 1     |     Tile 1     |
+ * +----------------+----------------+----------------+----------------+
+ * |     Tile 2     |     Tile 2     |     Tile 2     |     Tile 2     |
+ * +----------------+----------------+----------------+----------------+
+ *                                  ...
+ * +----------------+----------------+----------------+----------------+
+ * |     Tile 8     |     Tile 8     |     Tile 8     |     Tile 8     |
+ * +----------------+----------------+----------------+----------------+
+ */
+#define PICOLCDFB_NAME "picolcdfb"
+#define PICOLCDFB_WIDTH (256)
+#define PICOLCDFB_HEIGHT (64)
+#define PICOLCDFB_SIZE (PICOLCDFB_WIDTH * PICOLCDFB_HEIGHT / 8)
+
+#define PICOLCDFB_UPDATE_RATE_LIMIT   10
+#define PICOLCDFB_UPDATE_RATE_DEFAULT  2
+
+/* Framebuffer visual structures */
+static const struct fb_fix_screeninfo picolcdfb_fix = {
+        .id          = PICOLCDFB_NAME,
+        .type        = FB_TYPE_PACKED_PIXELS,
+        .visual      = FB_VISUAL_MONO01,
+        .xpanstep    = 0,
+        .ypanstep    = 0,
+        .ywrapstep   = 0,
+        .line_length = PICOLCDFB_WIDTH / 8,
+        .accel       = FB_ACCEL_NONE,
+};
+
+static const struct fb_var_screeninfo picolcdfb_var = {
+        .xres           = PICOLCDFB_WIDTH,
+        .yres           = PICOLCDFB_HEIGHT,
+        .xres_virtual   = PICOLCDFB_WIDTH,
+        .yres_virtual   = PICOLCDFB_HEIGHT,
+        .width          = 103,
+        .height         = 26,
+        .bits_per_pixel = 1,
+        .grayscale      = 1,
+        .red            = {
+                .offset = 0,
+                .length = 1,
+                .msb_right = 0,
+        },
+        .green          = {
+                .offset = 0,
+                .length = 1,
+                .msb_right = 0,
+        },
+        .blue           = {
+                .offset = 0,
+                .length = 1,
+                .msb_right = 0,
+        },
+        .transp         = {
+                .offset = 0,
+                .length = 0,
+                .msb_right = 0,
+        },
+};
+
+/* Send a given tile to PicoLCD */
+static int picolcd_fb_send_tile(struct picolcd_data *data, u8 *vbitmap,
+                int chip, int tile)
+{
+        struct hid_report *report1, *report2;
+        unsigned long flags;
+        u8 *tdata;
+        int i;
+
+        report1 = picolcd_out_report(REPORT_LCD_CMD_DATA, data->hdev);
+        if (!report1 || report1->maxfield != 1)
+                return -ENODEV;
+        report2 = picolcd_out_report(REPORT_LCD_DATA, data->hdev);
+        if (!report2 || report2->maxfield != 1)
+                return -ENODEV;
+
+        spin_lock_irqsave(&data->lock, flags);
+        if ((data->status & PICOLCD_FAILED)) {
+                spin_unlock_irqrestore(&data->lock, flags);
+                return -ENODEV;
+        }
+        hid_set_field(report1->field[0],  0, chip << 2);
+        hid_set_field(report1->field[0],  1, 0x02);
+        hid_set_field(report1->field[0],  2, 0x00);
+        hid_set_field(report1->field[0],  3, 0x00);
+        hid_set_field(report1->field[0],  4, 0xb8 | tile);
+        hid_set_field(report1->field[0],  5, 0x00);
+        hid_set_field(report1->field[0],  6, 0x00);
+        hid_set_field(report1->field[0],  7, 0x40);
+        hid_set_field(report1->field[0],  8, 0x00);
+        hid_set_field(report1->field[0],  9, 0x00);
+        hid_set_field(report1->field[0], 10,   32);
+
+        hid_set_field(report2->field[0],  0, (chip << 2) | 0x01);
+        hid_set_field(report2->field[0],  1, 0x00);
+        hid_set_field(report2->field[0],  2, 0x00);
+        hid_set_field(report2->field[0],  3,   32);
+
+        tdata = vbitmap + (tile * 4 + chip) * 64;
+        for (i = 0; i < 64; i++)
+                if (i < 32)
+                        hid_set_field(report1->field[0], 11 + i, tdata[i]);
+                else
+                        hid_set_field(report2->field[0], 4 + i - 32, tdata[i]);
+
+        usbhid_submit_report(data->hdev, report1, USB_DIR_OUT);
+        usbhid_submit_report(data->hdev, report2, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+/* Translate a single tile*/
+static int picolcd_fb_update_tile(u8 *vbitmap, const u8 *bitmap, int bpp,
+                int chip, int tile)
+{
+        int i, b, changed = 0;
+        u8 tdata[64];
+        u8 *vdata = vbitmap + (tile * 4 + chip) * 64;
+
+        if (bpp == 1) {
+                for (b = 7; b >= 0; b--) {
+                        const u8 *bdata = bitmap + tile * 256 + chip * 8 + b * 32;
+                        for (i = 0; i < 64; i++) {
+                                tdata[i] <<= 1;
+                                tdata[i] |= (bdata[i/8] >> (i % 8)) & 0x01;
+                        }
+                }
+        } else if (bpp == 8) {
+                for (b = 7; b >= 0; b--) {
+                        const u8 *bdata = bitmap + (tile * 256 + chip * 8 + b * 32) * 8;
+                        for (i = 0; i < 64; i++) {
+                                tdata[i] <<= 1;
+                                tdata[i] |= (bdata[i] & 0x80) ? 0x01 : 0x00;
+                        }
+                }
+        } else {
+                /* Oops, we should never get here! */
+                WARN_ON(1);
+                return 0;
+        }
+
+        for (i = 0; i < 64; i++)
+                if (tdata[i] != vdata[i]) {
+                        changed = 1;
+                        vdata[i] = tdata[i];
+                }
+        return changed;
+}
+
+void picolcd_fb_refresh(struct picolcd_data *data)
+{
+        if (data->fb_info)
+                schedule_delayed_work(&data->fb_info->deferred_work, 0);
+}
+
+/* Reconfigure LCD display */
+int picolcd_fb_reset(struct picolcd_data *data, int clear)
+{
+        struct hid_report *report = picolcd_out_report(REPORT_LCD_CMD, data->hdev);
+        struct picolcd_fb_data *fbdata = data->fb_info->par;
+        int i, j;
+        unsigned long flags;
+        static const u8 mapcmd[8] = { 0x00, 0x02, 0x00, 0x64, 0x3f, 0x00, 0x64, 0xc0 };
+
+        if (!report || report->maxfield != 1)
+                return -ENODEV;
+
+        spin_lock_irqsave(&data->lock, flags);
+        for (i = 0; i < 4; i++) {
+                for (j = 0; j < report->field[0]->maxusage; j++)
+                        if (j == 0)
+                                hid_set_field(report->field[0], j, i << 2);
+                        else if (j < sizeof(mapcmd))
+                                hid_set_field(report->field[0], j, mapcmd[j]);
+                        else
+                                hid_set_field(report->field[0], j, 0);
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        }
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        if (clear) {
+                memset(fbdata->vbitmap, 0, PICOLCDFB_SIZE);
+                memset(fbdata->bitmap, 0, PICOLCDFB_SIZE*fbdata->bpp);
+        }
+        fbdata->force = 1;
+
+        /* schedule first output of framebuffer */
+        if (fbdata->ready)
+                schedule_delayed_work(&data->fb_info->deferred_work, 0);
+        else
+                fbdata->ready = 1;
+
+        return 0;
+}
+
+/* Update fb_vbitmap from the screen_base and send changed tiles to device */
+static void picolcd_fb_update(struct fb_info *info)
+{
+        int chip, tile, n;
+        unsigned long flags;
+        struct picolcd_fb_data *fbdata = info->par;
+        struct picolcd_data *data;
+
+        mutex_lock(&info->lock);
+
+        spin_lock_irqsave(&fbdata->lock, flags);
+        if (!fbdata->ready && fbdata->picolcd)
+                picolcd_fb_reset(fbdata->picolcd, 0);
+        spin_unlock_irqrestore(&fbdata->lock, flags);
+
+        /*
+         * Translate the framebuffer into the format needed by the PicoLCD.
+         * See display layout above.
+         * Do this one tile after the other and push those tiles that changed.
+         *
+         * Wait for our IO to complete as otherwise we might flood the queue!
+         */
+        n = 0;
+        for (chip = 0; chip < 4; chip++)
+                for (tile = 0; tile < 8; tile++) {
+                        if (!fbdata->force && !picolcd_fb_update_tile(
+                                        fbdata->vbitmap, fbdata->bitmap,
+                                        fbdata->bpp, chip, tile))
+                                continue;
+                        n += 2;
+                        if (n >= HID_OUTPUT_FIFO_SIZE / 2) {
+                                spin_lock_irqsave(&fbdata->lock, flags);
+                                data = fbdata->picolcd;
+                                spin_unlock_irqrestore(&fbdata->lock, flags);
+                                mutex_unlock(&info->lock);
+                                if (!data)
+                                        return;
+                                usbhid_wait_io(data->hdev);
+                                mutex_lock(&info->lock);
+                                n = 0;
+                        }
+                        spin_lock_irqsave(&fbdata->lock, flags);
+                        data = fbdata->picolcd;
+                        spin_unlock_irqrestore(&fbdata->lock, flags);
+                        if (!data || picolcd_fb_send_tile(data,
+                                        fbdata->vbitmap, chip, tile))
+                                goto out;
+                }
+        fbdata->force = false;
+        if (n) {
+                spin_lock_irqsave(&fbdata->lock, flags);
+                data = fbdata->picolcd;
+                spin_unlock_irqrestore(&fbdata->lock, flags);
+                mutex_unlock(&info->lock);
+                if (data)
+                        usbhid_wait_io(data->hdev);
+                return;
+        }
+out:
+        mutex_unlock(&info->lock);
+}
+
+/* Stub to call the system default and update the image on the picoLCD */
+static void picolcd_fb_fillrect(struct fb_info *info,
+                const struct fb_fillrect *rect)
+{
+        if (!info->par)
+                return;
+        sys_fillrect(info, rect);
+
+        schedule_delayed_work(&info->deferred_work, 0);
+}
+
+/* Stub to call the system default and update the image on the picoLCD */
+static void picolcd_fb_copyarea(struct fb_info *info,
+                const struct fb_copyarea *area)
+{
+        if (!info->par)
+                return;
+        sys_copyarea(info, area);
+
+        schedule_delayed_work(&info->deferred_work, 0);
+}
+
+/* Stub to call the system default and update the image on the picoLCD */
+static void picolcd_fb_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+        if (!info->par)
+                return;
+        sys_imageblit(info, image);
+
+        schedule_delayed_work(&info->deferred_work, 0);
+}
+
+/*
+ * this is the slow path from userspace. they can seek and write to
+ * the fb. it's inefficient to do anything less than a full screen draw
+ */
+static ssize_t picolcd_fb_write(struct fb_info *info, const char __user *buf,
+                size_t count, loff_t *ppos)
+{
+        ssize_t ret;
+        if (!info->par)
+                return -ENODEV;
+        ret = fb_sys_write(info, buf, count, ppos);
+        if (ret >= 0)
+                schedule_delayed_work(&info->deferred_work, 0);
+        return ret;
+}
+
+static int picolcd_fb_blank(int blank, struct fb_info *info)
+{
+        /* We let fb notification do this for us via lcd/backlight device */
+        return 0;
+}
+
+static void picolcd_fb_destroy(struct fb_info *info)
+{
+        struct picolcd_fb_data *fbdata = info->par;
+
+        /* make sure no work is deferred */
+        fb_deferred_io_cleanup(info);
+
+        /* No thridparty should ever unregister our framebuffer! */
+        WARN_ON(fbdata->picolcd != NULL);
+
+        vfree((u8 *)info->fix.smem_start);
+        framebuffer_release(info);
+}
+
+static int picolcd_fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+        __u32 bpp      = var->bits_per_pixel;
+        __u32 activate = var->activate;
+
+        /* only allow 1/8 bit depth (8-bit is grayscale) */
+        *var = picolcdfb_var;
+        var->activate = activate;
+        if (bpp >= 8) {
+                var->bits_per_pixel = 8;
+                var->red.length     = 8;
+                var->green.length   = 8;
+                var->blue.length    = 8;
+        } else {
+                var->bits_per_pixel = 1;
+                var->red.length     = 1;
+                var->green.length   = 1;
+                var->blue.length    = 1;
+        }
+        return 0;
+}
+
+static int picolcd_set_par(struct fb_info *info)
+{
+        struct picolcd_fb_data *fbdata = info->par;
+        u8 *tmp_fb, *o_fb;
+        if (info->var.bits_per_pixel == fbdata->bpp)
+                return 0;
+        /* switch between 1/8 bit depths */
+        if (info->var.bits_per_pixel != 1 && info->var.bits_per_pixel != 8)
+                return -EINVAL;
+
+        o_fb   = fbdata->bitmap;
+        tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL);
+        if (!tmp_fb)
+                return -ENOMEM;
+
+        /* translate FB content to new bits-per-pixel */
+        if (info->var.bits_per_pixel == 1) {
+                int i, b;
+                for (i = 0; i < PICOLCDFB_SIZE; i++) {
+                        u8 p = 0;
+                        for (b = 0; b < 8; b++) {
+                                p <<= 1;
+                                p |= o_fb[i*8+b] ? 0x01 : 0x00;
+                        }
+                        tmp_fb[i] = p;
+                }
+                memcpy(o_fb, tmp_fb, PICOLCDFB_SIZE);
+                info->fix.visual = FB_VISUAL_MONO01;
+                info->fix.line_length = PICOLCDFB_WIDTH / 8;
+        } else {
+                int i;
+                memcpy(tmp_fb, o_fb, PICOLCDFB_SIZE);
+                for (i = 0; i < PICOLCDFB_SIZE * 8; i++)
+                        o_fb[i] = tmp_fb[i/8] & (0x01 << (7 - i % 8)) ? 0xff : 0x00;
+                info->fix.visual = FB_VISUAL_DIRECTCOLOR;
+                info->fix.line_length = PICOLCDFB_WIDTH;
+        }
+
+        kfree(tmp_fb);
+        fbdata->bpp = info->var.bits_per_pixel;
+        return 0;
+}
+
+/* Note this can't be const because of struct fb_info definition */
+static struct fb_ops picolcdfb_ops = {
+        .owner        = THIS_MODULE,
+        .fb_destroy   = picolcd_fb_destroy,
+        .fb_read      = fb_sys_read,
+        .fb_write     = picolcd_fb_write,
+        .fb_blank     = picolcd_fb_blank,
+        .fb_fillrect  = picolcd_fb_fillrect,
+        .fb_copyarea  = picolcd_fb_copyarea,
+        .fb_imageblit = picolcd_fb_imageblit,
+        .fb_check_var = picolcd_fb_check_var,
+        .fb_set_par   = picolcd_set_par,
+};
+
+
+/* Callback from deferred IO workqueue */
+static void picolcd_fb_deferred_io(struct fb_info *info, struct list_head *pagelist)
+{
+        picolcd_fb_update(info);
+}
+
+static const struct fb_deferred_io picolcd_fb_defio = {
+        .delay = HZ / PICOLCDFB_UPDATE_RATE_DEFAULT,
+        .deferred_io = picolcd_fb_deferred_io,
+};
+
+
+/*
+ * The "fb_update_rate" sysfs attribute
+ */
+static ssize_t picolcd_fb_update_rate_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        struct picolcd_fb_data *fbdata = data->fb_info->par;
+        unsigned i, fb_update_rate = fbdata->update_rate;
+        size_t ret = 0;
+
+        for (i = 1; i <= PICOLCDFB_UPDATE_RATE_LIMIT; i++)
+                if (ret >= PAGE_SIZE)
+                        break;
+                else if (i == fb_update_rate)
+                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "[%u] ", i);
+                else
+                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "%u ", i);
+        if (ret > 0)
+                buf[min(ret, (size_t)PAGE_SIZE)-1] = '\n';
+        return ret;
+}
+
+static ssize_t picolcd_fb_update_rate_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        struct picolcd_fb_data *fbdata = data->fb_info->par;
+        int i;
+        unsigned u;
+
+        if (count < 1 || count > 10)
+                return -EINVAL;
+
+        i = sscanf(buf, "%u", &u);
+        if (i != 1)
+                return -EINVAL;
+
+        if (u > PICOLCDFB_UPDATE_RATE_LIMIT)
+                return -ERANGE;
+        else if (u == 0)
+                u = PICOLCDFB_UPDATE_RATE_DEFAULT;
+
+        fbdata->update_rate = u;
+        data->fb_info->fbdefio->delay = HZ / fbdata->update_rate;
+        return count;
+}
+
+static DEVICE_ATTR(fb_update_rate, 0666, picolcd_fb_update_rate_show,
+                picolcd_fb_update_rate_store);
+
+/* initialize Framebuffer device */
+int picolcd_init_framebuffer(struct picolcd_data *data)
+{
+        struct device *dev = &data->hdev->dev;
+        struct fb_info *info = NULL;
+        struct picolcd_fb_data *fbdata = NULL;
+        int i, error = -ENOMEM;
+        u32 *palette;
+
+        /* The extra memory is:
+         * - 256*u32 for pseudo_palette
+         * - struct fb_deferred_io
+         */
+        info = framebuffer_alloc(256 * sizeof(u32) +
+                        sizeof(struct fb_deferred_io) +
+                        sizeof(struct picolcd_fb_data) +
+                        PICOLCDFB_SIZE, dev);
+        if (info == NULL) {
+                dev_err(dev, "failed to allocate a framebuffer\n");
+                goto err_nomem;
+        }
+
+        info->fbdefio = info->par;
+        *info->fbdefio = picolcd_fb_defio;
+        info->par += sizeof(struct fb_deferred_io);
+        palette = info->par;
+        info->par += 256 * sizeof(u32);
+        for (i = 0; i < 256; i++)
+                palette[i] = i > 0 && i < 16 ? 0xff : 0;
+        info->pseudo_palette = palette;
+        info->fbops = &picolcdfb_ops;
+        info->var = picolcdfb_var;
+        info->fix = picolcdfb_fix;
+        info->fix.smem_len   = PICOLCDFB_SIZE*8;
+        info->flags = FBINFO_FLAG_DEFAULT;
+
+        fbdata = info->par;
+        spin_lock_init(&fbdata->lock);
+        fbdata->picolcd = data;
+        fbdata->update_rate = PICOLCDFB_UPDATE_RATE_DEFAULT;
+        fbdata->bpp     = picolcdfb_var.bits_per_pixel;
+        fbdata->force   = 1;
+        fbdata->vbitmap = info->par + sizeof(struct picolcd_fb_data);
+        fbdata->bitmap  = vmalloc(PICOLCDFB_SIZE*8);
+        if (fbdata->bitmap == NULL) {
+                dev_err(dev, "can't get a free page for framebuffer\n");
+                goto err_nomem;
+        }
+        info->screen_base = (char __force __iomem *)fbdata->bitmap;
+        info->fix.smem_start = (unsigned long)fbdata->bitmap;
+        memset(fbdata->vbitmap, 0xff, PICOLCDFB_SIZE);
+        data->fb_info = info;
+
+        error = picolcd_fb_reset(data, 1);
+        if (error) {
+                dev_err(dev, "failed to configure display\n");
+                goto err_cleanup;
+        }
+
+        error = device_create_file(dev, &dev_attr_fb_update_rate);
+        if (error) {
+                dev_err(dev, "failed to create sysfs attributes\n");
+                goto err_cleanup;
+        }
+
+        fb_deferred_io_init(info);
+        error = register_framebuffer(info);
+        if (error) {
+                dev_err(dev, "failed to register framebuffer\n");
+                goto err_sysfs;
+        }
+        return 0;
+
+err_sysfs:
+        device_remove_file(dev, &dev_attr_fb_update_rate);
+        fb_deferred_io_cleanup(info);
+err_cleanup:
+        data->fb_info    = NULL;
+
+err_nomem:
+        if (fbdata)
+                vfree(fbdata->bitmap);
+        framebuffer_release(info);
+        return error;
+}
+
+void picolcd_exit_framebuffer(struct picolcd_data *data)
+{
+        struct fb_info *info = data->fb_info;
+        struct picolcd_fb_data *fbdata = info->par;
+        unsigned long flags;
+
+        device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
+
+        /* disconnect framebuffer from HID dev */
+        spin_lock_irqsave(&fbdata->lock, flags);
+        fbdata->picolcd = NULL;
+        spin_unlock_irqrestore(&fbdata->lock, flags);
+
+        /* make sure there is no running update - thus that fbdata->picolcd
+         * once obtained under lock is guaranteed not to get free() under
+         * the feet of the deferred work */
+        flush_delayed_work_sync(&info->deferred_work);
+
+        data->fb_info = NULL;
+        unregister_framebuffer(info);
+}
diff --git a/drivers/hid/hid-picolcd_lcd.c b/drivers/hid/hid-picolcd_lcd.c
new file mode 100644
index 000000000000..2d0ddc5ac65f
--- /dev/null
+++ b/drivers/hid/hid-picolcd_lcd.c
@@ -0,0 +1,107 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/lcd.h>
+
+#include "hid-picolcd.h"
+
+/*
+ * lcd class device
+ */
+static int picolcd_get_contrast(struct lcd_device *ldev)
+{
+        struct picolcd_data *data = lcd_get_data(ldev);
+        return data->lcd_contrast;
+}
+
+static int picolcd_set_contrast(struct lcd_device *ldev, int contrast)
+{
+        struct picolcd_data *data = lcd_get_data(ldev);
+        struct hid_report *report = picolcd_out_report(REPORT_CONTRAST, data->hdev);
+        unsigned long flags;
+
+        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
+                return -ENODEV;
+
+        data->lcd_contrast = contrast & 0x0ff;
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, data->lcd_contrast);
+        if (!(data->status & PICOLCD_FAILED))
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+static int picolcd_check_lcd_fb(struct lcd_device *ldev, struct fb_info *fb)
+{
+        return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
+}
+
+static struct lcd_ops picolcd_lcdops = {
+        .get_contrast   = picolcd_get_contrast,
+        .set_contrast   = picolcd_set_contrast,
+        .check_fb       = picolcd_check_lcd_fb,
+};
+
+int picolcd_init_lcd(struct picolcd_data *data, struct hid_report *report)
+{
+        struct device *dev = &data->hdev->dev;
+        struct lcd_device *ldev;
+
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
+                        report->field[0]->report_size != 8) {
+                dev_err(dev, "unsupported CONTRAST report");
+                return -EINVAL;
+        }
+
+        ldev = lcd_device_register(dev_name(dev), dev, data, &picolcd_lcdops);
+        if (IS_ERR(ldev)) {
+                dev_err(dev, "failed to register LCD\n");
+                return PTR_ERR(ldev);
+        }
+        ldev->props.max_contrast = 0x0ff;
+        data->lcd_contrast = 0xe5;
+        data->lcd = ldev;
+        picolcd_set_contrast(ldev, 0xe5);
+        return 0;
+}
+
+void picolcd_exit_lcd(struct picolcd_data *data)
+{
+        struct lcd_device *ldev = data->lcd;
+
+        data->lcd = NULL;
+        if (ldev)
+                lcd_device_unregister(ldev);
+}
+
+int picolcd_resume_lcd(struct picolcd_data *data)
+{
+        if (!data->lcd)
+                return 0;
+        return picolcd_set_contrast(data->lcd, data->lcd_contrast);
+}
+
diff --git a/drivers/hid/hid-picolcd_leds.c b/drivers/hid/hid-picolcd_leds.c
new file mode 100644
index 000000000000..28cb6a4f9634
--- /dev/null
+++ b/drivers/hid/hid-picolcd_leds.c
@@ -0,0 +1,175 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include <linux/input.h>
+#include "hid-ids.h"
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/vmalloc.h>
+#include <linux/backlight.h>
+#include <linux/lcd.h>
+
+#include <linux/leds.h>
+
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+
+#include "hid-picolcd.h"
+
+
+void picolcd_leds_set(struct picolcd_data *data)
+{
+        struct hid_report *report;
+        unsigned long flags;
+
+        if (!data->led[0])
+                return;
+        report = picolcd_out_report(REPORT_LED_STATE, data->hdev);
+        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
+                return;
+
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, data->led_state);
+        if (!(data->status & PICOLCD_FAILED))
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+}
+
+static void picolcd_led_set_brightness(struct led_classdev *led_cdev,
+                        enum led_brightness value)
+{
+        struct device *dev;
+        struct hid_device *hdev;
+        struct picolcd_data *data;
+        int i, state = 0;
+
+        dev  = led_cdev->dev->parent;
+        hdev = container_of(dev, struct hid_device, dev);
+        data = hid_get_drvdata(hdev);
+        if (!data)
+                return;
+        for (i = 0; i < 8; i++) {
+                if (led_cdev != data->led[i])
+                        continue;
+                state = (data->led_state >> i) & 1;
+                if (value == LED_OFF && state) {
+                        data->led_state &= ~(1 << i);
+                        picolcd_leds_set(data);
+                } else if (value != LED_OFF && !state) {
+                        data->led_state |= 1 << i;
+                        picolcd_leds_set(data);
+                }
+                break;
+        }
+}
+
+static enum led_brightness picolcd_led_get_brightness(struct led_classdev *led_cdev)
+{
+        struct device *dev;
+        struct hid_device *hdev;
+        struct picolcd_data *data;
+        int i, value = 0;
+
+        dev  = led_cdev->dev->parent;
+        hdev = container_of(dev, struct hid_device, dev);
+        data = hid_get_drvdata(hdev);
+        for (i = 0; i < 8; i++)
+                if (led_cdev == data->led[i]) {
+                        value = (data->led_state >> i) & 1;
+                        break;
+                }
+        return value ? LED_FULL : LED_OFF;
+}
+
+int picolcd_init_leds(struct picolcd_data *data, struct hid_report *report)
+{
+        struct device *dev = &data->hdev->dev;
+        struct led_classdev *led;
+        size_t name_sz = strlen(dev_name(dev)) + 8;
+        char *name;
+        int i, ret = 0;
+
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
+                        report->field[0]->report_size != 8) {
+                dev_err(dev, "unsupported LED_STATE report");
+                return -EINVAL;
+        }
+
+        for (i = 0; i < 8; i++) {
+                led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+                if (!led) {
+                        dev_err(dev, "can't allocate memory for LED %d\n", i);
+                        ret = -ENOMEM;
+                        goto err;
+                }
+                name = (void *)(&led[1]);
+                snprintf(name, name_sz, "%s::GPO%d", dev_name(dev), i);
+                led->name = name;
+                led->brightness = 0;
+                led->max_brightness = 1;
+                led->brightness_get = picolcd_led_get_brightness;
+                led->brightness_set = picolcd_led_set_brightness;
+
+                data->led[i] = led;
+                ret = led_classdev_register(dev, data->led[i]);
+                if (ret) {
+                        data->led[i] = NULL;
+                        kfree(led);
+                        dev_err(dev, "can't register LED %d\n", i);
+                        goto err;
+                }
+        }
+        return 0;
+err:
+        for (i = 0; i < 8; i++)
+                if (data->led[i]) {
+                        led = data->led[i];
+                        data->led[i] = NULL;
+                        led_classdev_unregister(led);
+                        kfree(led);
+                }
+        return ret;
+}
+
+void picolcd_exit_leds(struct picolcd_data *data)
+{
+        struct led_classdev *led;
+        int i;
+
+        for (i = 0; i < 8; i++) {
+                led = data->led[i];
+                data->led[i] = NULL;
+                if (!led)
+                        continue;
+                led_classdev_unregister(led);
+                kfree(led);
+        }
+}
+
+
diff --git a/drivers/hid/hid-primax.c b/drivers/hid/hid-primax.c
index 4d3c60d88318..c15adb0c98a1 100644
--- a/drivers/hid/hid-primax.c
+++ b/drivers/hid/hid-primax.c
@@ -64,29 +64,6 @@ static int px_raw_event(struct hid_device *hid, struct hid_report *report,
         return 0;
 }
 
-static int px_probe(struct hid_device *hid, const struct hid_device_id *id)
-{
-        int ret;
-
-        ret = hid_parse(hid);
-        if (ret) {
-                hid_err(hid, "parse failed\n");
-                goto fail;
-        }
-
-        ret = hid_hw_start(hid, HID_CONNECT_DEFAULT);
-        if (ret)
-                hid_err(hid, "hw start failed\n");
-
-fail:
-        return ret;
-}
-
-static void px_remove(struct hid_device *hid)
-{
-        hid_hw_stop(hid);
-}
-
 static const struct hid_device_id px_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
         { }
@@ -97,8 +74,6 @@ static struct hid_driver px_driver = {
         .name = "primax",
         .id_table = px_devices,
         .raw_event = px_raw_event,
-        .probe = px_probe,
-        .remove = px_remove,
 };
 
 static int __init px_init(void)
diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index b71b77ab0dc7..ec8ca3336315 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -105,7 +105,7 @@ static ssize_t show_channel(struct device *dev,
         struct device_attribute *attr, char *buf)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         dbg_hid("pcmidi sysfs read channel=%u\n", pk->pm->midi_channel);
 
@@ -118,7 +118,7 @@ static ssize_t store_channel(struct device *dev,
         struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         unsigned channel = 0;
 
@@ -142,7 +142,7 @@ static ssize_t show_sustain(struct device *dev,
  struct device_attribute *attr, char *buf)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         dbg_hid("pcmidi sysfs read sustain=%u\n", pk->pm->midi_sustain);
 
@@ -155,7 +155,7 @@ static ssize_t store_sustain(struct device *dev,
         struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         unsigned sustain = 0;
 
@@ -181,7 +181,7 @@ static ssize_t show_octave(struct device *dev,
         struct device_attribute *attr, char *buf)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         dbg_hid("pcmidi sysfs read octave=%d\n", pk->pm->midi_octave);
 
@@ -194,7 +194,7 @@ static ssize_t store_octave(struct device *dev,
         struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         int octave = 0;
 
@@ -759,7 +759,7 @@ static int pk_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
         struct pcmidi_snd *pm;
 
         pm = pk->pm;
@@ -777,7 +777,7 @@ static int pk_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 static int pk_raw_event(struct hid_device *hdev, struct hid_report *report,
         u8 *data, int size)
 {
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
         int ret = 0;
 
         if (1 == pk->pm->ifnum) {
@@ -858,7 +858,7 @@ err_free_pk:
 
 static void pk_remove(struct hid_device *hdev)
 {
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
         struct pcmidi_snd *pm;
 
         pm = pk->pm;
diff --git a/drivers/hid/hid-ps3remote.c b/drivers/hid/hid-ps3remote.c
new file mode 100644
index 000000000000..03811e539d71
--- /dev/null
+++ b/drivers/hid/hid-ps3remote.c
@@ -0,0 +1,215 @@
+/*
+ * HID driver for Sony PS3 BD Remote Control
+ *
+ * Copyright (c) 2012 David Dillow <dave@thedillows.org>
+ * Based on a blend of the bluez fakehid user-space code by Marcel Holtmann
+ * and other kernel HID drivers.
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+/* NOTE: in order for the Sony PS3 BD Remote Control to be found by
+ * a Bluetooth host, the key combination Start+Enter has to be kept pressed
+ * for about 7 seconds with the Bluetooth Host Controller in discovering mode.
+ *
+ * There will be no PIN request from the device.
+ */
+
+#include <linux/device.h>
+#include <linux/hid.h>
+#include <linux/module.h>
+
+#include "hid-ids.h"
+
+static __u8 ps3remote_rdesc[] = {
+        0x05, 0x01,          /* GUsagePage Generic Desktop */
+        0x09, 0x05,          /* LUsage 0x05 [Game Pad] */
+        0xA1, 0x01,          /* MCollection Application (mouse, keyboard) */
+
+         /* Use collection 1 for joypad buttons */
+         0xA1, 0x02,         /* MCollection Logical (interrelated data) */
+
+          /* Ignore the 1st byte, maybe it is used for a controller
+           * number but it's not needed for correct operation */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x01,        /* GReportCount 0x01 [1] */
+          0x81, 0x01,        /* MInput 0x01 (Const[0] Arr[1] Abs[2]) */
+
+          /* Bytes from 2nd to 4th are a bitmap for joypad buttons, for these
+           * buttons multiple keypresses are allowed */
+          0x05, 0x09,        /* GUsagePage Button */
+          0x19, 0x01,        /* LUsageMinimum 0x01 [Button 1 (primary/trigger)] */
+          0x29, 0x18,        /* LUsageMaximum 0x18 [Button 24] */
+          0x14,              /* GLogicalMinimum [0] */
+          0x25, 0x01,        /* GLogicalMaximum 0x01 [1] */
+          0x75, 0x01,        /* GReportSize 0x01 [1] */
+          0x95, 0x18,        /* GReportCount 0x18 [24] */
+          0x81, 0x02,        /* MInput 0x02 (Data[0] Var[1] Abs[2]) */
+
+          0xC0,              /* MEndCollection */
+
+         /* Use collection 2 for remote control buttons */
+         0xA1, 0x02,         /* MCollection Logical (interrelated data) */
+
+          /* 5th byte is used for remote control buttons */
+          0x05, 0x09,        /* GUsagePage Button */
+          0x18,              /* LUsageMinimum [No button pressed] */
+          0x29, 0xFE,        /* LUsageMaximum 0xFE [Button 254] */
+          0x14,              /* GLogicalMinimum [0] */
+          0x26, 0xFE, 0x00,  /* GLogicalMaximum 0x00FE [254] */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x01,        /* GReportCount 0x01 [1] */
+          0x80,              /* MInput  */
+
+          /* Ignore bytes from 6th to 11th, 6th to 10th are always constant at
+           * 0xff and 11th is for press indication */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x06,        /* GReportCount 0x06 [6] */
+          0x81, 0x01,        /* MInput 0x01 (Const[0] Arr[1] Abs[2]) */
+
+          /* 12th byte is for battery strength */
+          0x05, 0x06,        /* GUsagePage Generic Device Controls */
+          0x09, 0x20,        /* LUsage 0x20 [Battery Strength] */
+          0x14,              /* GLogicalMinimum [0] */
+          0x25, 0x05,        /* GLogicalMaximum 0x05 [5] */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x01,        /* GReportCount 0x01 [1] */
+          0x81, 0x02,        /* MInput 0x02 (Data[0] Var[1] Abs[2]) */
+
+          0xC0,              /* MEndCollection */
+
+         0xC0                /* MEndCollection [Game Pad] */
+};
+
+static const unsigned int ps3remote_keymap_joypad_buttons[] = {
+        [0x01] = KEY_SELECT,
+        [0x02] = BTN_THUMBL,            /* L3 */
+        [0x03] = BTN_THUMBR,            /* R3 */
+        [0x04] = BTN_START,
+        [0x05] = KEY_UP,
+        [0x06] = KEY_RIGHT,
+        [0x07] = KEY_DOWN,
+        [0x08] = KEY_LEFT,
+        [0x09] = BTN_TL2,               /* L2 */
+        [0x0a] = BTN_TR2,               /* R2 */
+        [0x0b] = BTN_TL,                /* L1 */
+        [0x0c] = BTN_TR,                /* R1 */
+        [0x0d] = KEY_OPTION,            /* options/triangle */
+        [0x0e] = KEY_BACK,              /* back/circle */
+        [0x0f] = BTN_0,                 /* cross */
+        [0x10] = KEY_SCREEN,            /* view/square */
+        [0x11] = KEY_HOMEPAGE,          /* PS button */
+        [0x14] = KEY_ENTER,
+};
+static const unsigned int ps3remote_keymap_remote_buttons[] = {
+        [0x00] = KEY_1,
+        [0x01] = KEY_2,
+        [0x02] = KEY_3,
+        [0x03] = KEY_4,
+        [0x04] = KEY_5,
+        [0x05] = KEY_6,
+        [0x06] = KEY_7,
+        [0x07] = KEY_8,
+        [0x08] = KEY_9,
+        [0x09] = KEY_0,
+        [0x0e] = KEY_ESC,               /* return */
+        [0x0f] = KEY_CLEAR,
+        [0x16] = KEY_EJECTCD,
+        [0x1a] = KEY_MENU,              /* top menu */
+        [0x28] = KEY_TIME,
+        [0x30] = KEY_PREVIOUS,
+        [0x31] = KEY_NEXT,
+        [0x32] = KEY_PLAY,
+        [0x33] = KEY_REWIND,            /* scan back */
+        [0x34] = KEY_FORWARD,           /* scan forward */
+        [0x38] = KEY_STOP,
+        [0x39] = KEY_PAUSE,
+        [0x40] = KEY_CONTEXT_MENU,      /* pop up/menu */
+        [0x60] = KEY_FRAMEBACK,         /* slow/step back */
+        [0x61] = KEY_FRAMEFORWARD,      /* slow/step forward */
+        [0x63] = KEY_SUBTITLE,
+        [0x64] = KEY_AUDIO,
+        [0x65] = KEY_ANGLE,
+        [0x70] = KEY_INFO,              /* display */
+        [0x80] = KEY_BLUE,
+        [0x81] = KEY_RED,
+        [0x82] = KEY_GREEN,
+        [0x83] = KEY_YELLOW,
+};
+
+static __u8 *ps3remote_fixup(struct hid_device *hdev, __u8 *rdesc,
+                             unsigned int *rsize)
+{
+        *rsize = sizeof(ps3remote_rdesc);
+        return ps3remote_rdesc;
+}
+
+static int ps3remote_mapping(struct hid_device *hdev, struct hid_input *hi,
+                             struct hid_field *field, struct hid_usage *usage,
+                             unsigned long **bit, int *max)
+{
+        unsigned int key = usage->hid & HID_USAGE;
+
+        if ((usage->hid & HID_USAGE_PAGE) != HID_UP_BUTTON)
+                return -1;
+
+        switch (usage->collection_index) {
+        case 1:
+                if (key >= ARRAY_SIZE(ps3remote_keymap_joypad_buttons))
+                        return -1;
+
+                key = ps3remote_keymap_joypad_buttons[key];
+                if (!key)
+                        return -1;
+                break;
+        case 2:
+                if (key >= ARRAY_SIZE(ps3remote_keymap_remote_buttons))
+                        return -1;
+
+                key = ps3remote_keymap_remote_buttons[key];
+                if (!key)
+                        return -1;
+                break;
+        default:
+                return -1;
+        }
+
+        hid_map_usage_clear(hi, usage, bit, max, EV_KEY, key);
+        return 1;
+}
+
+static const struct hid_device_id ps3remote_devices[] = {
+        /* PS3 BD Remote Control */
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_BDREMOTE) },
+        /* Logitech Harmony Adapter for PS3 */
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, ps3remote_devices);
+
+static struct hid_driver ps3remote_driver = {
+        .name          = "ps3_remote",
+        .id_table      = ps3remote_devices,
+        .report_fixup  = ps3remote_fixup,
+        .input_mapping = ps3remote_mapping,
+};
+
+static int __init ps3remote_init(void)
+{
+        return hid_register_driver(&ps3remote_driver);
+}
+
+static void __exit ps3remote_exit(void)
+{
+        hid_unregister_driver(&ps3remote_driver);
+}
+
+module_init(ps3remote_init);
+module_exit(ps3remote_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("David Dillow <dave@thedillows.org>, Antonio Ospite <ospite@studenti.unina.it>");
diff --git a/drivers/hid/hid-samsung.c b/drivers/hid/hid-samsung.c
index 3c1fd8af5e0c..a5821d317229 100644
--- a/drivers/hid/hid-samsung.c
+++ b/drivers/hid/hid-samsung.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2010 Don Prince <dhprince.devel@yahoo.co.uk>
  *
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 5cd25bd907f8..7f33ebf299c2 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -4,7 +4,6 @@
  *  Copyright (c) 1999 Andreas Gal
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2006-2008 Jiri Kosina
  */
diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
index d484a0043dd4..45b4b066a262 100644
--- a/drivers/hid/hid-sunplus.c
+++ b/drivers/hid/hid-sunplus.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
index 3aba02be1f26..2e56a1fd2375 100644
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -466,6 +466,86 @@ static __u8 twhl850_rdesc_fixed2[] = {
         0xC0                /*  End Collection                      */
 };
 
+/*
+ * See TWHA60 description, device and HID report descriptors at
+ * http://sf.net/apps/mediawiki/digimend/?title=UC-Logic_Tablet_TWHA60
+ */
+
+/* Size of the original descriptors of TWHA60 tablet */
+#define TWHA60_RDESC_ORIG_SIZE0 254
+#define TWHA60_RDESC_ORIG_SIZE1 139
+
+/* Fixed TWHA60 report descriptor, interface 0 (stylus) */
+static __u8 twha60_rdesc_fixed0[] = {
+        0x05, 0x0D,         /*  Usage Page (Digitizer),             */
+        0x09, 0x02,         /*  Usage (Pen),                        */
+        0xA1, 0x01,         /*  Collection (Application),           */
+        0x85, 0x09,         /*      Report ID (9),                  */
+        0x09, 0x20,         /*      Usage (Stylus),                 */
+        0xA0,               /*      Collection (Physical),          */
+        0x75, 0x01,         /*          Report Size (1),            */
+        0x09, 0x42,         /*          Usage (Tip Switch),         */
+        0x09, 0x44,         /*          Usage (Barrel Switch),      */
+        0x09, 0x46,         /*          Usage (Tablet Pick),        */
+        0x14,               /*          Logical Minimum (0),        */
+        0x25, 0x01,         /*          Logical Maximum (1),        */
+        0x95, 0x03,         /*          Report Count (3),           */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0x95, 0x04,         /*          Report Count (4),           */
+        0x81, 0x01,         /*          Input (Constant),           */
+        0x09, 0x32,         /*          Usage (In Range),           */
+        0x95, 0x01,         /*          Report Count (1),           */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0x75, 0x10,         /*          Report Size (16),           */
+        0x95, 0x01,         /*          Report Count (1),           */
+        0x14,               /*          Logical Minimum (0),        */
+        0xA4,               /*          Push,                       */
+        0x05, 0x01,         /*          Usage Page (Desktop),       */
+        0x55, 0xFD,         /*          Unit Exponent (-3),         */
+        0x65, 0x13,         /*          Unit (Inch),                */
+        0x34,               /*          Physical Minimum (0),       */
+        0x09, 0x30,         /*          Usage (X),                  */
+        0x46, 0x10, 0x27,   /*          Physical Maximum (10000),   */
+        0x27, 0x3F, 0x9C,
+                0x00, 0x00, /*          Logical Maximum (39999),    */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0x09, 0x31,         /*          Usage (Y),                  */
+        0x46, 0x6A, 0x18,   /*          Physical Maximum (6250),    */
+        0x26, 0xA7, 0x61,   /*          Logical Maximum (24999),    */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0xB4,               /*          Pop,                        */
+        0x09, 0x30,         /*          Usage (Tip Pressure),       */
+        0x26, 0xFF, 0x03,   /*          Logical Maximum (1023),     */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0xC0,               /*      End Collection,                 */
+        0xC0                /*  End Collection                      */
+};
+
+/* Fixed TWHA60 report descriptor, interface 1 (frame buttons) */
+static __u8 twha60_rdesc_fixed1[] = {
+        0x05, 0x01, /*  Usage Page (Desktop),       */
+        0x09, 0x06, /*  Usage (Keyboard),           */
+        0xA1, 0x01, /*  Collection (Application),   */
+        0x85, 0x05, /*      Report ID (5),          */
+        0x05, 0x07, /*      Usage Page (Keyboard),  */
+        0x14,       /*      Logical Minimum (0),    */
+        0x25, 0x01, /*      Logical Maximum (1),    */
+        0x75, 0x01, /*      Report Size (1),        */
+        0x95, 0x08, /*      Report Count (8),       */
+        0x81, 0x01, /*      Input (Constant),       */
+        0x95, 0x0C, /*      Report Count (12),      */
+        0x19, 0x3A, /*      Usage Minimum (KB F1),  */
+        0x29, 0x45, /*      Usage Maximum (KB F12), */
+        0x81, 0x02, /*      Input (Variable),       */
+        0x95, 0x0C, /*      Report Count (12),      */
+        0x19, 0x68, /*      Usage Minimum (KB F13), */
+        0x29, 0x73, /*      Usage Maximum (KB F24), */
+        0x81, 0x02, /*      Input (Variable),       */
+        0x95, 0x08, /*      Report Count (8),       */
+        0x81, 0x01, /*      Input (Constant),       */
+        0xC0        /*  End Collection              */
+};
+
 static __u8 *uclogic_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                                         unsigned int *rsize)
 {
@@ -525,6 +605,22 @@ static __u8 *uclogic_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                         break;
                 }
                 break;
+        case USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60:
+                switch (iface_num) {
+                case 0:
+                        if (*rsize == TWHA60_RDESC_ORIG_SIZE0) {
+                                rdesc = twha60_rdesc_fixed0;
+                                *rsize = sizeof(twha60_rdesc_fixed0);
+                        }
+                        break;
+                case 1:
+                        if (*rsize == TWHA60_RDESC_ORIG_SIZE1) {
+                                rdesc = twha60_rdesc_fixed1;
+                                *rsize = sizeof(twha60_rdesc_fixed1);
+                        }
+                        break;
+                }
+                break;
         }
 
         return rdesc;
@@ -543,6 +639,8 @@ static const struct hid_device_id uclogic_devices[] = {
                                 USB_DEVICE_ID_UCLOGIC_TABLET_WP1062) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
                                 USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
+                                USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, uclogic_devices);
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index fe23a1eb586b..2f60da9ed066 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby <jirislaby@gmail.com>
  *  Copyright (c) 2006 Andrew Zabolotny <zap@homelink.ru>
  *  Copyright (c) 2009 Bastien Nocera <hadess@hadess.net>
@@ -33,6 +32,8 @@
 #define PAD_DEVICE_ID   0x0F
 
 #define WAC_CMD_LED_CONTROL     0x20
+#define WAC_CMD_ICON_START_STOP     0x21
+#define WAC_CMD_ICON_TRANSFER       0x26
 
 struct wacom_data {
         __u16 tool;
@@ -69,6 +70,91 @@ static enum power_supply_property wacom_ac_props[] = {
         POWER_SUPPLY_PROP_SCOPE,
 };
 
+static void wacom_scramble(__u8 *image)
+{
+        __u16 mask;
+        __u16 s1;
+        __u16 s2;
+        __u16 r1 ;
+        __u16 r2 ;
+        __u16 r;
+        __u8 buf[256];
+        int i, w, x, y, z;
+
+        for (x = 0; x < 32; x++) {
+                for (y = 0; y < 8; y++)
+                        buf[(8 * x) + (7 - y)] = image[(8 * x) + y];
+        }
+
+        /* Change 76543210 into GECA6420 as required by Intuos4 WL
+         *        HGFEDCBA      HFDB7531
+         */
+        for (x = 0; x < 4; x++) {
+                for (y = 0; y < 4; y++) {
+                        for (z = 0; z < 8; z++) {
+                                mask = 0x0001;
+                                r1 = 0;
+                                r2 = 0;
+                                i = (x << 6) + (y << 4) + z;
+                                s1 = buf[i];
+                                s2 = buf[i+8];
+                                for (w = 0; w < 8; w++) {
+                                        r1 |= (s1 & mask);
+                                        r2 |= (s2 & mask);
+                                        s1 <<= 1;
+                                        s2 <<= 1;
+                                        mask <<= 2;
+                                }
+                                r = r1 | (r2 << 1);
+                                i = (x << 6) + (y << 4) + (z << 1);
+                                image[i] = 0xFF & r;
+                                image[i+1] = (0xFF00 & r) >> 8;
+                        }
+                }
+        }
+}
+
+static void wacom_set_image(struct hid_device *hdev, const char *image,
+                                                __u8 icon_no)
+{
+        __u8 rep_data[68];
+        __u8 p[256];
+        int ret, i, j;
+
+        for (i = 0; i < 256; i++)
+                p[i] = image[i];
+
+        rep_data[0] = WAC_CMD_ICON_START_STOP;
+        rep_data[1] = 0;
+        ret = hdev->hid_output_raw_report(hdev, rep_data, 2,
+                                HID_FEATURE_REPORT);
+        if (ret < 0)
+                goto err;
+
+        rep_data[0] = WAC_CMD_ICON_TRANSFER;
+        rep_data[1] = icon_no & 0x07;
+
+        wacom_scramble(p);
+
+        for (i = 0; i < 4; i++) {
+                for (j = 0; j < 64; j++)
+                        rep_data[j + 3] = p[(i << 6) + j];
+
+                rep_data[2] = i;
+                ret = hdev->hid_output_raw_report(hdev, rep_data, 67,
+                                        HID_FEATURE_REPORT);
+        }
+
+        rep_data[0] = WAC_CMD_ICON_START_STOP;
+        rep_data[1] = 0;
+
+        ret = hdev->hid_output_raw_report(hdev, rep_data, 2,
+                                HID_FEATURE_REPORT);
+
+err:
+        return;
+}
+
 static void wacom_leds_set_brightness(struct led_classdev *led_dev,
                                                 enum led_brightness value)
 {
@@ -91,7 +177,10 @@ static void wacom_leds_set_brightness(struct led_classdev *led_dev,
         if (buf) {
                 buf[0] = WAC_CMD_LED_CONTROL;
                 buf[1] = led;
-                buf[2] = value;
+                buf[2] = value >> 2;
+                buf[3] = value;
+                /* use fixed brightness for OLEDs */
+                buf[4] = 0x08;
                 hdev->hid_output_raw_report(hdev, buf, 9, HID_FEATURE_REPORT);
                 kfree(buf);
         }
@@ -317,6 +406,34 @@ static ssize_t wacom_store_speed(struct device *dev,
 static DEVICE_ATTR(speed, S_IRUGO | S_IWUSR | S_IWGRP,
                 wacom_show_speed, wacom_store_speed);
 
+#define WACOM_STORE(OLED_ID)                                            \
+static ssize_t wacom_oled##OLED_ID##_store(struct device *dev,          \
+                                struct device_attribute *attr,          \
+                                const char *buf, size_t count)          \
+{                                                                       \
+        struct hid_device *hdev = container_of(dev, struct hid_device,  \
+                                dev);                                   \
+                                                                        \
+        if (count != 256)                                               \
+                return -EINVAL;                                         \
+                                                                        \
+        wacom_set_image(hdev, buf, OLED_ID);                            \
+                                                                        \
+        return count;                                                   \
+}                                                                       \
+                                                                        \
+static DEVICE_ATTR(oled##OLED_ID##_img, S_IWUSR | S_IWGRP, NULL,        \
+                                wacom_oled##OLED_ID##_store)
+
+WACOM_STORE(0);
+WACOM_STORE(1);
+WACOM_STORE(2);
+WACOM_STORE(3);
+WACOM_STORE(4);
+WACOM_STORE(5);
+WACOM_STORE(6);
+WACOM_STORE(7);
+
 static int wacom_gr_parse_report(struct hid_device *hdev,
                         struct wacom_data *wdata,
                         struct input_dev *input, unsigned char *data)
@@ -717,17 +834,33 @@ static int wacom_probe(struct hid_device *hdev,
                 hid_warn(hdev,
                          "can't create sysfs speed attribute err: %d\n", ret);
 
+#define OLED_INIT(OLED_ID)                                              \
+        do {                                                            \
+                ret = device_create_file(&hdev->dev,                    \
+                                &dev_attr_oled##OLED_ID##_img);         \
+                if (ret)                                                \
+                        hid_warn(hdev,                                  \
+                         "can't create sysfs oled attribute, err: %d\n", ret);\
+        } while (0)
+
+OLED_INIT(0);
+OLED_INIT(1);
+OLED_INIT(2);
+OLED_INIT(3);
+OLED_INIT(4);
+OLED_INIT(5);
+OLED_INIT(6);
+OLED_INIT(7);
+
         wdata->features = 0;
         wacom_set_features(hdev, 1);
 
         if (hdev->product == USB_DEVICE_ID_WACOM_INTUOS4_BLUETOOTH) {
                 sprintf(hdev->name, "%s", "Wacom Intuos4 WL");
                 ret = wacom_initialize_leds(hdev);
-                if (ret) {
+                if (ret)
                         hid_warn(hdev,
                                  "can't create led attribute, err: %d\n", ret);
-                        goto destroy_leds;
-                }
         }
 
         wdata->battery.properties = wacom_battery_props;
@@ -740,8 +873,8 @@ static int wacom_probe(struct hid_device *hdev,
 
         ret = power_supply_register(&hdev->dev, &wdata->battery);
         if (ret) {
-                hid_warn(hdev, "can't create sysfs battery attribute, err: %d\n",
-                         ret);
+                hid_err(hdev, "can't create sysfs battery attribute, err: %d\n",
+                        ret);
                 goto err_battery;
         }
 
@@ -756,8 +889,8 @@ static int wacom_probe(struct hid_device *hdev,
 
         ret = power_supply_register(&hdev->dev, &wdata->ac);
         if (ret) {
-                hid_warn(hdev,
-                         "can't create ac battery attribute, err: %d\n", ret);
+                hid_err(hdev,
+                        "can't create ac battery attribute, err: %d\n", ret);
                 goto err_ac;
         }
 
@@ -767,10 +900,17 @@ static int wacom_probe(struct hid_device *hdev,
 err_ac:
         power_supply_unregister(&wdata->battery);
 err_battery:
+        wacom_destroy_leds(hdev);
+        device_remove_file(&hdev->dev, &dev_attr_oled0_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled1_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled2_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled3_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled4_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled5_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled6_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled7_img);
         device_remove_file(&hdev->dev, &dev_attr_speed);
         hid_hw_stop(hdev);
-destroy_leds:
-        wacom_destroy_leds(hdev);
 err_free:
         kfree(wdata);
         return ret;
@@ -781,6 +921,14 @@ static void wacom_remove(struct hid_device *hdev)
         struct wacom_data *wdata = hid_get_drvdata(hdev);
 
         wacom_destroy_leds(hdev);
+        device_remove_file(&hdev->dev, &dev_attr_oled0_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled1_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled2_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled3_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled4_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled5_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled6_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled7_img);
         device_remove_file(&hdev->dev, &dev_attr_speed);
         hid_hw_stop(hdev);
 
diff --git a/drivers/hid/hid-waltop.c b/drivers/hid/hid-waltop.c
index 745e4e9a8cf2..bb536ab5941e 100644
--- a/drivers/hid/hid-waltop.c
+++ b/drivers/hid/hid-waltop.c
@@ -638,28 +638,6 @@ static __u8 sirius_battery_free_tablet_rdesc_fixed[] = {
         0xC0                /*  End Collection                      */
 };
 
-static int waltop_probe(struct hid_device *hdev,
-                        const struct hid_device_id *id)
-{
-        int ret;
-
-        ret = hid_parse(hdev);
-        if (ret) {
-                hid_err(hdev, "parse failed\n");
-                goto err;
-        }
-
-        ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
-        if (ret) {
-                hid_err(hdev, "hw start failed\n");
-                goto err;
-        }
-
-        return 0;
-err:
-        return ret;
-}
-
 static __u8 *waltop_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
@@ -776,11 +754,6 @@ static int waltop_raw_event(struct hid_device *hdev, struct hid_report *report,
         return 0;
 }
 
-static void waltop_remove(struct hid_device *hdev)
-{
-        hid_hw_stop(hdev);
-}
-
 static const struct hid_device_id waltop_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP,
                                 USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) },
@@ -803,10 +776,8 @@ MODULE_DEVICE_TABLE(hid, waltop_devices);
 static struct hid_driver waltop_driver = {
         .name = "waltop",
         .id_table = waltop_devices,
-        .probe = waltop_probe,
         .report_fixup = waltop_report_fixup,
         .raw_event = waltop_raw_event,
-        .remove = waltop_remove,
 };
 
 static int __init waltop_init(void)
diff --git a/drivers/hid/hid-wiimote-ext.c b/drivers/hid/hid-wiimote-ext.c
index 0a1805c9b0e5..bc85bf29062e 100644
--- a/drivers/hid/hid-wiimote-ext.c
+++ b/drivers/hid/hid-wiimote-ext.c
@@ -28,12 +28,14 @@ struct wiimote_ext {
         bool mp_plugged;
         bool motionp;
         __u8 ext_type;
+        __u16 calib[4][3];
 };
 
 enum wiiext_type {
         WIIEXT_NONE,            /* placeholder */
         WIIEXT_CLASSIC,         /* Nintendo classic controller */
         WIIEXT_NUNCHUCK,        /* Nintendo nunchuck controller */
+        WIIEXT_BALANCE_BOARD,   /* Nintendo balance board controller */
 };
 
 enum wiiext_keys {
@@ -126,6 +128,7 @@ error:
 static __u8 ext_read(struct wiimote_ext *ext)
 {
         ssize_t ret;
+        __u8 buf[24], i, j, offs = 0;
         __u8 rmem[2], wmem;
         __u8 type = WIIEXT_NONE;
 
@@ -151,6 +154,28 @@ static __u8 ext_read(struct wiimote_ext *ext)
                         type = WIIEXT_NUNCHUCK;
                 else if (rmem[0] == 0x01 && rmem[1] == 0x01)
                         type = WIIEXT_CLASSIC;
+                else if (rmem[0] == 0x04 && rmem[1] == 0x02)
+                        type = WIIEXT_BALANCE_BOARD;
+        }
+
+        /* get balance board calibration data */
+        if (type == WIIEXT_BALANCE_BOARD) {
+                ret = wiimote_cmd_read(ext->wdata, 0xa40024, buf, 12);
+                ret += wiimote_cmd_read(ext->wdata, 0xa40024 + 12,
+                                        buf + 12, 12);
+
+                if (ret != 24) {
+                        type = WIIEXT_NONE;
+                } else {
+                        for (i = 0; i < 3; i++) {
+                                for (j = 0; j < 4; j++) {
+                                        ext->calib[j][i] = buf[offs];
+                                        ext->calib[j][i] <<= 8;
+                                        ext->calib[j][i] |= buf[offs + 1];
+                                        offs += 2;
+                                }
+                        }
+                }
         }
 
         wiimote_cmd_release(ext->wdata);
@@ -509,6 +534,71 @@ static void handler_classic(struct wiimote_ext *ext, const __u8 *payload)
         input_sync(ext->input);
 }
 
+static void handler_balance_board(struct wiimote_ext *ext, const __u8 *payload)
+{
+        __s32 val[4], tmp;
+        unsigned int i;
+
+        /*   Byte |  8  7  6  5  4  3  2  1  |
+         *   -----+--------------------------+
+         *    1   |    Top Right <15:8>      |
+         *    2   |    Top Right  <7:0>      |
+         *   -----+--------------------------+
+         *    3   | Bottom Right <15:8>      |
+         *    4   | Bottom Right  <7:0>      |
+         *   -----+--------------------------+
+         *    5   |     Top Left <15:8>      |
+         *    6   |     Top Left  <7:0>      |
+         *   -----+--------------------------+
+         *    7   |  Bottom Left <15:8>      |
+         *    8   |  Bottom Left  <7:0>      |
+         *   -----+--------------------------+
+         *
+         * These values represent the weight-measurements of the Wii-balance
+         * board with 16bit precision.
+         *
+         * The balance-board is never reported interleaved with motionp.
+         */
+
+        val[0] = payload[0];
+        val[0] <<= 8;
+        val[0] |= payload[1];
+
+        val[1] = payload[2];
+        val[1] <<= 8;
+        val[1] |= payload[3];
+
+        val[2] = payload[4];
+        val[2] <<= 8;
+        val[2] |= payload[5];
+
+        val[3] = payload[6];
+        val[3] <<= 8;
+        val[3] |= payload[7];
+
+        /* apply calibration data */
+        for (i = 0; i < 4; i++) {
+                if (val[i] < ext->calib[i][1]) {
+                        tmp = val[i] - ext->calib[i][0];
+                        tmp *= 1700;
+                        tmp /= ext->calib[i][1] - ext->calib[i][0];
+                } else {
+                        tmp = val[i] - ext->calib[i][1];
+                        tmp *= 1700;
+                        tmp /= ext->calib[i][2] - ext->calib[i][1];
+                        tmp += 1700;
+                }
+                val[i] = tmp;
+        }
+
+        input_report_abs(ext->input, ABS_HAT0X, val[0]);
+        input_report_abs(ext->input, ABS_HAT0Y, val[1]);
+        input_report_abs(ext->input, ABS_HAT1X, val[2]);
+        input_report_abs(ext->input, ABS_HAT1Y, val[3]);
+
+        input_sync(ext->input);
+}
+
 /* call this with state.lock spinlock held */
 void wiiext_handle(struct wiimote_data *wdata, const __u8 *payload)
 {
@@ -523,6 +613,8 @@ void wiiext_handle(struct wiimote_data *wdata, const __u8 *payload)
                 handler_nunchuck(ext, payload);
         } else if (ext->ext_type == WIIEXT_CLASSIC) {
                 handler_classic(ext, payload);
+        } else if (ext->ext_type == WIIEXT_BALANCE_BOARD) {
+                handler_balance_board(ext, payload);
         }
 }
 
@@ -551,6 +643,11 @@ static ssize_t wiiext_show(struct device *dev, struct device_attribute *attr,
                         return sprintf(buf, "motionp+classic\n");
                 else
                         return sprintf(buf, "classic\n");
+        } else if (type == WIIEXT_BALANCE_BOARD) {
+                if (motionp)
+                        return sprintf(buf, "motionp+balanceboard\n");
+                else
+                        return sprintf(buf, "balanceboard\n");
         } else {
                 if (motionp)
                         return sprintf(buf, "motionp\n");
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 3b6f7bf5a77e..17d15bb610d1 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -42,6 +42,7 @@ static struct cdev hidraw_cdev;
 static struct class *hidraw_class;
 static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
 static DEFINE_MUTEX(minors_lock);
+static void drop_ref(struct hidraw *hid, int exists_bit);
 
 static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
@@ -113,7 +114,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
         __u8 *buf;
         int ret = 0;
 
-        if (!hidraw_table[minor]) {
+        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                 ret = -ENODEV;
                 goto out;
         }
@@ -261,7 +262,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
         }
 
         mutex_lock(&minors_lock);
-        if (!hidraw_table[minor]) {
+        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                 err = -ENODEV;
                 goto out_unlock;
         }
@@ -298,36 +299,12 @@ out:
 static int hidraw_release(struct inode * inode, struct file * file)
 {
         unsigned int minor = iminor(inode);
-        struct hidraw *dev;
         struct hidraw_list *list = file->private_data;
-        int ret;
-        int i;
-
-        mutex_lock(&minors_lock);
-        if (!hidraw_table[minor]) {
-                ret = -ENODEV;
-                goto unlock;
-        }
 
+        drop_ref(hidraw_table[minor], 0);
         list_del(&list->node);
-        dev = hidraw_table[minor];
-        if (!--dev->open) {
-                if (list->hidraw->exist) {
-                        hid_hw_power(dev->hid, PM_HINT_NORMAL);
-                        hid_hw_close(dev->hid);
-                } else {
-                        kfree(list->hidraw);
-                }
-        }
-
-        for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
-                kfree(list->buffer[i].value);
         kfree(list);
-        ret = 0;
-unlock:
-        mutex_unlock(&minors_lock);
-
-        return ret;
+        return 0;
 }
 
 static long hidraw_ioctl(struct file *file, unsigned int cmd,
@@ -529,21 +506,7 @@ EXPORT_SYMBOL_GPL(hidraw_connect);
 void hidraw_disconnect(struct hid_device *hid)
 {
         struct hidraw *hidraw = hid->hidraw;
-
-        mutex_lock(&minors_lock);
-        hidraw->exist = 0;
-
-        device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
-
-        hidraw_table[hidraw->minor] = NULL;
-
-        if (hidraw->open) {
-                hid_hw_close(hid);
-                wake_up_interruptible(&hidraw->wait);
-        } else {
-                kfree(hidraw);
-        }
-        mutex_unlock(&minors_lock);
+        drop_ref(hidraw, 1);
 }
 EXPORT_SYMBOL_GPL(hidraw_disconnect);
 
@@ -559,21 +522,28 @@ int __init hidraw_init(void)
 
         if (result < 0) {
                 pr_warn("can't get major number\n");
-                result = 0;
                 goto out;
         }
 
         hidraw_class = class_create(THIS_MODULE, "hidraw");
         if (IS_ERR(hidraw_class)) {
                 result = PTR_ERR(hidraw_class);
-                unregister_chrdev(hidraw_major, "hidraw");
-                goto out;
+                goto error_cdev;
         }
 
         cdev_init(&hidraw_cdev, &hidraw_ops);
-        cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
+        result = cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
+        if (result < 0)
+                goto error_class;
+
 out:
         return result;
+
+error_class:
+        class_destroy(hidraw_class);
+error_cdev:
+        unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
+        goto out;
 }
 
 void hidraw_exit(void)
@@ -585,3 +555,23 @@ void hidraw_exit(void)
         unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
 
 }
+
+static void drop_ref(struct hidraw *hidraw, int exists_bit)
+{
+        mutex_lock(&minors_lock);
+        if (exists_bit) {
+                hid_hw_close(hidraw->hid);
+                hidraw->exist = 0;
+                if (hidraw->open)
+                        wake_up_interruptible(&hidraw->wait);
+        } else {
+                --hidraw->open;
+        }
+
+        if (!hidraw->open && !hidraw->exist) {
+                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+                hidraw_table[hidraw->minor] = NULL;
+                kfree(hidraw);
+        }
+        mutex_unlock(&minors_lock);
+}
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index dedd8e4e5c6d..8e0c4bf94ebc 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1415,20 +1415,20 @@ static int hid_post_reset(struct usb_interface *intf)
          * configuration descriptors passed, we already know that
          * the size of the HID report descriptor has not changed.
          */
-        rdesc = kmalloc(hid->rsize, GFP_KERNEL);
+        rdesc = kmalloc(hid->dev_rsize, GFP_KERNEL);
         if (!rdesc) {
                 dbg_hid("couldn't allocate rdesc memory (post_reset)\n");
                 return 1;
         }
         status = hid_get_class_descriptor(dev,
                                 interface->desc.bInterfaceNumber,
-                                HID_DT_REPORT, rdesc, hid->rsize);
+                                HID_DT_REPORT, rdesc, hid->dev_rsize);
         if (status < 0) {
                 dbg_hid("reading report descriptor failed (post_reset)\n");
                 kfree(rdesc);
                 return 1;
         }
-        status = memcmp(rdesc, hid->rdesc, hid->rsize);
+        status = memcmp(rdesc, hid->dev_rdesc, hid->dev_rsize);
         kfree(rdesc);
         if (status != 0) {
                 dbg_hid("report descriptor changed\n");
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 991e85c7325c..11c7932dc7e6 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -70,12 +70,13 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
-        { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c
index cfec802cf9ca..f915eb1c29f7 100644
--- a/drivers/hwmon/ad7314.c
+++ b/drivers/hwmon/ad7314.c
@@ -87,10 +87,18 @@ static ssize_t ad7314_show_temperature(struct device *dev,
         }
 }
 
+static ssize_t ad7314_show_name(struct device *dev,
+                                struct device_attribute *devattr, char *buf)
+{
+        return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
+
+static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL);
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
                           ad7314_show_temperature, NULL, 0);
 
 static struct attribute *ad7314_attributes[] = {
+        &dev_attr_name.attr,
         &sensor_dev_attr_temp1_input.dev_attr.attr,
         NULL,
 };
diff --git a/drivers/hwmon/ads7871.c b/drivers/hwmon/ads7871.c
index e65c6e45d36b..7bf4ce3d405e 100644
--- a/drivers/hwmon/ads7871.c
+++ b/drivers/hwmon/ads7871.c
@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct device *dev,
         }
 }
 
+static ssize_t ads7871_show_name(struct device *dev,
+                                 struct device_attribute *devattr, char *buf)
+{
+        return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
+
 static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0);
 static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1);
 static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_voltage, NULL, 5);
 static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6);
 static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7);
 
+static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL);
+
 static struct attribute *ads7871_attributes[] = {
         &sensor_dev_attr_in0_input.dev_attr.attr,
         &sensor_dev_attr_in1_input.dev_attr.attr,
@@ -157,6 +165,7 @@ static struct attribute *ads7871_attributes[] = {
         &sensor_dev_attr_in5_input.dev_attr.attr,
         &sensor_dev_attr_in6_input.dev_attr.attr,
         &sensor_dev_attr_in7_input.dev_attr.attr,
+        &dev_attr_name.attr,
         NULL
 };
 
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 282708860517..8f3f6f2c45fd 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -53,10 +53,10 @@
 
 #define APPLESMC_MAX_DATA_LENGTH 32
 
-/* wait up to 32 ms for a status change. */
+/* wait up to 128 ms for a status change. */
 #define APPLESMC_MIN_WAIT       0x0010
 #define APPLESMC_RETRY_WAIT     0x0100
-#define APPLESMC_MAX_WAIT       0x8000
+#define APPLESMC_MAX_WAIT       0x20000
 
 #define APPLESMC_READ_CMD       0x10
 #define APPLESMC_WRITE_CMD      0x11
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 0fa356fe82cc..984a3f13923b 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -815,17 +815,20 @@ static int __init coretemp_init(void)
         if (err)
                 goto exit;
 
+        get_online_cpus();
         for_each_online_cpu(i)
                 get_core_online(i);
 
 #ifndef CONFIG_HOTPLUG_CPU
         if (list_empty(&pdev_list)) {
+                put_online_cpus();
                 err = -ENODEV;
                 goto exit_driver_unreg;
         }
 #endif
 
         register_hotcpu_notifier(&coretemp_cpu_notifier);
+        put_online_cpus();
         return 0;
 
 #ifndef CONFIG_HOTPLUG_CPU
@@ -840,6 +843,7 @@ static void __exit coretemp_exit(void)
 {
         struct pdev_entry *p, *n;
 
+        get_online_cpus();
         unregister_hotcpu_notifier(&coretemp_cpu_notifier);
         mutex_lock(&pdev_list_mutex);
         list_for_each_entry_safe(p, n, &pdev_list, list) {
@@ -848,6 +852,7 @@ static void __exit coretemp_exit(void)
                 kfree(p);
         }
         mutex_unlock(&pdev_list_mutex);
+        put_online_cpus();
         platform_driver_unregister(&coretemp_driver);
 }
 
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index 2764b78a784b..af69073b3fe8 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -129,12 +129,12 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)
  * counter saturations resulting in bogus power readings.
  * We correct this value ourselves to cope with older BIOSes.
  */
-static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
+static const struct pci_device_id affected_device[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
         { 0 }
 };
 
-static void __devinit tweak_runavg_range(struct pci_dev *pdev)
+static void tweak_runavg_range(struct pci_dev *pdev)
 {
         u32 val;
 
@@ -158,6 +158,16 @@ static void __devinit tweak_runavg_range(struct pci_dev *pdev)
                 REG_TDP_RUNNING_AVERAGE, val);
 }
 
+#ifdef CONFIG_PM
+static int fam15h_power_resume(struct pci_dev *pdev)
+{
+        tweak_runavg_range(pdev);
+        return 0;
+}
+#else
+#define fam15h_power_resume NULL
+#endif
+
 static void __devinit fam15h_power_init_data(struct pci_dev *f4,
                                              struct fam15h_power_data *data)
 {
@@ -256,6 +266,7 @@ static struct pci_driver fam15h_power_driver = {
         .id_table = fam15h_power_id_table,
         .probe = fam15h_power_probe,
         .remove = __devexit_p(fam15h_power_remove),
+        .resume = fam15h_power_resume,
 };
 
 module_pci_driver(fam15h_power_driver);
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index 7f3f4a385729..602148299f68 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -69,22 +69,6 @@ struct ina2xx_data {
         u16 regs[INA2XX_MAX_REGISTERS];
 };
 
-int ina2xx_read_word(struct i2c_client *client, int reg)
-{
-        int val = i2c_smbus_read_word_data(client, reg);
-        if (unlikely(val < 0)) {
-                dev_dbg(&client->dev,
-                        "Failed to read register: %d\n", reg);
-                return val;
-        }
-        return be16_to_cpu(val);
-}
-
-void ina2xx_write_word(struct i2c_client *client, int reg, int data)
-{
-        i2c_smbus_write_word_data(client, reg, cpu_to_be16(data));
-}
-
 static struct ina2xx_data *ina2xx_update_device(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
@@ -102,7 +86,7 @@ static struct ina2xx_data *ina2xx_update_device(struct device *dev)
 
                 /* Read all registers */
                 for (i = 0; i < data->registers; i++) {
-                        int rv = ina2xx_read_word(client, i);
+                        int rv = i2c_smbus_read_word_swapped(client, i);
                         if (rv < 0) {
                                 ret = ERR_PTR(rv);
                                 goto abort;
@@ -279,22 +263,26 @@ static int ina2xx_probe(struct i2c_client *client,
         switch (data->kind) {
         case ina219:
                 /* device configuration */
-                ina2xx_write_word(client, INA2XX_CONFIG, INA219_CONFIG_DEFAULT);
+                i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+                                             INA219_CONFIG_DEFAULT);
 
                 /* set current LSB to 1mA, shunt is in uOhms */
                 /* (equation 13 in datasheet) */
-                ina2xx_write_word(client, INA2XX_CALIBRATION, 40960000 / shunt);
+                i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+                                             40960000 / shunt);
                 dev_info(&client->dev,
                          "power monitor INA219 (Rshunt = %li uOhm)\n", shunt);
                 data->registers = INA219_REGISTERS;
                 break;
         case ina226:
                 /* device configuration */
-                ina2xx_write_word(client, INA2XX_CONFIG, INA226_CONFIG_DEFAULT);
+                i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+                                             INA226_CONFIG_DEFAULT);
 
                 /* set current LSB to 1mA, shunt is in uOhms */
                 /* (equation 1 in datasheet)*/
-                ina2xx_write_word(client, INA2XX_CALIBRATION, 5120000 / shunt);
+                i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+                                             5120000 / shunt);
                 dev_info(&client->dev,
                          "power monitor INA226 (Rshunt = %li uOhm)\n", shunt);
                 data->registers = INA226_REGISTERS;
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index 0018c7dd0097..1a174f0a3cde 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -44,12 +44,13 @@ static ssize_t madc_read(struct device *dev,
                          struct device_attribute *devattr, char *buf)
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct twl4030_madc_request req;
+        struct twl4030_madc_request req = {
+                .channels = 1 << attr->index,
+                .method = TWL4030_MADC_SW2,
+                .type = TWL4030_MADC_WAIT,
+        };
         long val;
 
-        req.channels = (1 << attr->index);
-        req.method = TWL4030_MADC_SW2;
-        req.func_cb = NULL;
         val = twl4030_madc_conversion(&req);
         if (val < 0)
                 return val;
diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c
index ee4ebc198a94..2e56c6ce9fb6 100644
--- a/drivers/hwmon/via-cputemp.c
+++ b/drivers/hwmon/via-cputemp.c
@@ -328,6 +328,7 @@ static int __init via_cputemp_init(void)
         if (err)
                 goto exit;
 
+        get_online_cpus();
         for_each_online_cpu(i) {
                 struct cpuinfo_x86 *c = &cpu_data(i);
 
@@ -347,12 +348,14 @@ static int __init via_cputemp_init(void)
 
 #ifndef CONFIG_HOTPLUG_CPU
         if (list_empty(&pdev_list)) {
+                put_online_cpus();
                 err = -ENODEV;
                 goto exit_driver_unreg;
         }
 #endif
 
         register_hotcpu_notifier(&via_cputemp_cpu_notifier);
+        put_online_cpus();
         return 0;
 
 #ifndef CONFIG_HOTPLUG_CPU
@@ -367,6 +370,7 @@ static void __exit via_cputemp_exit(void)
 {
         struct pdev_entry *p, *n;
 
+        get_online_cpus();
         unregister_hotcpu_notifier(&via_cputemp_cpu_notifier);
         mutex_lock(&pdev_list_mutex);
         list_for_each_entry_safe(p, n, &pdev_list, list) {
@@ -375,6 +379,7 @@ static void __exit via_cputemp_exit(void)
                 kfree(p);
         }
         mutex_unlock(&pdev_list_mutex);
+        put_online_cpus();
         platform_driver_unregister(&via_cputemp_driver);
 }
 
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index 1201a15784c3..db713c0dfba4 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -552,7 +552,7 @@ EXPORT_SYMBOL_GPL(hwspin_lock_request_specific);
  */
 int hwspin_lock_free(struct hwspinlock *hwlock)
 {
-        struct device *dev = hwlock->bank->dev;
+        struct device *dev;
         struct hwspinlock *tmp;
         int ret;
 
@@ -561,6 +561,7 @@ int hwspin_lock_free(struct hwspinlock *hwlock)
                 return -EINVAL;
         }
 
+        dev = hwlock->bank->dev;
         mutex_lock(&hwspinlock_tree_lock);
 
         /* make sure the hwspinlock is used */
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 73133b1063f0..6f5f98d69af7 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -476,17 +476,17 @@ static int pca_init(struct i2c_adapter *adap)
                 /* To avoid integer overflow, use clock/100 for calculations */
                 clock = pca_clock(pca_data) / 100;
 
-                if (pca_data->i2c_clock > 10000) {
+                if (pca_data->i2c_clock > 1000000) {
                         mode = I2C_PCA_MODE_TURBO;
                         min_tlow = 14;
                         min_thi  = 5;
                         raise_fall_time = 22; /* Raise 11e-8s, Fall 11e-8s */
-                } else if (pca_data->i2c_clock > 4000) {
+                } else if (pca_data->i2c_clock > 400000) {
                         mode = I2C_PCA_MODE_FASTP;
                         min_tlow = 17;
                         min_thi  = 9;
                         raise_fall_time = 22; /* Raise 11e-8s, Fall 11e-8s */
-                } else if (pca_data->i2c_clock > 1000) {
+                } else if (pca_data->i2c_clock > 100000) {
                         mode = I2C_PCA_MODE_FAST;
                         min_tlow = 44;
                         min_thi  = 20;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index b4aaa1bd6728..970a1612e795 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -104,6 +104,7 @@ config I2C_I801
             DH89xxCC (PCH)
             Panther Point (PCH)
             Lynx Point (PCH)
+            Lynx Point-LP (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
@@ -354,9 +355,13 @@ config I2C_DAVINCI
           devices such as DaVinci NIC.
           For details please see http://www.ti.com/davinci
 
+config I2C_DESIGNWARE_CORE
+        tristate
+
 config I2C_DESIGNWARE_PLATFORM
         tristate "Synopsys DesignWare Platform"
         depends on HAVE_CLK
+        select I2C_DESIGNWARE_CORE
         help
           If you say yes to this option, support will be included for the
           Synopsys DesignWare I2C adapter. Only master mode is supported.
@@ -367,6 +372,7 @@ config I2C_DESIGNWARE_PLATFORM
 config I2C_DESIGNWARE_PCI
         tristate "Synopsys DesignWare PCI"
         depends on PCI
+        select I2C_DESIGNWARE_CORE
         help
           If you say yes to this option, support will be included for the
           Synopsys DesignWare I2C adapter. Only master mode is supported.
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index ce3c2be7fb40..37c4182cc98b 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -33,10 +33,11 @@ obj-$(CONFIG_I2C_AU1550)	+= i2c-au1550.o
 obj-$(CONFIG_I2C_BLACKFIN_TWI)  += i2c-bfin-twi.o
 obj-$(CONFIG_I2C_CPM)           += i2c-cpm.o
 obj-$(CONFIG_I2C_DAVINCI)       += i2c-davinci.o
+obj-$(CONFIG_I2C_DESIGNWARE_CORE)       += i2c-designware-core.o
 obj-$(CONFIG_I2C_DESIGNWARE_PLATFORM)   += i2c-designware-platform.o
-i2c-designware-platform-objs := i2c-designware-platdrv.o i2c-designware-core.o
+i2c-designware-platform-objs := i2c-designware-platdrv.o
 obj-$(CONFIG_I2C_DESIGNWARE_PCI)        += i2c-designware-pci.o
-i2c-designware-pci-objs := i2c-designware-pcidrv.o i2c-designware-core.o
+i2c-designware-pci-objs := i2c-designware-pcidrv.o
 obj-$(CONFIG_I2C_EG20T)         += i2c-eg20t.o
 obj-$(CONFIG_I2C_GPIO)          += i2c-gpio.o
 obj-$(CONFIG_I2C_HIGHLANDER)    += i2c-highlander.o
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 1e48bec80edf..7b8ebbefb581 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -25,6 +25,7 @@
  * ----------------------------------------------------------------------------
  *
  */
+#include <linux/export.h>
 #include <linux/clk.h>
 #include <linux/errno.h>
 #include <linux/err.h>
@@ -316,6 +317,7 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         dw_writel(dev, dev->master_cfg , DW_IC_CON);
         return 0;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_init);
 
 /*
  * Waiting for bus not busy
@@ -568,12 +570,14 @@ done:
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_xfer);
 
 u32 i2c_dw_func(struct i2c_adapter *adap)
 {
         struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
         return dev->functionality;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_func);
 
 static u32 i2c_dw_read_clear_intrbits(struct dw_i2c_dev *dev)
 {
@@ -678,17 +682,20 @@ tx_aborted:
 
         return IRQ_HANDLED;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_isr);
 
 void i2c_dw_enable(struct dw_i2c_dev *dev)
 {
        /* Enable the adapter */
         dw_writel(dev, 1, DW_IC_ENABLE);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_enable);
 
 u32 i2c_dw_is_enabled(struct dw_i2c_dev *dev)
 {
         return dw_readl(dev, DW_IC_ENABLE);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_is_enabled);
 
 void i2c_dw_disable(struct dw_i2c_dev *dev)
 {
@@ -699,18 +706,22 @@ void i2c_dw_disable(struct dw_i2c_dev *dev)
         dw_writel(dev, 0, DW_IC_INTR_MASK);
         dw_readl(dev, DW_IC_CLR_INTR);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_disable);
 
 void i2c_dw_clear_int(struct dw_i2c_dev *dev)
 {
         dw_readl(dev, DW_IC_CLR_INTR);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_clear_int);
 
 void i2c_dw_disable_int(struct dw_i2c_dev *dev)
 {
         dw_writel(dev, 0, DW_IC_INTR_MASK);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_disable_int);
 
 u32 i2c_dw_read_comp_param(struct dw_i2c_dev *dev)
 {
         return dw_readl(dev, DW_IC_COMP_PARAM_1);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_read_comp_param);
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 898dcf9c7ade..33e9b0c09af2 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -52,6 +52,7 @@
   DH89xxCC (PCH)        0x2330     32     hard     yes     yes     yes
   Panther Point (PCH)   0x1e22     32     hard     yes     yes     yes
   Lynx Point (PCH)      0x8c22     32     hard     yes     yes     yes
+  Lynx Point-LP (PCH)   0x9c22     32     hard     yes     yes     yes
 
   Features supported by this driver:
   Software PEC                     no
@@ -155,6 +156,7 @@
 #define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
 #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_SMBUS     0x8c22
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS  0x9c22
 
 struct i801_priv {
         struct i2c_adapter adapter;
@@ -771,6 +773,7 @@ static DEFINE_PCI_DEVICE_TABLE(i801_ids) = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PANTHERPOINT_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNXPOINT_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS) },
         { 0, }
 };
 
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 088c5c1ed17d..51f05b8520ed 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -365,10 +365,6 @@ static int mxs_i2c_get_ofdata(struct mxs_i2c_dev *i2c)
         struct device_node *node = dev->of_node;
         int ret;
 
-        if (!node)
-                return -EINVAL;
-
-        i2c->speed = &mxs_i2c_95kHz_config;
         ret = of_property_read_u32(node, "clock-frequency", &speed);
         if (ret)
                 dev_warn(dev, "No I2C speed selected, using 100kHz\n");
@@ -419,10 +415,13 @@ static int __devinit mxs_i2c_probe(struct platform_device *pdev)
                 return err;
 
         i2c->dev = dev;
+        i2c->speed = &mxs_i2c_95kHz_config;
 
-        err = mxs_i2c_get_ofdata(i2c);
-        if (err)
-                return err;
+        if (dev->of_node) {
+                err = mxs_i2c_get_ofdata(i2c);
+                if (err)
+                        return err;
+        }
 
         platform_set_drvdata(pdev, i2c);
 
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 5d54416770b0..8488bddfe465 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -48,8 +48,9 @@ enum {
         mcntrl_afie = 0x00000002,
         mcntrl_naie = 0x00000004,
         mcntrl_drmie = 0x00000008,
-        mcntrl_daie = 0x00000020,
-        mcntrl_rffie = 0x00000040,
+        mcntrl_drsie = 0x00000010,
+        mcntrl_rffie = 0x00000020,
+        mcntrl_daie = 0x00000040,
         mcntrl_tffie = 0x00000080,
         mcntrl_reset = 0x00000100,
         mcntrl_cdbmode = 0x00000400,
@@ -290,31 +291,37 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data)
          * or we didn't 'ask' for it yet.
          */
         if (ioread32(I2C_REG_STS(alg_data)) & mstatus_rfe) {
-                dev_dbg(&alg_data->adapter.dev,
-                        "%s(): Write dummy data to fill Rx-fifo...\n",
-                        __func__);
+                /* 'Asking' is done asynchronously, e.g. dummy TX of several
+                 * bytes is done before the first actual RX arrives in FIFO.
+                 * Therefore, ordered bytes (via TX) are counted separately.
+                 */
+                if (alg_data->mif.order) {
+                        dev_dbg(&alg_data->adapter.dev,
+                                "%s(): Write dummy data to fill Rx-fifo...\n",
+                                __func__);
 
-                if (alg_data->mif.len == 1) {
-                        /* Last byte, do not acknowledge next rcv. */
-                        val |= stop_bit;
+                        if (alg_data->mif.order == 1) {
+                                /* Last byte, do not acknowledge next rcv. */
+                                val |= stop_bit;
+
+                                /*
+                                 * Enable interrupt RFDAIE (data in Rx fifo),
+                                 * and disable DRMIE (need data for Tx)
+                                 */
+                                ctl = ioread32(I2C_REG_CTL(alg_data));
+                                ctl |= mcntrl_rffie | mcntrl_daie;
+                                ctl &= ~mcntrl_drmie;
+                                iowrite32(ctl, I2C_REG_CTL(alg_data));
+                        }
 
                         /*
-                         * Enable interrupt RFDAIE (data in Rx fifo),
-                         * and disable DRMIE (need data for Tx)
+                         * Now we'll 'ask' for data:
+                         * For each byte we want to receive, we must
+                         * write a (dummy) byte to the Tx-FIFO.
                          */
-                        ctl = ioread32(I2C_REG_CTL(alg_data));
-                        ctl |= mcntrl_rffie | mcntrl_daie;
-                        ctl &= ~mcntrl_drmie;
-                        iowrite32(ctl, I2C_REG_CTL(alg_data));
+                        iowrite32(val, I2C_REG_TX(alg_data));
+                        alg_data->mif.order--;
                 }
-
-                /*
-                 * Now we'll 'ask' for data:
-                 * For each byte we want to receive, we must
-                 * write a (dummy) byte to the Tx-FIFO.
-                 */
-                iowrite32(val, I2C_REG_TX(alg_data));
-
                 return 0;
         }
 
@@ -514,6 +521,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 
                 alg_data->mif.buf = pmsg->buf;
                 alg_data->mif.len = pmsg->len;
+                alg_data->mif.order = pmsg->len;
                 alg_data->mif.mode = (pmsg->flags & I2C_M_RD) ?
                         I2C_SMBUS_READ : I2C_SMBUS_WRITE;
                 alg_data->mif.ret = 0;
@@ -566,6 +574,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
         /* Cleanup to be sure... */
         alg_data->mif.buf = NULL;
         alg_data->mif.len = 0;
+        alg_data->mif.order = 0;
 
         dev_dbg(&alg_data->adapter.dev, "%s(): exiting, stat = %x\n",
                 __func__, ioread32(I2C_REG_STS(alg_data)));
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 2efa56c5ff2c..2091ae8f539a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -637,6 +637,22 @@ static void i2c_adapter_dev_release(struct device *dev)
 }
 
 /*
+ * This function is only needed for mutex_lock_nested, so it is never
+ * called unless locking correctness checking is enabled. Thus we
+ * make it inline to avoid a compiler warning. That's what gcc ends up
+ * doing anyway.
+ */
+static inline unsigned int i2c_adapter_depth(struct i2c_adapter *adapter)
+{
+        unsigned int depth = 0;
+
+        while ((adapter = i2c_parent_is_i2c_adapter(adapter)))
+                depth++;
+
+        return depth;
+}
+
+/*
  * Let users instantiate I2C devices through sysfs. This can be used when
  * platform initialization code doesn't contain the proper data for
  * whatever reason. Also useful for drivers that do device detection and
@@ -726,7 +742,8 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
 
         /* Make sure the device was added through sysfs */
         res = -ENOENT;
-        mutex_lock(&adap->userspace_clients_lock);
+        mutex_lock_nested(&adap->userspace_clients_lock,
+                          i2c_adapter_depth(adap));
         list_for_each_entry_safe(client, next, &adap->userspace_clients,
                                  detected) {
                 if (client->addr == addr) {
@@ -1073,7 +1090,8 @@ int i2c_del_adapter(struct i2c_adapter *adap)
                 return res;
 
         /* Remove devices instantiated from sysfs */
-        mutex_lock(&adap->userspace_clients_lock);
+        mutex_lock_nested(&adap->userspace_clients_lock,
+                          i2c_adapter_depth(adap));
         list_for_each_entry_safe(client, next, &adap->userspace_clients,
                                  detected) {
                 dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index f61780a02374..3bd5540238a7 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -617,7 +617,7 @@ static int __devinit at91_adc_probe(struct platform_device *pdev)
         st->adc_clk = clk_get(&pdev->dev, "adc_op_clk");
         if (IS_ERR(st->adc_clk)) {
                 dev_err(&pdev->dev, "Failed to get the ADC clock.\n");
-                ret = PTR_ERR(st->clk);
+                ret = PTR_ERR(st->adc_clk);
                 goto error_disable_clk;
         }
 
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 51f42061dae9..6cfd4d8fd0bd 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1361,11 +1361,11 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         struct tid_info *t = dev->rdev.lldi.tids;
 
         ep = lookup_tid(t, tid);
-        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         if (!ep) {
                 printk(KERN_WARNING MOD "Abort rpl to freed endpoint\n");
                 return 0;
         }
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case ABORTING:
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 53589000fd07..8615d7cf7e01 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -42,6 +42,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/smpboot.h>
 
 #include "ehca_classes.h"
 #include "ehca_irq.h"
@@ -652,7 +653,7 @@ void ehca_tasklet_eq(unsigned long data)
         ehca_process_eq((struct ehca_shca*)data, 1);
 }
 
-static inline int find_next_online_cpu(struct ehca_comp_pool *pool)
+static int find_next_online_cpu(struct ehca_comp_pool *pool)
 {
         int cpu;
         unsigned long flags;
@@ -662,17 +663,20 @@ static inline int find_next_online_cpu(struct ehca_comp_pool *pool)
                 ehca_dmp(cpu_online_mask, cpumask_size(), "");
 
         spin_lock_irqsave(&pool->last_cpu_lock, flags);
-        cpu = cpumask_next(pool->last_cpu, cpu_online_mask);
-        if (cpu >= nr_cpu_ids)
-                cpu = cpumask_first(cpu_online_mask);
-        pool->last_cpu = cpu;
+        do {
+                cpu = cpumask_next(pool->last_cpu, cpu_online_mask);
+                if (cpu >= nr_cpu_ids)
+                        cpu = cpumask_first(cpu_online_mask);
+                pool->last_cpu = cpu;
+        } while (!per_cpu_ptr(pool->cpu_comp_tasks, cpu)->active);
         spin_unlock_irqrestore(&pool->last_cpu_lock, flags);
 
         return cpu;
 }
 
 static void __queue_comp_task(struct ehca_cq *__cq,
-                              struct ehca_cpu_comp_task *cct)
+                              struct ehca_cpu_comp_task *cct,
+                              struct task_struct *thread)
 {
         unsigned long flags;
 
@@ -683,7 +687,7 @@ static void __queue_comp_task(struct ehca_cq *__cq,
                 __cq->nr_callbacks++;
                 list_add_tail(&__cq->entry, &cct->cq_list);
                 cct->cq_jobs++;
-                wake_up(&cct->wait_queue);
+                wake_up_process(thread);
         } else
                 __cq->nr_callbacks++;
 
@@ -695,6 +699,7 @@ static void queue_comp_task(struct ehca_cq *__cq)
 {
         int cpu_id;
         struct ehca_cpu_comp_task *cct;
+        struct task_struct *thread;
         int cq_jobs;
         unsigned long flags;
 
@@ -702,7 +707,8 @@ static void queue_comp_task(struct ehca_cq *__cq)
         BUG_ON(!cpu_online(cpu_id));
 
         cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
-        BUG_ON(!cct);
+        thread = *per_cpu_ptr(pool->cpu_comp_threads, cpu_id);
+        BUG_ON(!cct || !thread);
 
         spin_lock_irqsave(&cct->task_lock, flags);
         cq_jobs = cct->cq_jobs;
@@ -710,28 +716,25 @@ static void queue_comp_task(struct ehca_cq *__cq)
         if (cq_jobs > 0) {
                 cpu_id = find_next_online_cpu(pool);
                 cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
-                BUG_ON(!cct);
+                thread = *per_cpu_ptr(pool->cpu_comp_threads, cpu_id);
+                BUG_ON(!cct || !thread);
         }
-
-        __queue_comp_task(__cq, cct);
+        __queue_comp_task(__cq, cct, thread);
 }
 
 static void run_comp_task(struct ehca_cpu_comp_task *cct)
 {
         struct ehca_cq *cq;
-        unsigned long flags;
-
-        spin_lock_irqsave(&cct->task_lock, flags);
 
         while (!list_empty(&cct->cq_list)) {
                 cq = list_entry(cct->cq_list.next, struct ehca_cq, entry);
-                spin_unlock_irqrestore(&cct->task_lock, flags);
+                spin_unlock_irq(&cct->task_lock);
 
                 comp_event_callback(cq);
                 if (atomic_dec_and_test(&cq->nr_events))
                         wake_up(&cq->wait_completion);
 
-                spin_lock_irqsave(&cct->task_lock, flags);
+                spin_lock_irq(&cct->task_lock);
                 spin_lock(&cq->task_lock);
                 cq->nr_callbacks--;
                 if (!cq->nr_callbacks) {
@@ -740,159 +743,76 @@ static void run_comp_task(struct ehca_cpu_comp_task *cct)
                 }
                 spin_unlock(&cq->task_lock);
         }
-
-        spin_unlock_irqrestore(&cct->task_lock, flags);
 }
 
-static int comp_task(void *__cct)
+static void comp_task_park(unsigned int cpu)
 {
-        struct ehca_cpu_comp_task *cct = __cct;
-        int cql_empty;
-        DECLARE_WAITQUEUE(wait, current);
-
-        set_current_state(TASK_INTERRUPTIBLE);
-        while (!kthread_should_stop()) {
-                add_wait_queue(&cct->wait_queue, &wait);
-
-                spin_lock_irq(&cct->task_lock);
-                cql_empty = list_empty(&cct->cq_list);
-                spin_unlock_irq(&cct->task_lock);
-                if (cql_empty)
-                        schedule();
-                else
-                        __set_current_state(TASK_RUNNING);
-
-                remove_wait_queue(&cct->wait_queue, &wait);
+        struct ehca_cpu_comp_task *cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
+        struct ehca_cpu_comp_task *target;
+        struct task_struct *thread;
+        struct ehca_cq *cq, *tmp;
+        LIST_HEAD(list);
 
-                spin_lock_irq(&cct->task_lock);
-                cql_empty = list_empty(&cct->cq_list);
-                spin_unlock_irq(&cct->task_lock);
-                if (!cql_empty)
-                        run_comp_task(__cct);
+        spin_lock_irq(&cct->task_lock);
+        cct->cq_jobs = 0;
+        cct->active = 0;
+        list_splice_init(&cct->cq_list, &list);
+        spin_unlock_irq(&cct->task_lock);
 
-                set_current_state(TASK_INTERRUPTIBLE);
+        cpu = find_next_online_cpu(pool);
+        target = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
+        thread = *per_cpu_ptr(pool->cpu_comp_threads, cpu);
+        spin_lock_irq(&target->task_lock);
+        list_for_each_entry_safe(cq, tmp, &list, entry) {
+                list_del(&cq->entry);
+                __queue_comp_task(cq, target, thread);
         }
-        __set_current_state(TASK_RUNNING);
-
-        return 0;
-}
-
-static struct task_struct *create_comp_task(struct ehca_comp_pool *pool,
-                                            int cpu)
-{
-        struct ehca_cpu_comp_task *cct;
-
-        cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-        spin_lock_init(&cct->task_lock);
-        INIT_LIST_HEAD(&cct->cq_list);
-        init_waitqueue_head(&cct->wait_queue);
-        cct->task = kthread_create_on_node(comp_task, cct, cpu_to_node(cpu),
-                                           "ehca_comp/%d", cpu);
-
-        return cct->task;
+        spin_unlock_irq(&target->task_lock);
 }
 
-static void destroy_comp_task(struct ehca_comp_pool *pool,
-                              int cpu)
+static void comp_task_stop(unsigned int cpu, bool online)
 {
-        struct ehca_cpu_comp_task *cct;
-        struct task_struct *task;
-        unsigned long flags_cct;
-
-        cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-
-        spin_lock_irqsave(&cct->task_lock, flags_cct);
+        struct ehca_cpu_comp_task *cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
 
-        task = cct->task;
-        cct->task = NULL;
+        spin_lock_irq(&cct->task_lock);
         cct->cq_jobs = 0;
-
-        spin_unlock_irqrestore(&cct->task_lock, flags_cct);
-
-        if (task)
-                kthread_stop(task);
+        cct->active = 0;
+        WARN_ON(!list_empty(&cct->cq_list));
+        spin_unlock_irq(&cct->task_lock);
 }
 
-static void __cpuinit take_over_work(struct ehca_comp_pool *pool, int cpu)
+static int comp_task_should_run(unsigned int cpu)
 {
         struct ehca_cpu_comp_task *cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-        LIST_HEAD(list);
-        struct ehca_cq *cq;
-        unsigned long flags_cct;
-
-        spin_lock_irqsave(&cct->task_lock, flags_cct);
-
-        list_splice_init(&cct->cq_list, &list);
-
-        while (!list_empty(&list)) {
-                cq = list_entry(cct->cq_list.next, struct ehca_cq, entry);
-
-                list_del(&cq->entry);
-                __queue_comp_task(cq, this_cpu_ptr(pool->cpu_comp_tasks));
-        }
-
-        spin_unlock_irqrestore(&cct->task_lock, flags_cct);
 
+        return cct->cq_jobs;
 }
 
-static int __cpuinit comp_pool_callback(struct notifier_block *nfb,
-                                        unsigned long action,
-                                        void *hcpu)
+static void comp_task(unsigned int cpu)
 {
-        unsigned int cpu = (unsigned long)hcpu;
-        struct ehca_cpu_comp_task *cct;
+        struct ehca_cpu_comp_task *cct = this_cpu_ptr(pool->cpu_comp_tasks);
+        int cql_empty;
 
-        switch (action) {
-        case CPU_UP_PREPARE:
-        case CPU_UP_PREPARE_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_PREPARE)", cpu);
-                if (!create_comp_task(pool, cpu)) {
-                        ehca_gen_err("Can't create comp_task for cpu: %x", cpu);
-                        return notifier_from_errno(-ENOMEM);
-                }
-                break;
-        case CPU_UP_CANCELED:
-        case CPU_UP_CANCELED_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_CANCELED)", cpu);
-                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-                kthread_bind(cct->task, cpumask_any(cpu_online_mask));
-                destroy_comp_task(pool, cpu);
-                break;
-        case CPU_ONLINE:
-        case CPU_ONLINE_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_ONLINE)", cpu);
-                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-                kthread_bind(cct->task, cpu);
-                wake_up_process(cct->task);
-                break;
-        case CPU_DOWN_PREPARE:
-        case CPU_DOWN_PREPARE_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_DOWN_PREPARE)", cpu);
-                break;
-        case CPU_DOWN_FAILED:
-        case CPU_DOWN_FAILED_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_DOWN_FAILED)", cpu);
-                break;
-        case CPU_DEAD:
-        case CPU_DEAD_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_DEAD)", cpu);
-                destroy_comp_task(pool, cpu);
-                take_over_work(pool, cpu);
-                break;
+        spin_lock_irq(&cct->task_lock);
+        cql_empty = list_empty(&cct->cq_list);
+        if (!cql_empty) {
+                __set_current_state(TASK_RUNNING);
+                run_comp_task(cct);
         }
-
-        return NOTIFY_OK;
+        spin_unlock_irq(&cct->task_lock);
 }
 
-static struct notifier_block comp_pool_callback_nb __cpuinitdata = {
-        .notifier_call  = comp_pool_callback,
-        .priority       = 0,
+static struct smp_hotplug_thread comp_pool_threads = {
+        .thread_should_run      = comp_task_should_run,
+        .thread_fn              = comp_task,
+        .thread_comm            = "ehca_comp/%u",
+        .cleanup                = comp_task_stop,
+        .park                   = comp_task_park,
 };
 
 int ehca_create_comp_pool(void)
 {
-        int cpu;
-        struct task_struct *task;
+        int cpu, ret = -ENOMEM;
 
         if (!ehca_scaling_code)
                 return 0;
@@ -905,38 +825,46 @@ int ehca_create_comp_pool(void)
         pool->last_cpu = cpumask_any(cpu_online_mask);
 
         pool->cpu_comp_tasks = alloc_percpu(struct ehca_cpu_comp_task);
-        if (pool->cpu_comp_tasks == NULL) {
-                kfree(pool);
-                return -EINVAL;
-        }
+        if (!pool->cpu_comp_tasks)
+                goto out_pool;
 
-        for_each_online_cpu(cpu) {
-                task = create_comp_task(pool, cpu);
-                if (task) {
-                        kthread_bind(task, cpu);
-                        wake_up_process(task);
-                }
+        pool->cpu_comp_threads = alloc_percpu(struct task_struct *);
+        if (!pool->cpu_comp_threads)
+                goto out_tasks;
+
+        for_each_present_cpu(cpu) {
+                struct ehca_cpu_comp_task *cct;
+
+                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
+                spin_lock_init(&cct->task_lock);
+                INIT_LIST_HEAD(&cct->cq_list);
         }
 
-        register_hotcpu_notifier(&comp_pool_callback_nb);
+        comp_pool_threads.store = pool->cpu_comp_threads;
+        ret = smpboot_register_percpu_thread(&comp_pool_threads);
+        if (ret)
+                goto out_threads;
 
-        printk(KERN_INFO "eHCA scaling code enabled\n");
+        pr_info("eHCA scaling code enabled\n");
+        return ret;
 
-        return 0;
+out_threads:
+        free_percpu(pool->cpu_comp_threads);
+out_tasks:
+        free_percpu(pool->cpu_comp_tasks);
+out_pool:
+        kfree(pool);
+        return ret;
 }
 
 void ehca_destroy_comp_pool(void)
 {
-        int i;
-
         if (!ehca_scaling_code)
                 return;
 
-        unregister_hotcpu_notifier(&comp_pool_callback_nb);
-
-        for_each_online_cpu(i)
-                destroy_comp_task(pool, i);
+        smpboot_unregister_percpu_thread(&comp_pool_threads);
 
+        free_percpu(pool->cpu_comp_threads);
         free_percpu(pool->cpu_comp_tasks);
         kfree(pool);
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.h b/drivers/infiniband/hw/ehca/ehca_irq.h
index 3346cb06cea6..5370199f08c7 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.h
+++ b/drivers/infiniband/hw/ehca/ehca_irq.h
@@ -58,15 +58,15 @@ void ehca_tasklet_eq(unsigned long data);
 void ehca_process_eq(struct ehca_shca *shca, int is_irq);
 
 struct ehca_cpu_comp_task {
-        wait_queue_head_t wait_queue;
         struct list_head cq_list;
-        struct task_struct *task;
         spinlock_t task_lock;
         int cq_jobs;
+        int active;
 };
 
 struct ehca_comp_pool {
-        struct ehca_cpu_comp_task *cpu_comp_tasks;
+        struct ehca_cpu_comp_task __percpu *cpu_comp_tasks;
+        struct task_struct * __percpu *cpu_comp_threads;
         int last_cpu;
         spinlock_t last_cpu_lock;
 };
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index cb5b7f7d4d38..b29a4246ef41 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -2219,7 +2219,6 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
         u32 wqe_idx;
 
         if (!qp->wqe_wr_id_tbl[tail].signaled) {
-                expand = true;  /* CQE cannot be consumed yet */
                 *polled = false;    /* WC cannot be consumed yet */
         } else {
                 ibwc->status = IB_WC_SUCCESS;
@@ -2227,10 +2226,11 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
                 ibwc->qp = &qp->ibqp;
                 ocrdma_update_wc(qp, ibwc, tail);
                 *polled = true;
-                wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
-                if (tail != wqe_idx)
-                        expand = true; /* Coalesced CQE can't be consumed yet */
         }
+        wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
+        if (tail != wqe_idx)
+                expand = true; /* Coalesced CQE can't be consumed yet */
+
         ocrdma_hwq_inc_tail(&qp->sq);
         return expand;
 }
diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
index 19f1e6c45fb6..ccb119143d20 100644
--- a/drivers/infiniband/hw/qib/qib_mad.c
+++ b/drivers/infiniband/hw/qib/qib_mad.c
@@ -471,9 +471,10 @@ static int subn_get_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                 if (port_num != port) {
                         ibp = to_iport(ibdev, port_num);
                         ret = check_mkey(ibp, smp, 0);
-                        if (ret)
+                        if (ret) {
                                 ret = IB_MAD_RESULT_FAILURE;
                                 goto bail;
+                        }
                 }
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index ca43901ed861..0af216d21f87 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -262,7 +262,10 @@ struct ipoib_ethtool_st {
         u16     max_coalesced_frames;
 };
 
+struct ipoib_neigh_table;
+
 struct ipoib_neigh_hash {
+        struct ipoib_neigh_table       *ntbl;
         struct ipoib_neigh __rcu      **buckets;
         struct rcu_head                 rcu;
         u32                             mask;
@@ -271,9 +274,9 @@ struct ipoib_neigh_hash {
 
 struct ipoib_neigh_table {
         struct ipoib_neigh_hash __rcu  *htbl;
-        rwlock_t                        rwlock;
         atomic_t                        entries;
         struct completion               flushed;
+        struct completion               deleted;
 };
 
 /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 3e2085a3ee47..1e19b5ae7c47 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -546,15 +546,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
         struct ipoib_neigh *neigh;
         unsigned long flags;
 
+        spin_lock_irqsave(&priv->lock, flags);
         neigh = ipoib_neigh_alloc(daddr, dev);
         if (!neigh) {
+                spin_unlock_irqrestore(&priv->lock, flags);
                 ++dev->stats.tx_dropped;
                 dev_kfree_skb_any(skb);
                 return;
         }
 
-        spin_lock_irqsave(&priv->lock, flags);
-
         path = __path_find(dev, daddr + 4);
         if (!path) {
                 path = path_rec_create(dev, daddr + 4);
@@ -863,10 +863,10 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
         if (test_bit(IPOIB_STOP_NEIGH_GC, &priv->flags))
                 return;
 
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
 
         if (!htbl)
                 goto out_unlock;
@@ -883,16 +883,14 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                         /* was the neigh idle for two GC periods */
                         if (time_after(neigh_obsolete, neigh->alive)) {
                                 rcu_assign_pointer(*np,
                                                    rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                 /* remove from path/mc list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                 list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                 call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                         } else {
                                 np = &neigh->hnext;
@@ -902,7 +900,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
         }
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static void ipoib_reap_neigh(struct work_struct *work)
@@ -947,10 +945,8 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
         struct ipoib_neigh *neigh;
         u32 hash_val;
 
-        write_lock_bh(&ntbl->rwlock);
-
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
         if (!htbl) {
                 neigh = NULL;
                 goto out_unlock;
@@ -961,10 +957,10 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
          */
         hash_val = ipoib_addr_hash(htbl, daddr);
         for (neigh = rcu_dereference_protected(htbl->buckets[hash_val],
-                                               lockdep_is_held(&ntbl->rwlock));
+                                               lockdep_is_held(&priv->lock));
              neigh != NULL;
              neigh = rcu_dereference_protected(neigh->hnext,
-                                               lockdep_is_held(&ntbl->rwlock))) {
+                                               lockdep_is_held(&priv->lock))) {
                 if (memcmp(daddr, neigh->daddr, INFINIBAND_ALEN) == 0) {
                         /* found, take one ref on behalf of the caller */
                         if (!atomic_inc_not_zero(&neigh->refcnt)) {
@@ -987,12 +983,11 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
         /* put in hash */
         rcu_assign_pointer(neigh->hnext,
                            rcu_dereference_protected(htbl->buckets[hash_val],
-                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                     lockdep_is_held(&priv->lock)));
         rcu_assign_pointer(htbl->buckets[hash_val], neigh);
         atomic_inc(&ntbl->entries);
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
 
         return neigh;
 }
@@ -1040,35 +1035,29 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
         struct ipoib_neigh *n;
         u32 hash_val;
 
-        write_lock_bh(&ntbl->rwlock);
-
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
         if (!htbl)
-                goto out_unlock;
+                return;
 
         hash_val = ipoib_addr_hash(htbl, neigh->daddr);
         np = &htbl->buckets[hash_val];
         for (n = rcu_dereference_protected(*np,
-                                            lockdep_is_held(&ntbl->rwlock));
+                                            lockdep_is_held(&priv->lock));
              n != NULL;
              n = rcu_dereference_protected(*np,
-                                        lockdep_is_held(&ntbl->rwlock))) {
+                                        lockdep_is_held(&priv->lock))) {
                 if (n == neigh) {
                         /* found */
                         rcu_assign_pointer(*np,
                                            rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                         call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
-                        goto out_unlock;
+                        return;
                 } else {
                         np = &n->hnext;
                 }
         }
-
-out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
-
 }
 
 static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
@@ -1080,7 +1069,6 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
 
         clear_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
         ntbl->htbl = NULL;
-        rwlock_init(&ntbl->rwlock);
         htbl = kzalloc(sizeof(*htbl), GFP_KERNEL);
         if (!htbl)
                 return -ENOMEM;
@@ -1095,6 +1083,7 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
         htbl->mask = (size - 1);
         htbl->buckets = buckets;
         ntbl->htbl = htbl;
+        htbl->ntbl = ntbl;
         atomic_set(&ntbl->entries, 0);
 
         /* start garbage collection */
@@ -1111,9 +1100,11 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
                                                     struct ipoib_neigh_hash,
                                                     rcu);
         struct ipoib_neigh __rcu **buckets = htbl->buckets;
+        struct ipoib_neigh_table *ntbl = htbl->ntbl;
 
         kfree(buckets);
         kfree(htbl);
+        complete(&ntbl->deleted);
 }
 
 void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
@@ -1125,10 +1116,10 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
         int i;
 
         /* remove all neigh connected to a given path or mcast */
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
 
         if (!htbl)
                 goto out_unlock;
@@ -1138,16 +1129,14 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                         /* delete neighs belong to this parent */
                         if (!memcmp(gid, neigh->daddr + 4, sizeof (union ib_gid))) {
                                 rcu_assign_pointer(*np,
                                                    rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                 /* remove from parent list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                 list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                 call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                         } else {
                                 np = &neigh->hnext;
@@ -1156,7 +1145,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                 }
         }
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
@@ -1164,37 +1153,44 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
         struct ipoib_neigh_table *ntbl = &priv->ntbl;
         struct ipoib_neigh_hash *htbl;
         unsigned long flags;
-        int i;
+        int i, wait_flushed = 0;
 
-        write_lock_bh(&ntbl->rwlock);
+        init_completion(&priv->ntbl.flushed);
+
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
         if (!htbl)
                 goto out_unlock;
 
+        wait_flushed = atomic_read(&priv->ntbl.entries);
+        if (!wait_flushed)
+                goto free_htbl;
+
         for (i = 0; i < htbl->size; i++) {
                 struct ipoib_neigh *neigh;
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                       lockdep_is_held(&priv->lock))) != NULL) {
                         rcu_assign_pointer(*np,
                                            rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                         /* remove from path/mc list */
-                        spin_lock_irqsave(&priv->lock, flags);
                         list_del(&neigh->list);
-                        spin_unlock_irqrestore(&priv->lock, flags);
                         call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                 }
         }
 
+free_htbl:
         rcu_assign_pointer(ntbl->htbl, NULL);
         call_rcu(&htbl->rcu, neigh_hash_free_rcu);
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        if (wait_flushed)
+                wait_for_completion(&priv->ntbl.flushed);
 }
 
 static void ipoib_neigh_hash_uninit(struct net_device *dev)
@@ -1203,7 +1199,7 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         int stopped;
 
         ipoib_dbg(priv, "ipoib_neigh_hash_uninit\n");
-        init_completion(&priv->ntbl.flushed);
+        init_completion(&priv->ntbl.deleted);
         set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
 
         /* Stop GC if called at init fail need to cancel work */
@@ -1211,10 +1207,9 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         if (!stopped)
                 cancel_delayed_work(&priv->neigh_reap_task);
 
-        if (atomic_read(&priv->ntbl.entries)) {
-                ipoib_flush_neighs(priv);
-                wait_for_completion(&priv->ntbl.flushed);
-        }
+        ipoib_flush_neighs(priv);
+
+        wait_for_completion(&priv->ntbl.deleted);
 }
 
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 13f4aa7593c8..75367249f447 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -707,9 +707,7 @@ out:
                 neigh = ipoib_neigh_get(dev, daddr);
                 spin_lock_irqsave(&priv->lock, flags);
                 if (!neigh) {
-                        spin_unlock_irqrestore(&priv->lock, flags);
                         neigh = ipoib_neigh_alloc(daddr, dev);
-                        spin_lock_irqsave(&priv->lock, flags);
                         if (neigh) {
                                 kref_get(&mcast->ah->ref);
                                 neigh->ah       = mcast->ah;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 6c58bfff01a3..118d0300f1fb 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -54,16 +54,9 @@ struct evdev_client {
 static struct evdev *evdev_table[EVDEV_MINORS];
 static DEFINE_MUTEX(evdev_table_mutex);
 
-static void evdev_pass_event(struct evdev_client *client,
-                             struct input_event *event,
-                             ktime_t mono, ktime_t real)
+static void __pass_event(struct evdev_client *client,
+                         const struct input_event *event)
 {
-        event->time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ?
-                                        mono : real);
-
-        /* Interrupts are disabled, just acquire the lock. */
-        spin_lock(&client->buffer_lock);
-
         client->buffer[client->head++] = *event;
         client->head &= client->bufsize - 1;
 
@@ -86,42 +79,74 @@ static void evdev_pass_event(struct evdev_client *client,
                 client->packet_head = client->head;
                 kill_fasync(&client->fasync, SIGIO, POLL_IN);
         }
+}
+
+static void evdev_pass_values(struct evdev_client *client,
+                        const struct input_value *vals, unsigned int count,
+                        ktime_t mono, ktime_t real)
+{
+        struct evdev *evdev = client->evdev;
+        const struct input_value *v;
+        struct input_event event;
+        bool wakeup = false;
+
+        event.time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ?
+                                      mono : real);
+
+        /* Interrupts are disabled, just acquire the lock. */
+        spin_lock(&client->buffer_lock);
+
+        for (v = vals; v != vals + count; v++) {
+                event.type = v->type;
+                event.code = v->code;
+                event.value = v->value;
+                __pass_event(client, &event);
+                if (v->type == EV_SYN && v->code == SYN_REPORT)
+                        wakeup = true;
+        }
 
         spin_unlock(&client->buffer_lock);
+
+        if (wakeup)
+                wake_up_interruptible(&evdev->wait);
 }
 
 /*
- * Pass incoming event to all connected clients.
+ * Pass incoming events to all connected clients.
  */
-static void evdev_event(struct input_handle *handle,
-                        unsigned int type, unsigned int code, int value)
+static void evdev_events(struct input_handle *handle,
+                         const struct input_value *vals, unsigned int count)
 {
         struct evdev *evdev = handle->private;
         struct evdev_client *client;
-        struct input_event event;
         ktime_t time_mono, time_real;
 
         time_mono = ktime_get();
         time_real = ktime_sub(time_mono, ktime_get_monotonic_offset());
 
-        event.type = type;
-        event.code = code;
-        event.value = value;
-
         rcu_read_lock();
 
         client = rcu_dereference(evdev->grab);
 
         if (client)
-                evdev_pass_event(client, &event, time_mono, time_real);
+                evdev_pass_values(client, vals, count, time_mono, time_real);
         else
                 list_for_each_entry_rcu(client, &evdev->client_list, node)
-                        evdev_pass_event(client, &event, time_mono, time_real);
+                        evdev_pass_values(client, vals, count,
+                                          time_mono, time_real);
 
         rcu_read_unlock();
+}
 
-        if (type == EV_SYN && code == SYN_REPORT)
-                wake_up_interruptible(&evdev->wait);
+/*
+ * Pass incoming event to all connected clients.
+ */
+static void evdev_event(struct input_handle *handle,
+                        unsigned int type, unsigned int code, int value)
+{
+        struct input_value vals[] = { { type, code, value } };
+
+        evdev_events(handle, vals, 1);
 }
 
 static int evdev_fasync(int fd, struct file *file, int on)
@@ -653,20 +678,22 @@ static int evdev_handle_mt_request(struct input_dev *dev,
                                    unsigned int size,
                                    int __user *ip)
 {
-        const struct input_mt_slot *mt = dev->mt;
+        const struct input_mt *mt = dev->mt;
         unsigned int code;
         int max_slots;
         int i;
 
         if (get_user(code, &ip[0]))
                 return -EFAULT;
-        if (!input_is_mt_value(code))
+        if (!mt || !input_is_mt_value(code))
                 return -EINVAL;
 
         max_slots = (size - sizeof(__u32)) / sizeof(__s32);
-        for (i = 0; i < dev->mtsize && i < max_slots; i++)
-                if (put_user(input_mt_get_value(&mt[i], code), &ip[1 + i]))
+        for (i = 0; i < mt->num_slots && i < max_slots; i++) {
+                int value = input_mt_get_value(&mt->slots[i], code);
+                if (put_user(value, &ip[1 + i]))
                         return -EFAULT;
+        }
 
         return 0;
 }
@@ -1048,6 +1075,7 @@ MODULE_DEVICE_TABLE(input, evdev_ids);
 
 static struct input_handler evdev_handler = {
         .event          = evdev_event,
+        .events         = evdev_events,
         .connect        = evdev_connect,
         .disconnect     = evdev_disconnect,
         .fops           = &evdev_fops,
diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c
index 70a16c7da8cc..c0ec7d42c3be 100644
--- a/drivers/input/input-mt.c
+++ b/drivers/input/input-mt.c
@@ -14,6 +14,14 @@
 
 #define TRKID_SGN       ((TRKID_MAX + 1) >> 1)
 
+static void copy_abs(struct input_dev *dev, unsigned int dst, unsigned int src)
+{
+        if (dev->absinfo && test_bit(src, dev->absbit)) {
+                dev->absinfo[dst] = dev->absinfo[src];
+                dev->absbit[BIT_WORD(dst)] |= BIT_MASK(dst);
+        }
+}
+
 /**
  * input_mt_init_slots() - initialize MT input slots
  * @dev: input device supporting MT events and finger tracking
@@ -25,29 +33,63 @@
  * May be called repeatedly. Returns -EINVAL if attempting to
  * reinitialize with a different number of slots.
  */
-int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots)
+int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots,
+                        unsigned int flags)
 {
+        struct input_mt *mt = dev->mt;
         int i;
 
         if (!num_slots)
                 return 0;
-        if (dev->mt)
-                return dev->mtsize != num_slots ? -EINVAL : 0;
+        if (mt)
+                return mt->num_slots != num_slots ? -EINVAL : 0;
 
-        dev->mt = kcalloc(num_slots, sizeof(struct input_mt_slot), GFP_KERNEL);
-        if (!dev->mt)
-                return -ENOMEM;
+        mt = kzalloc(sizeof(*mt) + num_slots * sizeof(*mt->slots), GFP_KERNEL);
+        if (!mt)
+                goto err_mem;
 
-        dev->mtsize = num_slots;
+        mt->num_slots = num_slots;
+        mt->flags = flags;
         input_set_abs_params(dev, ABS_MT_SLOT, 0, num_slots - 1, 0, 0);
         input_set_abs_params(dev, ABS_MT_TRACKING_ID, 0, TRKID_MAX, 0, 0);
-        input_set_events_per_packet(dev, 6 * num_slots);
+
+        if (flags & (INPUT_MT_POINTER | INPUT_MT_DIRECT)) {
+                __set_bit(EV_KEY, dev->evbit);
+                __set_bit(BTN_TOUCH, dev->keybit);
+
+                copy_abs(dev, ABS_X, ABS_MT_POSITION_X);
+                copy_abs(dev, ABS_Y, ABS_MT_POSITION_Y);
+                copy_abs(dev, ABS_PRESSURE, ABS_MT_PRESSURE);
+        }
+        if (flags & INPUT_MT_POINTER) {
+                __set_bit(BTN_TOOL_FINGER, dev->keybit);
+                __set_bit(BTN_TOOL_DOUBLETAP, dev->keybit);
+                if (num_slots >= 3)
+                        __set_bit(BTN_TOOL_TRIPLETAP, dev->keybit);
+                if (num_slots >= 4)
+                        __set_bit(BTN_TOOL_QUADTAP, dev->keybit);
+                if (num_slots >= 5)
+                        __set_bit(BTN_TOOL_QUINTTAP, dev->keybit);
+                __set_bit(INPUT_PROP_POINTER, dev->propbit);
+        }
+        if (flags & INPUT_MT_DIRECT)
+                __set_bit(INPUT_PROP_DIRECT, dev->propbit);
+        if (flags & INPUT_MT_TRACK) {
+                unsigned int n2 = num_slots * num_slots;
+                mt->red = kcalloc(n2, sizeof(*mt->red), GFP_KERNEL);
+                if (!mt->red)
+                        goto err_mem;
+        }
 
         /* Mark slots as 'unused' */
         for (i = 0; i < num_slots; i++)
-                input_mt_set_value(&dev->mt[i], ABS_MT_TRACKING_ID, -1);
+                input_mt_set_value(&mt->slots[i], ABS_MT_TRACKING_ID, -1);
 
+        dev->mt = mt;
         return 0;
+err_mem:
+        kfree(mt);
+        return -ENOMEM;
 }
 EXPORT_SYMBOL(input_mt_init_slots);
 
@@ -60,11 +102,11 @@ EXPORT_SYMBOL(input_mt_init_slots);
  */
 void input_mt_destroy_slots(struct input_dev *dev)
 {
-        kfree(dev->mt);
+        if (dev->mt) {
+                kfree(dev->mt->red);
+                kfree(dev->mt);
+        }
         dev->mt = NULL;
-        dev->mtsize = 0;
-        dev->slot = 0;
-        dev->trkid = 0;
 }
 EXPORT_SYMBOL(input_mt_destroy_slots);
 
@@ -83,18 +125,24 @@ EXPORT_SYMBOL(input_mt_destroy_slots);
 void input_mt_report_slot_state(struct input_dev *dev,
                                 unsigned int tool_type, bool active)
 {
-        struct input_mt_slot *mt;
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *slot;
         int id;
 
-        if (!dev->mt || !active) {
+        if (!mt)
+                return;
+
+        slot = &mt->slots[mt->slot];
+        slot->frame = mt->frame;
+
+        if (!active) {
                 input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, -1);
                 return;
         }
 
-        mt = &dev->mt[dev->slot];
-        id = input_mt_get_value(mt, ABS_MT_TRACKING_ID);
-        if (id < 0 || input_mt_get_value(mt, ABS_MT_TOOL_TYPE) != tool_type)
-                id = input_mt_new_trkid(dev);
+        id = input_mt_get_value(slot, ABS_MT_TRACKING_ID);
+        if (id < 0 || input_mt_get_value(slot, ABS_MT_TOOL_TYPE) != tool_type)
+                id = input_mt_new_trkid(mt);
 
         input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, id);
         input_event(dev, EV_ABS, ABS_MT_TOOL_TYPE, tool_type);
@@ -135,13 +183,19 @@ EXPORT_SYMBOL(input_mt_report_finger_count);
  */
 void input_mt_report_pointer_emulation(struct input_dev *dev, bool use_count)
 {
-        struct input_mt_slot *oldest = NULL;
-        int oldid = dev->trkid;
-        int count = 0;
-        int i;
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *oldest;
+        int oldid, count, i;
+
+        if (!mt)
+                return;
+
+        oldest = 0;
+        oldid = mt->trkid;
+        count = 0;
 
-        for (i = 0; i < dev->mtsize; ++i) {
-                struct input_mt_slot *ps = &dev->mt[i];
+        for (i = 0; i < mt->num_slots; ++i) {
+                struct input_mt_slot *ps = &mt->slots[i];
                 int id = input_mt_get_value(ps, ABS_MT_TRACKING_ID);
 
                 if (id < 0)
@@ -160,13 +214,208 @@ void input_mt_report_pointer_emulation(struct input_dev *dev, bool use_count)
         if (oldest) {
                 int x = input_mt_get_value(oldest, ABS_MT_POSITION_X);
                 int y = input_mt_get_value(oldest, ABS_MT_POSITION_Y);
-                int p = input_mt_get_value(oldest, ABS_MT_PRESSURE);
 
                 input_event(dev, EV_ABS, ABS_X, x);
                 input_event(dev, EV_ABS, ABS_Y, y);
-                input_event(dev, EV_ABS, ABS_PRESSURE, p);
+
+                if (test_bit(ABS_MT_PRESSURE, dev->absbit)) {
+                        int p = input_mt_get_value(oldest, ABS_MT_PRESSURE);
+                        input_event(dev, EV_ABS, ABS_PRESSURE, p);
+                }
         } else {
-                input_event(dev, EV_ABS, ABS_PRESSURE, 0);
+                if (test_bit(ABS_MT_PRESSURE, dev->absbit))
+                        input_event(dev, EV_ABS, ABS_PRESSURE, 0);
         }
 }
 EXPORT_SYMBOL(input_mt_report_pointer_emulation);
+
+/**
+ * input_mt_sync_frame() - synchronize mt frame
+ * @dev: input device with allocated MT slots
+ *
+ * Close the frame and prepare the internal state for a new one.
+ * Depending on the flags, marks unused slots as inactive and performs
+ * pointer emulation.
+ */
+void input_mt_sync_frame(struct input_dev *dev)
+{
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *s;
+
+        if (!mt)
+                return;
+
+        if (mt->flags & INPUT_MT_DROP_UNUSED) {
+                for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                        if (s->frame == mt->frame)
+                                continue;
+                        input_mt_slot(dev, s - mt->slots);
+                        input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, -1);
+                }
+        }
+
+        input_mt_report_pointer_emulation(dev, (mt->flags & INPUT_MT_POINTER));
+
+        mt->frame++;
+}
+EXPORT_SYMBOL(input_mt_sync_frame);
+
+static int adjust_dual(int *begin, int step, int *end, int eq)
+{
+        int f, *p, s, c;
+
+        if (begin == end)
+                return 0;
+
+        f = *begin;
+        p = begin + step;
+        s = p == end ? f + 1 : *p;
+
+        for (; p != end; p += step)
+                if (*p < f)
+                        s = f, f = *p;
+                else if (*p < s)
+                        s = *p;
+
+        c = (f + s + 1) / 2;
+        if (c == 0 || (c > 0 && !eq))
+                return 0;
+        if (s < 0)
+                c *= 2;
+
+        for (p = begin; p != end; p += step)
+                *p -= c;
+
+        return (c < s && s <= 0) || (f >= 0 && f < c);
+}
+
+static void find_reduced_matrix(int *w, int nr, int nc, int nrc)
+{
+        int i, k, sum;
+
+        for (k = 0; k < nrc; k++) {
+                for (i = 0; i < nr; i++)
+                        adjust_dual(w + i, nr, w + i + nrc, nr <= nc);
+                sum = 0;
+                for (i = 0; i < nrc; i += nr)
+                        sum += adjust_dual(w + i, 1, w + i + nr, nc <= nr);
+                if (!sum)
+                        break;
+        }
+}
+
+static int input_mt_set_matrix(struct input_mt *mt,
+                               const struct input_mt_pos *pos, int num_pos)
+{
+        const struct input_mt_pos *p;
+        struct input_mt_slot *s;
+        int *w = mt->red;
+        int x, y;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                if (!input_mt_is_active(s))
+                        continue;
+                x = input_mt_get_value(s, ABS_MT_POSITION_X);
+                y = input_mt_get_value(s, ABS_MT_POSITION_Y);
+                for (p = pos; p != pos + num_pos; p++) {
+                        int dx = x - p->x, dy = y - p->y;
+                        *w++ = dx * dx + dy * dy;
+                }
+        }
+
+        return w - mt->red;
+}
+
+static void input_mt_set_slots(struct input_mt *mt,
+                               int *slots, int num_pos)
+{
+        struct input_mt_slot *s;
+        int *w = mt->red, *p;
+
+        for (p = slots; p != slots + num_pos; p++)
+                *p = -1;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                if (!input_mt_is_active(s))
+                        continue;
+                for (p = slots; p != slots + num_pos; p++)
+                        if (*w++ < 0)
+                                *p = s - mt->slots;
+        }
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                if (input_mt_is_active(s))
+                        continue;
+                for (p = slots; p != slots + num_pos; p++)
+                        if (*p < 0) {
+                                *p = s - mt->slots;
+                                break;
+                        }
+        }
+}
+
+/**
+ * input_mt_assign_slots() - perform a best-match assignment
+ * @dev: input device with allocated MT slots
+ * @slots: the slot assignment to be filled
+ * @pos: the position array to match
+ * @num_pos: number of positions
+ *
+ * Performs a best match against the current contacts and returns
+ * the slot assignment list. New contacts are assigned to unused
+ * slots.
+ *
+ * Returns zero on success, or negative error in case of failure.
+ */
+int input_mt_assign_slots(struct input_dev *dev, int *slots,
+                          const struct input_mt_pos *pos, int num_pos)
+{
+        struct input_mt *mt = dev->mt;
+        int nrc;
+
+        if (!mt || !mt->red)
+                return -ENXIO;
+        if (num_pos > mt->num_slots)
+                return -EINVAL;
+        if (num_pos < 1)
+                return 0;
+
+        nrc = input_mt_set_matrix(mt, pos, num_pos);
+        find_reduced_matrix(mt->red, num_pos, nrc / num_pos, nrc);
+        input_mt_set_slots(mt, slots, num_pos);
+
+        return 0;
+}
+EXPORT_SYMBOL(input_mt_assign_slots);
+
+/**
+ * input_mt_get_slot_by_key() - return slot matching key
+ * @dev: input device with allocated MT slots
+ * @key: the key of the sought slot
+ *
+ * Returns the slot of the given key, if it exists, otherwise
+ * set the key on the first unused slot and return.
+ *
+ * If no available slot can be found, -1 is returned.
+ */
+int input_mt_get_slot_by_key(struct input_dev *dev, int key)
+{
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *s;
+
+        if (!mt)
+                return -1;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++)
+                if (input_mt_is_active(s) && s->key == key)
+                        return s - mt->slots;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++)
+                if (!input_mt_is_active(s)) {
+                        s->key = key;
+                        return s - mt->slots;
+                }
+
+        return -1;
+}
+EXPORT_SYMBOL(input_mt_get_slot_by_key);
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 8921c6180c51..5244f3d05b12 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -47,6 +47,8 @@ static DEFINE_MUTEX(input_mutex);
 
 static struct input_handler *input_table[8];
 
+static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 };
+
 static inline int is_event_supported(unsigned int code,
                                      unsigned long *bm, unsigned int max)
 {
@@ -69,42 +71,102 @@ static int input_defuzz_abs_event(int value, int old_val, int fuzz)
         return value;
 }
 
+static void input_start_autorepeat(struct input_dev *dev, int code)
+{
+        if (test_bit(EV_REP, dev->evbit) &&
+            dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] &&
+            dev->timer.data) {
+                dev->repeat_key = code;
+                mod_timer(&dev->timer,
+                          jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
+        }
+}
+
+static void input_stop_autorepeat(struct input_dev *dev)
+{
+        del_timer(&dev->timer);
+}
+
 /*
  * Pass event first through all filters and then, if event has not been
  * filtered out, through all open handles. This function is called with
  * dev->event_lock held and interrupts disabled.
  */
-static void input_pass_event(struct input_dev *dev,
-                             unsigned int type, unsigned int code, int value)
+static unsigned int input_to_handler(struct input_handle *handle,
+                        struct input_value *vals, unsigned int count)
+{
+        struct input_handler *handler = handle->handler;
+        struct input_value *end = vals;
+        struct input_value *v;
+
+        for (v = vals; v != vals + count; v++) {
+                if (handler->filter &&
+                    handler->filter(handle, v->type, v->code, v->value))
+                        continue;
+                if (end != v)
+                        *end = *v;
+                end++;
+        }
+
+        count = end - vals;
+        if (!count)
+                return 0;
+
+        if (handler->events)
+                handler->events(handle, vals, count);
+        else if (handler->event)
+                for (v = vals; v != end; v++)
+                        handler->event(handle, v->type, v->code, v->value);
+
+        return count;
+}
+
+/*
+ * Pass values first through all filters and then, if event has not been
+ * filtered out, through all open handles. This function is called with
+ * dev->event_lock held and interrupts disabled.
+ */
+static void input_pass_values(struct input_dev *dev,
+                              struct input_value *vals, unsigned int count)
 {
-        struct input_handler *handler;
         struct input_handle *handle;
+        struct input_value *v;
+
+        if (!count)
+                return;
 
         rcu_read_lock();
 
         handle = rcu_dereference(dev->grab);
-        if (handle)
-                handle->handler->event(handle, type, code, value);
-        else {
-                bool filtered = false;
-
-                list_for_each_entry_rcu(handle, &dev->h_list, d_node) {
-                        if (!handle->open)
-                                continue;
+        if (handle) {
+                count = input_to_handler(handle, vals, count);
+        } else {
+                list_for_each_entry_rcu(handle, &dev->h_list, d_node)
+                        if (handle->open)
+                                count = input_to_handler(handle, vals, count);
+        }
 
-                        handler = handle->handler;
-                        if (!handler->filter) {
-                                if (filtered)
-                                        break;
+        rcu_read_unlock();
 
-                                handler->event(handle, type, code, value);
+        add_input_randomness(vals->type, vals->code, vals->value);
 
-                        } else if (handler->filter(handle, type, code, value))
-                                filtered = true;
+        /* trigger auto repeat for key events */
+        for (v = vals; v != vals + count; v++) {
+                if (v->type == EV_KEY && v->value != 2) {
+                        if (v->value)
+                                input_start_autorepeat(dev, v->code);
+                        else
+                                input_stop_autorepeat(dev);
                 }
         }
+}
 
-        rcu_read_unlock();
+static void input_pass_event(struct input_dev *dev,
+                             unsigned int type, unsigned int code, int value)
+{
+        struct input_value vals[] = { { type, code, value } };
+
+        input_pass_values(dev, vals, ARRAY_SIZE(vals));
 }
 
 /*
@@ -121,18 +183,12 @@ static void input_repeat_key(unsigned long data)
 
         if (test_bit(dev->repeat_key, dev->key) &&
             is_event_supported(dev->repeat_key, dev->keybit, KEY_MAX)) {
+                struct input_value vals[] =  {
+                        { EV_KEY, dev->repeat_key, 2 },
+                        input_value_sync
+                };
 
-                input_pass_event(dev, EV_KEY, dev->repeat_key, 2);
-
-                if (dev->sync) {
-                        /*
-                         * Only send SYN_REPORT if we are not in a middle
-                         * of driver parsing a new hardware packet.
-                         * Otherwise assume that the driver will send
-                         * SYN_REPORT once it's done.
-                         */
-                        input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
-                }
+                input_pass_values(dev, vals, ARRAY_SIZE(vals));
 
                 if (dev->rep[REP_PERIOD])
                         mod_timer(&dev->timer, jiffies +
@@ -142,30 +198,17 @@ static void input_repeat_key(unsigned long data)
         spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 
-static void input_start_autorepeat(struct input_dev *dev, int code)
-{
-        if (test_bit(EV_REP, dev->evbit) &&
-            dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] &&
-            dev->timer.data) {
-                dev->repeat_key = code;
-                mod_timer(&dev->timer,
-                          jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
-        }
-}
-
-static void input_stop_autorepeat(struct input_dev *dev)
-{
-        del_timer(&dev->timer);
-}
-
 #define INPUT_IGNORE_EVENT      0
 #define INPUT_PASS_TO_HANDLERS  1
 #define INPUT_PASS_TO_DEVICE    2
+#define INPUT_SLOT              4
+#define INPUT_FLUSH             8
 #define INPUT_PASS_TO_ALL       (INPUT_PASS_TO_HANDLERS | INPUT_PASS_TO_DEVICE)
 
 static int input_handle_abs_event(struct input_dev *dev,
                                   unsigned int code, int *pval)
 {
+        struct input_mt *mt = dev->mt;
         bool is_mt_event;
         int *pold;
 
@@ -174,8 +217,8 @@ static int input_handle_abs_event(struct input_dev *dev,
                  * "Stage" the event; we'll flush it later, when we
                  * get actual touch data.
                  */
-                if (*pval >= 0 && *pval < dev->mtsize)
-                        dev->slot = *pval;
+                if (mt && *pval >= 0 && *pval < mt->num_slots)
+                        mt->slot = *pval;
 
                 return INPUT_IGNORE_EVENT;
         }
@@ -184,9 +227,8 @@ static int input_handle_abs_event(struct input_dev *dev,
 
         if (!is_mt_event) {
                 pold = &dev->absinfo[code].value;
-        } else if (dev->mt) {
-                struct input_mt_slot *mtslot = &dev->mt[dev->slot];
-                pold = &mtslot->abs[code - ABS_MT_FIRST];
+        } else if (mt) {
+                pold = &mt->slots[mt->slot].abs[code - ABS_MT_FIRST];
         } else {
                 /*
                  * Bypass filtering for multi-touch events when
@@ -205,16 +247,16 @@ static int input_handle_abs_event(struct input_dev *dev,
         }
 
         /* Flush pending "slot" event */
-        if (is_mt_event && dev->slot != input_abs_get_val(dev, ABS_MT_SLOT)) {
-                input_abs_set_val(dev, ABS_MT_SLOT, dev->slot);
-                input_pass_event(dev, EV_ABS, ABS_MT_SLOT, dev->slot);
+        if (is_mt_event && mt && mt->slot != input_abs_get_val(dev, ABS_MT_SLOT)) {
+                input_abs_set_val(dev, ABS_MT_SLOT, mt->slot);
+                return INPUT_PASS_TO_HANDLERS | INPUT_SLOT;
         }
 
         return INPUT_PASS_TO_HANDLERS;
 }
 
-static void input_handle_event(struct input_dev *dev,
-                               unsigned int type, unsigned int code, int value)
+static int input_get_disposition(struct input_dev *dev,
+                          unsigned int type, unsigned int code, int value)
 {
         int disposition = INPUT_IGNORE_EVENT;
 
@@ -227,37 +269,34 @@ static void input_handle_event(struct input_dev *dev,
                         break;
 
                 case SYN_REPORT:
-                        if (!dev->sync) {
-                                dev->sync = true;
-                                disposition = INPUT_PASS_TO_HANDLERS;
-                        }
+                        disposition = INPUT_PASS_TO_HANDLERS | INPUT_FLUSH;
                         break;
                 case SYN_MT_REPORT:
-                        dev->sync = false;
                         disposition = INPUT_PASS_TO_HANDLERS;
                         break;
                 }
                 break;
 
         case EV_KEY:
-                if (is_event_supported(code, dev->keybit, KEY_MAX) &&
-                    !!test_bit(code, dev->key) != value) {
+                if (is_event_supported(code, dev->keybit, KEY_MAX)) {
 
-                        if (value != 2) {
-                                __change_bit(code, dev->key);
-                                if (value)
-                                        input_start_autorepeat(dev, code);
-                                else
-                                        input_stop_autorepeat(dev);
+                        /* auto-repeat bypasses state updates */
+                        if (value == 2) {
+                                disposition = INPUT_PASS_TO_HANDLERS;
+                                break;
                         }
 
-                        disposition = INPUT_PASS_TO_HANDLERS;
+                        if (!!test_bit(code, dev->key) != !!value) {
+
+                                __change_bit(code, dev->key);
+                                disposition = INPUT_PASS_TO_HANDLERS;
+                        }
                 }
                 break;
 
         case EV_SW:
                 if (is_event_supported(code, dev->swbit, SW_MAX) &&
-                    !!test_bit(code, dev->sw) != value) {
+                    !!test_bit(code, dev->sw) != !!value) {
 
                         __change_bit(code, dev->sw);
                         disposition = INPUT_PASS_TO_HANDLERS;
@@ -284,7 +323,7 @@ static void input_handle_event(struct input_dev *dev,
 
         case EV_LED:
                 if (is_event_supported(code, dev->ledbit, LED_MAX) &&
-                    !!test_bit(code, dev->led) != value) {
+                    !!test_bit(code, dev->led) != !!value) {
 
                         __change_bit(code, dev->led);
                         disposition = INPUT_PASS_TO_ALL;
@@ -317,14 +356,48 @@ static void input_handle_event(struct input_dev *dev,
                 break;
         }
 
-        if (disposition != INPUT_IGNORE_EVENT && type != EV_SYN)
-                dev->sync = false;
+        return disposition;
+}
+
+static void input_handle_event(struct input_dev *dev,
+                               unsigned int type, unsigned int code, int value)
+{
+        int disposition;
+
+        disposition = input_get_disposition(dev, type, code, value);
 
         if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
                 dev->event(dev, type, code, value);
 
-        if (disposition & INPUT_PASS_TO_HANDLERS)
-                input_pass_event(dev, type, code, value);
+        if (!dev->vals)
+                return;
+
+        if (disposition & INPUT_PASS_TO_HANDLERS) {
+                struct input_value *v;
+
+                if (disposition & INPUT_SLOT) {
+                        v = &dev->vals[dev->num_vals++];
+                        v->type = EV_ABS;
+                        v->code = ABS_MT_SLOT;
+                        v->value = dev->mt->slot;
+                }
+
+                v = &dev->vals[dev->num_vals++];
+                v->type = type;
+                v->code = code;
+                v->value = value;
+        }
+
+        if (disposition & INPUT_FLUSH) {
+                if (dev->num_vals >= 2)
+                        input_pass_values(dev, dev->vals, dev->num_vals);
+                dev->num_vals = 0;
+        } else if (dev->num_vals >= dev->max_vals - 2) {
+                dev->vals[dev->num_vals++] = input_value_sync;
+                input_pass_values(dev, dev->vals, dev->num_vals);
+                dev->num_vals = 0;
+        }
+
 }
 
 /**
@@ -352,7 +425,6 @@ void input_event(struct input_dev *dev,
         if (is_event_supported(type, dev->evbit, EV_MAX)) {
 
                 spin_lock_irqsave(&dev->event_lock, flags);
-                add_input_randomness(type, code, value);
                 input_handle_event(dev, type, code, value);
                 spin_unlock_irqrestore(&dev->event_lock, flags);
         }
@@ -831,10 +903,12 @@ int input_set_keycode(struct input_dev *dev,
         if (test_bit(EV_KEY, dev->evbit) &&
             !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
             __test_and_clear_bit(old_keycode, dev->key)) {
+                struct input_value vals[] =  {
+                        { EV_KEY, old_keycode, 0 },
+                        input_value_sync
+                };
 
-                input_pass_event(dev, EV_KEY, old_keycode, 0);
-                if (dev->sync)
-                        input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+                input_pass_values(dev, vals, ARRAY_SIZE(vals));
         }
 
  out:
@@ -1416,6 +1490,7 @@ static void input_dev_release(struct device *device)
         input_ff_destroy(dev);
         input_mt_destroy_slots(dev);
         kfree(dev->absinfo);
+        kfree(dev->vals);
         kfree(dev);
 
         module_put(THIS_MODULE);
@@ -1751,8 +1826,8 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
         int i;
         unsigned int events;
 
-        if (dev->mtsize) {
-                mt_slots = dev->mtsize;
+        if (dev->mt) {
+                mt_slots = dev->mt->num_slots;
         } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
                 mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
                            dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
@@ -1778,6 +1853,9 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
                 if (test_bit(i, dev->relbit))
                         events++;
 
+        /* Make room for KEY and MSC events */
+        events += 7;
+
         return events;
 }
 
@@ -1816,6 +1894,7 @@ int input_register_device(struct input_dev *dev)
 {
         static atomic_t input_no = ATOMIC_INIT(0);
         struct input_handler *handler;
+        unsigned int packet_size;
         const char *path;
         int error;
 
@@ -1828,9 +1907,14 @@ int input_register_device(struct input_dev *dev)
         /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
         input_cleanse_bitmasks(dev);
 
-        if (!dev->hint_events_per_packet)
-                dev->hint_events_per_packet =
-                                input_estimate_events_per_packet(dev);
+        packet_size = input_estimate_events_per_packet(dev);
+        if (dev->hint_events_per_packet < packet_size)
+                dev->hint_events_per_packet = packet_size;
+
+        dev->max_vals = max(dev->hint_events_per_packet, packet_size) + 2;
+        dev->vals = kcalloc(dev->max_vals, sizeof(*dev->vals), GFP_KERNEL);
+        if (!dev->vals)
+                return -ENOMEM;
 
         /*
          * If delay and period are pre-set by the driver, then autorepeating
diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index ce68e361558c..cdc252612c0b 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -516,9 +516,9 @@ static int __devinit imx_keypad_probe(struct platform_device *pdev)
         input_set_drvdata(input_dev, keypad);
 
         /* Ensure that the keypad will stay dormant until opened */
-        clk_enable(keypad->clk);
+        clk_prepare_enable(keypad->clk);
         imx_keypad_inhibit(keypad);
-        clk_disable(keypad->clk);
+        clk_disable_unprepare(keypad->clk);
 
         error = request_irq(irq, imx_keypad_irq_handler, 0,
                             pdev->name, keypad);
diff --git a/drivers/input/misc/ab8500-ponkey.c b/drivers/input/misc/ab8500-ponkey.c
index f06231b7cab1..84ec691c05aa 100644
--- a/drivers/input/misc/ab8500-ponkey.c
+++ b/drivers/input/misc/ab8500-ponkey.c
@@ -74,8 +74,8 @@ static int __devinit ab8500_ponkey_probe(struct platform_device *pdev)
 
         ponkey->idev = input;
         ponkey->ab8500 = ab8500;
-        ponkey->irq_dbf = ab8500_irq_get_virq(ab8500, irq_dbf);
-        ponkey->irq_dbr = ab8500_irq_get_virq(ab8500, irq_dbr);
+        ponkey->irq_dbf = irq_dbf;
+        ponkey->irq_dbr = irq_dbr;
 
         input->name = "AB8500 POn(PowerOn) Key";
         input->dev.parent = &pdev->dev;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 736056897e50..6b1797503e34 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -405,7 +405,7 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
                         goto exit;
                 if (test_bit(ABS_MT_SLOT, dev->absbit)) {
                         int nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
-                        input_mt_init_slots(dev, nslot);
+                        input_mt_init_slots(dev, nslot, 0);
                 } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
                         input_set_events_per_packet(dev, 60);
                 }
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 4a1347e91bdc..cf5af1f495ec 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1620,7 +1620,7 @@ int alps_init(struct psmouse *psmouse)
         case ALPS_PROTO_V3:
         case ALPS_PROTO_V4:
                 set_bit(INPUT_PROP_SEMI_MT, dev1->propbit);
-                input_mt_init_slots(dev1, 2);
+                input_mt_init_slots(dev1, 2, 0);
                 input_set_abs_params(dev1, ABS_MT_POSITION_X, 0, ALPS_V3_X_MAX, 0, 0);
                 input_set_abs_params(dev1, ABS_MT_POSITION_Y, 0, ALPS_V3_Y_MAX, 0, 0);
 
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index d528c23e194f..3a78f235fa3e 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -40,6 +40,7 @@
 #include <linux/usb/input.h>
 #include <linux/hid.h>
 #include <linux/mutex.h>
+#include <linux/input/mt.h>
 
 #define USB_VENDOR_ID_APPLE             0x05ac
 
@@ -183,26 +184,26 @@ struct tp_finger {
         __le16 abs_y;           /* absolute y coodinate */
         __le16 rel_x;           /* relative x coodinate */
         __le16 rel_y;           /* relative y coodinate */
-        __le16 size_major;      /* finger size, major axis? */
-        __le16 size_minor;      /* finger size, minor axis? */
+        __le16 tool_major;      /* tool area, major axis */
+        __le16 tool_minor;      /* tool area, minor axis */
         __le16 orientation;     /* 16384 when point, else 15 bit angle */
-        __le16 force_major;     /* trackpad force, major axis? */
-        __le16 force_minor;     /* trackpad force, minor axis? */
+        __le16 touch_major;     /* touch area, major axis */
+        __le16 touch_minor;     /* touch area, minor axis */
         __le16 unused[3];       /* zeros */
         __le16 multi;           /* one finger: varies, more fingers: constant */
 } __attribute__((packed,aligned(2)));
 
 /* trackpad finger data size, empirically at least ten fingers */
+#define MAX_FINGERS             16
 #define SIZEOF_FINGER           sizeof(struct tp_finger)
-#define SIZEOF_ALL_FINGERS      (16 * SIZEOF_FINGER)
+#define SIZEOF_ALL_FINGERS      (MAX_FINGERS * SIZEOF_FINGER)
 #define MAX_FINGER_ORIENTATION  16384
 
 /* device-specific parameters */
 struct bcm5974_param {
-        int dim;                /* logical dimension */
-        int fuzz;               /* logical noise value */
-        int devmin;             /* device minimum reading */
-        int devmax;             /* device maximum reading */
+        int snratio;            /* signal-to-noise ratio */
+        int min;                /* device minimum reading */
+        int max;                /* device maximum reading */
 };
 
 /* device-specific configuration */
@@ -219,6 +220,7 @@ struct bcm5974_config {
         struct bcm5974_param w; /* finger width limits */
         struct bcm5974_param x; /* horizontal limits */
         struct bcm5974_param y; /* vertical limits */
+        struct bcm5974_param o; /* orientation limits */
 };
 
 /* logical device structure */
@@ -234,23 +236,16 @@ struct bcm5974 {
         struct bt_data *bt_data;        /* button transferred data */
         struct urb *tp_urb;             /* trackpad usb request block */
         u8 *tp_data;                    /* trackpad transferred data */
-        int fingers;                    /* number of fingers on trackpad */
+        const struct tp_finger *index[MAX_FINGERS];     /* finger index data */
+        struct input_mt_pos pos[MAX_FINGERS];           /* position array */
+        int slots[MAX_FINGERS];                         /* slot assignments */
 };
 
-/* logical dimensions */
-#define DIM_PRESSURE    256             /* maximum finger pressure */
-#define DIM_WIDTH       16              /* maximum finger width */
-#define DIM_X           1280            /* maximum trackpad x value */
-#define DIM_Y           800             /* maximum trackpad y value */
-
 /* logical signal quality */
 #define SN_PRESSURE     45              /* pressure signal-to-noise ratio */
-#define SN_WIDTH        100             /* width signal-to-noise ratio */
+#define SN_WIDTH        25              /* width signal-to-noise ratio */
 #define SN_COORD        250             /* coordinate signal-to-noise ratio */
-
-/* pressure thresholds */
-#define PRESSURE_LOW    (2 * DIM_PRESSURE / SN_PRESSURE)
-#define PRESSURE_HIGH   (3 * PRESSURE_LOW)
+#define SN_ORIENT       10              /* orientation signal-to-noise ratio */
 
 /* device constants */
 static const struct bcm5974_config bcm5974_config_table[] = {
@@ -261,10 +256,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 0,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 256 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4824, 5342 },
-                { DIM_Y, DIM_Y / SN_COORD, -172, 5820 }
+                { SN_PRESSURE, 0, 256 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4824, 5342 },
+                { SN_COORD, -172, 5820 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI,
@@ -273,10 +269,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 0,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 256 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4824, 4824 },
-                { DIM_Y, DIM_Y / SN_COORD, -172, 4290 }
+                { SN_PRESSURE, 0, 256 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4824, 4824 },
+                { SN_COORD, -172, 4290 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI,
@@ -285,10 +282,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4460, 5166 },
-                { DIM_Y, DIM_Y / SN_COORD, -75, 6700 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4460, 5166 },
+                { SN_COORD, -75, 6700 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI,
@@ -297,10 +295,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4620, 5140 },
+                { SN_COORD, -150, 6600 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI,
@@ -309,10 +308,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4616, 5112 },
-                { DIM_Y, DIM_Y / SN_COORD, -142, 5234 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4616, 5112 },
+                { SN_COORD, -142, 5234 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI,
@@ -321,10 +321,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4415, 5050 },
-                { DIM_Y, DIM_Y / SN_COORD, -55, 6680 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4415, 5050 },
+                { SN_COORD, -55, 6680 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI,
@@ -333,10 +334,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4620, 5140 },
+                { SN_COORD, -150, 6600 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI,
@@ -345,10 +347,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4750, 5280 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6730 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4750, 5280 },
+                { SN_COORD, -150, 6730 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI,
@@ -357,10 +360,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4620, 5140 },
+                { SN_COORD, -150, 6600 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI,
@@ -369,10 +373,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4750, 5280 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6730 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4750, 5280 },
+                { SN_COORD, -150, 6730 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {}
 };
@@ -396,18 +401,11 @@ static inline int raw2int(__le16 x)
         return (signed short)le16_to_cpu(x);
 }
 
-/* scale device data to logical dimensions (asserts devmin < devmax) */
-static inline int int2scale(const struct bcm5974_param *p, int x)
-{
-        return x * p->dim / (p->devmax - p->devmin);
-}
-
-/* all logical value ranges are [0,dim). */
-static inline int int2bound(const struct bcm5974_param *p, int x)
+static void set_abs(struct input_dev *input, unsigned int code,
+                    const struct bcm5974_param *p)
 {
-        int s = int2scale(p, x);
-
-        return clamp_val(s, 0, p->dim - 1);
+        int fuzz = p->snratio ? (p->max - p->min) / p->snratio : 0;
+        input_set_abs_params(input, code, p->min, p->max, fuzz, 0);
 }
 
 /* setup which logical events to report */
@@ -416,48 +414,30 @@ static void setup_events_to_report(struct input_dev *input_dev,
 {
         __set_bit(EV_ABS, input_dev->evbit);
 
-        input_set_abs_params(input_dev, ABS_PRESSURE,
-                                0, cfg->p.dim, cfg->p.fuzz, 0);
-        input_set_abs_params(input_dev, ABS_TOOL_WIDTH,
-                                0, cfg->w.dim, cfg->w.fuzz, 0);
-        input_set_abs_params(input_dev, ABS_X,
-                                0, cfg->x.dim, cfg->x.fuzz, 0);
-        input_set_abs_params(input_dev, ABS_Y,
-                                0, cfg->y.dim, cfg->y.fuzz, 0);
+        /* for synaptics only */
+        input_set_abs_params(input_dev, ABS_PRESSURE, 0, 256, 5, 0);
+        input_set_abs_params(input_dev, ABS_TOOL_WIDTH, 0, 16, 0, 0);
 
         /* finger touch area */
-        input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
-        input_set_abs_params(input_dev, ABS_MT_TOUCH_MINOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        set_abs(input_dev, ABS_MT_TOUCH_MAJOR, &cfg->w);
+        set_abs(input_dev, ABS_MT_TOUCH_MINOR, &cfg->w);
         /* finger approach area */
-        input_set_abs_params(input_dev, ABS_MT_WIDTH_MAJOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
-        input_set_abs_params(input_dev, ABS_MT_WIDTH_MINOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        set_abs(input_dev, ABS_MT_WIDTH_MAJOR, &cfg->w);
+        set_abs(input_dev, ABS_MT_WIDTH_MINOR, &cfg->w);
         /* finger orientation */
-        input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
-                             -MAX_FINGER_ORIENTATION,
-                             MAX_FINGER_ORIENTATION, 0, 0);
+        set_abs(input_dev, ABS_MT_ORIENTATION, &cfg->o);
         /* finger position */
-        input_set_abs_params(input_dev, ABS_MT_POSITION_X,
-                             cfg->x.devmin, cfg->x.devmax, 0, 0);
-        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
-                             cfg->y.devmin, cfg->y.devmax, 0, 0);
+        set_abs(input_dev, ABS_MT_POSITION_X, &cfg->x);
+        set_abs(input_dev, ABS_MT_POSITION_Y, &cfg->y);
 
         __set_bit(EV_KEY, input_dev->evbit);
-        __set_bit(BTN_TOUCH, input_dev->keybit);
-        __set_bit(BTN_TOOL_FINGER, input_dev->keybit);
-        __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
-        __set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit);
-        __set_bit(BTN_TOOL_QUADTAP, input_dev->keybit);
         __set_bit(BTN_LEFT, input_dev->keybit);
 
-        __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
         if (cfg->caps & HAS_INTEGRATED_BUTTON)
                 __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
 
-        input_set_events_per_packet(input_dev, 60);
+        input_mt_init_slots(input_dev, MAX_FINGERS,
+                INPUT_MT_POINTER | INPUT_MT_DROP_UNUSED | INPUT_MT_TRACK);
 }
 
 /* report button data as logical button state */
@@ -477,24 +457,44 @@ static int report_bt_state(struct bcm5974 *dev, int size)
         return 0;
 }
 
-static void report_finger_data(struct input_dev *input,
-                               const struct bcm5974_config *cfg,
+static void report_finger_data(struct input_dev *input, int slot,
+                               const struct input_mt_pos *pos,
                                const struct tp_finger *f)
 {
+        input_mt_slot(input, slot);
+        input_mt_report_slot_state(input, MT_TOOL_FINGER, true);
+
         input_report_abs(input, ABS_MT_TOUCH_MAJOR,
-                         raw2int(f->force_major) << 1);
+                         raw2int(f->touch_major) << 1);
         input_report_abs(input, ABS_MT_TOUCH_MINOR,
-                         raw2int(f->force_minor) << 1);
+                         raw2int(f->touch_minor) << 1);
         input_report_abs(input, ABS_MT_WIDTH_MAJOR,
-                         raw2int(f->size_major) << 1);
+                         raw2int(f->tool_major) << 1);
         input_report_abs(input, ABS_MT_WIDTH_MINOR,
-                         raw2int(f->size_minor) << 1);
+                         raw2int(f->tool_minor) << 1);
         input_report_abs(input, ABS_MT_ORIENTATION,
                          MAX_FINGER_ORIENTATION - raw2int(f->orientation));
-        input_report_abs(input, ABS_MT_POSITION_X, raw2int(f->abs_x));
-        input_report_abs(input, ABS_MT_POSITION_Y,
-                         cfg->y.devmin + cfg->y.devmax - raw2int(f->abs_y));
-        input_mt_sync(input);
+        input_report_abs(input, ABS_MT_POSITION_X, pos->x);
+        input_report_abs(input, ABS_MT_POSITION_Y, pos->y);
+}
+
+static void report_synaptics_data(struct input_dev *input,
+                                  const struct bcm5974_config *cfg,
+                                  const struct tp_finger *f, int raw_n)
+{
+        int abs_p = 0, abs_w = 0;
+
+        if (raw_n) {
+                int p = raw2int(f->touch_major);
+                int w = raw2int(f->tool_major);
+                if (p > 0 && raw2int(f->origin)) {
+                        abs_p = clamp_val(256 * p / cfg->p.max, 0, 255);
+                        abs_w = clamp_val(16 * w / cfg->w.max, 0, 15);
+                }
+        }
+
+        input_report_abs(input, ABS_PRESSURE, abs_p);
+        input_report_abs(input, ABS_TOOL_WIDTH, abs_w);
 }
 
 /* report trackpad data as logical trackpad state */
@@ -503,9 +503,7 @@ static int report_tp_state(struct bcm5974 *dev, int size)
         const struct bcm5974_config *c = &dev->cfg;
         const struct tp_finger *f;
         struct input_dev *input = dev->input;
-        int raw_p, raw_w, raw_x, raw_y, raw_n, i;
-        int ptest, origin, ibt = 0, nmin = 0, nmax = 0;
-        int abs_p = 0, abs_w = 0, abs_x = 0, abs_y = 0;
+        int raw_n, i, n = 0;
 
         if (size < c->tp_offset || (size - c->tp_offset) % SIZEOF_FINGER != 0)
                 return -EIO;
@@ -514,76 +512,29 @@ static int report_tp_state(struct bcm5974 *dev, int size)
         f = (const struct tp_finger *)(dev->tp_data + c->tp_offset);
         raw_n = (size - c->tp_offset) / SIZEOF_FINGER;
 
-        /* always track the first finger; when detached, start over */
-        if (raw_n) {
-
-                /* report raw trackpad data */
-                for (i = 0; i < raw_n; i++)
-                        report_finger_data(input, c, &f[i]);
-
-                raw_p = raw2int(f->force_major);
-                raw_w = raw2int(f->size_major);
-                raw_x = raw2int(f->abs_x);
-                raw_y = raw2int(f->abs_y);
-
-                dprintk(9,
-                        "bcm5974: "
-                        "raw: p: %+05d w: %+05d x: %+05d y: %+05d n: %d\n",
-                        raw_p, raw_w, raw_x, raw_y, raw_n);
-
-                ptest = int2bound(&c->p, raw_p);
-                origin = raw2int(f->origin);
-
-                /* while tracking finger still valid, count all fingers */
-                if (ptest > PRESSURE_LOW && origin) {
-                        abs_p = ptest;
-                        abs_w = int2bound(&c->w, raw_w);
-                        abs_x = int2bound(&c->x, raw_x - c->x.devmin);
-                        abs_y = int2bound(&c->y, c->y.devmax - raw_y);
-                        while (raw_n--) {
-                                ptest = int2bound(&c->p,
-                                                  raw2int(f->force_major));
-                                if (ptest > PRESSURE_LOW)
-                                        nmax++;
-                                if (ptest > PRESSURE_HIGH)
-                                        nmin++;
-                                f++;
-                        }
-                }
+        for (i = 0; i < raw_n; i++) {
+                if (raw2int(f[i].touch_major) == 0)
+                        continue;
+                dev->pos[n].x = raw2int(f[i].abs_x);
+                dev->pos[n].y = c->y.min + c->y.max - raw2int(f[i].abs_y);
+                dev->index[n++] = &f[i];
         }
 
-        /* set the integrated button if applicable */
-        if (c->tp_type == TYPE2)
-                ibt = raw2int(dev->tp_data[BUTTON_TYPE2]);
-
-        if (dev->fingers < nmin)
-                dev->fingers = nmin;
-        if (dev->fingers > nmax)
-                dev->fingers = nmax;
-
-        input_report_key(input, BTN_TOUCH, dev->fingers > 0);
-        input_report_key(input, BTN_TOOL_FINGER, dev->fingers == 1);
-        input_report_key(input, BTN_TOOL_DOUBLETAP, dev->fingers == 2);
-        input_report_key(input, BTN_TOOL_TRIPLETAP, dev->fingers == 3);
-        input_report_key(input, BTN_TOOL_QUADTAP, dev->fingers > 3);
-
-        input_report_abs(input, ABS_PRESSURE, abs_p);
-        input_report_abs(input, ABS_TOOL_WIDTH, abs_w);
+        input_mt_assign_slots(input, dev->slots, dev->pos, n);
 
-        if (abs_p) {
-                input_report_abs(input, ABS_X, abs_x);
-                input_report_abs(input, ABS_Y, abs_y);
+        for (i = 0; i < n; i++)
+                report_finger_data(input, dev->slots[i],
+                                   &dev->pos[i], dev->index[i]);
 
-                dprintk(8,
-                        "bcm5974: abs: p: %+05d w: %+05d x: %+05d y: %+05d "
-                        "nmin: %d nmax: %d n: %d ibt: %d\n", abs_p, abs_w,
-                        abs_x, abs_y, nmin, nmax, dev->fingers, ibt);
+        input_mt_sync_frame(input);
 
-        }
+        report_synaptics_data(input, c, f, raw_n);
 
         /* type 2 reports button events via ibt only */
-        if (c->tp_type == TYPE2)
+        if (c->tp_type == TYPE2) {
+                int ibt = raw2int(dev->tp_data[BUTTON_TYPE2]);
                 input_report_key(input, BTN_LEFT, ibt);
+        }
 
         input_sync(input);
 
@@ -742,9 +693,11 @@ static int bcm5974_start_traffic(struct bcm5974 *dev)
                 goto err_out;
         }
 
-        error = usb_submit_urb(dev->bt_urb, GFP_KERNEL);
-        if (error)
-                goto err_reset_mode;
+        if (dev->bt_urb) {
+                error = usb_submit_urb(dev->bt_urb, GFP_KERNEL);
+                if (error)
+                        goto err_reset_mode;
+        }
 
         error = usb_submit_urb(dev->tp_urb, GFP_KERNEL);
         if (error)
@@ -868,19 +821,23 @@ static int bcm5974_probe(struct usb_interface *iface,
         mutex_init(&dev->pm_mutex);
 
         /* setup urbs */
-        dev->bt_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!dev->bt_urb)
-                goto err_free_devs;
+        if (cfg->tp_type == TYPE1) {
+                dev->bt_urb = usb_alloc_urb(0, GFP_KERNEL);
+                if (!dev->bt_urb)
+                        goto err_free_devs;
+        }
 
         dev->tp_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!dev->tp_urb)
                 goto err_free_bt_urb;
 
-        dev->bt_data = usb_alloc_coherent(dev->udev,
+        if (dev->bt_urb) {
+                dev->bt_data = usb_alloc_coherent(dev->udev,
                                           dev->cfg.bt_datalen, GFP_KERNEL,
                                           &dev->bt_urb->transfer_dma);
-        if (!dev->bt_data)
-                goto err_free_urb;
+                if (!dev->bt_data)
+                        goto err_free_urb;
+        }
 
         dev->tp_data = usb_alloc_coherent(dev->udev,
                                           dev->cfg.tp_datalen, GFP_KERNEL,
@@ -888,10 +845,11 @@ static int bcm5974_probe(struct usb_interface *iface,
         if (!dev->tp_data)
                 goto err_free_bt_buffer;
 
-        usb_fill_int_urb(dev->bt_urb, udev,
-                         usb_rcvintpipe(udev, cfg->bt_ep),
-                         dev->bt_data, dev->cfg.bt_datalen,
-                         bcm5974_irq_button, dev, 1);
+        if (dev->bt_urb)
+                usb_fill_int_urb(dev->bt_urb, udev,
+                                 usb_rcvintpipe(udev, cfg->bt_ep),
+                                 dev->bt_data, dev->cfg.bt_datalen,
+                                 bcm5974_irq_button, dev, 1);
 
         usb_fill_int_urb(dev->tp_urb, udev,
                          usb_rcvintpipe(udev, cfg->tp_ep),
@@ -929,8 +887,9 @@ err_free_buffer:
         usb_free_coherent(dev->udev, dev->cfg.tp_datalen,
                 dev->tp_data, dev->tp_urb->transfer_dma);
 err_free_bt_buffer:
-        usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
-                dev->bt_data, dev->bt_urb->transfer_dma);
+        if (dev->bt_urb)
+                usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
+                                  dev->bt_data, dev->bt_urb->transfer_dma);
 err_free_urb:
         usb_free_urb(dev->tp_urb);
 err_free_bt_urb:
@@ -951,8 +910,9 @@ static void bcm5974_disconnect(struct usb_interface *iface)
         input_unregister_device(dev->input);
         usb_free_coherent(dev->udev, dev->cfg.tp_datalen,
                           dev->tp_data, dev->tp_urb->transfer_dma);
-        usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
-                          dev->bt_data, dev->bt_urb->transfer_dma);
+        if (dev->bt_urb)
+                usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
+                                  dev->bt_data, dev->bt_urb->transfer_dma);
         usb_free_urb(dev->tp_urb);
         usb_free_urb(dev->bt_urb);
         kfree(dev);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 479011004a11..1e8e42fb03a4 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1004,7 +1004,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                         input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2,
                                              ETP_WMAX_V2, 0, 0);
                 }
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
                 break;
@@ -1035,7 +1035,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                 input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2,
                                      ETP_WMAX_V2, 0, 0);
                 /* Multitouch capable pad, up to 5 fingers. */
-                input_mt_init_slots(dev, ETP_MAX_FINGERS);
+                input_mt_init_slots(dev, ETP_MAX_FINGERS, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
                 input_abs_set_res(dev, ABS_MT_POSITION_X, x_res);
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index 3f5649f19082..e582922bacf7 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -721,6 +721,17 @@ static psmouse_ret_t fsp_process_byte(struct psmouse *psmouse)
 
         switch (psmouse->packet[0] >> FSP_PKT_TYPE_SHIFT) {
         case FSP_PKT_TYPE_ABS:
+
+                if ((packet[0] == 0x48 || packet[0] == 0x49) &&
+                    packet[1] == 0 && packet[2] == 0) {
+                        /*
+                         * Ignore coordinate noise when finger leaving the
+                         * surface, otherwise cursor may jump to upper-left
+                         * corner.
+                         */
+                        packet[3] &= 0xf0;
+                }
+
                 abs_x = GET_ABS_X(packet);
                 abs_y = GET_ABS_Y(packet);
 
@@ -960,7 +971,7 @@ static int fsp_set_input_params(struct psmouse *psmouse)
 
                 input_set_abs_params(dev, ABS_X, 0, abs_x, 0, 0);
                 input_set_abs_params(dev, ABS_Y, 0, abs_y, 0, 0);
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_X, 0, abs_x, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y, 0, abs_y, 0, 0);
         }
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 14eaecea2b70..37033ade79d3 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1232,7 +1232,7 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
         input_set_abs_params(dev, ABS_PRESSURE, 0, 255, 0, 0);
 
         if (SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) {
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 set_abs_position_params(dev, priv, ABS_MT_POSITION_X,
                                         ABS_MT_POSITION_Y);
                 /* Image sensors can report per-contact pressure */
@@ -1244,7 +1244,7 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
         } else if (SYN_CAP_ADV_GESTURE(priv->ext_cap_0c)) {
                 /* Non-image sensors with AGM use semi-mt */
                 __set_bit(INPUT_PROP_SEMI_MT, dev->propbit);
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 set_abs_position_params(dev, priv, ABS_MT_POSITION_X,
                                         ABS_MT_POSITION_Y);
         }
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index 2ffd110bd5bc..2e77246c2e5a 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -72,7 +72,7 @@ static int amba_kmi_open(struct serio *io)
         unsigned int divisor;
         int ret;
 
-        ret = clk_enable(kmi->clk);
+        ret = clk_prepare_enable(kmi->clk);
         if (ret)
                 goto out;
 
@@ -92,7 +92,7 @@ static int amba_kmi_open(struct serio *io)
         return 0;
 
  clk_disable:
-        clk_disable(kmi->clk);
+        clk_disable_unprepare(kmi->clk);
  out:
         return ret;
 }
@@ -104,7 +104,7 @@ static void amba_kmi_close(struct serio *io)
         writeb(0, KMICR);
 
         free_irq(kmi->irq, kmi);
-        clk_disable(kmi->clk);
+        clk_disable_unprepare(kmi->clk);
 }
 
 static int __devinit amba_kmi_probe(struct amba_device *dev,
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 6918773ce024..d6cc77a53c7e 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -335,6 +335,12 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
         },
         {
                 .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+                },
+        },
+        {
+                .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
                 },
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 532d067a9e07..2a81ce375f75 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1530,7 +1530,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                         __set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit);
                         __set_bit(BTN_TOOL_QUADTAP, input_dev->keybit);
 
-                        input_mt_init_slots(input_dev, features->touch_max);
+                        input_mt_init_slots(input_dev, features->touch_max, 0);
 
                         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
                                              0, 255, 0, 0);
@@ -1575,7 +1575,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
         case TABLETPC2FG:
                 if (features->device_type == BTN_TOOL_FINGER) {
-                        input_mt_init_slots(input_dev, features->touch_max);
+                        input_mt_init_slots(input_dev, features->touch_max, 0);
                         input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
                                         0, MT_TOOL_MAX, 0, 0);
                         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
@@ -1631,7 +1631,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
                         __set_bit(BTN_TOOL_FINGER, input_dev->keybit);
                         __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
-                        input_mt_init_slots(input_dev, features->touch_max);
+                        input_mt_init_slots(input_dev, features->touch_max, 0);
 
                         if (features->pktlen == WACOM_PKGLEN_BBTOUCH3) {
                                 __set_bit(BTN_TOOL_TRIPLETAP,
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 4623cc69fc60..e92615d0b1b0 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1152,7 +1152,7 @@ static int __devinit mxt_probe(struct i2c_client *client,
 
         /* For multi touch */
         num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
-        error = input_mt_init_slots(input_dev, num_mt_slots);
+        error = input_mt_init_slots(input_dev, num_mt_slots, 0);
         if (error)
                 goto err_free_object;
         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
diff --git a/drivers/input/touchscreen/cyttsp_core.c b/drivers/input/touchscreen/cyttsp_core.c
index f030d9ec795d..8e60437ac85b 100644
--- a/drivers/input/touchscreen/cyttsp_core.c
+++ b/drivers/input/touchscreen/cyttsp_core.c
@@ -571,7 +571,7 @@ struct cyttsp *cyttsp_probe(const struct cyttsp_bus_ops *bus_ops,
         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
                              0, CY_MAXZ, 0, 0);
 
-        input_mt_init_slots(input_dev, CY_MAX_ID);
+        input_mt_init_slots(input_dev, CY_MAX_ID, 0);
 
         error = request_threaded_irq(ts->irq, NULL, cyttsp_irq,
                                      IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index b06a5e3a665e..099d144ab7c9 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -566,9 +566,12 @@ static ssize_t edt_ft5x06_debugfs_raw_data_read(struct file *file,
         }
 
         read = min_t(size_t, count, tsdata->raw_bufsize - *off);
-        error = copy_to_user(buf, tsdata->raw_buffer + *off, read);
-        if (!error)
-                *off += read;
+        if (copy_to_user(buf, tsdata->raw_buffer + *off, read)) {
+                error = -EFAULT;
+                goto out;
+        }
+
+        *off += read;
 out:
         mutex_unlock(&tsdata->mutex);
         return error ?: read;
@@ -779,7 +782,7 @@ static int __devinit edt_ft5x06_ts_probe(struct i2c_client *client,
                              0, tsdata->num_x * 64 - 1, 0, 0);
         input_set_abs_params(input, ABS_MT_POSITION_Y,
                              0, tsdata->num_y * 64 - 1, 0, 0);
-        error = input_mt_init_slots(input, MAX_SUPPORT_POINTS);
+        error = input_mt_init_slots(input, MAX_SUPPORT_POINTS, 0);
         if (error) {
                 dev_err(&client->dev, "Unable to init MT slots.\n");
                 goto err_free_mem;
diff --git a/drivers/input/touchscreen/egalax_ts.c b/drivers/input/touchscreen/egalax_ts.c
index 70524dd34f42..c1e3460f1195 100644
--- a/drivers/input/touchscreen/egalax_ts.c
+++ b/drivers/input/touchscreen/egalax_ts.c
@@ -204,7 +204,7 @@ static int __devinit egalax_ts_probe(struct i2c_client *client,
                              ABS_MT_POSITION_X, 0, EGALAX_MAX_X, 0, 0);
         input_set_abs_params(input_dev,
                              ABS_MT_POSITION_X, 0, EGALAX_MAX_Y, 0, 0);
-        input_mt_init_slots(input_dev, MAX_SUPPORT_POINTS);
+        input_mt_init_slots(input_dev, MAX_SUPPORT_POINTS, 0);
 
         input_set_drvdata(input_dev, ts);
 
diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index c0044175a921..4ac69760ec08 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -252,7 +252,7 @@ static int __devinit ili210x_i2c_probe(struct i2c_client *client,
         input_set_abs_params(input, ABS_Y, 0, ymax, 0, 0);
 
         /* Multi touch */
-        input_mt_init_slots(input, MAX_TOUCHES);
+        input_mt_init_slots(input, MAX_TOUCHES, 0);
         input_set_abs_params(input, ABS_MT_POSITION_X, 0, xmax, 0, 0);
         input_set_abs_params(input, ABS_MT_POSITION_Y, 0, ymax, 0, 0);
 
diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index 49c44bbf548d..560cf09d1c5a 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -404,7 +404,7 @@ static int __devinit mms114_probe(struct i2c_client *client,
         input_set_abs_params(input_dev, ABS_Y, 0, data->pdata->y_size, 0, 0);
 
         /* For multi touch */
-        input_mt_init_slots(input_dev, MMS114_MAX_TOUCH);
+        input_mt_init_slots(input_dev, MMS114_MAX_TOUCH, 0);
         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
                              0, MMS114_MAX_AREA, 0, 0);
         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
diff --git a/drivers/input/touchscreen/penmount.c b/drivers/input/touchscreen/penmount.c
index 4ccde45b9da2..b49f0b836925 100644
--- a/drivers/input/touchscreen/penmount.c
+++ b/drivers/input/touchscreen/penmount.c
@@ -264,7 +264,7 @@ static int pm_connect(struct serio *serio, struct serio_driver *drv)
         input_set_abs_params(pm->dev, ABS_Y, 0, max_y, 0, 0);
 
         if (pm->maxcontacts > 1) {
-                input_mt_init_slots(pm->dev, pm->maxcontacts);
+                input_mt_init_slots(pm->dev, pm->maxcontacts, 0);
                 input_set_abs_params(pm->dev,
                                      ABS_MT_POSITION_X, 0, max_x, 0, 0);
                 input_set_abs_params(pm->dev,
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index e32709e0dd65..721fdb3597ca 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -304,6 +304,45 @@ static int e2i_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 #define EGALAX_PKT_TYPE_REPT            0x80
 #define EGALAX_PKT_TYPE_DIAG            0x0A
 
+static int egalax_init(struct usbtouch_usb *usbtouch)
+{
+        int ret, i;
+        unsigned char *buf;
+        struct usb_device *udev = interface_to_usbdev(usbtouch->interface);
+
+        /*
+         * An eGalax diagnostic packet kicks the device into using the right
+         * protocol.  We send a "check active" packet.  The response will be
+         * read later and ignored.
+         */
+
+        buf = kmalloc(3, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        buf[0] = EGALAX_PKT_TYPE_DIAG;
+        buf[1] = 1;     /* length */
+        buf[2] = 'A';   /* command - check active */
+
+        for (i = 0; i < 3; i++) {
+                ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                                      0,
+                                      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                      0, 0, buf, 3,
+                                      USB_CTRL_SET_TIMEOUT);
+                if (ret >= 0) {
+                        ret = 0;
+                        break;
+                }
+                if (ret != -EPIPE)
+                        break;
+        }
+
+        kfree(buf);
+
+        return ret;
+}
+
 static int egalax_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 {
         if ((pkt[0] & EGALAX_PKT_TYPE_MASK) != EGALAX_PKT_TYPE_REPT)
@@ -1056,6 +1095,7 @@ static struct usbtouch_device_info usbtouch_dev_info[] = {
                 .process_pkt    = usbtouch_process_multi,
                 .get_pkt_len    = egalax_get_pkt_len,
                 .read_data      = egalax_read_data,
+                .init           = egalax_init,
         },
 #endif
 
diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index 8f9ad2f893b8..9a83be6b6584 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -471,7 +471,7 @@ static int w8001_setup(struct w8001 *w8001)
                 case 5:
                         w8001->pktlen = W8001_PKTLEN_TOUCH2FG;
 
-                        input_mt_init_slots(dev, 2);
+                        input_mt_init_slots(dev, 2, 0);
                         input_set_abs_params(dev, ABS_MT_POSITION_X,
                                                 0, touch.x, 0, 0);
                         input_set_abs_params(dev, ABS_MT_POSITION_Y,
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index b64502dfa9f4..e89daf1b21b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -266,7 +266,7 @@ static void swap_pci_ref(struct pci_dev **from, struct pci_dev *to)
 
 static int iommu_init_device(struct device *dev)
 {
-        struct pci_dev *dma_pdev, *pdev = to_pci_dev(dev);
+        struct pci_dev *dma_pdev = NULL, *pdev = to_pci_dev(dev);
         struct iommu_dev_data *dev_data;
         struct iommu_group *group;
         u16 alias;
@@ -293,7 +293,9 @@ static int iommu_init_device(struct device *dev)
                 dev_data->alias_data = alias_data;
 
                 dma_pdev = pci_get_bus_and_slot(alias >> 8, alias & 0xff);
-        } else
+        }
+
+        if (dma_pdev == NULL)
                 dma_pdev = pci_dev_get(pdev);
 
         /* Account for quirked devices */
diff --git a/drivers/isdn/hardware/mISDN/avmfritz.c b/drivers/isdn/hardware/mISDN/avmfritz.c
index fa6ca4733725..dceaec821b0e 100644
--- a/drivers/isdn/hardware/mISDN/avmfritz.c
+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
@@ -857,8 +857,9 @@ avm_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&fc->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 modehdlc(bch, ISDN_P_NONE);
                 spin_unlock_irqrestore(&fc->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 5e402cf2e795..f02794203bb1 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -5059,6 +5059,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
                                 printk(KERN_INFO
                                        "HFC-E1 #%d has overlapping B-channels on fragment #%d\n",
                                        E1_cnt + 1, pt);
+                                kfree(hc);
                                 return -EINVAL;
                         }
                         maskcheck |= hc->bmask[pt];
@@ -5086,6 +5087,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
         if ((poll >> 1) > sizeof(hc->silence_data)) {
                 printk(KERN_ERR "HFCMULTI error: silence_data too small, "
                        "please fix\n");
+                kfree(hc);
                 return -EINVAL;
         }
         for (i = 0; i < (poll >> 1); i++)
diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index 752e0825591f..ccd7d851be26 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1406,8 +1406,9 @@ hscx_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(hx->ip->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 hscx_mode(hx, ISDN_P_NONE);
                 spin_unlock_irqrestore(hx->ip->hwlock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/mISDNisar.c b/drivers/isdn/hardware/mISDN/mISDNisar.c
index be5973ded6d6..182ecf0626c2 100644
--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
@@ -1588,8 +1588,9 @@ isar_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(ich->is->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 modeisar(ich, ISDN_P_NONE);
                 spin_unlock_irqrestore(ich->is->hwlock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index c3e3e7686273..9bcade59eb73 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -812,8 +812,9 @@ nj_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 mode_tiger(bc, ISDN_P_NONE);
                 spin_unlock_irqrestore(&card->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c
index 26a86b846099..335fe6455002 100644
--- a/drivers/isdn/hardware/mISDN/w6692.c
+++ b/drivers/isdn/hardware/mISDN/w6692.c
@@ -1054,8 +1054,9 @@ w6692_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 w6692_mode(bc, ISDN_P_NONE);
                 spin_unlock_irqrestore(&card->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/mISDN/hwchannel.c b/drivers/isdn/mISDN/hwchannel.c
index ef34fd40867c..2602be23f341 100644
--- a/drivers/isdn/mISDN/hwchannel.c
+++ b/drivers/isdn/mISDN/hwchannel.c
@@ -148,17 +148,16 @@ mISDN_clear_bchannel(struct bchannel *ch)
         ch->next_minlen = ch->init_minlen;
         ch->maxlen = ch->init_maxlen;
         ch->next_maxlen = ch->init_maxlen;
+        skb_queue_purge(&ch->rqueue);
+        ch->rcount = 0;
 }
 EXPORT_SYMBOL(mISDN_clear_bchannel);
 
-int
+void
 mISDN_freebchannel(struct bchannel *ch)
 {
+        cancel_work_sync(&ch->workq);
         mISDN_clear_bchannel(ch);
-        skb_queue_purge(&ch->rqueue);
-        ch->rcount = 0;
-        flush_work_sync(&ch->workq);
-        return 0;
 }
 EXPORT_SYMBOL(mISDN_freebchannel);
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index d8abb90a6c2f..034233eefc82 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1555,6 +1555,7 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
                            unsigned long arg)
 {
         struct multipath *m = ti->private;
+        struct pgpath *pgpath;
         struct block_device *bdev;
         fmode_t mode;
         unsigned long flags;
@@ -1570,12 +1571,14 @@ again:
         if (!m->current_pgpath)
                 __choose_pgpath(m, 0);
 
-        if (m->current_pgpath) {
-                bdev = m->current_pgpath->path.dev->bdev;
-                mode = m->current_pgpath->path.dev->mode;
+        pgpath = m->current_pgpath;
+
+        if (pgpath) {
+                bdev = pgpath->path.dev->bdev;
+                mode = pgpath->path.dev->mode;
         }
 
-        if (m->queue_io)
+        if ((pgpath && m->queue_io) || (!pgpath && m->queue_if_no_path))
                 r = -EAGAIN;
         else if (!bdev)
                 r = -EIO;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index f90069029aae..100368eb7991 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1212,6 +1212,41 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
         return &t->targets[(KEYS_PER_NODE * n) + k];
 }
 
+static int count_device(struct dm_target *ti, struct dm_dev *dev,
+                        sector_t start, sector_t len, void *data)
+{
+        unsigned *num_devices = data;
+
+        (*num_devices)++;
+
+        return 0;
+}
+
+/*
+ * Check whether a table has no data devices attached using each
+ * target's iterate_devices method.
+ * Returns false if the result is unknown because a target doesn't
+ * support iterate_devices.
+ */
+bool dm_table_has_no_data_devices(struct dm_table *table)
+{
+        struct dm_target *uninitialized_var(ti);
+        unsigned i = 0, num_devices = 0;
+
+        while (i < dm_table_get_num_targets(table)) {
+                ti = dm_table_get_target(table, i++);
+
+                if (!ti->type->iterate_devices)
+                        return false;
+
+                ti->type->iterate_devices(ti, count_device, &num_devices);
+                if (num_devices)
+                        return false;
+        }
+
+        return true;
+}
+
 /*
  * Establish the new table's queue_limits and validate them.
  */
@@ -1354,17 +1389,25 @@ static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
         return q && blk_queue_nonrot(q);
 }
 
-static bool dm_table_is_nonrot(struct dm_table *t)
+static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
+                             sector_t start, sector_t len, void *data)
+{
+        struct request_queue *q = bdev_get_queue(dev->bdev);
+
+        return q && !blk_queue_add_random(q);
+}
+
+static bool dm_table_all_devices_attribute(struct dm_table *t,
+                                           iterate_devices_callout_fn func)
 {
         struct dm_target *ti;
         unsigned i = 0;
 
-        /* Ensure that all underlying device are non-rotational. */
         while (i < dm_table_get_num_targets(t)) {
                 ti = dm_table_get_target(t, i++);
 
                 if (!ti->type->iterate_devices ||
-                    !ti->type->iterate_devices(ti, device_is_nonrot, NULL))
+                    !ti->type->iterate_devices(ti, func, NULL))
                         return 0;
         }
 
@@ -1396,7 +1439,8 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         if (!dm_table_discard_zeroes_data(t))
                 q->limits.discard_zeroes_data = 0;
 
-        if (dm_table_is_nonrot(t))
+        /* Ensure that all underlying devices are non-rotational. */
+        if (dm_table_all_devices_attribute(t, device_is_nonrot))
                 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
         else
                 queue_flag_clear_unlocked(QUEUE_FLAG_NONROT, q);
@@ -1404,6 +1448,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         dm_table_set_integrity(t);
 
         /*
+         * Determine whether or not this queue's I/O timings contribute
+         * to the entropy pool, Only request-based targets use this.
+         * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
+         * have it set.
+         */
+        if (blk_queue_add_random(q) && dm_table_all_devices_attribute(t, device_is_not_random))
+                queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, q);
+
+        /*
          * QUEUE_FLAG_STACKABLE must be set after all queue settings are
          * visible to other CPUs because, once the flag is set, incoming bios
          * are processed by request-based dm, which refers to the queue
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index af1fc3b2c2ad..c29410af1e22 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -509,9 +509,9 @@ enum pool_mode {
 struct pool_features {
         enum pool_mode mode;
 
-        unsigned zero_new_blocks:1;
-        unsigned discard_enabled:1;
-        unsigned discard_passdown:1;
+        bool zero_new_blocks:1;
+        bool discard_enabled:1;
+        bool discard_passdown:1;
 };
 
 struct thin_c;
@@ -580,7 +580,8 @@ struct pool_c {
         struct dm_target_callbacks callbacks;
 
         dm_block_t low_water_blocks;
-        struct pool_features pf;
+        struct pool_features requested_pf; /* Features requested during table load */
+        struct pool_features adjusted_pf;  /* Features used after adjusting for constituent devices */
 };
 
 /*
@@ -1839,6 +1840,47 @@ static void __requeue_bios(struct pool *pool)
 /*----------------------------------------------------------------
  * Binding of control targets to a pool object
  *--------------------------------------------------------------*/
+static bool data_dev_supports_discard(struct pool_c *pt)
+{
+        struct request_queue *q = bdev_get_queue(pt->data_dev->bdev);
+
+        return q && blk_queue_discard(q);
+}
+
+/*
+ * If discard_passdown was enabled verify that the data device
+ * supports discards.  Disable discard_passdown if not.
+ */
+static void disable_passdown_if_not_supported(struct pool_c *pt)
+{
+        struct pool *pool = pt->pool;
+        struct block_device *data_bdev = pt->data_dev->bdev;
+        struct queue_limits *data_limits = &bdev_get_queue(data_bdev)->limits;
+        sector_t block_size = pool->sectors_per_block << SECTOR_SHIFT;
+        const char *reason = NULL;
+        char buf[BDEVNAME_SIZE];
+
+        if (!pt->adjusted_pf.discard_passdown)
+                return;
+
+        if (!data_dev_supports_discard(pt))
+                reason = "discard unsupported";
+
+        else if (data_limits->max_discard_sectors < pool->sectors_per_block)
+                reason = "max discard sectors smaller than a block";
+
+        else if (data_limits->discard_granularity > block_size)
+                reason = "discard granularity larger than a block";
+
+        else if (block_size & (data_limits->discard_granularity - 1))
+                reason = "discard granularity not a factor of block size";
+
+        if (reason) {
+                DMWARN("Data device (%s) %s: Disabling discard passdown.", bdevname(data_bdev, buf), reason);
+                pt->adjusted_pf.discard_passdown = false;
+        }
+}
+
 static int bind_control_target(struct pool *pool, struct dm_target *ti)
 {
         struct pool_c *pt = ti->private;
@@ -1847,31 +1889,16 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
          * We want to make sure that degraded pools are never upgraded.
          */
         enum pool_mode old_mode = pool->pf.mode;
-        enum pool_mode new_mode = pt->pf.mode;
+        enum pool_mode new_mode = pt->adjusted_pf.mode;
 
         if (old_mode > new_mode)
                 new_mode = old_mode;
 
         pool->ti = ti;
         pool->low_water_blocks = pt->low_water_blocks;
-        pool->pf = pt->pf;
-        set_pool_mode(pool, new_mode);
+        pool->pf = pt->adjusted_pf;
 
-        /*
-         * If discard_passdown was enabled verify that the data device
-         * supports discards.  Disable discard_passdown if not; otherwise
-         * -EOPNOTSUPP will be returned.
-         */
-        /* FIXME: pull this out into a sep fn. */
-        if (pt->pf.discard_passdown) {
-                struct request_queue *q = bdev_get_queue(pt->data_dev->bdev);
-                if (!q || !blk_queue_discard(q)) {
-                        char buf[BDEVNAME_SIZE];
-                        DMWARN("Discard unsupported by data device (%s): Disabling discard passdown.",
-                               bdevname(pt->data_dev->bdev, buf));
-                        pool->pf.discard_passdown = 0;
-                }
-        }
+        set_pool_mode(pool, new_mode);
 
         return 0;
 }
@@ -1889,9 +1916,9 @@ static void unbind_control_target(struct pool *pool, struct dm_target *ti)
 static void pool_features_init(struct pool_features *pf)
 {
         pf->mode = PM_WRITE;
-        pf->zero_new_blocks = 1;
-        pf->discard_enabled = 1;
-        pf->discard_passdown = 1;
+        pf->zero_new_blocks = true;
+        pf->discard_enabled = true;
+        pf->discard_passdown = true;
 }
 
 static void __pool_destroy(struct pool *pool)
@@ -2119,13 +2146,13 @@ static int parse_pool_features(struct dm_arg_set *as, struct pool_features *pf,
                 argc--;
 
                 if (!strcasecmp(arg_name, "skip_block_zeroing"))
-                        pf->zero_new_blocks = 0;
+                        pf->zero_new_blocks = false;
 
                 else if (!strcasecmp(arg_name, "ignore_discard"))
-                        pf->discard_enabled = 0;
+                        pf->discard_enabled = false;
 
                 else if (!strcasecmp(arg_name, "no_discard_passdown"))
-                        pf->discard_passdown = 0;
+                        pf->discard_passdown = false;
 
                 else if (!strcasecmp(arg_name, "read_only"))
                         pf->mode = PM_READ_ONLY;
@@ -2259,8 +2286,9 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
         pt->metadata_dev = metadata_dev;
         pt->data_dev = data_dev;
         pt->low_water_blocks = low_water_blocks;
-        pt->pf = pf;
+        pt->adjusted_pf = pt->requested_pf = pf;
         ti->num_flush_requests = 1;
+
         /*
          * Only need to enable discards if the pool should pass
          * them down to the data device.  The thin device's discard
@@ -2268,12 +2296,14 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
          */
         if (pf.discard_enabled && pf.discard_passdown) {
                 ti->num_discard_requests = 1;
+
                 /*
                  * Setting 'discards_supported' circumvents the normal
                  * stacking of discard limits (this keeps the pool and
                  * thin devices' discard limits consistent).
                  */
                 ti->discards_supported = true;
+                ti->discard_zeroes_data_unsupported = true;
         }
         ti->private = pt;
 
@@ -2703,7 +2733,7 @@ static int pool_status(struct dm_target *ti, status_type_t type,
                        format_dev_t(buf2, pt->data_dev->bdev->bd_dev),
                        (unsigned long)pool->sectors_per_block,
                        (unsigned long long)pt->low_water_blocks);
-                emit_flags(&pt->pf, result, sz, maxlen);
+                emit_flags(&pt->requested_pf, result, sz, maxlen);
                 break;
         }
 
@@ -2732,20 +2762,21 @@ static int pool_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
         return min(max_size, q->merge_bvec_fn(q, bvm, biovec));
 }
 
-static void set_discard_limits(struct pool *pool, struct queue_limits *limits)
+static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits)
 {
-        /*
-         * FIXME: these limits may be incompatible with the pool's data device
-         */
+        struct pool *pool = pt->pool;
+        struct queue_limits *data_limits;
+
         limits->max_discard_sectors = pool->sectors_per_block;
 
         /*
-         * This is just a hint, and not enforced.  We have to cope with
-         * bios that cover a block partially.  A discard that spans a block
-         * boundary is not sent to this target.
+         * discard_granularity is just a hint, and not enforced.
          */
-        limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
-        limits->discard_zeroes_data = pool->pf.zero_new_blocks;
+        if (pt->adjusted_pf.discard_passdown) {
+                data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits;
+                limits->discard_granularity = data_limits->discard_granularity;
+        } else
+                limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
 }
 
 static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
@@ -2755,15 +2786,25 @@ static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
         blk_limits_io_min(limits, 0);
         blk_limits_io_opt(limits, pool->sectors_per_block << SECTOR_SHIFT);
-        if (pool->pf.discard_enabled)
-                set_discard_limits(pool, limits);
+
+        /*
+         * pt->adjusted_pf is a staging area for the actual features to use.
+         * They get transferred to the live pool in bind_control_target()
+         * called from pool_preresume().
+         */
+        if (!pt->adjusted_pf.discard_enabled)
+                return;
+
+        disable_passdown_if_not_supported(pt);
+
+        set_discard_limits(pt, limits);
 }
 
 static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 3, 0},
+        .version = {1, 4, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -3042,19 +3083,19 @@ static int thin_iterate_devices(struct dm_target *ti,
         return 0;
 }
 
+/*
+ * A thin device always inherits its queue limits from its pool.
+ */
 static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 {
         struct thin_c *tc = ti->private;
-        struct pool *pool = tc->pool;
 
-        blk_limits_io_min(limits, 0);
-        blk_limits_io_opt(limits, pool->sectors_per_block << SECTOR_SHIFT);
-        set_discard_limits(pool, limits);
+        *limits = bdev_get_queue(tc->pool_dev->bdev)->limits;
 }
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 3, 0},
+        .version = {1, 4, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
index 254d19268ad2..892ae2766aa6 100644
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -718,8 +718,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
         v->hash_dev_block_bits = ffs(num) - 1;
 
         if (sscanf(argv[5], "%llu%c", &num_ll, &dummy) != 1 ||
-            num_ll << (v->data_dev_block_bits - SECTOR_SHIFT) !=
-            (sector_t)num_ll << (v->data_dev_block_bits - SECTOR_SHIFT)) {
+            (sector_t)(num_ll << (v->data_dev_block_bits - SECTOR_SHIFT))
+            >> (v->data_dev_block_bits - SECTOR_SHIFT) != num_ll) {
                 ti->error = "Invalid data blocks";
                 r = -EINVAL;
                 goto bad;
@@ -733,8 +733,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
         }
 
         if (sscanf(argv[6], "%llu%c", &num_ll, &dummy) != 1 ||
-            num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT) !=
-            (sector_t)num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT)) {
+            (sector_t)(num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT))
+            >> (v->hash_dev_block_bits - SECTOR_SHIFT) != num_ll) {
                 ti->error = "Invalid hash start";
                 r = -EINVAL;
                 goto bad;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 4e09b6ff5b49..67ffa391edcf 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -865,10 +865,14 @@ static void dm_done(struct request *clone, int error, bool mapped)
 {
         int r = error;
         struct dm_rq_target_io *tio = clone->end_io_data;
-        dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
+        dm_request_endio_fn rq_end_io = NULL;
 
-        if (mapped && rq_end_io)
-                r = rq_end_io(tio->ti, clone, error, &tio->info);
+        if (tio->ti) {
+                rq_end_io = tio->ti->type->rq_end_io;
+
+                if (mapped && rq_end_io)
+                        r = rq_end_io(tio->ti, clone, error, &tio->info);
+        }
 
         if (r <= 0)
                 /* The target wants to complete the I/O */
@@ -1588,15 +1592,6 @@ static int map_request(struct dm_target *ti, struct request *clone,
         int r, requeued = 0;
         struct dm_rq_target_io *tio = clone->end_io_data;
 
-        /*
-         * Hold the md reference here for the in-flight I/O.
-         * We can't rely on the reference count by device opener,
-         * because the device may be closed during the request completion
-         * when all bios are completed.
-         * See the comment in rq_completed() too.
-         */
-        dm_get(md);
-
         tio->ti = ti;
         r = ti->type->map_rq(ti, clone, &tio->info);
         switch (r) {
@@ -1628,6 +1623,26 @@ static int map_request(struct dm_target *ti, struct request *clone,
         return requeued;
 }
 
+static struct request *dm_start_request(struct mapped_device *md, struct request *orig)
+{
+        struct request *clone;
+
+        blk_start_request(orig);
+        clone = orig->special;
+        atomic_inc(&md->pending[rq_data_dir(clone)]);
+
+        /*
+         * Hold the md reference here for the in-flight I/O.
+         * We can't rely on the reference count by device opener,
+         * because the device may be closed during the request completion
+         * when all bios are completed.
+         * See the comment in rq_completed() too.
+         */
+        dm_get(md);
+
+        return clone;
+}
+
 /*
  * q->request_fn for request-based dm.
  * Called with the queue lock held.
@@ -1657,14 +1672,21 @@ static void dm_request_fn(struct request_queue *q)
                         pos = blk_rq_pos(rq);
 
                 ti = dm_table_find_target(map, pos);
-                BUG_ON(!dm_target_is_valid(ti));
+                if (!dm_target_is_valid(ti)) {
+                        /*
+                         * Must perform setup, that dm_done() requires,
+                         * before calling dm_kill_unmapped_request
+                         */
+                        DMERR_LIMIT("request attempted access beyond the end of device");
+                        clone = dm_start_request(md, rq);
+                        dm_kill_unmapped_request(clone, -EIO);
+                        continue;
+                }
 
                 if (ti->type->busy && ti->type->busy(ti))
                         goto delay_and_out;
 
-                blk_start_request(rq);
-                clone = rq->special;
-                atomic_inc(&md->pending[rq_data_dir(clone)]);
+                clone = dm_start_request(md, rq);
 
                 spin_unlock(q->queue_lock);
                 if (map_request(ti, clone, md))
@@ -1684,8 +1706,6 @@ delay_and_out:
         blk_delay_queue(q, HZ / 10);
 out:
         dm_table_put(map);
-
-        return;
 }
 
 int dm_underlying_device_busy(struct request_queue *q)
@@ -2409,7 +2429,7 @@ static void dm_queue_flush(struct mapped_device *md)
  */
 struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
 {
-        struct dm_table *map = ERR_PTR(-EINVAL);
+        struct dm_table *live_map, *map = ERR_PTR(-EINVAL);
         struct queue_limits limits;
         int r;
 
@@ -2419,6 +2439,19 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
         if (!dm_suspended_md(md))
                 goto out;
 
+        /*
+         * If the new table has no data devices, retain the existing limits.
+         * This helps multipath with queue_if_no_path if all paths disappear,
+         * then new I/O is queued based on these limits, and then some paths
+         * reappear.
+         */
+        if (dm_table_has_no_data_devices(table)) {
+                live_map = dm_get_live_table(md);
+                if (live_map)
+                        limits = md->queue->limits;
+                dm_table_put(live_map);
+        }
+
         r = dm_calculate_queue_limits(table, &limits);
         if (r) {
                 map = ERR_PTR(r);
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 52eef493d266..6a99fefaa743 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -54,6 +54,7 @@ void dm_table_event_callback(struct dm_table *t,
                              void (*fn)(void *), void *context);
 struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index);
 struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector);
+bool dm_table_has_no_data_devices(struct dm_table *table);
 int dm_calculate_queue_limits(struct dm_table *table,
                               struct queue_limits *limits);
 void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3f6203a4c7ea..308e87b417e0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7619,6 +7619,8 @@ static int remove_and_add_spares(struct mddev *mddev)
                         }
                 }
         }
+        if (removed)
+                set_bit(MD_CHANGE_DEVS, &mddev->flags);
         return spares;
 }
 
@@ -7632,9 +7634,11 @@ static void reap_sync_thread(struct mddev *mddev)
             !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                 /* success...*/
                 /* activate any spares */
-                if (mddev->pers->spare_active(mddev))
+                if (mddev->pers->spare_active(mddev)) {
                         sysfs_notify(&mddev->kobj, NULL,
                                      "degraded");
+                        set_bit(MD_CHANGE_DEVS, &mddev->flags);
+                }
         }
         if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
             mddev->pers->finish_reshape)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1c2eb38f3c51..0138a727c1f3 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1512,14 +1512,16 @@ static int _enough(struct r10conf *conf, struct geom *geo, int ignore)
         do {
                 int n = conf->copies;
                 int cnt = 0;
+                int this = first;
                 while (n--) {
-                        if (conf->mirrors[first].rdev &&
-                            first != ignore)
+                        if (conf->mirrors[this].rdev &&
+                            this != ignore)
                                 cnt++;
-                        first = (first+1) % geo->raid_disks;
+                        this = (this+1) % geo->raid_disks;
                 }
                 if (cnt == 0)
                         return 0;
+                first = (first + geo->near_copies) % geo->raid_disks;
         } while (first != 0);
         return 1;
 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index adda94df5eb2..0689173fd9f5 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -393,6 +393,8 @@ static int calc_degraded(struct r5conf *conf)
         degraded = 0;
         for (i = 0; i < conf->previous_raid_disks; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (rdev && test_bit(Faulty, &rdev->flags))
+                        rdev = rcu_dereference(conf->disks[i].replacement);
                 if (!rdev || test_bit(Faulty, &rdev->flags))
                         degraded++;
                 else if (test_bit(In_sync, &rdev->flags))
@@ -417,6 +419,8 @@ static int calc_degraded(struct r5conf *conf)
         degraded2 = 0;
         for (i = 0; i < conf->raid_disks; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (rdev && test_bit(Faulty, &rdev->flags))
+                        rdev = rcu_dereference(conf->disks[i].replacement);
                 if (!rdev || test_bit(Faulty, &rdev->flags))
                         degraded2++;
                 else if (test_bit(In_sync, &rdev->flags))
@@ -1587,6 +1591,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                 #ifdef CONFIG_MULTICORE_RAID456
                 init_waitqueue_head(&nsh->ops.wait_for_ops);
                 #endif
+                spin_lock_init(&nsh->stripe_lock);
 
                 list_add(&nsh->lru, &newstripes);
         }
@@ -4192,7 +4197,7 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                         finish_wait(&conf->wait_for_overlap, &w);
                         set_bit(STRIPE_HANDLE, &sh->state);
                         clear_bit(STRIPE_DELAYED, &sh->state);
-                        if ((bi->bi_rw & REQ_NOIDLE) &&
+                        if ((bi->bi_rw & REQ_SYNC) &&
                             !test_and_set_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
                                 atomic_inc(&conf->preread_active_stripes);
                         release_stripe_plug(mddev, sh);
diff --git a/drivers/mfd/88pm800.c b/drivers/mfd/88pm800.c
index b67a3018b136..ce229ea933d1 100644
--- a/drivers/mfd/88pm800.c
+++ b/drivers/mfd/88pm800.c
@@ -470,7 +470,8 @@ static int __devinit device_800_init(struct pm80x_chip *chip,
 
         ret =
             mfd_add_devices(chip->dev, 0, &onkey_devs[0],
-                            ARRAY_SIZE(onkey_devs), &onkey_resources[0], 0);
+                            ARRAY_SIZE(onkey_devs), &onkey_resources[0], 0,
+                            NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add onkey subdev\n");
                 goto out_dev;
@@ -481,7 +482,7 @@ static int __devinit device_800_init(struct pm80x_chip *chip,
                 rtc_devs[0].platform_data = pdata->rtc;
                 rtc_devs[0].pdata_size = sizeof(struct pm80x_rtc_pdata);
                 ret = mfd_add_devices(chip->dev, 0, &rtc_devs[0],
-                                      ARRAY_SIZE(rtc_devs), NULL, 0);
+                                      ARRAY_SIZE(rtc_devs), NULL, 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add rtc subdev\n");
                         goto out_dev;
diff --git a/drivers/mfd/88pm805.c b/drivers/mfd/88pm805.c
index 6146583589f6..c20a31136f04 100644
--- a/drivers/mfd/88pm805.c
+++ b/drivers/mfd/88pm805.c
@@ -216,7 +216,8 @@ static int __devinit device_805_init(struct pm80x_chip *chip)
         }
 
         ret = mfd_add_devices(chip->dev, 0, &codec_devs[0],
-                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0);
+                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0,
+                              NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add codec subdev\n");
                 goto out_codec;
diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
index d09918cf1b15..b73f033b2c60 100644
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -637,7 +637,7 @@ static void __devinit device_bk_init(struct pm860x_chip *chip,
                         bk_devs[i].resources = &bk_resources[j];
                         ret = mfd_add_devices(chip->dev, 0,
                                               &bk_devs[i], 1,
-                                              &bk_resources[j], 0);
+                                              &bk_resources[j], 0, NULL);
                         if (ret < 0) {
                                 dev_err(chip->dev, "Failed to add "
                                         "backlight subdev\n");
@@ -672,7 +672,7 @@ static void __devinit device_led_init(struct pm860x_chip *chip,
                         led_devs[i].resources = &led_resources[j],
                         ret = mfd_add_devices(chip->dev, 0,
                                               &led_devs[i], 1,
-                                              &led_resources[j], 0);
+                                              &led_resources[j], 0, NULL);
                         if (ret < 0) {
                                 dev_err(chip->dev, "Failed to add "
                                         "led subdev\n");
@@ -709,7 +709,7 @@ static void __devinit device_regulator_init(struct pm860x_chip *chip,
                 regulator_devs[i].resources = &regulator_resources[seq];
 
                 ret = mfd_add_devices(chip->dev, 0, &regulator_devs[i], 1,
-                                      &regulator_resources[seq], 0);
+                                      &regulator_resources[seq], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add regulator subdev\n");
                         goto out;
@@ -733,7 +733,7 @@ static void __devinit device_rtc_init(struct pm860x_chip *chip,
         rtc_devs[0].resources = &rtc_resources[0];
         ret = mfd_add_devices(chip->dev, 0, &rtc_devs[0],
                               ARRAY_SIZE(rtc_devs), &rtc_resources[0],
-                              chip->irq_base);
+                              chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add rtc subdev\n");
 }
@@ -752,7 +752,7 @@ static void __devinit device_touch_init(struct pm860x_chip *chip,
         touch_devs[0].resources = &touch_resources[0];
         ret = mfd_add_devices(chip->dev, 0, &touch_devs[0],
                               ARRAY_SIZE(touch_devs), &touch_resources[0],
-                              chip->irq_base);
+                              chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add touch subdev\n");
 }
@@ -770,7 +770,7 @@ static void __devinit device_power_init(struct pm860x_chip *chip,
         power_devs[0].num_resources = ARRAY_SIZE(battery_resources);
         power_devs[0].resources = &battery_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &power_devs[0], 1,
-                              &battery_resources[0], chip->irq_base);
+                              &battery_resources[0], chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add battery subdev\n");
 
@@ -779,7 +779,7 @@ static void __devinit device_power_init(struct pm860x_chip *chip,
         power_devs[1].num_resources = ARRAY_SIZE(charger_resources);
         power_devs[1].resources = &charger_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &power_devs[1], 1,
-                              &charger_resources[0], chip->irq_base);
+                              &charger_resources[0], chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add charger subdev\n");
 
@@ -788,7 +788,7 @@ static void __devinit device_power_init(struct pm860x_chip *chip,
         power_devs[2].num_resources = ARRAY_SIZE(preg_resources);
         power_devs[2].resources = &preg_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &power_devs[2], 1,
-                              &preg_resources[0], chip->irq_base);
+                              &preg_resources[0], chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add preg subdev\n");
 }
@@ -802,7 +802,7 @@ static void __devinit device_onkey_init(struct pm860x_chip *chip,
         onkey_devs[0].resources = &onkey_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &onkey_devs[0],
                               ARRAY_SIZE(onkey_devs), &onkey_resources[0],
-                              chip->irq_base);
+                              chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add onkey subdev\n");
 }
@@ -815,7 +815,8 @@ static void __devinit device_codec_init(struct pm860x_chip *chip,
         codec_devs[0].num_resources = ARRAY_SIZE(codec_resources);
         codec_devs[0].resources = &codec_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &codec_devs[0],
-                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0);
+                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0,
+                              NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add codec subdev\n");
 }
diff --git a/drivers/mfd/aat2870-core.c b/drivers/mfd/aat2870-core.c
index 44a3fdbadef4..f1beb4971f87 100644
--- a/drivers/mfd/aat2870-core.c
+++ b/drivers/mfd/aat2870-core.c
@@ -424,7 +424,7 @@ static int aat2870_i2c_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(aat2870->dev, 0, aat2870_devs,
-                              ARRAY_SIZE(aat2870_devs), NULL, 0);
+                              ARRAY_SIZE(aat2870_devs), NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(aat2870->dev, "Failed to add subdev: %d\n", ret);
                 goto out_disable;
diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
index 78fca2902c8d..01781ae5d0d7 100644
--- a/drivers/mfd/ab3100-core.c
+++ b/drivers/mfd/ab3100-core.c
@@ -946,7 +946,7 @@ static int __devinit ab3100_probe(struct i2c_client *client,
         }
 
         err = mfd_add_devices(&client->dev, 0, ab3100_devs,
-                ARRAY_SIZE(ab3100_devs), NULL, 0);
+                              ARRAY_SIZE(ab3100_devs), NULL, 0, NULL);
 
         ab3100_setup_debugfs(ab3100);
 
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 626b4ecaf647..47adf800024e 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -1418,25 +1418,25 @@ static int __devinit ab8500_probe(struct platform_device *pdev)
 
         ret = mfd_add_devices(ab8500->dev, 0, abx500_common_devs,
                         ARRAY_SIZE(abx500_common_devs), NULL,
-                        ab8500->irq_base);
+                        ab8500->irq_base, ab8500->domain);
         if (ret)
                 goto out_freeirq;
 
         if (is_ab9540(ab8500))
                 ret = mfd_add_devices(ab8500->dev, 0, ab9540_devs,
                                 ARRAY_SIZE(ab9540_devs), NULL,
-                                ab8500->irq_base);
+                                ab8500->irq_base, ab8500->domain);
         else
                 ret = mfd_add_devices(ab8500->dev, 0, ab8500_devs,
                                 ARRAY_SIZE(ab8500_devs), NULL,
-                                ab8500->irq_base);
+                                ab8500->irq_base, ab8500->domain);
         if (ret)
                 goto out_freeirq;
 
         if (is_ab9540(ab8500) || is_ab8505(ab8500))
                 ret = mfd_add_devices(ab8500->dev, 0, ab9540_ab8505_devs,
                                 ARRAY_SIZE(ab9540_ab8505_devs), NULL,
-                                ab8500->irq_base);
+                                ab8500->irq_base, ab8500->domain);
         if (ret)
                 goto out_freeirq;
 
@@ -1444,7 +1444,7 @@ static int __devinit ab8500_probe(struct platform_device *pdev)
                 /* Add battery management devices */
                 ret = mfd_add_devices(ab8500->dev, 0, ab8500_bm_devs,
                                       ARRAY_SIZE(ab8500_bm_devs), NULL,
-                                      ab8500->irq_base);
+                                      ab8500->irq_base, ab8500->domain);
                 if (ret)
                         dev_err(ab8500->dev, "error adding bm devices\n");
         }
diff --git a/drivers/mfd/ab8500-gpadc.c b/drivers/mfd/ab8500-gpadc.c
index 866f95960b4b..29d72a259c85 100644
--- a/drivers/mfd/ab8500-gpadc.c
+++ b/drivers/mfd/ab8500-gpadc.c
@@ -342,7 +342,7 @@ int ab8500_gpadc_read_raw(struct ab8500_gpadc *gpadc, u8 channel)
 
                  /*
                   * Delay might be needed for ABB8500 cut 3.0, if not, remove
-                  * when hardware will be availible
+                  * when hardware will be available
                   */
                         msleep(1);
                         break;
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index c7983e862549..1b48f2094806 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -316,7 +316,7 @@ int __devinit arizona_dev_init(struct arizona *arizona)
         }
 
         ret = mfd_add_devices(arizona->dev, -1, early_devs,
-                              ARRAY_SIZE(early_devs), NULL, 0);
+                              ARRAY_SIZE(early_devs), NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(dev, "Failed to add early children: %d\n", ret);
                 return ret;
@@ -516,11 +516,11 @@ int __devinit arizona_dev_init(struct arizona *arizona)
         switch (arizona->type) {
         case WM5102:
                 ret = mfd_add_devices(arizona->dev, -1, wm5102_devs,
-                                      ARRAY_SIZE(wm5102_devs), NULL, 0);
+                                      ARRAY_SIZE(wm5102_devs), NULL, 0, NULL);
                 break;
         case WM5110:
                 ret = mfd_add_devices(arizona->dev, -1, wm5110_devs,
-                                      ARRAY_SIZE(wm5102_devs), NULL, 0);
+                                      ARRAY_SIZE(wm5102_devs), NULL, 0, NULL);
                 break;
         }
 
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 683e18a23329..62f0883a7630 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -913,14 +913,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
         if (pdata->clock_rate) {
                 ds1wm_pdata.clock_rate = pdata->clock_rate;
                 ret = mfd_add_devices(&pdev->dev, pdev->id,
-                        &asic3_cell_ds1wm, 1, mem, asic->irq_base);
+                        &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL);
                 if (ret < 0)
                         goto out;
         }
 
         if (mem_sdio && (irq >= 0)) {
                 ret = mfd_add_devices(&pdev->dev, pdev->id,
-                        &asic3_cell_mmc, 1, mem_sdio, irq);
+                        &asic3_cell_mmc, 1, mem_sdio, irq, NULL);
                 if (ret < 0)
                         goto out;
         }
@@ -934,7 +934,7 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
                         asic3_cell_leds[i].pdata_size = sizeof(pdata->leds[i]);
                 }
                 ret = mfd_add_devices(&pdev->dev, 0,
-                        asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0);
+                        asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL);
         }
 
  out:
diff --git a/drivers/mfd/cs5535-mfd.c b/drivers/mfd/cs5535-mfd.c
index 3419e726de47..2b282133c725 100644
--- a/drivers/mfd/cs5535-mfd.c
+++ b/drivers/mfd/cs5535-mfd.c
@@ -149,7 +149,7 @@ static int __devinit cs5535_mfd_probe(struct pci_dev *pdev,
         }
 
         err = mfd_add_devices(&pdev->dev, -1, cs5535_mfd_cells,
-                        ARRAY_SIZE(cs5535_mfd_cells), NULL, 0);
+                              ARRAY_SIZE(cs5535_mfd_cells), NULL, 0, NULL);
         if (err) {
                 dev_err(&pdev->dev, "MFD add devices failed: %d\n", err);
                 goto err_disable;
diff --git a/drivers/mfd/da9052-core.c b/drivers/mfd/da9052-core.c
index 2544910e1fd6..a0a62b24621b 100644
--- a/drivers/mfd/da9052-core.c
+++ b/drivers/mfd/da9052-core.c
@@ -803,7 +803,7 @@ int __devinit da9052_device_init(struct da9052 *da9052, u8 chip_id)
                 dev_err(da9052->dev, "DA9052 ADC IRQ failed ret=%d\n", ret);
 
         ret = mfd_add_devices(da9052->dev, -1, da9052_subdev_info,
-                              ARRAY_SIZE(da9052_subdev_info), NULL, 0);
+                              ARRAY_SIZE(da9052_subdev_info), NULL, 0, NULL);
         if (ret)
                 goto err;
 
diff --git a/drivers/mfd/davinci_voicecodec.c b/drivers/mfd/davinci_voicecodec.c
index 4e2af2cb2d26..45e83a68641b 100644
--- a/drivers/mfd/davinci_voicecodec.c
+++ b/drivers/mfd/davinci_voicecodec.c
@@ -129,7 +129,7 @@ static int __init davinci_vc_probe(struct platform_device *pdev)
         cell->pdata_size = sizeof(*davinci_vc);
 
         ret = mfd_add_devices(&pdev->dev, pdev->id, davinci_vc->cells,
-                              DAVINCI_VC_CELLS, NULL, 0);
+                              DAVINCI_VC_CELLS, NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(&pdev->dev, "fail to register client devices\n");
                 goto fail4;
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index 7040a0081130..0e63cdd9b52a 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -3010,7 +3010,7 @@ static int __devinit db8500_prcmu_probe(struct platform_device *pdev)
                 prcmu_config_esram0_deep_sleep(ESRAM0_DEEP_SLEEP_STATE_RET);
 
         err = mfd_add_devices(&pdev->dev, 0, db8500_prcmu_devs,
-                        ARRAY_SIZE(db8500_prcmu_devs), NULL, 0);
+                              ARRAY_SIZE(db8500_prcmu_devs), NULL, 0, NULL);
         if (err) {
                 pr_err("prcmu: Failed to add subdevices\n");
                 return err;
diff --git a/drivers/mfd/htc-pasic3.c b/drivers/mfd/htc-pasic3.c
index 04c7093d6499..9e5453d21a68 100644
--- a/drivers/mfd/htc-pasic3.c
+++ b/drivers/mfd/htc-pasic3.c
@@ -168,7 +168,7 @@ static int __init pasic3_probe(struct platform_device *pdev)
                 /* the first 5 PASIC3 registers control the DS1WM */
                 ds1wm_resources[0].end = (5 << asic->bus_shift) - 1;
                 ret = mfd_add_devices(&pdev->dev, pdev->id,
-                                &ds1wm_cell, 1, r, irq);
+                                      &ds1wm_cell, 1, r, irq, NULL);
                 if (ret < 0)
                         dev_warn(dev, "failed to register DS1WM\n");
         }
@@ -176,7 +176,8 @@ static int __init pasic3_probe(struct platform_device *pdev)
         if (pdata && pdata->led_pdata) {
                 led_cell.platform_data = pdata->led_pdata;
                 led_cell.pdata_size = sizeof(struct pasic3_leds_machinfo);
-                ret = mfd_add_devices(&pdev->dev, pdev->id, &led_cell, 1, r, 0);
+                ret = mfd_add_devices(&pdev->dev, pdev->id, &led_cell, 1, r,
+                                      0, NULL);
                 if (ret < 0)
                         dev_warn(dev, "failed to register LED device\n");
         }
diff --git a/drivers/mfd/intel_msic.c b/drivers/mfd/intel_msic.c
index 59df5584cb58..266bdc5bd96d 100644
--- a/drivers/mfd/intel_msic.c
+++ b/drivers/mfd/intel_msic.c
@@ -344,13 +344,13 @@ static int __devinit intel_msic_init_devices(struct intel_msic *msic)
                         continue;
 
                 ret = mfd_add_devices(&pdev->dev, -1, &msic_devs[i], 1, NULL,
-                                      pdata->irq[i]);
+                                      pdata->irq[i], NULL);
                 if (ret)
                         goto fail;
         }
 
         ret = mfd_add_devices(&pdev->dev, 0, msic_other_devs,
-                              ARRAY_SIZE(msic_other_devs), NULL, 0);
+                              ARRAY_SIZE(msic_other_devs), NULL, 0, NULL);
         if (ret)
                 goto fail;
 
diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
index 2ea99989551a..965c4801df8a 100644
--- a/drivers/mfd/janz-cmodio.c
+++ b/drivers/mfd/janz-cmodio.c
@@ -147,7 +147,7 @@ static int __devinit cmodio_probe_submodules(struct cmodio_device *priv)
         }
 
         return mfd_add_devices(&pdev->dev, 0, priv->cells,
-                               num_probed, NULL, pdev->irq);
+                               num_probed, NULL, pdev->irq, NULL);
 }
 
 /*
diff --git a/drivers/mfd/jz4740-adc.c b/drivers/mfd/jz4740-adc.c
index 87662a17dec6..c6b6d7dda517 100644
--- a/drivers/mfd/jz4740-adc.c
+++ b/drivers/mfd/jz4740-adc.c
@@ -287,7 +287,8 @@ static int __devinit jz4740_adc_probe(struct platform_device *pdev)
         writeb(0xff, adc->base + JZ_REG_ADC_CTRL);
 
         ret = mfd_add_devices(&pdev->dev, 0, jz4740_adc_cells,
-                ARRAY_SIZE(jz4740_adc_cells), mem_base, irq_base);
+                              ARRAY_SIZE(jz4740_adc_cells), mem_base,
+                              irq_base, NULL);
         if (ret < 0)
                 goto err_clk_put;
 
diff --git a/drivers/mfd/lm3533-core.c b/drivers/mfd/lm3533-core.c
index 0b2879b87fd9..24212f45b201 100644
--- a/drivers/mfd/lm3533-core.c
+++ b/drivers/mfd/lm3533-core.c
@@ -393,7 +393,8 @@ static int __devinit lm3533_device_als_init(struct lm3533 *lm3533)
         lm3533_als_devs[0].platform_data = pdata->als;
         lm3533_als_devs[0].pdata_size = sizeof(*pdata->als);
 
-        ret = mfd_add_devices(lm3533->dev, 0, lm3533_als_devs, 1, NULL, 0);
+        ret = mfd_add_devices(lm3533->dev, 0, lm3533_als_devs, 1, NULL,
+                              0, NULL);
         if (ret) {
                 dev_err(lm3533->dev, "failed to add ALS device\n");
                 return ret;
@@ -422,7 +423,7 @@ static int __devinit lm3533_device_bl_init(struct lm3533 *lm3533)
         }
 
         ret = mfd_add_devices(lm3533->dev, 0, lm3533_bl_devs,
-                                        pdata->num_backlights, NULL, 0);
+                              pdata->num_backlights, NULL, 0, NULL);
         if (ret) {
                 dev_err(lm3533->dev, "failed to add backlight devices\n");
                 return ret;
@@ -451,7 +452,7 @@ static int __devinit lm3533_device_led_init(struct lm3533 *lm3533)
         }
 
         ret = mfd_add_devices(lm3533->dev, 0, lm3533_led_devs,
-                                                pdata->num_leds, NULL, 0);
+                              pdata->num_leds, NULL, 0, NULL);
         if (ret) {
                 dev_err(lm3533->dev, "failed to add LED devices\n");
                 return ret;
diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
index 027cc8f86132..092ad4b44b6d 100644
--- a/drivers/mfd/lpc_ich.c
+++ b/drivers/mfd/lpc_ich.c
@@ -750,7 +750,7 @@ gpe0_done:
 
         lpc_ich_finalize_cell(&lpc_ich_cells[LPC_GPIO], id);
         ret = mfd_add_devices(&dev->dev, -1, &lpc_ich_cells[LPC_GPIO],
-                                1, NULL, 0);
+                              1, NULL, 0, NULL);
 
 gpio_done:
         if (acpi_conflict)
@@ -765,7 +765,6 @@ static int __devinit lpc_ich_init_wdt(struct pci_dev *dev,
         u32 base_addr_cfg;
         u32 base_addr;
         int ret;
-        bool acpi_conflict = false;
         struct resource *res;
 
         /* Setup power management base register */
@@ -780,20 +779,11 @@ static int __devinit lpc_ich_init_wdt(struct pci_dev *dev,
         res = wdt_io_res(ICH_RES_IO_TCO);
         res->start = base_addr + ACPIBASE_TCO_OFF;
         res->end = base_addr + ACPIBASE_TCO_END;
-        ret = acpi_check_resource_conflict(res);
-        if (ret) {
-                acpi_conflict = true;
-                goto wdt_done;
-        }
 
         res = wdt_io_res(ICH_RES_IO_SMI);
         res->start = base_addr + ACPIBASE_SMI_OFF;
         res->end = base_addr + ACPIBASE_SMI_END;
-        ret = acpi_check_resource_conflict(res);
-        if (ret) {
-                acpi_conflict = true;
-                goto wdt_done;
-        }
+
         lpc_ich_enable_acpi_space(dev);
 
         /*
@@ -813,21 +803,13 @@ static int __devinit lpc_ich_init_wdt(struct pci_dev *dev,
                 res = wdt_mem_res(ICH_RES_MEM_GCS);
                 res->start = base_addr + ACPIBASE_GCS_OFF;
                 res->end = base_addr + ACPIBASE_GCS_END;
-                ret = acpi_check_resource_conflict(res);
-                if (ret) {
-                        acpi_conflict = true;
-                        goto wdt_done;
-                }
         }
 
         lpc_ich_finalize_cell(&lpc_ich_cells[LPC_WDT], id);
         ret = mfd_add_devices(&dev->dev, -1, &lpc_ich_cells[LPC_WDT],
-                                1, NULL, 0);
+                              1, NULL, 0, NULL);
 
 wdt_done:
-        if (acpi_conflict)
-                pr_warn("Resource conflict(s) found affecting %s\n",
-                                lpc_ich_cells[LPC_WDT].name);
         return ret;
 }
 
diff --git a/drivers/mfd/lpc_sch.c b/drivers/mfd/lpc_sch.c
index 9f20abc5e393..f6b9c5c96b24 100644
--- a/drivers/mfd/lpc_sch.c
+++ b/drivers/mfd/lpc_sch.c
@@ -127,7 +127,8 @@ static int __devinit lpc_sch_probe(struct pci_dev *dev,
                 lpc_sch_cells[i].id = id->device;
 
         ret = mfd_add_devices(&dev->dev, 0,
-                        lpc_sch_cells, ARRAY_SIZE(lpc_sch_cells), NULL, 0);
+                              lpc_sch_cells, ARRAY_SIZE(lpc_sch_cells), NULL,
+                              0, NULL);
         if (ret)
                 goto out_dev;
 
@@ -153,7 +154,8 @@ static int __devinit lpc_sch_probe(struct pci_dev *dev,
                         tunnelcreek_cells[i].id = id->device;
 
                 ret = mfd_add_devices(&dev->dev, 0, tunnelcreek_cells,
-                        ARRAY_SIZE(tunnelcreek_cells), NULL, 0);
+                                      ARRAY_SIZE(tunnelcreek_cells), NULL,
+                                      0, NULL);
         }
 
         return ret;
diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
index c03e12b51924..d9e24c849a00 100644
--- a/drivers/mfd/max77686.c
+++ b/drivers/mfd/max77686.c
@@ -126,7 +126,7 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
         max77686_irq_init(max77686);
 
         ret = mfd_add_devices(max77686->dev, -1, max77686_devs,
-                              ARRAY_SIZE(max77686_devs), NULL, 0);
+                              ARRAY_SIZE(max77686_devs), NULL, 0, NULL);
 
         if (ret < 0)
                 goto err_mfd;
diff --git a/drivers/mfd/max77693-irq.c b/drivers/mfd/max77693-irq.c
index 2b403569e0a6..1029d018c739 100644
--- a/drivers/mfd/max77693-irq.c
+++ b/drivers/mfd/max77693-irq.c
@@ -137,6 +137,9 @@ static void max77693_irq_mask(struct irq_data *data)
         const struct max77693_irq_data *irq_data =
                                 irq_to_max77693_irq(max77693, data->irq);
 
+        if (irq_data->group >= MAX77693_IRQ_GROUP_NR)
+                return;
+
         if (irq_data->group >= MUIC_INT1 && irq_data->group <= MUIC_INT3)
                 max77693->irq_masks_cur[irq_data->group] &= ~irq_data->mask;
         else
@@ -149,6 +152,9 @@ static void max77693_irq_unmask(struct irq_data *data)
         const struct max77693_irq_data *irq_data =
             irq_to_max77693_irq(max77693, data->irq);
 
+        if (irq_data->group >= MAX77693_IRQ_GROUP_NR)
+                return;
+
         if (irq_data->group >= MUIC_INT1 && irq_data->group <= MUIC_INT3)
                 max77693->irq_masks_cur[irq_data->group] |= irq_data->mask;
         else
@@ -200,7 +206,7 @@ static irqreturn_t max77693_irq_thread(int irq, void *data)
 
         if (irq_src & MAX77693_IRQSRC_MUIC)
                 /* MUIC INT1 ~ INT3 */
-                max77693_bulk_read(max77693->regmap, MAX77693_MUIC_REG_INT1,
+                max77693_bulk_read(max77693->regmap_muic, MAX77693_MUIC_REG_INT1,
                         MAX77693_NUM_IRQ_MUIC_REGS, &irq_reg[MUIC_INT1]);
 
         /* Apply masking */
@@ -255,7 +261,8 @@ int max77693_irq_init(struct max77693_dev *max77693)
 {
         struct irq_domain *domain;
         int i;
-        int ret;
+        int ret = 0;
+        u8 intsrc_mask;
 
         mutex_init(&max77693->irqlock);
 
@@ -287,19 +294,38 @@ int max77693_irq_init(struct max77693_dev *max77693)
                                         &max77693_irq_domain_ops, max77693);
         if (!domain) {
                 dev_err(max77693->dev, "could not create irq domain\n");
-                return -ENODEV;
+                ret = -ENODEV;
+                goto err_irq;
         }
         max77693->irq_domain = domain;
 
+        /* Unmask max77693 interrupt */
+        ret = max77693_read_reg(max77693->regmap,
+                        MAX77693_PMIC_REG_INTSRC_MASK, &intsrc_mask);
+        if (ret < 0) {
+                dev_err(max77693->dev, "fail to read PMIC register\n");
+                goto err_irq;
+        }
+
+        intsrc_mask &= ~(MAX77693_IRQSRC_CHG);
+        intsrc_mask &= ~(MAX77693_IRQSRC_FLASH);
+        intsrc_mask &= ~(MAX77693_IRQSRC_MUIC);
+        ret = max77693_write_reg(max77693->regmap,
+                        MAX77693_PMIC_REG_INTSRC_MASK, intsrc_mask);
+        if (ret < 0) {
+                dev_err(max77693->dev, "fail to write PMIC register\n");
+                goto err_irq;
+        }
+
         ret = request_threaded_irq(max77693->irq, NULL, max77693_irq_thread,
                                    IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                    "max77693-irq", max77693);
-
         if (ret)
                 dev_err(max77693->dev, "Failed to request IRQ %d: %d\n",
                         max77693->irq, ret);
 
-        return 0;
+err_irq:
+        return ret;
 }
 
 void max77693_irq_exit(struct max77693_dev *max77693)
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index a1811cb50ec7..cc5155e20494 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -152,6 +152,20 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
         max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
         i2c_set_clientdata(max77693->haptic, max77693);
 
+        /*
+         * Initialize register map for MUIC device because use regmap-muic
+         * instance of MUIC device when irq of max77693 is initialized
+         * before call max77693-muic probe() function.
+         */
+        max77693->regmap_muic = devm_regmap_init_i2c(max77693->muic,
+                                         &max77693_regmap_config);
+        if (IS_ERR(max77693->regmap_muic)) {
+                ret = PTR_ERR(max77693->regmap_muic);
+                dev_err(max77693->dev,
+                        "failed to allocate register map: %d\n", ret);
+                goto err_regmap;
+        }
+
         ret = max77693_irq_init(max77693);
         if (ret < 0)
                 goto err_irq;
@@ -159,7 +173,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
         pm_runtime_set_active(max77693->dev);
 
         ret = mfd_add_devices(max77693->dev, -1, max77693_devs,
-                        ARRAY_SIZE(max77693_devs), NULL, 0);
+                              ARRAY_SIZE(max77693_devs), NULL, 0, NULL);
         if (ret < 0)
                 goto err_mfd;
 
diff --git a/drivers/mfd/max8925-core.c b/drivers/mfd/max8925-core.c
index 825a7f06d9ba..ee53757beca7 100644
--- a/drivers/mfd/max8925-core.c
+++ b/drivers/mfd/max8925-core.c
@@ -598,7 +598,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
 
         ret = mfd_add_devices(chip->dev, 0, &rtc_devs[0],
                               ARRAY_SIZE(rtc_devs),
-                              &rtc_resources[0], chip->irq_base);
+                              &rtc_resources[0], chip->irq_base, NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add rtc subdev\n");
                 goto out;
@@ -606,7 +606,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
 
         ret = mfd_add_devices(chip->dev, 0, &onkey_devs[0],
                               ARRAY_SIZE(onkey_devs),
-                              &onkey_resources[0], 0);
+                              &onkey_resources[0], 0, NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add onkey subdev\n");
                 goto out_dev;
@@ -615,7 +615,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata) {
                 ret = mfd_add_devices(chip->dev, 0, &regulator_devs[0],
                                       ARRAY_SIZE(regulator_devs),
-                                      &regulator_resources[0], 0);
+                                      &regulator_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add regulator subdev\n");
                         goto out_dev;
@@ -625,7 +625,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata && pdata->backlight) {
                 ret = mfd_add_devices(chip->dev, 0, &backlight_devs[0],
                                       ARRAY_SIZE(backlight_devs),
-                                      &backlight_resources[0], 0);
+                                      &backlight_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add backlight subdev\n");
                         goto out_dev;
@@ -635,7 +635,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata && pdata->power) {
                 ret = mfd_add_devices(chip->dev, 0, &power_devs[0],
                                         ARRAY_SIZE(power_devs),
-                                        &power_supply_resources[0], 0);
+                                      &power_supply_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add power supply "
                                 "subdev\n");
@@ -646,7 +646,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata && pdata->touch) {
                 ret = mfd_add_devices(chip->dev, 0, &touch_devs[0],
                                       ARRAY_SIZE(touch_devs),
-                                      &touch_resources[0], 0);
+                                      &touch_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add touch subdev\n");
                         goto out_dev;
diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
index 10b629c245b6..f123517065ec 100644
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -160,7 +160,7 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
 
         mfd_add_devices(max8997->dev, -1, max8997_devs,
                         ARRAY_SIZE(max8997_devs),
-                        NULL, 0);
+                        NULL, 0, NULL);
 
         /*
          * TODO: enable others (flash, muic, rtc, battery, ...) and
diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
index 6ef56d28c056..d7218cc90945 100644
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -161,13 +161,13 @@ static int max8998_i2c_probe(struct i2c_client *i2c,
         switch (id->driver_data) {
         case TYPE_LP3974:
                 ret = mfd_add_devices(max8998->dev, -1,
-                                lp3974_devs, ARRAY_SIZE(lp3974_devs),
-                                NULL, 0);
+                                      lp3974_devs, ARRAY_SIZE(lp3974_devs),
+                                      NULL, 0, NULL);
                 break;
         case TYPE_MAX8998:
                 ret = mfd_add_devices(max8998->dev, -1,
-                                max8998_devs, ARRAY_SIZE(max8998_devs),
-                                NULL, 0);
+                                      max8998_devs, ARRAY_SIZE(max8998_devs),
+                                      NULL, 0, NULL);
                 break;
         default:
                 ret = -EINVAL;
diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
index b801dc72f041..1ec79b54bd2f 100644
--- a/drivers/mfd/mc13xxx-core.c
+++ b/drivers/mfd/mc13xxx-core.c
@@ -612,7 +612,7 @@ static int mc13xxx_add_subdevice_pdata(struct mc13xxx *mc13xxx,
         if (!cell.name)
                 return -ENOMEM;
 
-        return mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0);
+        return mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0, NULL);
 }
 
 static int mc13xxx_add_subdevice(struct mc13xxx *mc13xxx, const char *format)
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 0c3a01cde2f7..f8b77711ad2d 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -74,12 +74,11 @@ static int mfd_platform_add_cell(struct platform_device *pdev,
 static int mfd_add_device(struct device *parent, int id,
                           const struct mfd_cell *cell,
                           struct resource *mem_base,
-                          int irq_base)
+                          int irq_base, struct irq_domain *domain)
 {
         struct resource *res;
         struct platform_device *pdev;
         struct device_node *np = NULL;
-        struct irq_domain *domain = NULL;
         int ret = -ENOMEM;
         int r;
 
@@ -97,7 +96,6 @@ static int mfd_add_device(struct device *parent, int id,
                 for_each_child_of_node(parent->of_node, np) {
                         if (of_device_is_compatible(np, cell->of_compatible)) {
                                 pdev->dev.of_node = np;
-                                domain = irq_find_host(parent->of_node);
                                 break;
                         }
                 }
@@ -177,7 +175,7 @@ fail_alloc:
 int mfd_add_devices(struct device *parent, int id,
                     struct mfd_cell *cells, int n_devs,
                     struct resource *mem_base,
-                    int irq_base)
+                    int irq_base, struct irq_domain *domain)
 {
         int i;
         int ret = 0;
@@ -191,7 +189,8 @@ int mfd_add_devices(struct device *parent, int id,
         for (i = 0; i < n_devs; i++) {
                 atomic_set(&cnts[i], 0);
                 cells[i].usage_count = &cnts[i];
-                ret = mfd_add_device(parent, id, cells + i, mem_base, irq_base);
+                ret = mfd_add_device(parent, id, cells + i, mem_base,
+                                     irq_base, domain);
                 if (ret)
                         break;
         }
@@ -247,7 +246,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones)
         for (i = 0; i < n_clones; i++) {
                 cell_entry.name = clones[i];
                 /* don't give up if a single call fails; just report error */
-                if (mfd_add_device(pdev->dev.parent, -1, &cell_entry, NULL, 0))
+                if (mfd_add_device(pdev->dev.parent, -1, &cell_entry, NULL, 0,
+                                   NULL))
                         dev_err(dev, "failed to create platform device '%s'\n",
                                         clones[i]);
         }
diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c
index c4a69f193a1d..a345f9bb7b47 100644
--- a/drivers/mfd/palmas.c
+++ b/drivers/mfd/palmas.c
@@ -453,7 +453,8 @@ static int __devinit palmas_i2c_probe(struct i2c_client *i2c,
 
         ret = mfd_add_devices(palmas->dev, -1,
                               children, ARRAY_SIZE(palmas_children),
-                              NULL, regmap_irq_chip_get_base(palmas->irq_data));
+                              NULL, regmap_irq_chip_get_base(palmas->irq_data),
+                              NULL);
         kfree(children);
 
         if (ret < 0)
diff --git a/drivers/mfd/rc5t583.c b/drivers/mfd/rc5t583.c
index cdc1df7fa0e9..ff61efc76ce2 100644
--- a/drivers/mfd/rc5t583.c
+++ b/drivers/mfd/rc5t583.c
@@ -281,7 +281,7 @@ static int __devinit rc5t583_i2c_probe(struct i2c_client *i2c,
 
         if (i2c->irq) {
                 ret = rc5t583_irq_init(rc5t583, i2c->irq, pdata->irq_base);
-                /* Still continue with waring if irq init fails */
+                /* Still continue with warning, if irq init fails */
                 if (ret)
                         dev_warn(&i2c->dev, "IRQ init failed: %d\n", ret);
                 else
@@ -289,7 +289,7 @@ static int __devinit rc5t583_i2c_probe(struct i2c_client *i2c,
         }
 
         ret = mfd_add_devices(rc5t583->dev, -1, rc5t583_subdevs,
-                        ARRAY_SIZE(rc5t583_subdevs), NULL, 0);
+                              ARRAY_SIZE(rc5t583_subdevs), NULL, 0, NULL);
         if (ret) {
                 dev_err(&i2c->dev, "add mfd devices failed: %d\n", ret);
                 goto err_add_devs;
diff --git a/drivers/mfd/rdc321x-southbridge.c b/drivers/mfd/rdc321x-southbridge.c
index 685d61e431ad..fbabc3cbe350 100644
--- a/drivers/mfd/rdc321x-southbridge.c
+++ b/drivers/mfd/rdc321x-southbridge.c
@@ -1,5 +1,5 @@
 /*
- * RDC321x MFD southbrige driver
+ * RDC321x MFD southbridge driver
  *
  * Copyright (C) 2007-2010 Florian Fainelli <florian@openwrt.org>
  * Copyright (C) 2010 Bernhard Loos <bernhardloos@googlemail.com>
@@ -87,7 +87,8 @@ static int __devinit rdc321x_sb_probe(struct pci_dev *pdev,
         rdc321x_wdt_pdata.sb_pdev = pdev;
 
         return mfd_add_devices(&pdev->dev, -1,
-                rdc321x_sb_cells, ARRAY_SIZE(rdc321x_sb_cells), NULL, 0);
+                               rdc321x_sb_cells, ARRAY_SIZE(rdc321x_sb_cells),
+                               NULL, 0, NULL);
 }
 
 static void __devexit rdc321x_sb_remove(struct pci_dev *pdev)
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index 2988efde11eb..49d361a618d0 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -141,19 +141,19 @@ static int sec_pmic_probe(struct i2c_client *i2c,
         switch (sec_pmic->device_type) {
         case S5M8751X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s5m8751_devs,
-                                        ARRAY_SIZE(s5m8751_devs), NULL, 0);
+                                      ARRAY_SIZE(s5m8751_devs), NULL, 0, NULL);
                 break;
         case S5M8763X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s5m8763_devs,
-                                        ARRAY_SIZE(s5m8763_devs), NULL, 0);
+                                      ARRAY_SIZE(s5m8763_devs), NULL, 0, NULL);
                 break;
         case S5M8767X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s5m8767_devs,
-                                        ARRAY_SIZE(s5m8767_devs), NULL, 0);
+                                      ARRAY_SIZE(s5m8767_devs), NULL, 0, NULL);
                 break;
         case S2MPS11X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s2mps11_devs,
-                                        ARRAY_SIZE(s2mps11_devs), NULL, 0);
+                                      ARRAY_SIZE(s2mps11_devs), NULL, 0, NULL);
                 break;
         default:
                 /* If this happens the probe function is problem */
diff --git a/drivers/mfd/sta2x11-mfd.c b/drivers/mfd/sta2x11-mfd.c
index d31fed07aefb..d35da6820bea 100644
--- a/drivers/mfd/sta2x11-mfd.c
+++ b/drivers/mfd/sta2x11-mfd.c
@@ -407,7 +407,7 @@ static int __devinit sta2x11_mfd_probe(struct pci_dev *pdev,
                               sta2x11_mfd_bar0,
                               ARRAY_SIZE(sta2x11_mfd_bar0),
                               &pdev->resource[0],
-                              0);
+                              0, NULL);
         if (err) {
                 dev_err(&pdev->dev, "mfd_add_devices[0] failed: %d\n", err);
                 goto err_disable;
@@ -417,7 +417,7 @@ static int __devinit sta2x11_mfd_probe(struct pci_dev *pdev,
                               sta2x11_mfd_bar1,
                               ARRAY_SIZE(sta2x11_mfd_bar1),
                               &pdev->resource[1],
-                              0);
+                              0, NULL);
         if (err) {
                 dev_err(&pdev->dev, "mfd_add_devices[1] failed: %d\n", err);
                 goto err_disable;
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 2dd8d49cb30b..c94f521f392c 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -962,7 +962,7 @@ static int __devinit stmpe_add_device(struct stmpe *stmpe,
                                       struct mfd_cell *cell, int irq)
 {
         return mfd_add_devices(stmpe->dev, stmpe->pdata->id, cell, 1,
-                               NULL, stmpe->irq_base + irq);
+                               NULL, stmpe->irq_base + irq, NULL);
 }
 
 static int __devinit stmpe_devices_init(struct stmpe *stmpe)
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c
index 2d9e8799e733..b32940ec9034 100644
--- a/drivers/mfd/t7l66xb.c
+++ b/drivers/mfd/t7l66xb.c
@@ -388,7 +388,7 @@ static int t7l66xb_probe(struct platform_device *dev)
 
         ret = mfd_add_devices(&dev->dev, dev->id,
                               t7l66xb_cells, ARRAY_SIZE(t7l66xb_cells),
-                              iomem, t7l66xb->irq_base);
+                              iomem, t7l66xb->irq_base, NULL);
 
         if (!ret)
                 return 0;
diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c
index 048bf0532a09..b56ba6b43294 100644
--- a/drivers/mfd/tc3589x.c
+++ b/drivers/mfd/tc3589x.c
@@ -262,8 +262,8 @@ static int __devinit tc3589x_device_init(struct tc3589x *tc3589x)
 
         if (blocks & TC3589x_BLOCK_GPIO) {
                 ret = mfd_add_devices(tc3589x->dev, -1, tc3589x_dev_gpio,
-                                ARRAY_SIZE(tc3589x_dev_gpio), NULL,
-                                tc3589x->irq_base);
+                                      ARRAY_SIZE(tc3589x_dev_gpio), NULL,
+                                      tc3589x->irq_base, NULL);
                 if (ret) {
                         dev_err(tc3589x->dev, "failed to add gpio child\n");
                         return ret;
@@ -273,8 +273,8 @@ static int __devinit tc3589x_device_init(struct tc3589x *tc3589x)
 
         if (blocks & TC3589x_BLOCK_KEYPAD) {
                 ret = mfd_add_devices(tc3589x->dev, -1, tc3589x_dev_keypad,
-                                ARRAY_SIZE(tc3589x_dev_keypad), NULL,
-                                tc3589x->irq_base);
+                                      ARRAY_SIZE(tc3589x_dev_keypad), NULL,
+                                      tc3589x->irq_base, NULL);
                 if (ret) {
                         dev_err(tc3589x->dev, "failed to keypad child\n");
                         return ret;
diff --git a/drivers/mfd/tc6387xb.c b/drivers/mfd/tc6387xb.c
index d20a284ad4ba..413c891102f8 100644
--- a/drivers/mfd/tc6387xb.c
+++ b/drivers/mfd/tc6387xb.c
@@ -192,7 +192,7 @@ static int __devinit tc6387xb_probe(struct platform_device *dev)
         printk(KERN_INFO "Toshiba tc6387xb initialised\n");
 
         ret = mfd_add_devices(&dev->dev, dev->id, tc6387xb_cells,
-                              ARRAY_SIZE(tc6387xb_cells), iomem, irq);
+                              ARRAY_SIZE(tc6387xb_cells), iomem, irq, NULL);
 
         if (!ret)
                 return 0;
diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c
index 9612264f0e6d..dcab026fcbb2 100644
--- a/drivers/mfd/tc6393xb.c
+++ b/drivers/mfd/tc6393xb.c
@@ -700,8 +700,8 @@ static int __devinit tc6393xb_probe(struct platform_device *dev)
         tc6393xb_cells[TC6393XB_CELL_FB].pdata_size = sizeof(*tcpd->fb_data);
 
         ret = mfd_add_devices(&dev->dev, dev->id,
-                        tc6393xb_cells, ARRAY_SIZE(tc6393xb_cells),
-                        iomem, tcpd->irq_base);
+                              tc6393xb_cells, ARRAY_SIZE(tc6393xb_cells),
+                              iomem, tcpd->irq_base, NULL);
 
         if (!ret)
                 return 0;
diff --git a/drivers/mfd/ti-ssp.c b/drivers/mfd/ti-ssp.c
index 4fb0e6c8e8fe..7c3675a74f93 100644
--- a/drivers/mfd/ti-ssp.c
+++ b/drivers/mfd/ti-ssp.c
@@ -412,7 +412,7 @@ static int __devinit ti_ssp_probe(struct platform_device *pdev)
                 cells[id].data_size     = data->pdata_size;
         }
 
-        error = mfd_add_devices(dev, 0, cells, 2, NULL, 0);
+        error = mfd_add_devices(dev, 0, cells, 2, NULL, 0, NULL);
         if (error < 0) {
                 dev_err(dev, "cannot add mfd cells\n");
                 goto error_enable;
diff --git a/drivers/mfd/timberdale.c b/drivers/mfd/timberdale.c
index a447f4ec11fb..cccc626c83c8 100644
--- a/drivers/mfd/timberdale.c
+++ b/drivers/mfd/timberdale.c
@@ -757,25 +757,25 @@ static int __devinit timb_probe(struct pci_dev *dev,
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg0,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg0),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         case TIMB_HW_VER1:
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg1,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg1),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         case TIMB_HW_VER2:
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg2,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg2),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         case TIMB_HW_VER3:
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg3,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg3),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         default:
                 dev_err(&dev->dev, "Uknown IP setup: %d.%d.%d\n",
@@ -792,7 +792,7 @@ static int __devinit timb_probe(struct pci_dev *dev,
 
         err = mfd_add_devices(&dev->dev, 0,
                 timberdale_cells_bar1, ARRAY_SIZE(timberdale_cells_bar1),
-                &dev->resource[1], msix_entries[0].vector);
+                &dev->resource[1], msix_entries[0].vector, NULL);
         if (err) {
                 dev_err(&dev->dev, "mfd_add_devices failed: %d\n", err);
                 goto err_mfd2;
@@ -803,7 +803,7 @@ static int __devinit timb_probe(struct pci_dev *dev,
                 ((priv->fw.config & TIMB_HW_VER_MASK) == TIMB_HW_VER3)) {
                 err = mfd_add_devices(&dev->dev, 1, timberdale_cells_bar2,
                         ARRAY_SIZE(timberdale_cells_bar2),
-                        &dev->resource[2], msix_entries[0].vector);
+                        &dev->resource[2], msix_entries[0].vector, NULL);
                 if (err) {
                         dev_err(&dev->dev, "mfd_add_devices failed: %d\n", err);
                         goto err_mfd2;
diff --git a/drivers/mfd/tps6105x.c b/drivers/mfd/tps6105x.c
index a293b978e27c..14051bdc714b 100644
--- a/drivers/mfd/tps6105x.c
+++ b/drivers/mfd/tps6105x.c
@@ -188,7 +188,7 @@ static int __devinit tps6105x_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(&client->dev, 0, tps6105x_cells,
-                ARRAY_SIZE(tps6105x_cells), NULL, 0);
+                              ARRAY_SIZE(tps6105x_cells), NULL, 0, NULL);
         if (ret)
                 goto fail;
 
diff --git a/drivers/mfd/tps6507x.c b/drivers/mfd/tps6507x.c
index 33ba7723c967..1b203499c744 100644
--- a/drivers/mfd/tps6507x.c
+++ b/drivers/mfd/tps6507x.c
@@ -100,7 +100,7 @@ static int tps6507x_i2c_probe(struct i2c_client *i2c,
 
         ret = mfd_add_devices(tps6507x->dev, -1,
                               tps6507x_devs, ARRAY_SIZE(tps6507x_devs),
-                              NULL, 0);
+                              NULL, 0, NULL);
 
         if (ret < 0)
                 goto err;
diff --git a/drivers/mfd/tps65090.c b/drivers/mfd/tps65090.c
index 80e24f4b47bf..50fd87c87a1c 100644
--- a/drivers/mfd/tps65090.c
+++ b/drivers/mfd/tps65090.c
@@ -292,7 +292,7 @@ static int __devinit tps65090_i2c_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(tps65090->dev, -1, tps65090s,
-                ARRAY_SIZE(tps65090s), NULL, 0);
+                              ARRAY_SIZE(tps65090s), NULL, 0, NULL);
         if (ret) {
                 dev_err(&client->dev, "add mfd devices failed with err: %d\n",
                         ret);
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index 61c097a98f5d..a95e9421b735 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -24,11 +24,18 @@
 #include <linux/slab.h>
 #include <linux/regmap.h>
 #include <linux/err.h>
-#include <linux/regulator/of_regulator.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 
 #include <linux/mfd/core.h>
 #include <linux/mfd/tps65217.h>
 
+static struct mfd_cell tps65217s[] = {
+        {
+                .name = "tps65217-pmic",
+        },
+};
+
 /**
  * tps65217_reg_read: Read a single tps65217 register.
  *
@@ -133,83 +140,48 @@ int tps65217_clear_bits(struct tps65217 *tps, unsigned int reg,
 }
 EXPORT_SYMBOL_GPL(tps65217_clear_bits);
 
-#ifdef CONFIG_OF
-static struct of_regulator_match reg_matches[] = {
-        { .name = "dcdc1", .driver_data = (void *)TPS65217_DCDC_1 },
-        { .name = "dcdc2", .driver_data = (void *)TPS65217_DCDC_2 },
-        { .name = "dcdc3", .driver_data = (void *)TPS65217_DCDC_3 },
-        { .name = "ldo1", .driver_data = (void *)TPS65217_LDO_1 },
-        { .name = "ldo2", .driver_data = (void *)TPS65217_LDO_2 },
-        { .name = "ldo3", .driver_data = (void *)TPS65217_LDO_3 },
-        { .name = "ldo4", .driver_data = (void *)TPS65217_LDO_4 },
-};
-
-static struct tps65217_board *tps65217_parse_dt(struct i2c_client *client)
-{
-        struct device_node *node = client->dev.of_node;
-        struct tps65217_board *pdata;
-        struct device_node *regs;
-        int count = ARRAY_SIZE(reg_matches);
-        int ret, i;
-
-        regs = of_find_node_by_name(node, "regulators");
-        if (!regs)
-                return NULL;
-
-        ret = of_regulator_match(&client->dev, regs, reg_matches, count);
-        of_node_put(regs);
-        if ((ret < 0) || (ret > count))
-                return NULL;
-
-        count = ret;
-        pdata = devm_kzalloc(&client->dev, count * sizeof(*pdata), GFP_KERNEL);
-        if (!pdata)
-                return NULL;
-
-        for (i = 0; i < count; i++) {
-                if (!reg_matches[i].init_data || !reg_matches[i].of_node)
-                        continue;
-
-                pdata->tps65217_init_data[i] = reg_matches[i].init_data;
-                pdata->of_node[i] = reg_matches[i].of_node;
-        }
-
-        return pdata;
-}
-
-static struct of_device_id tps65217_of_match[] = {
-        { .compatible = "ti,tps65217", },
-        { },
-};
-#else
-static struct tps65217_board *tps65217_parse_dt(struct i2c_client *client)
-{
-        return NULL;
-}
-#endif
-
 static struct regmap_config tps65217_regmap_config = {
         .reg_bits = 8,
         .val_bits = 8,
 };
 
+static const struct of_device_id tps65217_of_match[] = {
+        { .compatible = "ti,tps65217", .data = (void *)TPS65217 },
+        { /* sentinel */ },
+};
+
 static int __devinit tps65217_probe(struct i2c_client *client,
                                 const struct i2c_device_id *ids)
 {
         struct tps65217 *tps;
-        struct regulator_init_data *reg_data;
-        struct tps65217_board *pdata = client->dev.platform_data;
-        int i, ret;
         unsigned int version;
+        unsigned int chip_id = ids->driver_data;
+        const struct of_device_id *match;
+        int ret;
 
-        if (!pdata && client->dev.of_node)
-                pdata = tps65217_parse_dt(client);
+        if (client->dev.of_node) {
+                match = of_match_device(tps65217_of_match, &client->dev);
+                if (!match) {
+                        dev_err(&client->dev,
+                                "Failed to find matching dt id\n");
+                        return -EINVAL;
+                }
+                chip_id = (unsigned int)match->data;
+        }
+
+        if (!chip_id) {
+                dev_err(&client->dev, "id is null.\n");
+                return -ENODEV;
+        }
 
         tps = devm_kzalloc(&client->dev, sizeof(*tps), GFP_KERNEL);
         if (!tps)
                 return -ENOMEM;
 
-        tps->pdata = pdata;
+        i2c_set_clientdata(client, tps);
+        tps->dev = &client->dev;
+        tps->id = chip_id;
+
         tps->regmap = devm_regmap_init_i2c(client, &tps65217_regmap_config);
         if (IS_ERR(tps->regmap)) {
                 ret = PTR_ERR(tps->regmap);
@@ -218,8 +190,12 @@ static int __devinit tps65217_probe(struct i2c_client *client,
                 return ret;
         }
 
-        i2c_set_clientdata(client, tps);
-        tps->dev = &client->dev;
+        ret = mfd_add_devices(tps->dev, -1, tps65217s,
+                              ARRAY_SIZE(tps65217s), NULL, 0, NULL);
+        if (ret < 0) {
+                dev_err(tps->dev, "mfd_add_devices failed: %d\n", ret);
+                return ret;
+        }
 
         ret = tps65217_reg_read(tps, TPS65217_REG_CHIPID, &version);
         if (ret < 0) {
@@ -232,41 +208,21 @@ static int __devinit tps65217_probe(struct i2c_client *client,
                         (version & TPS65217_CHIPID_CHIP_MASK) >> 4,
                         version & TPS65217_CHIPID_REV_MASK);
 
-        for (i = 0; i < TPS65217_NUM_REGULATOR; i++) {
-                struct platform_device *pdev;
-
-                pdev = platform_device_alloc("tps65217-pmic", i);
-                if (!pdev) {
-                        dev_err(tps->dev, "Cannot create regulator %d\n", i);
-                        continue;
-                }
-
-                pdev->dev.parent = tps->dev;
-                pdev->dev.of_node = pdata->of_node[i];
-                reg_data = pdata->tps65217_init_data[i];
-                platform_device_add_data(pdev, reg_data, sizeof(*reg_data));
-                tps->regulator_pdev[i] = pdev;
-
-                platform_device_add(pdev);
-        }
-
         return 0;
 }
 
 static int __devexit tps65217_remove(struct i2c_client *client)
 {
         struct tps65217 *tps = i2c_get_clientdata(client);
-        int i;
 
-        for (i = 0; i < TPS65217_NUM_REGULATOR; i++)
-                platform_device_unregister(tps->regulator_pdev[i]);
+        mfd_remove_devices(tps->dev);
 
         return 0;
 }
 
 static const struct i2c_device_id tps65217_id_table[] = {
-        {"tps65217", 0xF0},
-        {/* end of list */}
+        {"tps65217", TPS65217},
+        { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(i2c, tps65217_id_table);
 
diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index 353c34812120..345960ca2fd8 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -25,6 +25,7 @@
 #include <linux/i2c.h>
 #include <linux/regmap.h>
 #include <linux/regulator/of_regulator.h>
+#include <linux/regulator/machine.h>
 
 #include <linux/mfd/core.h>
 #include <linux/mfd/tps6586x.h>
@@ -346,6 +347,7 @@ failed:
 
 #ifdef CONFIG_OF
 static struct of_regulator_match tps6586x_matches[] = {
+        { .name = "sys",     .driver_data = (void *)TPS6586X_ID_SYS     },
         { .name = "sm0",     .driver_data = (void *)TPS6586X_ID_SM_0    },
         { .name = "sm1",     .driver_data = (void *)TPS6586X_ID_SM_1    },
         { .name = "sm2",     .driver_data = (void *)TPS6586X_ID_SM_2    },
@@ -369,6 +371,7 @@ static struct tps6586x_platform_data *tps6586x_parse_dt(struct i2c_client *clien
         struct tps6586x_platform_data *pdata;
         struct tps6586x_subdev_info *devs;
         struct device_node *regs;
+        const char *sys_rail_name = NULL;
         unsigned int count;
         unsigned int i, j;
         int err;
@@ -391,12 +394,22 @@ static struct tps6586x_platform_data *tps6586x_parse_dt(struct i2c_client *clien
                 return NULL;
 
         for (i = 0, j = 0; i < num && j < count; i++) {
+                struct regulator_init_data *reg_idata;
+
                 if (!tps6586x_matches[i].init_data)
                         continue;
 
+                reg_idata  = tps6586x_matches[i].init_data;
                 devs[j].name = "tps6586x-regulator";
                 devs[j].platform_data = tps6586x_matches[i].init_data;
                 devs[j].id = (int)tps6586x_matches[i].driver_data;
+                if (devs[j].id == TPS6586X_ID_SYS)
+                        sys_rail_name = reg_idata->constraints.name;
+
+                if ((devs[j].id == TPS6586X_ID_LDO_5) ||
+                        (devs[j].id == TPS6586X_ID_LDO_RTC))
+                        reg_idata->supply_regulator = sys_rail_name;
+
                 devs[j].of_node = tps6586x_matches[i].of_node;
                 j++;
         }
@@ -493,7 +506,8 @@ static int __devinit tps6586x_i2c_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(tps6586x->dev, -1,
-                        tps6586x_cell, ARRAY_SIZE(tps6586x_cell), NULL, 0);
+                              tps6586x_cell, ARRAY_SIZE(tps6586x_cell),
+                              NULL, 0, NULL);
         if (ret < 0) {
                 dev_err(&client->dev, "mfd_add_devices failed: %d\n", ret);
                 goto err_mfd_add;
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 1c563792c777..d3ce4d569deb 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -254,7 +254,7 @@ static __devinit int tps65910_i2c_probe(struct i2c_client *i2c,
 
         ret = mfd_add_devices(tps65910->dev, -1,
                               tps65910s, ARRAY_SIZE(tps65910s),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret < 0) {
                 dev_err(&i2c->dev, "mfd_add_devices failed: %d\n", ret);
                 return ret;
diff --git a/drivers/mfd/tps65911-comparator.c b/drivers/mfd/tps65911-comparator.c
index 5a62e6bf89ae..0b6e361432c4 100644
--- a/drivers/mfd/tps65911-comparator.c
+++ b/drivers/mfd/tps65911-comparator.c
@@ -136,7 +136,7 @@ static __devinit int tps65911_comparator_probe(struct platform_device *pdev)
 
         ret = comp_threshold_set(tps65910, COMP2, pdata->vmbch2_threshold);
         if (ret < 0) {
-                dev_err(&pdev->dev, "cannot set COMP2 theshold\n");
+                dev_err(&pdev->dev, "cannot set COMP2 threshold\n");
                 return ret;
         }
 
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 74fd8cb5f372..4658b5bdcd84 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -146,7 +146,7 @@ int tps65912_device_init(struct tps65912 *tps65912)
 
         ret = mfd_add_devices(tps65912->dev, -1,
                               tps65912s, ARRAY_SIZE(tps65912s),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret < 0)
                 goto err;
 
diff --git a/drivers/mfd/twl4030-audio.c b/drivers/mfd/twl4030-audio.c
index 838ce4eb444e..77c9acb14583 100644
--- a/drivers/mfd/twl4030-audio.c
+++ b/drivers/mfd/twl4030-audio.c
@@ -223,7 +223,7 @@ static int __devinit twl4030_audio_probe(struct platform_device *pdev)
 
         if (childs)
                 ret = mfd_add_devices(&pdev->dev, pdev->id, audio->cells,
-                                      childs, NULL, 0);
+                                      childs, NULL, 0, NULL);
         else {
                 dev_err(&pdev->dev, "No platform data found for childs\n");
                 ret = -ENODEV;
diff --git a/drivers/mfd/twl6040-core.c b/drivers/mfd/twl6040-core.c
index b0fad0ffca56..3dca5c195a20 100644
--- a/drivers/mfd/twl6040-core.c
+++ b/drivers/mfd/twl6040-core.c
@@ -632,7 +632,7 @@ static int __devinit twl6040_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(&client->dev, -1, twl6040->cells, children,
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret)
                 goto mfd_err;
 
diff --git a/drivers/mfd/vx855.c b/drivers/mfd/vx855.c
index 872aff21e4be..b9a636d44c7f 100644
--- a/drivers/mfd/vx855.c
+++ b/drivers/mfd/vx855.c
@@ -102,7 +102,7 @@ static __devinit int vx855_probe(struct pci_dev *pdev,
         vx855_gpio_resources[1].end = vx855_gpio_resources[1].start + 3;
 
         ret = mfd_add_devices(&pdev->dev, -1, vx855_cells, ARRAY_SIZE(vx855_cells),
-                        NULL, 0);
+                        NULL, 0, NULL);
 
         /* we always return -ENODEV here in order to enable other
          * drivers like old, not-yet-platform_device ported i2c-viapro */
diff --git a/drivers/mfd/wl1273-core.c b/drivers/mfd/wl1273-core.c
index f39b756df561..86e0e4309fc2 100644
--- a/drivers/mfd/wl1273-core.c
+++ b/drivers/mfd/wl1273-core.c
@@ -241,7 +241,7 @@ static int __devinit wl1273_core_probe(struct i2c_client *client,
                 __func__, children);
 
         r = mfd_add_devices(&client->dev, -1, core->cells,
-                            children, NULL, 0);
+                            children, NULL, 0, NULL);
         if (r)
                 goto err;
 
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index 946698fd2dc6..301731035940 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -1813,27 +1813,27 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
         case WM8310:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8310_devs, ARRAY_SIZE(wm8310_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 break;
 
         case WM8311:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8311_devs, ARRAY_SIZE(wm8311_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 if (!pdata || !pdata->disable_touch)
                         mfd_add_devices(wm831x->dev, wm831x_num,
                                         touch_devs, ARRAY_SIZE(touch_devs),
-                                        NULL, 0);
+                                        NULL, 0, NULL);
                 break;
 
         case WM8312:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8312_devs, ARRAY_SIZE(wm8312_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 if (!pdata || !pdata->disable_touch)
                         mfd_add_devices(wm831x->dev, wm831x_num,
                                         touch_devs, ARRAY_SIZE(touch_devs),
-                                        NULL, 0);
+                                        NULL, 0, NULL);
                 break;
 
         case WM8320:
@@ -1842,7 +1842,7 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
         case WM8326:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8320_devs, ARRAY_SIZE(wm8320_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 break;
 
         default:
@@ -1867,7 +1867,7 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
         if (ret & WM831X_XTAL_ENA) {
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       rtc_devs, ARRAY_SIZE(rtc_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 if (ret != 0) {
                         dev_err(wm831x->dev, "Failed to add RTC: %d\n", ret);
                         goto err_irq;
@@ -1880,7 +1880,7 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
                 /* Treat errors as non-critical */
                 ret = mfd_add_devices(wm831x->dev, wm831x_num, backlight_devs,
                                       ARRAY_SIZE(backlight_devs), NULL,
-                                      0);
+                                      0, NULL);
                 if (ret < 0)
                         dev_err(wm831x->dev, "Failed to add backlight: %d\n",
                                 ret);
diff --git a/drivers/mfd/wm8400-core.c b/drivers/mfd/wm8400-core.c
index 4b7d378551d5..639ca359242f 100644
--- a/drivers/mfd/wm8400-core.c
+++ b/drivers/mfd/wm8400-core.c
@@ -70,7 +70,7 @@ static int wm8400_register_codec(struct wm8400 *wm8400)
                 .pdata_size = sizeof(*wm8400),
         };
 
-        return mfd_add_devices(wm8400->dev, -1, &cell, 1, NULL, 0);
+        return mfd_add_devices(wm8400->dev, -1, &cell, 1, NULL, 0, NULL);
 }
 
 /*
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index eec74aa55fdf..2febf88cfce8 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -414,7 +414,7 @@ static __devinit int wm8994_device_init(struct wm8994 *wm8994, int irq)
         ret = mfd_add_devices(wm8994->dev, -1,
                               wm8994_regulator_devs,
                               ARRAY_SIZE(wm8994_regulator_devs),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(wm8994->dev, "Failed to add children: %d\n", ret);
                 goto err;
@@ -648,7 +648,7 @@ static __devinit int wm8994_device_init(struct wm8994 *wm8994, int irq)
 
         ret = mfd_add_devices(wm8994->dev, -1,
                               wm8994_devs, ARRAY_SIZE(wm8994_devs),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(wm8994->dev, "Failed to add children: %d\n", ret);
                 goto err_irq;
diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c
index 0aac4aff17a5..a050e56a9bbd 100644
--- a/drivers/mfd/wm8994-irq.c
+++ b/drivers/mfd/wm8994-irq.c
@@ -135,6 +135,7 @@ static struct regmap_irq_chip wm8994_irq_chip = {
         .status_base = WM8994_INTERRUPT_STATUS_1,
         .mask_base = WM8994_INTERRUPT_STATUS_1_MASK,
         .ack_base = WM8994_INTERRUPT_STATUS_1,
+        .runtime_pm = true,
 };
 
 int wm8994_irq_init(struct wm8994 *wm8994)
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index d4619e2ec030..2273ce6b6c1a 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -641,7 +641,7 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
         /*
          * If the host and card support UHS-I mode request the card
          * to switch to 1.8V signaling level.  No 1.8v signalling if
-         * UHS mode is not enabled to maintain compatibilty and some
+         * UHS mode is not enabled to maintain compatibility and some
          * systems that claim 1.8v signalling in fact do not support
          * it.
          */
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index efdb81d21c44..74bed0fc23e7 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -356,7 +356,7 @@ static void at91_mci_handle_transmitted(struct at91mci_host *host)
 }
 
 /*
- * Update bytes tranfered count during a write operation
+ * Update bytes transfered count during a write operation
  */
 static void at91_mci_update_bytes_xfered(struct at91mci_host *host)
 {
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index a53c7c478e05..852d5fbda630 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1022,7 +1022,7 @@ static void atmci_stop_transfer(struct atmel_mci *host)
 }
 
 /*
- * Stop data transfer because error(s) occured.
+ * Stop data transfer because error(s) occurred.
  */
 static void atmci_stop_transfer_pdc(struct atmel_mci *host)
 {
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 3a09f93cc3b6..686e256764c8 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -447,7 +447,7 @@ static void omap_hsmmc_stop_clock(struct omap_hsmmc_host *host)
         OMAP_HSMMC_WRITE(host->base, SYSCTL,
                 OMAP_HSMMC_READ(host->base, SYSCTL) & ~CEN);
         if ((OMAP_HSMMC_READ(host->base, SYSCTL) & CEN) != 0x0)
-                dev_dbg(mmc_dev(host->mmc), "MMC Clock is not stoped\n");
+                dev_dbg(mmc_dev(host->mmc), "MMC Clock is not stopped\n");
 }
 
 static void omap_hsmmc_enable_irq(struct omap_hsmmc_host *host,
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index e23f8134591c..32f4a070551f 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -315,7 +315,7 @@ static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
                 new_val = val & (SDHCI_CTRL_LED | \
                                 SDHCI_CTRL_4BITBUS | \
                                 SDHCI_CTRL_D3CD);
-                /* ensure the endianess */
+                /* ensure the endianness */
                 new_val |= ESDHC_HOST_CONTROL_LE;
                 /* bits 8&9 are reserved on mx25 */
                 if (!is_imx25_esdhc(imx_data)) {
diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 3135a1a5d75d..58eab9ac1d01 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -806,7 +806,7 @@ static void command_res_completed(struct urb *urb)
                  * we suspect a buggy USB host controller
                  */
         } else if (!vub300->data) {
-                /* this means that the command (typically CMD52) suceeded */
+                /* this means that the command (typically CMD52) succeeded */
         } else if (vub300->resp.common.header_type != 0x02) {
                 /*
                  * this is an error response from the VUB300 chip
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index f2f482bec573..a6e74514e662 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -1123,6 +1123,33 @@ static unsigned long mtdchar_get_unmapped_area(struct file *file,
 }
 #endif
 
+static inline unsigned long get_vm_size(struct vm_area_struct *vma)
+{
+        return vma->vm_end - vma->vm_start;
+}
+
+static inline resource_size_t get_vm_offset(struct vm_area_struct *vma)
+{
+        return (resource_size_t) vma->vm_pgoff << PAGE_SHIFT;
+}
+
+/*
+ * Set a new vm offset.
+ *
+ * Verify that the incoming offset really works as a page offset,
+ * and that the offset and size fit in a resource_size_t.
+ */
+static inline int set_vm_offset(struct vm_area_struct *vma, resource_size_t off)
+{
+        pgoff_t pgoff = off >> PAGE_SHIFT;
+        if (off != (resource_size_t) pgoff << PAGE_SHIFT)
+                return -EINVAL;
+        if (off + get_vm_size(vma) - 1 < off)
+                return -EINVAL;
+        vma->vm_pgoff = pgoff;
+        return 0;
+}
+
 /*
  * set up a mapping for shared memory segments
  */
@@ -1132,20 +1159,29 @@ static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
         struct mtd_file_info *mfi = file->private_data;
         struct mtd_info *mtd = mfi->mtd;
         struct map_info *map = mtd->priv;
-        unsigned long start;
-        unsigned long off;
-        u32 len;
+        resource_size_t start, off;
+        unsigned long len, vma_len;
 
         if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
-                off = vma->vm_pgoff << PAGE_SHIFT;
+                off = get_vm_offset(vma);
                 start = map->phys;
                 len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
                 start &= PAGE_MASK;
-                if ((vma->vm_end - vma->vm_start + off) > len)
+                vma_len = get_vm_size(vma);
+
+                /* Overflow in off+len? */
+                if (vma_len + off < off)
+                        return -EINVAL;
+                /* Does it fit in the mapping? */
+                if (vma_len + off > len)
                         return -EINVAL;
 
                 off += start;
-                vma->vm_pgoff = off >> PAGE_SHIFT;
+                /* Did that overflow? */
+                if (off < start)
+                        return -EINVAL;
+                if (set_vm_offset(vma, off) < 0)
+                        return -EINVAL;
                 vma->vm_flags |= VM_IO | VM_RESERVED;
 
 #ifdef pgprot_noncached
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index 98ee43819911..7edadee487ba 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1391,7 +1391,6 @@ static irqreturn_t ican3_irq(int irq, void *dev_id)
  */
 static int ican3_reset_module(struct ican3_dev *mod)
 {
-        u8 val = 1 << mod->num;
         unsigned long start;
         u8 runold, runnew;
 
@@ -1405,8 +1404,7 @@ static int ican3_reset_module(struct ican3_dev *mod)
         runold = ioread8(mod->dpm + TARGET_RUNNING);
 
         /* reset the module */
-        iowrite8(val, &mod->ctrl->reset_assert);
-        iowrite8(val, &mod->ctrl->reset_deassert);
+        iowrite8(0x00, &mod->dpmctrl->hwreset);
 
         /* wait until the module has finished resetting and is running */
         start = jiffies;
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index a580db29e503..26e7129332ab 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -83,6 +83,11 @@
 #define INSTRUCTION_LOAD_TXB(n) (0x40 + 2 * (n))
 #define INSTRUCTION_READ_RXB(n) (((n) == 0) ? 0x90 : 0x94)
 #define INSTRUCTION_RESET       0xC0
+#define RTS_TXB0                0x01
+#define RTS_TXB1                0x02
+#define RTS_TXB2                0x04
+#define INSTRUCTION_RTS(n)      (0x80 | ((n) & 0x07))
+
 
 /* MPC251x registers */
 #define CANSTAT       0x0e
@@ -397,6 +402,7 @@ static void mcp251x_hw_tx_frame(struct spi_device *spi, u8 *buf,
 static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
                           int tx_buf_idx)
 {
+        struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
         u32 sid, eid, exide, rtr;
         u8 buf[SPI_TRANSFER_BUF_LEN];
 
@@ -418,7 +424,10 @@ static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
         buf[TXBDLC_OFF] = (rtr << DLC_RTR_SHIFT) | frame->can_dlc;
         memcpy(buf + TXBDAT_OFF, frame->data, frame->can_dlc);
         mcp251x_hw_tx_frame(spi, buf, frame->can_dlc, tx_buf_idx);
-        mcp251x_write_reg(spi, TXBCTRL(tx_buf_idx), TXBCTRL_TXREQ);
+
+        /* use INSTRUCTION_RTS, to avoid "repeated frame problem" */
+        priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx);
+        mcp251x_spi_trans(priv->spi, 1);
 }
 
 static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index 527dbcf95335..9ded21e79db5 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(struct platform_device *pdev)
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct ti_hecc_priv *priv = netdev_priv(ndev);
 
+        unregister_candev(ndev);
         clk_disable(priv->clk);
         clk_put(priv->clk);
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         iounmap(priv->base);
         release_mem_region(res->start, resource_size(res));
-        unregister_candev(ndev);
         free_candev(ndev);
         platform_set_drvdata(pdev, NULL);
 
diff --git a/drivers/net/ethernet/3com/typhoon.c b/drivers/net/ethernet/3com/typhoon.c
index b15366635147..bb9670f29b59 100644
--- a/drivers/net/ethernet/3com/typhoon.c
+++ b/drivers/net/ethernet/3com/typhoon.c
@@ -364,7 +364,7 @@ typhoon_inc_rxfree_index(u32 *index, const int count)
 static inline void
 typhoon_inc_tx_index(u32 *index, const int count)
 {
-        /* if we start using the Hi Tx ring, this needs updateing */
+        /* if we start using the Hi Tx ring, this needs updating */
         typhoon_inc_index(index, count, TXLO_ENTRIES);
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 79cebd8525ce..e48312f2305d 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -8564,7 +8564,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 error:
-        iounmap(bp->regview);
+        pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 6d1a24acb77e..eac25236856c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1458,7 +1458,7 @@ struct bnx2x {
         int                             fw_stats_req_sz;
 
         /*
-         * FW statistics data shortcut (points at the begining of
+         * FW statistics data shortcut (points at the beginning of
          * fw_stats buffer + fw_stats_req_sz).
          */
         struct bnx2x_fw_stats_data      *fw_stats_data;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index af20c6ee2cd9..e8e97a7d1d06 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -662,14 +662,16 @@ void bnx2x_csum_validate(struct sk_buff *skb, union eth_rx_cqe *cqe,
                                  struct bnx2x_fastpath *fp,
                                  struct bnx2x_eth_q_stats *qstats)
 {
-        /* Do nothing if no IP/L4 csum validation was done */
-
+        /* Do nothing if no L4 csum validation was done.
+         * We do not check whether IP csum was validated. For IPv4 we assume
+         * that if the card got as far as validating the L4 csum, it also
+         * validated the IP csum. IPv6 has no IP csum.
+         */
         if (cqe->fast_path_cqe.status_flags &
-            (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG |
-             ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG))
+            ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG)
                 return;
 
-        /* If both IP/L4 validation were done, check if an error was found. */
+        /* If L4 validation was done, check if an error was found. */
 
         if (cqe->fast_path_cqe.type_error_flags &
             (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index 21b553229ea4..dfd86a55f1dc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -710,17 +710,15 @@ static inline u16 bnx2x_tx_avail(struct bnx2x *bp,
         prod = txdata->tx_bd_prod;
         cons = txdata->tx_bd_cons;
 
-        /* NUM_TX_RINGS = number of "next-page" entries
-           It will be used as a threshold */
-        used = SUB_S16(prod, cons) + (s16)NUM_TX_RINGS;
+        used = SUB_S16(prod, cons);
 
 #ifdef BNX2X_STOP_ON_ERROR
         WARN_ON(used < 0);
-        WARN_ON(used > bp->tx_ring_size);
-        WARN_ON((bp->tx_ring_size - used) > MAX_TX_AVAIL);
+        WARN_ON(used > txdata->tx_ring_size);
+        WARN_ON((txdata->tx_ring_size - used) > MAX_TX_AVAIL);
 #endif
 
-        return (s16)(bp->tx_ring_size) - used;
+        return (s16)(txdata->tx_ring_size) - used;
 }
 
 static inline int bnx2x_tx_queue_has_work(struct bnx2x_fp_txdata *txdata)
@@ -1088,6 +1086,7 @@ static inline void bnx2x_init_txdata(struct bnx2x *bp,
         txdata->txq_index = txq_index;
         txdata->tx_cons_sb = tx_cons_sb;
         txdata->parent_fp = fp;
+        txdata->tx_ring_size = IS_FCOE_FP(fp) ? MAX_TX_AVAIL : bp->tx_ring_size;
 
         DP(NETIF_MSG_IFUP, "created tx data cid %d, txq %d\n",
            txdata->cid, txdata->txq_index);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
index 3e4cff9b1ebe..b926f58e983b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
@@ -401,11 +401,11 @@ static const struct reg_addr reg_addrs[] = {
         { 0x70000, 8, RI_ALL_ONLINE },
         { 0x70020, 8184, RI_ALL_OFFLINE },
         { 0x78000, 8192, RI_E3E3B0_OFFLINE },
-        { 0x85000, 3, RI_ALL_ONLINE },
-        { 0x8501c, 7, RI_ALL_ONLINE },
-        { 0x85048, 1, RI_ALL_ONLINE },
-        { 0x85200, 32, RI_ALL_ONLINE },
-        { 0xb0000, 16384, RI_E1H_ONLINE },
+        { 0x85000, 3, RI_ALL_OFFLINE },
+        { 0x8501c, 7, RI_ALL_OFFLINE },
+        { 0x85048, 1, RI_ALL_OFFLINE },
+        { 0x85200, 32, RI_ALL_OFFLINE },
+        { 0xb0000, 16384, RI_E1H_OFFLINE },
         { 0xc1000, 7, RI_ALL_ONLINE },
         { 0xc103c, 2, RI_E2E3E3B0_ONLINE },
         { 0xc1800, 2, RI_ALL_ONLINE },
@@ -581,17 +581,12 @@ static const struct reg_addr reg_addrs[] = {
         { 0x140188, 3, RI_E1E1HE2E3_ONLINE },
         { 0x140194, 13, RI_ALL_ONLINE },
         { 0x140200, 6, RI_E1E1HE2E3_ONLINE },
-        { 0x140220, 4, RI_E2E3_ONLINE },
-        { 0x140240, 4, RI_E2E3_ONLINE },
         { 0x140260, 4, RI_E2E3_ONLINE },
         { 0x140280, 4, RI_E2E3_ONLINE },
-        { 0x1402a0, 4, RI_E2E3_ONLINE },
-        { 0x1402c0, 4, RI_E2E3_ONLINE },
         { 0x1402e0, 2, RI_E2E3_ONLINE },
         { 0x1402e8, 2, RI_E2E3E3B0_ONLINE },
         { 0x1402f0, 9, RI_E2E3_ONLINE },
         { 0x140314, 44, RI_E3B0_ONLINE },
-        { 0x1403d0, 70, RI_E3B0_ONLINE },
         { 0x144000, 4, RI_E1E1H_ONLINE },
         { 0x148000, 4, RI_E1E1H_ONLINE },
         { 0x14c000, 4, RI_E1E1H_ONLINE },
@@ -704,7 +699,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x180398, 1, RI_E2E3E3B0_ONLINE },
         { 0x1803a0, 5, RI_E2E3E3B0_ONLINE },
         { 0x1803b4, 2, RI_E3E3B0_ONLINE },
-        { 0x180400, 1, RI_ALL_ONLINE },
         { 0x180404, 255, RI_E1E1H_OFFLINE },
         { 0x181000, 4, RI_ALL_ONLINE },
         { 0x181010, 1020, RI_ALL_OFFLINE },
@@ -800,9 +794,9 @@ static const struct reg_addr reg_addrs[] = {
         { 0x1b905c, 1, RI_E3E3B0_ONLINE },
         { 0x1b9064, 1, RI_E3B0_ONLINE },
         { 0x1b9080, 10, RI_E3B0_ONLINE },
-        { 0x1b9400, 14, RI_E2E3E3B0_ONLINE },
-        { 0x1b943c, 19, RI_E2E3E3B0_ONLINE },
-        { 0x1b9490, 10, RI_E2E3E3B0_ONLINE },
+        { 0x1b9400, 14, RI_E2E3E3B0_OFFLINE },
+        { 0x1b943c, 19, RI_E2E3E3B0_OFFLINE },
+        { 0x1b9490, 10, RI_E2E3E3B0_OFFLINE },
         { 0x1c0000, 2, RI_ALL_ONLINE },
         { 0x200000, 65, RI_ALL_ONLINE },
         { 0x20014c, 2, RI_E1HE2E3E3B0_ONLINE },
@@ -814,7 +808,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x200398, 1, RI_E2E3E3B0_ONLINE },
         { 0x2003a0, 1, RI_E2E3E3B0_ONLINE },
         { 0x2003a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x200400, 1, RI_ALL_ONLINE },
         { 0x200404, 255, RI_E1E1H_OFFLINE },
         { 0x202000, 4, RI_ALL_ONLINE },
         { 0x202010, 2044, RI_ALL_OFFLINE },
@@ -921,7 +914,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x280398, 1, RI_E2E3E3B0_ONLINE },
         { 0x2803a0, 1, RI_E2E3E3B0_ONLINE },
         { 0x2803a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x280400, 1, RI_ALL_ONLINE },
         { 0x280404, 255, RI_E1E1H_OFFLINE },
         { 0x282000, 4, RI_ALL_ONLINE },
         { 0x282010, 2044, RI_ALL_OFFLINE },
@@ -1031,7 +1023,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x300398, 1, RI_E2E3E3B0_ONLINE },
         { 0x3003a0, 1, RI_E2E3E3B0_ONLINE },
         { 0x3003a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x300400, 1, RI_ALL_ONLINE },
         { 0x300404, 255, RI_E1E1H_OFFLINE },
         { 0x302000, 4, RI_ALL_ONLINE },
         { 0x302010, 2044, RI_ALL_OFFLINE },
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index c37a68d68090..ebf40cd7aa10 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -775,7 +775,7 @@ static void bnx2x_get_regs(struct net_device *dev,
         struct bnx2x *bp = netdev_priv(dev);
         struct dump_hdr dump_hdr = {0};
 
-        regs->version = 0;
+        regs->version = 1;
         memset(p, 0, regs->len);
 
         if (!netif_running(bp->dev))
@@ -1587,6 +1587,12 @@ static int bnx2x_set_pauseparam(struct net_device *dev,
                         bp->link_params.req_flow_ctrl[cfg_idx] =
                                 BNX2X_FLOW_CTRL_AUTO;
                 }
+                bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_NONE;
+                if (epause->rx_pause)
+                        bp->link_params.req_fc_auto_adv |= BNX2X_FLOW_CTRL_RX;
+
+                if (epause->tx_pause)
+                        bp->link_params.req_fc_auto_adv |= BNX2X_FLOW_CTRL_TX;
         }
 
         DP(BNX2X_MSG_ETHTOOL,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index f4beb46c4709..b046beb435b2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -2667,9 +2667,11 @@ int bnx2x_update_pfc(struct link_params *params,
                 return bnx2x_status;
 
         DP(NETIF_MSG_LINK, "About to update PFC in BMAC\n");
-        if (CHIP_IS_E3(bp))
-                bnx2x_update_pfc_xmac(params, vars, 0);
-        else {
+
+        if (CHIP_IS_E3(bp)) {
+                if (vars->mac_type == MAC_TYPE_XMAC)
+                        bnx2x_update_pfc_xmac(params, vars, 0);
+        } else {
                 val = REG_RD(bp, MISC_REG_RESET_REG_2);
                 if ((val &
                      (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << params->port))
@@ -5432,7 +5434,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                 switch (speed_mask) {
                 case GP_STATUS_10M:
                         vars->line_speed = SPEED_10;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_10TFD;
                         else
                                 vars->link_status |= LINK_10THD;
@@ -5440,7 +5442,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
 
                 case GP_STATUS_100M:
                         vars->line_speed = SPEED_100;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_100TXFD;
                         else
                                 vars->link_status |= LINK_100TXHD;
@@ -5449,7 +5451,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                 case GP_STATUS_1G:
                 case GP_STATUS_1G_KX:
                         vars->line_speed = SPEED_1000;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_1000TFD;
                         else
                                 vars->link_status |= LINK_1000THD;
@@ -5457,7 +5459,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
 
                 case GP_STATUS_2_5G:
                         vars->line_speed = SPEED_2500;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_2500TFD;
                         else
                                 vars->link_status |= LINK_2500THD;
@@ -5531,6 +5533,7 @@ static int bnx2x_link_settings_status(struct bnx2x_phy *phy,
 
         if (gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_LINK_STATUS) {
                 if (SINGLE_MEDIA_DIRECT(params)) {
+                        vars->duplex = duplex;
                         bnx2x_flow_ctrl_resolve(phy, params, vars, gp_status);
                         if (phy->req_line_speed == SPEED_AUTO_NEG)
                                 bnx2x_xgxs_an_resolve(phy, params, vars,
@@ -5625,6 +5628,7 @@ static int bnx2x_warpcore_read_status(struct bnx2x_phy *phy,
                                         LINK_STATUS_PARALLEL_DETECTION_USED;
                         }
                         bnx2x_ext_phy_resolve_fc(phy, params, vars);
+                        vars->duplex = duplex;
                 }
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 21054987257a..0875ecfe3372 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -7561,8 +7561,14 @@ int bnx2x_set_mac_one(struct bnx2x *bp, u8 *mac,
         }
 
         rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
-        if (rc < 0)
+
+        if (rc == -EEXIST) {
+                DP(BNX2X_MSG_SP, "Failed to schedule ADD operations: %d\n", rc);
+                /* do not treat adding same MAC as error */
+                rc = 0;
+        } else if (rc < 0)
                 BNX2X_ERR("%s MAC failed\n", (set ? "Set" : "Del"));
+
         return rc;
 }
 
@@ -9825,12 +9831,13 @@ static void __devinit bnx2x_get_igu_cam_info(struct bnx2x *bp)
         }
 
 #ifdef CONFIG_PCI_MSI
-        /*
-         * It's expected that number of CAM entries for this functions is equal
-         * to the number evaluated based on the MSI-X table size. We want a
-         * harsh warning if these values are different!
+        /* Due to new PF resource allocation by MFW T7.4 and above, it's
+         * optional that number of CAM entries will not be equal to the value
+         * advertised in PCI.
+         * Driver should use the minimal value of both as the actual status
+         * block count
          */
-        WARN_ON(bp->igu_sb_cnt != igu_sb_cnt);
+        bp->igu_sb_cnt = min_t(int, bp->igu_sb_cnt, igu_sb_cnt);
 #endif
 
         if (igu_sb_cnt == 0)
@@ -10294,13 +10301,11 @@ static void __devinit bnx2x_get_fcoe_info(struct bnx2x *bp)
                                 dev_info.port_hw_config[port].
                                  fcoe_wwn_node_name_lower);
         } else if (!IS_MF_SD(bp)) {
-                u32 cfg = MF_CFG_RD(bp, func_ext_config[func].func_cfg);
-
                 /*
                  * Read the WWN info only if the FCoE feature is enabled for
                  * this function.
                  */
-                if (cfg & MACP_FUNC_CFG_FLAGS_FCOE_OFFLOAD)
+                if (BNX2X_MF_EXT_PROTOCOL_FCOE(bp) && !CHIP_IS_E1x(bp))
                         bnx2x_get_ext_wwn_info(bp, func);
 
         } else if (IS_MF_FCOE_SD(bp))
@@ -11073,7 +11078,14 @@ static int bnx2x_set_uc_list(struct bnx2x *bp)
         netdev_for_each_uc_addr(ha, dev) {
                 rc = bnx2x_set_mac_one(bp, bnx2x_uc_addr(ha), mac_obj, true,
                                        BNX2X_UC_LIST_MAC, &ramrod_flags);
-                if (rc < 0) {
+                if (rc == -EEXIST) {
+                        DP(BNX2X_MSG_SP,
+                           "Failed to schedule ADD operations: %d\n", rc);
+                        /* do not treat adding same MAC as error */
+                        rc = 0;
+
+                } else if (rc < 0) {
+
                         BNX2X_ERR("Failed to schedule ADD operations: %d\n",
                                   rc);
                         return rc;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
index f83e033da6da..acf2fe4ca608 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
@@ -1321,7 +1321,7 @@ void bnx2x_init_mcast_obj(struct bnx2x *bp,
  * the current command will be enqueued to the tail of the
  * pending commands list.
  *
- * Return: 0 is operation was sucessfull and there are no pending completions,
+ * Return: 0 is operation was successfull and there are no pending completions,
  *         negative if there were errors, positive if there are pending
  *         completions.
  */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 332db64dd5be..a1d0446b39b3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -101,6 +101,11 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
         if (CHIP_REV_IS_SLOW(bp))
                 return;
 
+        /* Update MCP's statistics if possible */
+        if (bp->func_stx)
+                memcpy(bnx2x_sp(bp, func_stats), &bp->func_stats,
+                       sizeof(bp->func_stats));
+
         /* loader */
         if (bp->executer_idx) {
                 int loader_idx = PMF_DMAE_C(bp);
@@ -128,8 +133,6 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
 
         } else if (bp->func_stx) {
                 *stats_comp = 0;
-                memcpy(bnx2x_sp(bp, func_stats), &bp->func_stats,
-                       sizeof(bp->func_stats));
                 bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
         }
 }
@@ -1151,9 +1154,11 @@ static void bnx2x_stats_update(struct bnx2x *bp)
         if (bp->port.pmf)
                 bnx2x_hw_stats_update(bp);
 
-        if (bnx2x_storm_stats_update(bp) && (bp->stats_pending++ == 3)) {
-                BNX2X_ERR("storm stats were not updated for 3 times\n");
-                bnx2x_panic();
+        if (bnx2x_storm_stats_update(bp)) {
+                if (bp->stats_pending++ == 3) {
+                        BNX2X_ERR("storm stats were not updated for 3 times\n");
+                        bnx2x_panic();
+                }
                 return;
         }
 
diff --git a/drivers/net/ethernet/cadence/at91_ether.c b/drivers/net/ethernet/cadence/at91_ether.c
index 77884191a8c6..4e980a7886fb 100644
--- a/drivers/net/ethernet/cadence/at91_ether.c
+++ b/drivers/net/ethernet/cadence/at91_ether.c
@@ -1086,7 +1086,7 @@ static int __init at91ether_probe(struct platform_device *pdev)
         /* Clock */
         lp->ether_clk = clk_get(&pdev->dev, "ether_clk");
         if (IS_ERR(lp->ether_clk)) {
-                res = -ENODEV;
+                res = PTR_ERR(lp->ether_clk);
                 goto err_ioumap;
         }
         clk_enable(lp->ether_clk);
diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
index 8971921cc1c8..ab6762caa957 100644
--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -1773,6 +1773,7 @@ static int gfar_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
 }
 
 int gfar_phc_index = -1;
+EXPORT_SYMBOL(gfar_phc_index);
 
 static int gfar_get_ts_info(struct net_device *dev,
                             struct ethtool_ts_info *info)
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index c08e5d40fecb..0daa66b8eca0 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -515,7 +515,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
                 err = PTR_ERR(etsects->clock);
                 goto no_clock;
         }
-        gfar_phc_clock = ptp_clock_index(etsects->clock);
+        gfar_phc_index = ptp_clock_index(etsects->clock);
 
         dev_set_drvdata(&dev->dev, etsects);
 
@@ -539,7 +539,7 @@ static int gianfar_ptp_remove(struct platform_device *dev)
         gfar_write(&etsects->regs->tmr_temask, 0);
         gfar_write(&etsects->regs->tmr_ctrl,   0);
 
-        gfar_phc_clock = -1;
+        gfar_phc_index = -1;
         ptp_clock_unregister(etsects->clock);
         iounmap(etsects->regs);
         release_resource(etsects->rsrc);
diff --git a/drivers/net/ethernet/i825xx/znet.c b/drivers/net/ethernet/i825xx/znet.c
index bd1f1ef91e19..ba4e0cea3506 100644
--- a/drivers/net/ethernet/i825xx/znet.c
+++ b/drivers/net/ethernet/i825xx/znet.c
@@ -139,8 +139,11 @@ struct znet_private {
 /* Only one can be built-in;-> */
 static struct net_device *znet_dev;
 
+#define NETIDBLK_MAGIC          "NETIDBLK"
+#define NETIDBLK_MAGIC_SIZE     8
+
 struct netidblk {
-        char magic[8];          /* The magic number (string) "NETIDBLK" */
+        char magic[NETIDBLK_MAGIC_SIZE];        /* The magic number (string) "NETIDBLK" */
         unsigned char netid[8]; /* The physical station address */
         char nettype, globalopt;
         char vendor[8];         /* The machine vendor and product name. */
@@ -373,14 +376,16 @@ static int __init znet_probe (void)
         struct znet_private *znet;
         struct net_device *dev;
         char *p;
+        char *plast = phys_to_virt(0x100000 - NETIDBLK_MAGIC_SIZE);
         int err = -ENOMEM;
 
         /* This code scans the region 0xf0000 to 0xfffff for a "NETIDBLK". */
-        for(p = (char *)phys_to_virt(0xf0000); p < (char *)phys_to_virt(0x100000); p++)
-                if (*p == 'N'  &&  strncmp(p, "NETIDBLK", 8) == 0)
+        for(p = (char *)phys_to_virt(0xf0000); p <= plast; p++)
+                if (*p == 'N' &&
+                    strncmp(p, NETIDBLK_MAGIC, NETIDBLK_MAGIC_SIZE) == 0)
                         break;
 
-        if (p >= (char *)phys_to_virt(0x100000)) {
+        if (p > plast) {
                 if (znet_debug > 1)
                         printk(KERN_INFO "No Z-Note ethernet adaptor found.\n");
                 return -ENODEV;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 9010cea68bc3..b68d28a130e6 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
         }
 
         if (adapter->rx_queue.queue_addr != NULL) {
-                if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) {
-                        dma_unmap_single(dev,
-                                        adapter->rx_queue.queue_dma,
-                                        adapter->rx_queue.queue_len,
-                                        DMA_BIDIRECTIONAL);
-                        adapter->rx_queue.queue_dma = DMA_ERROR_CODE;
-                }
-                kfree(adapter->rx_queue.queue_addr);
+                dma_free_coherent(dev, adapter->rx_queue.queue_len,
+                                  adapter->rx_queue.queue_addr,
+                                  adapter->rx_queue.queue_dma);
                 adapter->rx_queue.queue_addr = NULL;
         }
 
@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_device *netdev)
                 goto err_out;
         }
 
+        dev = &adapter->vdev->dev;
+
         adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
                                                 rxq_entries;
-        adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len,
-                                                GFP_KERNEL);
+        adapter->rx_queue.queue_addr =
+            dma_alloc_coherent(dev, adapter->rx_queue.queue_len,
+                               &adapter->rx_queue.queue_dma, GFP_KERNEL);
 
         if (!adapter->rx_queue.queue_addr) {
                 netdev_err(netdev, "unable to allocate rx queue pages\n");
@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_device *netdev)
                 goto err_out;
         }
 
-        dev = &adapter->vdev->dev;
-
         adapter->buffer_list_dma = dma_map_single(dev,
                         adapter->buffer_list_addr, 4096, DMA_BIDIRECTIONAL);
         adapter->filter_list_dma = dma_map_single(dev,
                         adapter->filter_list_addr, 4096, DMA_BIDIRECTIONAL);
-        adapter->rx_queue.queue_dma = dma_map_single(dev,
-                        adapter->rx_queue.queue_addr,
-                        adapter->rx_queue.queue_len, DMA_BIDIRECTIONAL);
 
         if ((dma_mapping_error(dev, adapter->buffer_list_dma)) ||
-            (dma_mapping_error(dev, adapter->filter_list_dma)) ||
-            (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
+            (dma_mapping_error(dev, adapter->filter_list_dma))) {
                 netdev_err(netdev, "unable to map filter or buffer list "
                            "pages\n");
                 rc = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 3bfbb8df8989..bde337ee1a34 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -3149,6 +3149,17 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                 return NETDEV_TX_OK;
         }
 
+        /* On PCI/PCI-X HW, if packet size is less than ETH_ZLEN,
+         * packets may get corrupted during padding by HW.
+         * To WA this issue, pad all small packets manually.
+         */
+        if (skb->len < ETH_ZLEN) {
+                if (skb_pad(skb, ETH_ZLEN - skb->len))
+                        return NETDEV_TX_OK;
+                skb->len = ETH_ZLEN;
+                skb_set_tail_pointer(skb, ETH_ZLEN);
+        }
+
         mss = skb_shinfo(skb)->gso_size;
         /* The controller does a simple calculation to
          * make sure there is enough room in the FIFO before
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index daf417923661..31d02649be41 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -227,9 +227,10 @@ int mlx4_UNMAP_ICM_AUX(struct mlx4_dev *dev)
                         MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
 }
 
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
+        u32 i = (obj & (table->num_obj - 1)) /
+                        (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
         int ret = 0;
 
         mutex_lock(&table->mutex);
@@ -262,16 +263,18 @@ out:
         return ret;
 }
 
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i;
+        u32 i;
+        u64 offset;
 
         i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
 
         mutex_lock(&table->mutex);
 
         if (--table->icm[i]->refcount == 0) {
-                mlx4_UNMAP_ICM(dev, table->virt + i * MLX4_TABLE_CHUNK_SIZE,
+                offset = (u64) i * MLX4_TABLE_CHUNK_SIZE;
+                mlx4_UNMAP_ICM(dev, table->virt + offset,
                                MLX4_TABLE_CHUNK_SIZE / MLX4_ICM_PAGE_SIZE);
                 mlx4_free_icm(dev, table->icm[i], table->coherent);
                 table->icm[i] = NULL;
@@ -280,9 +283,11 @@ void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
         mutex_unlock(&table->mutex);
 }
 
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle)
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+                        dma_addr_t *dma_handle)
 {
-        int idx, offset, dma_offset, i;
+        int offset, dma_offset, i;
+        u64 idx;
         struct mlx4_icm_chunk *chunk;
         struct mlx4_icm *icm;
         struct page *page = NULL;
@@ -292,7 +297,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_han
 
         mutex_lock(&table->mutex);
 
-        idx = (obj & (table->num_obj - 1)) * table->obj_size;
+        idx = (u64) (obj & (table->num_obj - 1)) * table->obj_size;
         icm = table->icm[idx / MLX4_TABLE_CHUNK_SIZE];
         dma_offset = offset = idx % MLX4_TABLE_CHUNK_SIZE;
 
@@ -326,10 +331,11 @@ out:
 }
 
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end)
+                         u32 start, u32 end)
 {
         int inc = MLX4_TABLE_CHUNK_SIZE / table->obj_size;
-        int i, err;
+        int err;
+        u32 i;
 
         for (i = start; i <= end; i += inc) {
                 err = mlx4_table_get(dev, table, i);
@@ -349,9 +355,9 @@ fail:
 }
 
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end)
+                          u32 start, u32 end)
 {
-        int i;
+        u32 i;
 
         for (i = start; i <= end; i += MLX4_TABLE_CHUNK_SIZE / table->obj_size)
                 mlx4_table_put(dev, table, i);
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
index a67744f53506..dee67fa39107 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
@@ -71,17 +71,17 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
                                 gfp_t gfp_mask, int coherent);
 void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent);
 
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end);
+                         u32 start, u32 end);
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end);
+                          u32 start, u32 end);
 int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                         u64 virt, int obj_size, u32 nobj, int reserved,
                         int use_lowmem, int use_coherent);
 void mlx4_cleanup_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table);
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle);
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, dma_addr_t *dma_handle);
 
 static inline void mlx4_icm_first(struct mlx4_icm *icm,
                                   struct mlx4_icm_iter *iter)
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 827b72dfce99..2f816c6aed72 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1234,13 +1234,13 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                                 mlx4_info(dev, "non-primary physical function, skipping.\n");
                         else
                                 mlx4_err(dev, "QUERY_FW command failed, aborting.\n");
-                        goto unmap_bf;
+                        return err;
                 }
 
                 err = mlx4_load_fw(dev);
                 if (err) {
                         mlx4_err(dev, "Failed to start FW, aborting.\n");
-                        goto unmap_bf;
+                        return err;
                 }
 
                 mlx4_cfg.log_pg_sz_m = 1;
@@ -1304,7 +1304,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                 err = mlx4_init_slave(dev);
                 if (err) {
                         mlx4_err(dev, "Failed to initialize slave\n");
-                        goto unmap_bf;
+                        return err;
                 }
 
                 err = mlx4_slave_cap(dev);
@@ -1324,7 +1324,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
         err = mlx4_QUERY_ADAPTER(dev, &adapter);
         if (err) {
                 mlx4_err(dev, "QUERY_ADAPTER command failed, aborting.\n");
-                goto err_close;
+                goto unmap_bf;
         }
 
         priv->eq_table.inta_pin = adapter.inta_pin;
@@ -1332,6 +1332,9 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
         return 0;
 
+unmap_bf:
+        unmap_bf_area(dev);
+
 err_close:
         mlx4_close_hca(dev);
 
@@ -1344,8 +1347,6 @@ err_stop_fw:
                 mlx4_UNMAP_FA(dev);
                 mlx4_free_icm(dev, priv->fw.fw_icm, 0);
         }
-unmap_bf:
-        unmap_bf_area(dev);
         return err;
 }
 
@@ -1996,7 +1997,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         }
 
 slave_start:
-        if (mlx4_cmd_init(dev)) {
+        err = mlx4_cmd_init(dev);
+        if (err) {
                 mlx4_err(dev, "Failed to init command interface, aborting.\n");
                 goto err_sriov;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index a018ea2a43de..e151c21baf2b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -137,11 +137,11 @@ static int mlx4_GID_HASH(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox,
         return err;
 }
 
-static struct mlx4_promisc_qp *get_promisc_qp(struct mlx4_dev *dev, u8 pf_num,
+static struct mlx4_promisc_qp *get_promisc_qp(struct mlx4_dev *dev, u8 port,
                                               enum mlx4_steer_type steer,
                                               u32 qpn)
 {
-        struct mlx4_steer *s_steer = &mlx4_priv(dev)->steer[pf_num];
+        struct mlx4_steer *s_steer = &mlx4_priv(dev)->steer[port - 1];
         struct mlx4_promisc_qp *pqp;
 
         list_for_each_entry(pqp, &s_steer->promisc_qps[steer], list) {
@@ -182,7 +182,7 @@ static int new_steering_entry(struct mlx4_dev *dev, u8 port,
         /* If the given qpn is also a promisc qp,
          * it should be inserted to duplicates list
          */
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
         if (pqp) {
                 dqp = kmalloc(sizeof *dqp, GFP_KERNEL);
                 if (!dqp) {
@@ -256,7 +256,7 @@ static int existing_steering_entry(struct mlx4_dev *dev, u8 port,
 
         s_steer = &mlx4_priv(dev)->steer[port - 1];
 
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
         if (!pqp)
                 return 0; /* nothing to do */
 
@@ -302,7 +302,7 @@ static bool check_duplicate_entry(struct mlx4_dev *dev, u8 port,
         s_steer = &mlx4_priv(dev)->steer[port - 1];
 
         /* if qp is not promisc, it cannot be duplicated */
-        if (!get_promisc_qp(dev, 0, steer, qpn))
+        if (!get_promisc_qp(dev, port, steer, qpn))
                 return false;
 
         /* The qp is promisc qp so it is a duplicate on this index
@@ -352,7 +352,7 @@ static bool can_remove_steering_entry(struct mlx4_dev *dev, u8 port,
         members_count = be32_to_cpu(mgm->members_count) & 0xffffff;
         for (i = 0;  i < members_count; i++) {
                 qpn = be32_to_cpu(mgm->qp[i]) & MGM_QPN_MASK;
-                if (!get_promisc_qp(dev, 0, steer, qpn) && qpn != tqpn) {
+                if (!get_promisc_qp(dev, port, steer, qpn) && qpn != tqpn) {
                         /* the qp is not promisc, the entry can't be removed */
                         goto out;
                 }
@@ -398,7 +398,7 @@ static int add_promisc_qp(struct mlx4_dev *dev, u8 port,
 
         mutex_lock(&priv->mcg_table.mutex);
 
-        if (get_promisc_qp(dev, 0, steer, qpn)) {
+        if (get_promisc_qp(dev, port, steer, qpn)) {
                 err = 0;  /* Noting to do, already exists */
                 goto out_mutex;
         }
@@ -503,7 +503,7 @@ static int remove_promisc_qp(struct mlx4_dev *dev, u8 port,
         s_steer = &mlx4_priv(dev)->steer[port - 1];
         mutex_lock(&priv->mcg_table.mutex);
 
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
         if (unlikely(!pqp)) {
                 mlx4_warn(dev, "QP %x is not promiscuous QP\n", qpn);
                 /* nothing to do */
@@ -650,13 +650,6 @@ static int find_entry(struct mlx4_dev *dev, u8 port,
         return err;
 }
 
-struct mlx4_net_trans_rule_hw_ctrl {
-        __be32 ctrl;
-        __be32 vf_vep_port;
-        __be32 qpn;
-        __be32 reserved;
-};
-
 static void trans_rule_ctrl_to_hw(struct mlx4_net_trans_rule *ctrl,
                                   struct mlx4_net_trans_rule_hw_ctrl *hw)
 {
@@ -680,87 +673,18 @@ static void trans_rule_ctrl_to_hw(struct mlx4_net_trans_rule *ctrl,
         hw->qpn = cpu_to_be32(ctrl->qpn);
 }
 
-struct mlx4_net_trans_rule_hw_ib {
-        u8      size;
-        u8      rsvd1;
-        __be16  id;
-        u32     rsvd2;
-        __be32  qpn;
-        __be32  qpn_mask;
-        u8      dst_gid[16];
-        u8      dst_gid_msk[16];
-} __packed;
-
-struct mlx4_net_trans_rule_hw_eth {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        u8      rsvd1[6];
-        u8      dst_mac[6];
-        u16     rsvd2;
-        u8      dst_mac_msk[6];
-        u16     rsvd3;
-        u8      src_mac[6];
-        u16     rsvd4;
-        u8      src_mac_msk[6];
-        u8      rsvd5;
-        u8      ether_type_enable;
-        __be16  ether_type;
-        __be16  vlan_id_msk;
-        __be16  vlan_id;
-} __packed;
-
-struct mlx4_net_trans_rule_hw_tcp_udp {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        __be16  rsvd1[3];
-        __be16  dst_port;
-        __be16  rsvd2;
-        __be16  dst_port_msk;
-        __be16  rsvd3;
-        __be16  src_port;
-        __be16  rsvd4;
-        __be16  src_port_msk;
-} __packed;
-
-struct mlx4_net_trans_rule_hw_ipv4 {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        __be32  rsvd1;
-        __be32  dst_ip;
-        __be32  dst_ip_msk;
-        __be32  src_ip;
-        __be32  src_ip_msk;
-} __packed;
-
-struct _rule_hw {
-        union {
-                struct {
-                        u8 size;
-                        u8 rsvd;
-                        __be16 id;
-                };
-                struct mlx4_net_trans_rule_hw_eth eth;
-                struct mlx4_net_trans_rule_hw_ib ib;
-                struct mlx4_net_trans_rule_hw_ipv4 ipv4;
-                struct mlx4_net_trans_rule_hw_tcp_udp tcp_udp;
-        };
+const u16 __sw_id_hw[] = {
+        [MLX4_NET_TRANS_RULE_ID_ETH]     = 0xE001,
+        [MLX4_NET_TRANS_RULE_ID_IB]      = 0xE005,
+        [MLX4_NET_TRANS_RULE_ID_IPV6]    = 0xE003,
+        [MLX4_NET_TRANS_RULE_ID_IPV4]    = 0xE002,
+        [MLX4_NET_TRANS_RULE_ID_TCP]     = 0xE004,
+        [MLX4_NET_TRANS_RULE_ID_UDP]     = 0xE006
 };
 
 static int parse_trans_rule(struct mlx4_dev *dev, struct mlx4_spec_list *spec,
                             struct _rule_hw *rule_hw)
 {
-        static const u16 __sw_id_hw[] = {
-                [MLX4_NET_TRANS_RULE_ID_ETH]     = 0xE001,
-                [MLX4_NET_TRANS_RULE_ID_IB]      = 0xE005,
-                [MLX4_NET_TRANS_RULE_ID_IPV6]    = 0xE003,
-                [MLX4_NET_TRANS_RULE_ID_IPV4]    = 0xE002,
-                [MLX4_NET_TRANS_RULE_ID_TCP]     = 0xE004,
-                [MLX4_NET_TRANS_RULE_ID_UDP]     = 0xE006
-        };
-
         static const size_t __rule_hw_sz[] = {
                 [MLX4_NET_TRANS_RULE_ID_ETH] =
                         sizeof(struct mlx4_net_trans_rule_hw_eth),
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 4d9df8f2a126..dba69d98734a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -690,6 +690,82 @@ struct mlx4_steer {
         struct list_head steer_entries[MLX4_NUM_STEERS];
 };
 
+struct mlx4_net_trans_rule_hw_ctrl {
+        __be32 ctrl;
+        __be32 vf_vep_port;
+        __be32 qpn;
+        __be32 reserved;
+};
+
+struct mlx4_net_trans_rule_hw_ib {
+        u8 size;
+        u8 rsvd1;
+        __be16 id;
+        u32 rsvd2;
+        __be32 qpn;
+        __be32 qpn_mask;
+        u8 dst_gid[16];
+        u8 dst_gid_msk[16];
+} __packed;
+
+struct mlx4_net_trans_rule_hw_eth {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        u8      rsvd1[6];
+        u8      dst_mac[6];
+        u16     rsvd2;
+        u8      dst_mac_msk[6];
+        u16     rsvd3;
+        u8      src_mac[6];
+        u16     rsvd4;
+        u8      src_mac_msk[6];
+        u8      rsvd5;
+        u8      ether_type_enable;
+        __be16  ether_type;
+        __be16  vlan_id_msk;
+        __be16  vlan_id;
+} __packed;
+
+struct mlx4_net_trans_rule_hw_tcp_udp {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        __be16  rsvd1[3];
+        __be16  dst_port;
+        __be16  rsvd2;
+        __be16  dst_port_msk;
+        __be16  rsvd3;
+        __be16  src_port;
+        __be16  rsvd4;
+        __be16  src_port_msk;
+} __packed;
+
+struct mlx4_net_trans_rule_hw_ipv4 {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        __be32  rsvd1;
+        __be32  dst_ip;
+        __be32  dst_ip_msk;
+        __be32  src_ip;
+        __be32  src_ip_msk;
+} __packed;
+
+struct _rule_hw {
+        union {
+                struct {
+                        u8 size;
+                        u8 rsvd;
+                        __be16 id;
+                };
+                struct mlx4_net_trans_rule_hw_eth eth;
+                struct mlx4_net_trans_rule_hw_ib ib;
+                struct mlx4_net_trans_rule_hw_ipv4 ipv4;
+                struct mlx4_net_trans_rule_hw_tcp_udp tcp_udp;
+        };
+};
+
 struct mlx4_priv {
         struct mlx4_dev         dev;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 94ceddd17ab2..293c9e820c49 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -42,6 +42,7 @@
 #include <linux/mlx4/cmd.h>
 #include <linux/mlx4/qp.h>
 #include <linux/if_ether.h>
+#include <linux/etherdevice.h>
 
 #include "mlx4.h"
 #include "fw.h"
@@ -2776,18 +2777,133 @@ ex_put:
         return err;
 }
 
+/*
+ * MAC validation for Flow Steering rules.
+ * VF can attach rules only with a mac address which is assigned to it.
+ */
+static int validate_eth_header_mac(int slave, struct _rule_hw *eth_header,
+                                   struct list_head *rlist)
+{
+        struct mac_res *res, *tmp;
+        __be64 be_mac;
+
+        /* make sure it isn't multicast or broadcast mac*/
+        if (!is_multicast_ether_addr(eth_header->eth.dst_mac) &&
+            !is_broadcast_ether_addr(eth_header->eth.dst_mac)) {
+                list_for_each_entry_safe(res, tmp, rlist, list) {
+                        be_mac = cpu_to_be64(res->mac << 16);
+                        if (!memcmp(&be_mac, eth_header->eth.dst_mac, ETH_ALEN))
+                                return 0;
+                }
+                pr_err("MAC %pM doesn't belong to VF %d, Steering rule rejected\n",
+                       eth_header->eth.dst_mac, slave);
+                return -EINVAL;
+        }
+        return 0;
+}
+
+/*
+ * In case of missing eth header, append eth header with a MAC address
+ * assigned to the VF.
+ */
+static int add_eth_header(struct mlx4_dev *dev, int slave,
+                          struct mlx4_cmd_mailbox *inbox,
+                          struct list_head *rlist, int header_id)
+{
+        struct mac_res *res, *tmp;
+        u8 port;
+        struct mlx4_net_trans_rule_hw_ctrl *ctrl;
+        struct mlx4_net_trans_rule_hw_eth *eth_header;
+        struct mlx4_net_trans_rule_hw_ipv4 *ip_header;
+        struct mlx4_net_trans_rule_hw_tcp_udp *l4_header;
+        __be64 be_mac = 0;
+        __be64 mac_msk = cpu_to_be64(MLX4_MAC_MASK << 16);
+
+        ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
+        port = be32_to_cpu(ctrl->vf_vep_port) & 0xff;
+        eth_header = (struct mlx4_net_trans_rule_hw_eth *)(ctrl + 1);
+
+        /* Clear a space in the inbox for eth header */
+        switch (header_id) {
+        case MLX4_NET_TRANS_RULE_ID_IPV4:
+                ip_header =
+                        (struct mlx4_net_trans_rule_hw_ipv4 *)(eth_header + 1);
+                memmove(ip_header, eth_header,
+                        sizeof(*ip_header) + sizeof(*l4_header));
+                break;
+        case MLX4_NET_TRANS_RULE_ID_TCP:
+        case MLX4_NET_TRANS_RULE_ID_UDP:
+                l4_header = (struct mlx4_net_trans_rule_hw_tcp_udp *)
+                            (eth_header + 1);
+                memmove(l4_header, eth_header, sizeof(*l4_header));
+                break;
+        default:
+                return -EINVAL;
+        }
+        list_for_each_entry_safe(res, tmp, rlist, list) {
+                if (port == res->port) {
+                        be_mac = cpu_to_be64(res->mac << 16);
+                        break;
+                }
+        }
+        if (!be_mac) {
+                pr_err("Failed adding eth header to FS rule, Can't find matching MAC for port %d .\n",
+                       port);
+                return -EINVAL;
+        }
+
+        memset(eth_header, 0, sizeof(*eth_header));
+        eth_header->size = sizeof(*eth_header) >> 2;
+        eth_header->id = cpu_to_be16(__sw_id_hw[MLX4_NET_TRANS_RULE_ID_ETH]);
+        memcpy(eth_header->dst_mac, &be_mac, ETH_ALEN);
+        memcpy(eth_header->dst_mac_msk, &mac_msk, ETH_ALEN);
+
+        return 0;
+
+}
+
 int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                                          struct mlx4_vhcr *vhcr,
                                          struct mlx4_cmd_mailbox *inbox,
                                          struct mlx4_cmd_mailbox *outbox,
                                          struct mlx4_cmd_info *cmd)
 {
+
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        struct mlx4_resource_tracker *tracker = &priv->mfunc.master.res_tracker;
+        struct list_head *rlist = &tracker->slave_list[slave].res_list[RES_MAC];
         int err;
+        struct mlx4_net_trans_rule_hw_ctrl *ctrl;
+        struct _rule_hw  *rule_header;
+        int header_id;
 
         if (dev->caps.steering_mode !=
             MLX4_STEERING_MODE_DEVICE_MANAGED)
                 return -EOPNOTSUPP;
 
+        ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
+        rule_header = (struct _rule_hw *)(ctrl + 1);
+        header_id = map_hw_to_sw_id(be16_to_cpu(rule_header->id));
+
+        switch (header_id) {
+        case MLX4_NET_TRANS_RULE_ID_ETH:
+                if (validate_eth_header_mac(slave, rule_header, rlist))
+                        return -EINVAL;
+                break;
+        case MLX4_NET_TRANS_RULE_ID_IPV4:
+        case MLX4_NET_TRANS_RULE_ID_TCP:
+        case MLX4_NET_TRANS_RULE_ID_UDP:
+                pr_warn("Can't attach FS rule without L2 headers, adding L2 header.\n");
+                if (add_eth_header(dev, slave, inbox, rlist, header_id))
+                        return -EINVAL;
+                vhcr->in_modifier +=
+                        sizeof(struct mlx4_net_trans_rule_hw_eth) >> 2;
+                break;
+        default:
+                pr_err("Corrupted mailbox.\n");
+                return -EINVAL;
+        }
+
         err = mlx4_cmd_imm(dev, inbox->dma, &vhcr->out_param,
                            vhcr->in_modifier, 0,
                            MLX4_QP_FLOW_STEERING_ATTACH, MLX4_CMD_TIME_CLASS_A,
diff --git a/drivers/net/ethernet/octeon/octeon_mgmt.c b/drivers/net/ethernet/octeon/octeon_mgmt.c
index c42bbb16cdae..a688a2ddcfd6 100644
--- a/drivers/net/ethernet/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/octeon/octeon_mgmt.c
@@ -722,10 +722,8 @@ static int octeon_mgmt_init_phy(struct net_device *netdev)
                                    octeon_mgmt_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
 
-        if (IS_ERR(p->phydev)) {
-                p->phydev = NULL;
+        if (!p->phydev)
                 return -1;
-        }
 
         phy_start_aneg(p->phydev);
 
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index e559dfa06d6a..6fa74d530e44 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1101,9 +1101,9 @@ static int pasemi_mac_phy_init(struct net_device *dev)
         phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
                                 PHY_INTERFACE_MODE_SGMII);
 
-        if (IS_ERR(phydev)) {
+        if (!phydev) {
                 printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
-                return PTR_ERR(phydev);
+                return -ENODEV;
         }
 
         mac->phydev = phydev;
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 342b3a79bd0f..a77c558d8f40 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1378,6 +1378,10 @@ static void netxen_mask_aer_correctable(struct netxen_adapter *adapter)
         struct pci_dev *root = pdev->bus->self;
         u32 aer_pos;
 
+        /* root bus? */
+        if (!root)
+                return;
+
         if (adapter->ahw.board_type != NETXEN_BRDTYPE_P3_4_GB_MM &&
                 adapter->ahw.board_type != NETXEN_BRDTYPE_P3_10G_TP)
                 return;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
index b8ead696141e..2a179d087207 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
@@ -15,7 +15,7 @@ qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
 
         do {
                 /* give atleast 1ms for firmware to respond */
-                msleep(1);
+                mdelay(1);
 
                 if (++timeout > QLCNIC_OS_CRB_RETRY_COUNT)
                         return QLCNIC_CDRP_RSP_TIMEOUT;
@@ -601,7 +601,7 @@ void qlcnic_fw_destroy_ctx(struct qlcnic_adapter *adapter)
                 qlcnic_fw_cmd_destroy_tx_ctx(adapter);
 
                 /* Allow dma queues to drain after context reset */
-                msleep(20);
+                mdelay(20);
         }
 }
 
diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
index bb8c8222122b..4d15bf413bdc 100644
--- a/drivers/net/ethernet/seeq/sgiseeq.c
+++ b/drivers/net/ethernet/seeq/sgiseeq.c
@@ -751,6 +751,7 @@ static int __devinit sgiseeq_probe(struct platform_device *pdev)
         sp->srings = sr;
         sp->rx_desc = sp->srings->rxvector;
         sp->tx_desc = sp->srings->txvector;
+        spin_lock_init(&sp->tx_lock);
 
         /* A couple calculations now, saves many cycles later. */
         setup_rx_ring(dev, sp->rx_desc, SEEQ_RX_BUFFERS);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index c136162e6473..3be88331d17a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1066,7 +1066,7 @@ static int stmmac_open(struct net_device *dev)
         } else
                 priv->tm->enable = 1;
 #endif
-        clk_enable(priv->stmmac_clk);
+        clk_prepare_enable(priv->stmmac_clk);
 
         stmmac_check_ether_addr(priv);
 
@@ -1188,7 +1188,7 @@ open_error:
         if (priv->phydev)
                 phy_disconnect(priv->phydev);
 
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
 
         return ret;
 }
@@ -1246,7 +1246,7 @@ static int stmmac_release(struct net_device *dev)
 #ifdef CONFIG_STMMAC_DEBUG_FS
         stmmac_exit_fs();
 #endif
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
 
         return 0;
 }
@@ -2178,7 +2178,7 @@ int stmmac_suspend(struct net_device *ndev)
         else {
                 stmmac_set_mac(priv->ioaddr, false);
                 /* Disable clock in case of PWM is off */
-                clk_disable(priv->stmmac_clk);
+                clk_disable_unprepare(priv->stmmac_clk);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
         return 0;
@@ -2203,7 +2203,7 @@ int stmmac_resume(struct net_device *ndev)
                 priv->hw->mac->pmt(priv->ioaddr, 0);
         else
                 /* enable the clk prevously disabled */
-                clk_enable(priv->stmmac_clk);
+                clk_prepare_enable(priv->stmmac_clk);
 
         netif_device_attach(ndev);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
index 2a0e1abde7e7..4ccd4e2977b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
@@ -97,19 +97,19 @@ static struct clk *timer_clock;
 static void stmmac_tmu_start(unsigned int new_freq)
 {
         clk_set_rate(timer_clock, new_freq);
-        clk_enable(timer_clock);
+        clk_prepare_enable(timer_clock);
 }
 
 static void stmmac_tmu_stop(void)
 {
-        clk_disable(timer_clock);
+        clk_disable_unprepare(timer_clock);
 }
 
 int stmmac_open_ext_timer(struct net_device *dev, struct stmmac_timer *tm)
 {
         timer_clock = clk_get(NULL, TMU_CHANNEL);
 
-        if (timer_clock == NULL)
+        if (IS_ERR(timer_clock))
                 return -1;
 
         if (tmu2_register_user(stmmac_timer_handler, (void *)dev) < 0) {
@@ -126,7 +126,7 @@ int stmmac_open_ext_timer(struct net_device *dev, struct stmmac_timer *tm)
 
 int stmmac_close_ext_timer(void)
 {
-        clk_disable(timer_clock);
+        clk_disable_unprepare(timer_clock);
         tmu2_unregister_user();
         clk_put(timer_clock);
         return 0;
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 256eddf1f75a..795109425568 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -280,7 +280,7 @@ static int sh_sir_set_baudrate(struct sh_sir_self *self, u32 baudrate)
         }
 
         clk = clk_get(NULL, "irda_clk");
-        if (!clk) {
+        if (IS_ERR(clk)) {
                 dev_err(dev, "can not get irda_clk\n");
                 return -EIO;
         }
diff --git a/drivers/net/phy/bcm87xx.c b/drivers/net/phy/bcm87xx.c
index 2346b38b9837..799789518e87 100644
--- a/drivers/net/phy/bcm87xx.c
+++ b/drivers/net/phy/bcm87xx.c
@@ -229,3 +229,5 @@ static void __exit bcm87xx_exit(void)
                 ARRAY_SIZE(bcm87xx_driver));
 }
 module_exit(bcm87xx_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index cf287e0eb408..2165d5fdb8c0 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -21,6 +21,12 @@
 #include <linux/phy.h>
 #include <linux/micrel_phy.h>
 
+/* Operation Mode Strap Override */
+#define MII_KSZPHY_OMSO                         0x16
+#define KSZPHY_OMSO_B_CAST_OFF                  (1 << 9)
+#define KSZPHY_OMSO_RMII_OVERRIDE               (1 << 1)
+#define KSZPHY_OMSO_MII_OVERRIDE                (1 << 0)
+
 /* general Interrupt control/status reg in vendor specific block. */
 #define MII_KSZPHY_INTCS                        0x1B
 #define KSZPHY_INTCS_JABBER                     (1 << 15)
@@ -101,6 +107,13 @@ static int kszphy_config_init(struct phy_device *phydev)
         return 0;
 }
 
+static int ksz8021_config_init(struct phy_device *phydev)
+{
+        const u16 val = KSZPHY_OMSO_B_CAST_OFF | KSZPHY_OMSO_RMII_OVERRIDE;
+        phy_write(phydev, MII_KSZPHY_OMSO, val);
+        return 0;
+}
+
 static int ks8051_config_init(struct phy_device *phydev)
 {
         int regval;
@@ -128,9 +141,22 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = ks8737_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8041,
+        .phy_id         = PHY_ID_KSZ8021,
+        .phy_id_mask    = 0x00ffffff,
+        .name           = "Micrel KSZ8021",
+        .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = ksz8021_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = kszphy_ack_interrupt,
+        .config_intr    = kszphy_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
+        .phy_id         = PHY_ID_KSZ8041,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8041",
+        .name           = "Micrel KSZ8041",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -141,9 +167,9 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8051,
+        .phy_id         = PHY_ID_KSZ8051,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8051",
+        .name           = "Micrel KSZ8051",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -154,8 +180,8 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8001,
-        .name           = "Micrel KS8001 or KS8721",
+        .phy_id         = PHY_ID_KSZ8001,
+        .name           = "Micrel KSZ8001 or KS8721",
         .phy_id_mask    = 0x00ffffff,
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -201,10 +227,11 @@ MODULE_LICENSE("GPL");
 
 static struct mdio_device_id __maybe_unused micrel_tbl[] = {
         { PHY_ID_KSZ9021, 0x000ffffe },
-        { PHY_ID_KS8001, 0x00ffffff },
+        { PHY_ID_KSZ8001, 0x00ffffff },
         { PHY_ID_KS8737, 0x00fffff0 },
-        { PHY_ID_KS8041, 0x00fffff0 },
-        { PHY_ID_KS8051, 0x00fffff0 },
+        { PHY_ID_KSZ8021, 0x00ffffff },
+        { PHY_ID_KSZ8041, 0x00fffff0 },
+        { PHY_ID_KSZ8051, 0x00fffff0 },
         { }
 };
 
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index 6d6192316b30..88e3991464e7 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -56,6 +56,32 @@ static int smsc_phy_config_init(struct phy_device *phydev)
         return smsc_phy_ack_interrupt (phydev);
 }
 
+static int lan87xx_config_init(struct phy_device *phydev)
+{
+        /*
+         * Make sure the EDPWRDOWN bit is NOT set. Setting this bit on
+         * LAN8710/LAN8720 PHY causes the PHY to misbehave, likely due
+         * to a bug on the chip.
+         *
+         * When the system is powered on with the network cable being
+         * disconnected all the way until after ifconfig ethX up is
+         * issued for the LAN port with this PHY, connecting the cable
+         * afterwards does not cause LINK change detection, while the
+         * expected behavior is the Link UP being detected.
+         */
+        int rc = phy_read(phydev, MII_LAN83C185_CTRL_STATUS);
+        if (rc < 0)
+                return rc;
+
+        rc &= ~MII_LAN83C185_EDPWRDOWN;
+
+        rc = phy_write(phydev, MII_LAN83C185_CTRL_STATUS, rc);
+        if (rc < 0)
+                return rc;
+
+        return smsc_phy_ack_interrupt(phydev);
+}
+
 static int lan911x_config_init(struct phy_device *phydev)
 {
         return smsc_phy_ack_interrupt(phydev);
@@ -162,7 +188,7 @@ static struct phy_driver smsc_phy_driver[] = {
         /* basic functions */
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
-        .config_init    = smsc_phy_config_init,
+        .config_init    = lan87xx_config_init,
 
         /* IRQ related */
         .ack_interrupt  = smsc_phy_ack_interrupt,
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index cbf7047decc0..20f31d0d1536 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -570,7 +570,7 @@ static int pppoe_release(struct socket *sock)
 
         po = pppox_sk(sk);
 
-        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
                 dev_put(po->pppoe_dev);
                 po->pppoe_dev = NULL;
         }
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 341b65dbbcd3..f8cd61f449a4 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -848,7 +848,7 @@ static struct netpoll_info *team_netpoll_info(struct team *team)
 }
 #endif
 
-static void __team_port_change_check(struct team_port *port, bool linkup);
+static void __team_port_change_port_added(struct team_port *port, bool linkup);
 
 static int team_port_add(struct team *team, struct net_device *port_dev)
 {
@@ -948,7 +948,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
         team_port_enable(team, port);
         list_add_tail_rcu(&port->list, &team->port_list);
         __team_compute_features(team);
-        __team_port_change_check(port, !!netif_carrier_ok(port_dev));
+        __team_port_change_port_added(port, !!netif_carrier_ok(port_dev));
         __team_options_change_check(team);
 
         netdev_info(dev, "Port device %s added\n", portname);
@@ -983,6 +983,8 @@ err_set_mtu:
         return err;
 }
 
+static void __team_port_change_port_removed(struct team_port *port);
+
 static int team_port_del(struct team *team, struct net_device *port_dev)
 {
         struct net_device *dev = team->dev;
@@ -999,8 +1001,7 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
         __team_option_inst_mark_removed_port(team, port);
         __team_options_change_check(team);
         __team_option_inst_del_port(team, port);
-        port->removed = true;
-        __team_port_change_check(port, false);
+        __team_port_change_port_removed(port);
         team_port_disable(team, port);
         list_del_rcu(&port->list);
         netdev_rx_handler_unregister(port_dev);
@@ -1652,8 +1653,8 @@ static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info)
 
         hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq,
                           &team_nl_family, 0, TEAM_CMD_NOOP);
-        if (IS_ERR(hdr)) {
-                err = PTR_ERR(hdr);
+        if (!hdr) {
+                err = -EMSGSIZE;
                 goto err_msg_put;
         }
 
@@ -1847,8 +1848,8 @@ start_again:
 
         hdr = genlmsg_put(skb, pid, seq, &team_nl_family, flags | NLM_F_MULTI,
                           TEAM_CMD_OPTIONS_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
                 goto nla_put_failure;
@@ -2067,8 +2068,8 @@ static int team_nl_fill_port_list_get(struct sk_buff *skb,
 
         hdr = genlmsg_put(skb, pid, seq, &team_nl_family, flags,
                           TEAM_CMD_PORT_LIST_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
                 goto nla_put_failure;
@@ -2251,13 +2252,11 @@ static void __team_options_change_check(struct team *team)
 }
 
 /* rtnl lock is held */
-static void __team_port_change_check(struct team_port *port, bool linkup)
+
+static void __team_port_change_send(struct team_port *port, bool linkup)
 {
         int err;
 
-        if (!port->removed && port->state.linkup == linkup)
-                return;
-
         port->changed = true;
         port->state.linkup = linkup;
         team_refresh_port_linkup(port);
@@ -2282,6 +2281,23 @@ send_event:
 
 }
 
+static void __team_port_change_check(struct team_port *port, bool linkup)
+{
+        if (port->state.linkup != linkup)
+                __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_added(struct team_port *port, bool linkup)
+{
+        __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_removed(struct team_port *port)
+{
+        port->removed = true;
+        __team_port_change_send(port, false);
+}
+
 static void team_port_change_check(struct team_port *port, bool linkup)
 {
         struct team *team = port->team;
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 4fd48df6b989..32e31c5c5dc6 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -962,6 +962,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x2001, 0x3c05),
         .driver_info = (unsigned long) &ax88772_info,
 }, {
+       // DLink DUB-E100 H/W Ver C1
+       USB_DEVICE (0x2001, 0x1a02),
+       .driver_info = (unsigned long) &ax88772_info,
+}, {
         // Linksys USB1000
         USB_DEVICE (0x1737, 0x0039),
         .driver_info = (unsigned long) &ax88178_info,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index adfab3fc5478..3543c9e57824 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -297,7 +297,7 @@ static int qmi_wwan_suspend(struct usb_interface *intf, pm_message_t message)
         if (ret < 0)
                 goto err;
 
-        if (info->subdriver && info->subdriver->suspend)
+        if (intf == info->control && info->subdriver && info->subdriver->suspend)
                 ret = info->subdriver->suspend(intf, message);
         if (ret < 0)
                 usbnet_resume(intf);
@@ -310,13 +310,14 @@ static int qmi_wwan_resume(struct usb_interface *intf)
         struct usbnet *dev = usb_get_intfdata(intf);
         struct qmi_wwan_state *info = (void *)&dev->data;
         int ret = 0;
+        bool callsub = (intf == info->control && info->subdriver && info->subdriver->resume);
 
-        if (info->subdriver && info->subdriver->resume)
+        if (callsub)
                 ret = info->subdriver->resume(intf);
         if (ret < 0)
                 goto err;
         ret = usbnet_resume(intf);
-        if (ret < 0 && info->subdriver && info->subdriver->resume && info->subdriver->suspend)
+        if (ret < 0 && callsub && info->subdriver->suspend)
                 info->subdriver->suspend(intf, PMSG_SUSPEND);
 err:
         return ret;
@@ -365,16 +366,20 @@ static const struct usb_device_id products[] = {
         },
 
         /* 2. Combined interface devices matching on class+protocol */
+        {       /* Huawei E367 and possibly others in "Windows mode" */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 7),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
         {       /* Huawei E392, E398 and possibly others in "Windows mode" */
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
                 .driver_info        = (unsigned long)&qmi_wwan_shared,
         },
-        {       /* Pantech UML290 */
-                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
+        {       /* Pantech UML290, P4200 and more */
+                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_shared,
         },
         {       /* Pantech UML290 - newer firmware */
-                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
+                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_shared,
         },
 
@@ -382,6 +387,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x0055, 1)},    /* ZTE (Vodafone) K3520-Z */
         {QMI_FIXED_INTF(0x19d2, 0x0063, 4)},    /* ZTE (Vodafone) K3565-Z */
         {QMI_FIXED_INTF(0x19d2, 0x0104, 4)},    /* ZTE (Vodafone) K4505-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0157, 5)},    /* ZTE MF683 */
         {QMI_FIXED_INTF(0x19d2, 0x0167, 4)},    /* ZTE MF820D */
         {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
         {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
@@ -398,7 +404,6 @@ static const struct usb_device_id products[] = {
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
         {QMI_GOBI1K_DEVICE(0x03f0, 0x1f1d)},    /* HP un2400 Gobi Modem Device */
-        {QMI_GOBI1K_DEVICE(0x03f0, 0x371d)},    /* HP un2430 Mobile Broadband Module */
         {QMI_GOBI1K_DEVICE(0x04da, 0x250d)},    /* Panasonic Gobi Modem device */
         {QMI_GOBI1K_DEVICE(0x413c, 0x8172)},    /* Dell Gobi Modem device */
         {QMI_GOBI1K_DEVICE(0x1410, 0xa001)},    /* Novatel Gobi Modem device */
@@ -440,6 +445,7 @@ static const struct usb_device_id products[] = {
         {QMI_GOBI_DEVICE(0x16d8, 0x8002)},      /* CMDTech Gobi 2000 Modem device (VU922) */
         {QMI_GOBI_DEVICE(0x05c6, 0x9205)},      /* Gobi 2000 Modem device */
         {QMI_GOBI_DEVICE(0x1199, 0x9013)},      /* Sierra Wireless Gobi 3000 Modem device (MC8355) */
+        {QMI_GOBI_DEVICE(0x03f0, 0x371d)},      /* HP un2430 Mobile Broadband Module */
         {QMI_GOBI_DEVICE(0x1199, 0x9015)},      /* Sierra Wireless Gobi 3000 Modem device */
         {QMI_GOBI_DEVICE(0x1199, 0x9019)},      /* Sierra Wireless Gobi 3000 Modem device */
         {QMI_GOBI_DEVICE(0x1199, 0x901b)},      /* Sierra Wireless MC7770 */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index 7be49ea60b6d..8e22417fa6c1 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -656,7 +656,7 @@ static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
                 return -EIO;
         }
 
-        *datap = *attrdata;
+        *datap = le16_to_cpu(*attrdata);
 
         kfree(attrdata);
         return result;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index f5ab6e613ec8..376143e8a1aa 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -1253,6 +1253,7 @@ static struct usb_driver smsc75xx_driver = {
         .probe          = usbnet_probe,
         .suspend        = usbnet_suspend,
         .resume         = usbnet_resume,
+        .reset_resume   = usbnet_resume,
         .disconnect     = usbnet_disconnect,
         .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index fd4b26d46fd5..fc9f578a1e25 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1201,19 +1201,26 @@ deferred:
 }
 EXPORT_SYMBOL_GPL(usbnet_start_xmit);
 
-static void rx_alloc_submit(struct usbnet *dev, gfp_t flags)
+static int rx_alloc_submit(struct usbnet *dev, gfp_t flags)
 {
         struct urb      *urb;
         int             i;
+        int             ret = 0;
 
         /* don't refill the queue all at once */
         for (i = 0; i < 10 && dev->rxq.qlen < RX_QLEN(dev); i++) {
                 urb = usb_alloc_urb(0, flags);
                 if (urb != NULL) {
-                        if (rx_submit(dev, urb, flags) == -ENOLINK)
-                                return;
+                        ret = rx_submit(dev, urb, flags);
+                        if (ret)
+                                goto err;
+                } else {
+                        ret = -ENOMEM;
+                        goto err;
                 }
         }
+err:
+        return ret;
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1257,7 +1264,8 @@ static void usbnet_bh (unsigned long param)
                 int     temp = dev->rxq.qlen;
 
                 if (temp < RX_QLEN(dev)) {
-                        rx_alloc_submit(dev, GFP_ATOMIC);
+                        if (rx_alloc_submit(dev, GFP_ATOMIC) == -ENOLINK)
+                                return;
                         if (temp != dev->rxq.qlen)
                                 netif_dbg(dev, link, dev->net,
                                           "rxqlen %d --> %d\n",
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index aaaca9aa2293..3f575afd8cfc 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -10,6 +10,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/cdev.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 2588848f4a82..d066f2516e47 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -2982,6 +2982,10 @@ static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
         case EEP_RX_MASK:
                 return pBase->txrxMask & 0xf;
         case EEP_PAPRD:
+                if (AR_SREV_9462(ah))
+                        return false;
+                if (!ah->config.enable_paprd);
+                        return false;
                 return !!(pBase->featureEnable & BIT(5));
         case EEP_CHAIN_MASK_REDUCE:
                 return (pBase->miscConfiguration >> 0x3) & 0x1;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 2c9f7d7ed4cc..0ed3846f9cbb 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -142,6 +142,7 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
         };
         int training_power;
         int i, val;
+        u32 am2pm_mask = ah->paprd_ratemask;
 
         if (IS_CHAN_2GHZ(ah->curchan))
                 training_power = ar9003_get_training_power_2g(ah);
@@ -158,10 +159,13 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
         }
         ah->paprd_training_power = training_power;
 
+        if (AR_SREV_9330(ah))
+                am2pm_mask = 0;
+
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2AM, AR_PHY_PAPRD_AM2AM_MASK,
                       ah->paprd_ratemask);
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2PM, AR_PHY_PAPRD_AM2PM_MASK,
-                      ah->paprd_ratemask);
+                      am2pm_mask);
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_HT40, AR_PHY_PAPRD_HT40_MASK,
                       ah->paprd_ratemask_ht40);
 
@@ -782,6 +786,102 @@ int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain)
 }
 EXPORT_SYMBOL(ar9003_paprd_setup_gain_table);
 
+static bool ar9003_paprd_retrain_pa_in(struct ath_hw *ah,
+                                       struct ath9k_hw_cal_data *caldata,
+                                       int chain)
+{
+        u32 *pa_in = caldata->pa_table[chain];
+        int capdiv_offset, quick_drop_offset;
+        int capdiv2g, quick_drop;
+        int count = 0;
+        int i;
+
+        if (!AR_SREV_9485(ah) && !AR_SREV_9330(ah))
+                return false;
+
+        capdiv2g = REG_READ_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                                  AR_PHY_65NM_CH0_TXRF3_CAPDIV2G);
+
+        quick_drop = REG_READ_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                                    AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP);
+
+        if (quick_drop)
+                quick_drop -= 0x40;
+
+        for (i = 0; i < NUM_BIN + 1; i++) {
+                if (pa_in[i] == 1400)
+                        count++;
+        }
+
+        if (AR_SREV_9485(ah)) {
+                if (pa_in[23] < 800) {
+                        capdiv_offset = (int)((1000 - pa_in[23] + 75) / 150);
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 7) {
+                                capdiv2g = 7;
+                                if (pa_in[23] < 600) {
+                                        quick_drop++;
+                                        if (quick_drop > 0)
+                                                quick_drop = 0;
+                                }
+                        }
+                } else if (pa_in[23] == 1400) {
+                        quick_drop_offset = min_t(int, count / 3, 2);
+                        quick_drop += quick_drop_offset;
+                        capdiv2g += quick_drop_offset / 2;
+
+                        if (capdiv2g > 7)
+                                capdiv2g = 7;
+
+                        if (quick_drop > 0) {
+                                quick_drop = 0;
+                                capdiv2g -= quick_drop_offset;
+                                if (capdiv2g < 0)
+                                        capdiv2g = 0;
+                        }
+                } else {
+                        return false;
+                }
+        } else if (AR_SREV_9330(ah)) {
+                if (pa_in[23] < 1000) {
+                        capdiv_offset = (1000 - pa_in[23]) / 100;
+                        capdiv2g += capdiv_offset;
+                        if (capdiv_offset > 3) {
+                                capdiv_offset = 1;
+                                quick_drop--;
+                        }
+
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 6)
+                                capdiv2g = 6;
+                        if (quick_drop < -4)
+                                quick_drop = -4;
+                } else if (pa_in[23] == 1400) {
+                        if (count > 3) {
+                                quick_drop++;
+                                capdiv2g -= count / 4;
+                                if (quick_drop > -2)
+                                        quick_drop = -2;
+                        } else {
+                                capdiv2g--;
+                        }
+
+                        if (capdiv2g < 0)
+                                capdiv2g = 0;
+                } else {
+                        return false;
+                }
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                      AR_PHY_65NM_CH0_TXRF3_CAPDIV2G, capdiv2g);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP,
+                      quick_drop);
+
+        return true;
+}
+
 int ar9003_paprd_create_curve(struct ath_hw *ah,
                               struct ath9k_hw_cal_data *caldata, int chain)
 {
@@ -817,6 +917,9 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
         if (!create_pa_curve(data_L, data_U, pa_table, small_signal_gain))
                 status = -2;
 
+        if (ar9003_paprd_retrain_pa_in(ah, caldata, chain))
+                status = -EINPROGRESS;
+
         REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
                     AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 7bfbaf065a43..84d3d4956861 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -625,6 +625,10 @@
 #define AR_PHY_AIC_CTRL_4_B0    (AR_SM_BASE + 0x4c0)
 #define AR_PHY_AIC_STAT_2_B0    (AR_SM_BASE + 0x4cc)
 
+#define AR_PHY_65NM_CH0_TXRF3       0x16048
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G          0x0000001e
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G_S        1
+
 #define AR_PHY_65NM_CH0_SYNTH4      0x1608c
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   (AR_SREV_9462(ah) ? 0x00000001 : 0x00000002)
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S (AR_SREV_9462(ah) ? 0 : 1)
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 68b643c8943c..c8ef30127adb 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -1577,6 +1577,8 @@ int ath9k_init_debug(struct ath_hw *ah)
                             sc->debug.debugfs_phy, sc, &fops_tx_chainmask);
         debugfs_create_file("disable_ani", S_IRUSR | S_IWUSR,
                             sc->debug.debugfs_phy, sc, &fops_disable_ani);
+        debugfs_create_bool("paprd", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
+                            &sc->sc_ah->config.enable_paprd);
         debugfs_create_file("regidx", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                             sc, &fops_regidx);
         debugfs_create_file("regval", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index bacdb8fb4ef4..9f83f71742a5 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -341,7 +341,8 @@ void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc)
 {
         struct ath_btcoex *btcoex = &sc->btcoex;
 
-        ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
+        if (btcoex->hw_timer_enabled)
+                ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
 }
 
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 60b6a9daff7e..4faf0a395876 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -463,9 +463,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
                 ah->config.spurchans[i][1] = AR_NO_SPUR;
         }
 
-        /* PAPRD needs some more work to be enabled */
-        ah->config.paprd_disable = 1;
-
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -978,9 +975,6 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
         else
                 imr_reg |= AR_IMR_TXOK;
 
-        if (opmode == NL80211_IFTYPE_AP)
-                imr_reg |= AR_IMR_MIB;
-
         ENABLE_REGWRITE_BUFFER(ah);
 
         REG_WRITE(ah, AR_IMR, imr_reg);
@@ -1778,6 +1772,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 /* Operating channel changed, reset channel calibration data */
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
+        } else if (caldata) {
+                caldata->paprd_packet_sent = false;
         }
         ah->noise = ath9k_hw_getchan_noise(ah, chan);
 
@@ -2501,9 +2497,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
-                if (!ah->config.paprd_disable &&
-                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
-                        pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
                 if (AR_SREV_9280_20(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index ce7332c64efb..de6968fc64f4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -236,7 +236,6 @@ enum ath9k_hw_caps {
         ATH9K_HW_CAP_LDPC                       = BIT(6),
         ATH9K_HW_CAP_FASTCLOCK                  = BIT(7),
         ATH9K_HW_CAP_SGI_20                     = BIT(8),
-        ATH9K_HW_CAP_PAPRD                      = BIT(9),
         ATH9K_HW_CAP_ANT_DIV_COMB               = BIT(10),
         ATH9K_HW_CAP_2GHZ                       = BIT(11),
         ATH9K_HW_CAP_5GHZ                       = BIT(12),
@@ -287,12 +286,12 @@ struct ath9k_ops_config {
         u8 pcie_clock_req;
         u32 pcie_waen;
         u8 analog_shiftreg;
-        u8 paprd_disable;
         u32 ofdm_trig_low;
         u32 ofdm_trig_high;
         u32 cck_trig_high;
         u32 cck_trig_low;
         u32 enable_ani;
+        u32 enable_paprd;
         int serialize_regmode;
         bool rx_intr_mitigation;
         bool tx_intr_mitigation;
@@ -405,6 +404,7 @@ struct ath9k_hw_cal_data {
         int8_t iCoff;
         int8_t qCoff;
         bool rtt_done;
+        bool paprd_packet_sent;
         bool paprd_done;
         bool nfcal_pending;
         bool nfcal_interference;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index d4549e9aac5c..7b88b9c39ccd 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -254,8 +254,9 @@ void ath_paprd_calibrate(struct work_struct *work)
         int chain_ok = 0;
         int chain;
         int len = 1800;
+        int ret;
 
-        if (!caldata)
+        if (!caldata || !caldata->paprd_packet_sent || caldata->paprd_done)
                 return;
 
         ath9k_ps_wakeup(sc);
@@ -282,13 +283,6 @@ void ath_paprd_calibrate(struct work_struct *work)
                         continue;
 
                 chain_ok = 0;
-
-                ath_dbg(common, CALIBRATE,
-                        "Sending PAPRD frame for thermal measurement on chain %d\n",
-                        chain);
-                if (!ath_paprd_send_frame(sc, skb, chain))
-                        goto fail_paprd;
-
                 ar9003_paprd_setup_gain_table(ah, chain);
 
                 ath_dbg(common, CALIBRATE,
@@ -302,7 +296,13 @@ void ath_paprd_calibrate(struct work_struct *work)
                         break;
                 }
 
-                if (ar9003_paprd_create_curve(ah, caldata, chain)) {
+                ret = ar9003_paprd_create_curve(ah, caldata, chain);
+                if (ret == -EINPROGRESS) {
+                        ath_dbg(common, CALIBRATE,
+                                "PAPRD curve on chain %d needs to be re-trained\n",
+                                chain);
+                        break;
+                } else if (ret) {
                         ath_dbg(common, CALIBRATE,
                                 "PAPRD create curve failed on chain %d\n",
                                 chain);
@@ -423,7 +423,7 @@ set_timer:
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
 
         mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) && ah->caldata) {
+        if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD) && ah->caldata) {
                 if (!ah->caldata->paprd_done)
                         ieee80211_queue_work(sc->hw, &sc->paprd_work);
                 else if (!ah->paprd_table_write_done)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 2c9da6b2ecb1..0d4155aec48d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2018,6 +2018,9 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
 
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
 
+        if (sc->sc_ah->caldata)
+                sc->sc_ah->caldata->paprd_packet_sent = true;
+
         if (!(tx_flags & ATH_TX_ERROR))
                 /* Frame was ACKed */
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 3876c7ea54f4..7a28d21ac389 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -34,8 +34,8 @@ config B43_BCMA
 config B43_BCMA_EXTRA
         bool "Hardware support that overlaps with the brcmsmac driver"
         depends on B43_BCMA
-        default n if BRCMSMAC || BRCMSMAC_MODULE
-        default y
+        default n if BRCMSMAC
+        default y
 
 config B43_SSB
         bool
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 49765d34b4e0..7c4ee72f9d56 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -638,6 +638,8 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 
                 oobirq_entry = kzalloc(sizeof(struct brcmf_sdio_oobirq),
                                        GFP_KERNEL);
+                if (!oobirq_entry)
+                        return -ENOMEM;
                 oobirq_entry->irq = res->start;
                 oobirq_entry->flags = res->flags & IRQF_TRIGGER_MASK;
                 list_add_tail(&oobirq_entry->list, &oobirq_lh);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 2621dd3d7dcd..6f70953f0bad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(struct brcmf_pub *drvr, int arp_mode)
 {
         char iovbuf[32];
         int retcode;
+        __le32 arp_mode_le;
 
-        brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
+        arp_mode_le = cpu_to_le32(arp_mode);
+        brcmf_c_mkiovar("arp_ol", (char *)&arp_mode_le, 4, iovbuf,
+                        sizeof(iovbuf));
         retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
                                    iovbuf, sizeof(iovbuf));
         retcode = retcode >= 0 ? 0 : retcode;
@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(struct brcmf_pub *drvr, int arp_enable)
 {
         char iovbuf[32];
         int retcode;
+        __le32 arp_enable_le;
 
-        brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4,
+        arp_enable_le = cpu_to_le32(arp_enable);
+
+        brcmf_c_mkiovar("arpoe", (char *)&arp_enable_le, 4,
                         iovbuf, sizeof(iovbuf));
         retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
                                    iovbuf, sizeof(iovbuf));
@@ -800,10 +806,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
         char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];      /*  Room for
                                  "event_msgs" + '\0' + bitvec  */
         char buf[128], *ptr;
-        u32 roaming = 1;
-        uint bcn_timeout = 3;
-        int scan_assoc_time = 40;
-        int scan_unassoc_time = 40;
+        __le32 roaming_le = cpu_to_le32(1);
+        __le32 bcn_timeout_le = cpu_to_le32(3);
+        __le32 scan_assoc_time_le = cpu_to_le32(40);
+        __le32 scan_unassoc_time_le = cpu_to_le32(40);
         int i;
         struct brcmf_bus_dcmd *cmdlst;
         struct list_head *cur, *q;
@@ -829,14 +835,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
 
         /* Setup timeout if Beacons are lost and roam is off to report
                  link down */
-        brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
+        brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout_le, 4, iovbuf,
                     sizeof(iovbuf));
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
                                   sizeof(iovbuf));
 
         /* Enable/Disable build-in roaming to allowed ext supplicant to take
                  of romaing */
-        brcmf_c_mkiovar("roam_off", (char *)&roaming, 4,
+        brcmf_c_mkiovar("roam_off", (char *)&roaming_le, 4,
                       iovbuf, sizeof(iovbuf));
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
                                   sizeof(iovbuf));
@@ -848,9 +854,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
                                   sizeof(iovbuf));
 
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
-                         (char *)&scan_assoc_time, sizeof(scan_assoc_time));
+                 (char *)&scan_assoc_time_le, sizeof(scan_assoc_time_le));
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
-                         (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
+                 (char *)&scan_unassoc_time_le, sizeof(scan_unassoc_time_le));
 
         /* Set and enable ARP offload feature */
         brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index a299d42da8e7..58f89fa9c9f8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -519,7 +519,7 @@ static void brcmf_usb_tx_complete(struct urb *urb)
         else
                 devinfo->bus_pub.bus->dstats.tx_errors++;
 
-        dev_kfree_skb(req->skb);
+        brcmu_pkt_buf_free_skb(req->skb);
         req->skb = NULL;
         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
 
@@ -540,7 +540,7 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                 devinfo->bus_pub.bus->dstats.rx_packets++;
         } else {
                 devinfo->bus_pub.bus->dstats.rx_errors++;
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                 return;
         }
@@ -550,13 +550,15 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                 if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
                         brcmf_dbg(ERROR, "rx protocol error\n");
                         brcmu_pkt_buf_free_skb(skb);
+                        brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                         devinfo->bus_pub.bus->dstats.rx_errors++;
                 } else {
                         brcmf_rx_packet(devinfo->dev, ifidx, skb);
                         brcmf_usb_rx_refill(devinfo, req);
                 }
         } else {
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
+                brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
         }
         return;
 
@@ -581,14 +583,13 @@ static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
                           req);
-        req->urb->transfer_flags |= URB_ZERO_PACKET;
         req->devinfo = devinfo;
+        brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
 
         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (ret == 0) {
-                brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
-        } else {
-                dev_kfree_skb(req->skb);
+        if (ret) {
+                brcmf_usb_del_fromq(devinfo, req);
+                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
         }
@@ -683,23 +684,22 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 
         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq);
         if (!req) {
+                brcmu_pkt_buf_free_skb(skb);
                 brcmf_dbg(ERROR, "no req to send\n");
                 return -ENOMEM;
         }
-        if (!req->urb) {
-                brcmf_dbg(ERROR, "no urb for req %p\n", req);
-                return -ENOBUFS;
-        }
 
         req->skb = skb;
         req->devinfo = devinfo;
         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
                           skb->data, skb->len, brcmf_usb_tx_complete, req);
         req->urb->transfer_flags |= URB_ZERO_PACKET;
+        brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (!ret) {
-                brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
-        } else {
+        if (ret) {
+                brcmf_dbg(ERROR, "brcmf_usb_tx usb_submit_urb FAILED\n");
+                brcmf_usb_del_fromq(devinfo, req);
+                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 28c5fbb4af26..50b5553b6964 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_scan_params_le *params_le,
         params_le->active_time = cpu_to_le32(-1);
         params_le->passive_time = cpu_to_le32(-1);
         params_le->home_time = cpu_to_le32(-1);
-        if (ssid && ssid->SSID_len)
-                memcpy(&params_le->ssid_le, ssid, sizeof(struct brcmf_ssid));
+        if (ssid && ssid->SSID_len) {
+                params_le->ssid_le.SSID_len = cpu_to_le32(ssid->SSID_len);
+                memcpy(&params_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len);
+        }
 }
 
 static s32
@@ -1876,16 +1878,17 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
         }
 
         if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status)) {
-                scb_val.val = cpu_to_le32(0);
+                memset(&scb_val, 0, sizeof(scb_val));
                 err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_RSSI, &scb_val,
                                       sizeof(struct brcmf_scb_val_le));
-                if (err)
+                if (err) {
                         WL_ERR("Could not get rssi (%d)\n", err);
-
-                rssi = le32_to_cpu(scb_val.val);
-                sinfo->filled |= STATION_INFO_SIGNAL;
-                sinfo->signal = rssi;
-                WL_CONN("RSSI %d dBm\n", rssi);
+                } else {
+                        rssi = le32_to_cpu(scb_val.val);
+                        sinfo->filled |= STATION_INFO_SIGNAL;
+                        sinfo->signal = rssi;
+                        WL_CONN("RSSI %d dBm\n", rssi);
+                }
         }
 
 done:
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index 7ed7d7577024..64a48f06d68b 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -77,7 +77,7 @@
                                          NL80211_RRF_NO_IBSS)
 
 static const struct ieee80211_regdomain brcms_regdom_x2 = {
-        .n_reg_rules = 7,
+        .n_reg_rules = 6,
         .alpha2 = "X2",
         .reg_rules = {
                 BRCM_2GHZ_2412_2462,
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 1e86ea2266d4..dbeebef562d5 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1442,6 +1442,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         return err;
 
 err_free_irq:
+        trans_pcie->irq_requested = false;
         free_irq(trans_pcie->irq, trans);
 error:
         iwl_free_isr_ict(trans);
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index e970897f6ab5..4cb234349fbf 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1326,6 +1326,11 @@ static int if_sdio_suspend(struct device *dev)
 
         mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
 
+        /* If we're powered off anyway, just let the mmc layer remove the
+         * card. */
+        if (!lbs_iface_active(card->priv))
+                return -ENOSYS;
+
         dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
                  sdio_func_id(func), flags);
 
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index c68adec3cc8b..565527aee0ea 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -170,7 +170,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
         cmd_code = le16_to_cpu(host_cmd->command);
         cmd_size = le16_to_cpu(host_cmd->size);
 
-        skb_trim(cmd_node->cmd_skb, cmd_size);
+        /* Adjust skb length */
+        if (cmd_node->cmd_skb->len > cmd_size)
+                /*
+                 * cmd_size is less than sizeof(struct host_cmd_ds_command).
+                 * Trim off the unused portion.
+                 */
+                skb_trim(cmd_node->cmd_skb, cmd_size);
+        else if (cmd_node->cmd_skb->len < cmd_size)
+                /*
+                 * cmd_size is larger than sizeof(struct host_cmd_ds_command)
+                 * because we have appended custom IE TLV. Increase skb length
+                 * accordingly.
+                 */
+                skb_put(cmd_node->cmd_skb, cmd_size - cmd_node->cmd_skb->len);
 
         do_gettimeofday(&tstamp);
         dev_dbg(adapter->dev, "cmd: DNLD_CMD: (%lu.%lu): %#x, act %#x, len %d,"
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 8b9dbd76a252..64328af496f5 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_BIT8, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2400pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index d3a4a68cc439..7564ae992b73 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -670,6 +670,7 @@
 #define GPIOCSR_BIT5                    FIELD32(0x00000020)
 #define GPIOCSR_BIT6                    FIELD32(0x00000040)
 #define GPIOCSR_BIT7                    FIELD32(0x00000080)
+#define GPIOCSR_BIT8                    FIELD32(0x00000100)
 
 /*
  * BBPPCSR: BBP Pin control register.
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index d2cf8a4bc8b5..3de0406735f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2500pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 3aae36bb0a9e..89fee311d8fd 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
         u16 reg;
 
         rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
-        return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
+        return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
 }
 
 #ifdef CONFIG_RT2X00_LIB_LEDS
@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u16 reg;
 
         /*
          * Allocate eeprom data.
@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
+        rt2x00_set_field16(&reg, MAC_CSR19_BIT8, 0);
+        rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2500usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index b493306a7eed..196bd5103e4f 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -189,14 +189,15 @@
  * MAC_CSR19: GPIO control register.
  */
 #define MAC_CSR19                       0x0426
-#define MAC_CSR19_BIT0                  FIELD32(0x0001)
-#define MAC_CSR19_BIT1                  FIELD32(0x0002)
-#define MAC_CSR19_BIT2                  FIELD32(0x0004)
-#define MAC_CSR19_BIT3                  FIELD32(0x0008)
-#define MAC_CSR19_BIT4                  FIELD32(0x0010)
-#define MAC_CSR19_BIT5                  FIELD32(0x0020)
-#define MAC_CSR19_BIT6                  FIELD32(0x0040)
-#define MAC_CSR19_BIT7                  FIELD32(0x0080)
+#define MAC_CSR19_BIT0                  FIELD16(0x0001)
+#define MAC_CSR19_BIT1                  FIELD16(0x0002)
+#define MAC_CSR19_BIT2                  FIELD16(0x0004)
+#define MAC_CSR19_BIT3                  FIELD16(0x0008)
+#define MAC_CSR19_BIT4                  FIELD16(0x0010)
+#define MAC_CSR19_BIT5                  FIELD16(0x0020)
+#define MAC_CSR19_BIT6                  FIELD16(0x0040)
+#define MAC_CSR19_BIT7                  FIELD16(0x0080)
+#define MAC_CSR19_BIT8                  FIELD16(0x0100)
 
 /*
  * MAC_CSR20: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index cb8c2aca54e4..b93516d832fb 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -4089,6 +4089,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                 rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
                 msleep(1);
                 rt2800_register_read(rt2x00dev, LDO_CFG0, &reg);
+                rt2x00_set_field32(&reg, LDO_CFG0_LDO_CORE_VLEVEL, 0);
                 rt2x00_set_field32(&reg, LDO_CFG0_BGSEL, 1);
                 rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
         }
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 98aa426a3564..4765bbd654cd 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -983,6 +983,7 @@ static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -996,6 +997,14 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2800_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 6cf336595e25..6b4226b71618 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
         skb_pull(entry->skb, RXINFO_DESC_SIZE);
 
         /*
-         * FIXME: we need to check for rx_pkt_len validity
+         * Check for rx_pkt_len validity. Return if invalid, leaving
+         * rxdesc->size zeroed out by the upper level.
          */
+        if (unlikely(rx_pkt_len == 0 ||
+                        rx_pkt_len > entry->queue->data_size)) {
+                ERROR(entry->queue->rt2x00dev,
+                        "Bad frame size %d, forcing to 0\n", rx_pkt_len);
+                return;
+        }
+
         rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
 
         /*
@@ -736,6 +744,7 @@ static int rt2800usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -749,6 +758,14 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2800_probe_hw_mode(rt2x00dev);
@@ -1157,6 +1174,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1690, 0x0744) },
         { USB_DEVICE(0x1690, 0x0761) },
         { USB_DEVICE(0x1690, 0x0764) },
+        /* ASUS */
+        { USB_DEVICE(0x0b05, 0x179d) },
         /* Cisco */
         { USB_DEVICE(0x167b, 0x4001) },
         /* EnGenius */
@@ -1222,7 +1241,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0b05, 0x1760) },
         { USB_DEVICE(0x0b05, 0x1761) },
         { USB_DEVICE(0x0b05, 0x1790) },
-        { USB_DEVICE(0x0b05, 0x179d) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3262) },
         { USB_DEVICE(0x13d3, 0x3284) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index a6b88bd4a1a5..3f07e36f462b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -629,7 +629,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp)
          */
         if (unlikely(rxdesc.size == 0 ||
                      rxdesc.size > entry->queue->data_size)) {
-                WARNING(rt2x00dev, "Wrong frame size %d max %d.\n",
+                ERROR(rt2x00dev, "Wrong frame size %d max %d.\n",
                         rxdesc.size, entry->queue->data_size);
                 dev_kfree_skb(entry->skb);
                 goto renew_skb;
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 3f7bc5cadf9a..b8ec96163922 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2832,6 +2832,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Disable power saving.
@@ -2850,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT13, 1);
+        rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt61pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index e3cd6db76b0e..8f3da5a56766 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
 
 /*
  * MAC_CSR14: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index ba6e434b859d..248436c13ce0 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT15, 0);
+        rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt73usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 9f6b470414d3..df1cc116b83b 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
+#define MAC_CSR13_BIT14                 FIELD32(0x00004000)
+#define MAC_CSR13_BIT15                 FIELD32(0x00008000)
 
 /*
  * MAC_CSR14: LED control register.
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index 44febfde9493..8a7b864faca3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -315,7 +315,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
         u16 box_reg = 0, box_extreg = 0;
         u8 u1b_tmp;
         bool isfw_read = false;
-        bool bwrite_sucess = false;
+        bool bwrite_success = false;
         u8 wait_h2c_limmit = 100;
         u8 wait_writeh2c_limmit = 100;
         u8 boxcontent[4], boxextcontent[2];
@@ -354,7 +354,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
                 }
         }
 
-        while (!bwrite_sucess) {
+        while (!bwrite_success) {
                 wait_writeh2c_limmit--;
                 if (wait_writeh2c_limmit == 0) {
                         RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
@@ -491,7 +491,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
                         break;
                 }
 
-                bwrite_sucess = true;
+                bwrite_success = true;
 
                 rtlhal->last_hmeboxnum = boxnum + 1;
                 if (rtlhal->last_hmeboxnum == 4)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 04c3aef8a4f6..2925094b2d91 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -117,6 +117,7 @@
 
 #define CHIP_VER_B                      BIT(4)
 #define CHIP_92C_BITMASK                BIT(0)
+#define CHIP_UNKNOWN                    BIT(7)
 #define CHIP_92C_1T2R                   0x03
 #define CHIP_92C                        0x01
 #define CHIP_88C                        0x00
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index bd0da7ef290b..dd4bb0950a57 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -994,8 +994,16 @@ static enum version_8192c _rtl92ce_read_chip_version(struct ieee80211_hw *hw)
                 version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C :
                            VERSION_A_CHIP_88C;
         } else {
-                version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C :
-                           VERSION_B_CHIP_88C;
+                version = (enum version_8192c) (CHIP_VER_B |
+                                ((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) |
+                                ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0));
+                if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 &
+                     CHIP_VER_RTL_MASK)) {
+                        version = (enum version_8192c)(version |
+                                   ((((value32 & CHIP_VER_RTL_MASK) == BIT(12))
+                                   ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) |
+                                   CHIP_VENDOR_UMC));
+                }
         }
 
         switch (version) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 3aa927f8b9b9..7d8f96405f42 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
 
         /* request fw */
         if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
-            !IS_92C_SERIAL(rtlhal->version))
+            !IS_92C_SERIAL(rtlhal->version)) {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
-        else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
+        } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
+                pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n");
+        }
 
         rtlpriv->max_fw_size = 0x4000;
         pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
index 895ae6c1f354..eb22dccc418b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
@@ -365,7 +365,7 @@ static void _rtl92d_fill_h2c_command(struct ieee80211_hw *hw,
         u8 u1b_tmp;
         bool isfw_read = false;
         u8 buf_index = 0;
-        bool bwrite_sucess = false;
+        bool bwrite_success = false;
         u8 wait_h2c_limmit = 100;
         u8 wait_writeh2c_limmit = 100;
         u8 boxcontent[4], boxextcontent[2];
@@ -408,7 +408,7 @@ static void _rtl92d_fill_h2c_command(struct ieee80211_hw *hw,
                         break;
                 }
         }
-        while (!bwrite_sucess) {
+        while (!bwrite_success) {
                 wait_writeh2c_limmit--;
                 if (wait_writeh2c_limmit == 0) {
                         RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
@@ -515,7 +515,7 @@ static void _rtl92d_fill_h2c_command(struct ieee80211_hw *hw,
                                  "switch case not processed\n");
                         break;
                 }
-                bwrite_sucess = true;
+                bwrite_success = true;
                 rtlhal->last_hmeboxnum = boxnum + 1;
                 if (rtlhal->last_hmeboxnum == 4)
                         rtlhal->last_hmeboxnum = 0;
diff --git a/drivers/pci/.gitignore b/drivers/pci/.gitignore
deleted file mode 100644
index f297ca8d313e..000000000000
--- a/drivers/pci/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-classlist.h
-devlist.h
-gen-devlist
-
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 3782e1cd3697..934d861a3235 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -2196,10 +2196,8 @@ static int __init acer_wmi_init(void)
                 interface->capability &= ~ACER_CAP_BRIGHTNESS;
                 pr_info("Brightness must be controlled by acpi video driver\n");
         } else {
-#ifdef CONFIG_ACPI_VIDEO
                 pr_info("Disabling ACPI video driver\n");
                 acpi_video_unregister();
-#endif
         }
 
         if (wmi_has_guid(WMID_GUID3)) {
diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c
index dfb1a92ce949..db8f63841b42 100644
--- a/drivers/platform/x86/apple-gmux.c
+++ b/drivers/platform/x86/apple-gmux.c
@@ -101,7 +101,7 @@ static void gmux_pio_write32(struct apple_gmux_data *gmux_data, int port,
 
         for (i = 0; i < 4; i++) {
                 tmpval = (val >> (i * 8)) & 0xff;
-                outb(tmpval, port + i);
+                outb(tmpval, gmux_data->iostart + port + i);
         }
 }
 
@@ -142,8 +142,9 @@ static u8 gmux_index_read8(struct apple_gmux_data *gmux_data, int port)
         u8 val;
 
         mutex_lock(&gmux_data->index_lock);
-        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
         gmux_index_wait_ready(gmux_data);
+        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
+        gmux_index_wait_complete(gmux_data);
         val = inb(gmux_data->iostart + GMUX_PORT_VALUE);
         mutex_unlock(&gmux_data->index_lock);
 
@@ -166,8 +167,9 @@ static u32 gmux_index_read32(struct apple_gmux_data *gmux_data, int port)
         u32 val;
 
         mutex_lock(&gmux_data->index_lock);
-        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
         gmux_index_wait_ready(gmux_data);
+        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
+        gmux_index_wait_complete(gmux_data);
         val = inl(gmux_data->iostart + GMUX_PORT_VALUE);
         mutex_unlock(&gmux_data->index_lock);
 
@@ -461,18 +463,22 @@ static int __devinit gmux_probe(struct pnp_dev *pnp,
         ver_release = gmux_read8(gmux_data, GMUX_PORT_VERSION_RELEASE);
         if (ver_major == 0xff && ver_minor == 0xff && ver_release == 0xff) {
                 if (gmux_is_indexed(gmux_data)) {
+                        u32 version;
                         mutex_init(&gmux_data->index_lock);
                         gmux_data->indexed = true;
+                        version = gmux_read32(gmux_data,
+                                GMUX_PORT_VERSION_MAJOR);
+                        ver_major = (version >> 24) & 0xff;
+                        ver_minor = (version >> 16) & 0xff;
+                        ver_release = (version >> 8) & 0xff;
                 } else {
                         pr_info("gmux device not present\n");
                         ret = -ENODEV;
                         goto err_release;
                 }
-                pr_info("Found indexed gmux\n");
-        } else {
-                pr_info("Found gmux version %d.%d.%d\n", ver_major, ver_minor,
-                        ver_release);
         }
+        pr_info("Found gmux version %d.%d.%d [%s]\n", ver_major, ver_minor,
+                ver_release, (gmux_data->indexed ? "indexed" : "classic"));
 
         memset(&props, 0, sizeof(props));
         props.type = BACKLIGHT_PLATFORM;
@@ -505,9 +511,7 @@ static int __devinit gmux_probe(struct pnp_dev *pnp,
          * Disable the other backlight choices.
          */
         acpi_video_dmi_promote_vendor();
-#if defined (CONFIG_ACPI_VIDEO) || defined (CONFIG_ACPI_VIDEO_MODULE)
         acpi_video_unregister();
-#endif
         apple_bl_unregister();
 
         gmux_data->power_state = VGA_SWITCHEROO_ON;
@@ -593,9 +597,7 @@ static void __devexit gmux_remove(struct pnp_dev *pnp)
         kfree(gmux_data);
 
         acpi_video_dmi_demote_vendor();
-#if defined (CONFIG_ACPI_VIDEO) || defined (CONFIG_ACPI_VIDEO_MODULE)
         acpi_video_register();
-#endif
         apple_bl_register();
 }
 
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index e38f91be0b10..4b568df56643 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -85,7 +85,7 @@ static char *wled_type = "unknown";
 static char *bled_type = "unknown";
 
 module_param(wled_type, charp, 0444);
-MODULE_PARM_DESC(wlan_status, "Set the wled type on boot "
+MODULE_PARM_DESC(wled_type, "Set the wled type on boot "
                  "(unknown, led or rfkill). "
                  "default is unknown");
 
@@ -863,9 +863,9 @@ static ssize_t show_infos(struct device *dev,
          * The significance of others is yet to be found.
          * If we don't find the method, we assume the device are present.
          */
-        rv = acpi_evaluate_integer(asus->handle, "HRWS", NULL, &temp);
+        rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
         if (!ACPI_FAILURE(rv))
-                len += sprintf(page + len, "HRWS value         : %#x\n",
+                len += sprintf(page + len, "HWRS value         : %#x\n",
                                (uint) temp);
         /*
          * Another value for userspace: the ASYM method returns 0x02 for
@@ -1751,9 +1751,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
          * The significance of others is yet to be found.
          */
         status =
-            acpi_evaluate_integer(asus->handle, "HRWS", NULL, &hwrs_result);
+            acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
         if (!ACPI_FAILURE(status))
-                pr_notice("  HRWS returned %x", (int)hwrs_result);
+                pr_notice("  HWRS returned %x", (int)hwrs_result);
 
         if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
                 asus->have_rsts = true;
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 2eb9fe8e8efd..c0e9ff489b24 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -47,9 +47,7 @@
 #include <linux/thermal.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
-#ifdef CONFIG_ACPI_VIDEO
 #include <acpi/video.h>
-#endif
 
 #include "asus-wmi.h"
 
@@ -1704,10 +1702,8 @@ static int asus_wmi_add(struct platform_device *pdev)
         if (asus->driver->quirks->wmi_backlight_power)
                 acpi_video_dmi_promote_vendor();
         if (!acpi_video_backlight_support()) {
-#ifdef CONFIG_ACPI_VIDEO
                 pr_info("Disabling ACPI video driver\n");
                 acpi_video_unregister();
-#endif
                 err = asus_wmi_backlight_init(asus);
                 if (err && err != -ENODEV)
                         goto fail_backlight;
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index dab91b48d22c..5ca264179f4e 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -610,12 +610,12 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
 
                 if (!bus) {
                         pr_warn("Unable to find PCI bus 1?\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                 }
 
                 if (pci_bus_read_config_dword(bus, 0, PCI_VENDOR_ID, &l)) {
                         pr_err("Unable to read PCI config space?\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                 }
 
                 absent = (l == 0xffffffff);
@@ -627,7 +627,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                                 absent ? "absent" : "present");
                         pr_warn("skipped wireless hotplug as probably "
                                 "inappropriate for this model\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                 }
 
                 if (!blocked) {
@@ -635,7 +635,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                         if (dev) {
                                 /* Device already present */
                                 pci_dev_put(dev);
-                                goto out_unlock;
+                                goto out_put_dev;
                         }
                         dev = pci_scan_single_device(bus, 0);
                         if (dev) {
@@ -650,6 +650,8 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                                 pci_dev_put(dev);
                         }
                 }
+out_put_dev:
+                pci_dev_put(port);
         }
 
 out_unlock:
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index c1ca7bcebb66..dd90d15f5210 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -26,9 +26,7 @@
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
-#ifdef CONFIG_ACPI_VIDEO
 #include <acpi/video.h>
-#endif
 
 /*
  * This driver is needed because a number of Samsung laptops do not hook
@@ -1558,9 +1556,7 @@ static int __init samsung_init(void)
                 samsung->handle_backlight = false;
         } else if (samsung->quirks->broken_acpi_video) {
                 pr_info("Disabling ACPI video driver\n");
-#ifdef CONFIG_ACPI_VIDEO
                 acpi_video_unregister();
-#endif
         }
 #endif
 
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 80e377949314..52daaa816e53 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -545,7 +545,7 @@ TPACPI_HANDLE(hkey, ec, "\\_SB.HKEY",	/* 600e/x, 770e, 770x */
  */
 
 static int acpi_evalf(acpi_handle handle,
-                      void *res, char *method, char *fmt, ...)
+                      int *res, char *method, char *fmt, ...)
 {
         char *fmt0 = fmt;
         struct acpi_object_list params;
@@ -606,7 +606,7 @@ static int acpi_evalf(acpi_handle handle,
                 success = (status == AE_OK &&
                            out_obj.type == ACPI_TYPE_INTEGER);
                 if (success && res)
-                        *(int *)res = out_obj.integer.value;
+                        *res = out_obj.integer.value;
                 break;
         case 'v':               /* void */
                 success = status == AE_OK;
@@ -7386,17 +7386,18 @@ static int fan_get_status(u8 *status)
          * Add TPACPI_FAN_RD_ACPI_FANS ? */
 
         switch (fan_status_access_mode) {
-        case TPACPI_FAN_RD_ACPI_GFAN:
+        case TPACPI_FAN_RD_ACPI_GFAN: {
                 /* 570, 600e/x, 770e, 770x */
+                int res;
 
-                if (unlikely(!acpi_evalf(gfan_handle, &s, NULL, "d")))
+                if (unlikely(!acpi_evalf(gfan_handle, &res, NULL, "d")))
                         return -EIO;
 
                 if (likely(status))
-                        *status = s & 0x07;
+                        *status = res & 0x07;
 
                 break;
-
+        }
         case TPACPI_FAN_RD_TPEC:
                 /* all except 570, 600e/x, 770e, 770x */
                 if (unlikely(!acpi_ec_read(fan_status_offset, &s)))
diff --git a/drivers/pwm/pwm-tiecap.c b/drivers/pwm/pwm-tiecap.c
index 0b66d0f25922..4b6688909fee 100644
--- a/drivers/pwm/pwm-tiecap.c
+++ b/drivers/pwm/pwm-tiecap.c
@@ -100,6 +100,13 @@ static int ecap_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                 writel(period_cycles, pc->mmio_base + CAP3);
         }
 
+        if (!test_bit(PWMF_ENABLED, &pwm->flags)) {
+                reg_val = readw(pc->mmio_base + ECCTL2);
+                /* Disable APWM mode to put APWM output Low */
+                reg_val &= ~ECCTL2_APWM_MODE;
+                writew(reg_val, pc->mmio_base + ECCTL2);
+        }
+
         pm_runtime_put_sync(pc->chip.dev);
         return 0;
 }
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index c3756d1be194..b1996bcd5b78 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -104,6 +104,7 @@ struct ehrpwm_pwm_chip {
         struct pwm_chip chip;
         unsigned int    clk_rate;
         void __iomem    *mmio_base;
+        unsigned long period_cycles[NUM_PWM_CHANNEL];
 };
 
 static inline struct ehrpwm_pwm_chip *to_ehrpwm_pwm_chip(struct pwm_chip *chip)
@@ -210,6 +211,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
         unsigned long long c;
         unsigned long period_cycles, duty_cycles;
         unsigned short ps_divval, tb_divval;
+        int i;
 
         if (period_ns < 0 || duty_ns < 0 || period_ns > NSEC_PER_SEC)
                 return -ERANGE;
@@ -229,6 +231,28 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                 duty_cycles = (unsigned long)c;
         }
 
+        /*
+         * Period values should be same for multiple PWM channels as IP uses
+         * same period register for multiple channels.
+         */
+        for (i = 0; i < NUM_PWM_CHANNEL; i++) {
+                if (pc->period_cycles[i] &&
+                                (pc->period_cycles[i] != period_cycles)) {
+                        /*
+                         * Allow channel to reconfigure period if no other
+                         * channels being configured.
+                         */
+                        if (i == pwm->hwpwm)
+                                continue;
+
+                        dev_err(chip->dev, "Period value conflicts with channel %d\n",
+                                        i);
+                        return -EINVAL;
+                }
+        }
+
+        pc->period_cycles[pwm->hwpwm] = period_cycles;
+
         /* Configure clock prescaler to support Low frequency PWM wave */
         if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
                                 &tb_divval)) {
@@ -320,10 +344,15 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
 
 static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
 {
+        struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
         if (test_bit(PWMF_ENABLED, &pwm->flags)) {
                 dev_warn(chip->dev, "Removing PWM device without disabling\n");
                 pm_runtime_put_sync(chip->dev);
         }
+
+        /* set period value to zero on free */
+        pc->period_cycles[pwm->hwpwm] = 0;
 }
 
 static const struct pwm_ops ehrpwm_pwm_ops = {
diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
index 4e932cc695e9..e98a5e7827df 100644
--- a/drivers/regulator/Kconfig
+++ b/drivers/regulator/Kconfig
@@ -33,9 +33,8 @@ config REGULATOR_DUMMY
         help
           If this option is enabled then when a regulator lookup fails
           and the board has not specified that it has provided full
-          constraints then the regulator core will provide an always
-          enabled dummy regulator will be provided, allowing consumer
-          drivers to continue.
+          constraints the regulator core will provide an always
+          enabled dummy regulator, allowing consumer drivers to continue.
 
           A warning will be generated when this substitution is done.
 
@@ -50,11 +49,11 @@ config REGULATOR_VIRTUAL_CONSUMER
         tristate "Virtual regulator consumer support"
         help
           This driver provides a virtual consumer for the voltage and
-          current regulator API which provides sysfs controls for
-          configuring the supplies requested.  This is mainly useful
-          for test purposes.
+          current regulator API which provides sysfs controls for
+          configuring the supplies requested.  This is mainly useful
+          for test purposes.
 
-          If unsure, say no.
+          If unsure, say no.
 
 config REGULATOR_USERSPACE_CONSUMER
         tristate "Userspace regulator consumer support"
@@ -63,7 +62,7 @@ config REGULATOR_USERSPACE_CONSUMER
           from user space. Userspace consumer driver provides ability to
           control power supplies for such devices.
 
-          If unsure, say no.
+          If unsure, say no.
 
 config REGULATOR_GPIO
         tristate "GPIO regulator support"
@@ -110,6 +109,17 @@ config REGULATOR_DA9052
           This driver supports the voltage regulators of DA9052-BC and
           DA9053-AA/Bx PMIC.
 
+config REGULATOR_FAN53555
+        tristate "Fairchild FAN53555 Regulator"
+        depends on I2C
+        select REGMAP_I2C
+        help
+          This driver supports Fairchild FAN53555 Digitally Programmable
+          TinyBuck Regulator. The FAN53555 is a step-down switching voltage
+          regulator that delivers a digitally programmable output from an
+          input voltage supply of 2.5V to 5.5V. The output voltage is
+          programmed through an I2C interface.
+
 config REGULATOR_ANATOP
         tristate "Freescale i.MX on-chip ANATOP LDO regulators"
         depends on MFD_ANATOP
@@ -172,6 +182,14 @@ config REGULATOR_MAX8660
           This driver controls a Maxim 8660/8661 voltage output
           regulator via I2C bus.
 
+config REGULATOR_MAX8907
+        tristate "Maxim 8907 voltage regulator"
+        depends on MFD_MAX8907
+        help
+          This driver controls a Maxim 8907 voltage output regulator
+          via I2C bus. The provided regulator is suitable for Tegra
+          chip to control Step-Down DC-DC and LDOs.
+
 config REGULATOR_MAX8925
         tristate "Maxim MAX8925 Power Management IC"
         depends on MFD_MAX8925
@@ -247,7 +265,7 @@ config REGULATOR_LP8788
 
 config REGULATOR_PCF50633
         tristate "NXP PCF50633 regulator driver"
-        depends on MFD_PCF50633
+        depends on MFD_PCF50633
         help
          Say Y here to support the voltage regulators and convertors
          on PCF50633
@@ -416,7 +434,7 @@ config REGULATOR_WM8350
         depends on MFD_WM8350
         help
           This driver provides support for the voltage and current regulators
-          of the WM8350 AudioPlus PMIC.
+          of the WM8350 AudioPlus PMIC.
 
 config REGULATOR_WM8400
         tristate "Wolfson Microelectronics WM8400 AudioPlus PMIC"
diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
index 3342615cf25e..e431eed8a878 100644
--- a/drivers/regulator/Makefile
+++ b/drivers/regulator/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_REGULATOR_DA903X)	+= da903x.o
 obj-$(CONFIG_REGULATOR_DA9052)  += da9052-regulator.o
 obj-$(CONFIG_REGULATOR_DBX500_PRCMU) += dbx500-prcmu.o
 obj-$(CONFIG_REGULATOR_DB8500_PRCMU) += db8500-prcmu.o
+obj-$(CONFIG_REGULATOR_FAN53555) += fan53555.o
 obj-$(CONFIG_REGULATOR_GPIO) += gpio-regulator.o
 obj-$(CONFIG_REGULATOR_ISL6271A) += isl6271a-regulator.o
 obj-$(CONFIG_REGULATOR_LP3971) += lp3971.o
@@ -30,6 +31,7 @@ obj-$(CONFIG_REGULATOR_LP8788) += lp8788-ldo.o
 obj-$(CONFIG_REGULATOR_MAX1586) += max1586.o
 obj-$(CONFIG_REGULATOR_MAX8649) += max8649.o
 obj-$(CONFIG_REGULATOR_MAX8660) += max8660.o
+obj-$(CONFIG_REGULATOR_MAX8907) += max8907-regulator.o
 obj-$(CONFIG_REGULATOR_MAX8925) += max8925-regulator.o
 obj-$(CONFIG_REGULATOR_MAX8952) += max8952.o
 obj-$(CONFIG_REGULATOR_MAX8997) += max8997.o
diff --git a/drivers/regulator/aat2870-regulator.c b/drivers/regulator/aat2870-regulator.c
index 6f45bfd22e83..167c93f21981 100644
--- a/drivers/regulator/aat2870-regulator.c
+++ b/drivers/regulator/aat2870-regulator.c
@@ -162,7 +162,7 @@ static struct aat2870_regulator *aat2870_get_regulator(int id)
 static int aat2870_regulator_probe(struct platform_device *pdev)
 {
         struct aat2870_regulator *ri;
-        struct regulator_config config = { 0 };
+        struct regulator_config config = { };
         struct regulator_dev *rdev;
 
         ri = aat2870_get_regulator(pdev->id);
diff --git a/drivers/regulator/ab3100.c b/drivers/regulator/ab3100.c
index c151fd5d8c97..65ad2b36ce36 100644
--- a/drivers/regulator/ab3100.c
+++ b/drivers/regulator/ab3100.c
@@ -347,17 +347,11 @@ static int ab3100_get_voltage_regulator_external(struct regulator_dev *reg)
         return abreg->plfdata->external_voltage;
 }
 
-static int ab3100_get_fixed_voltage_regulator(struct regulator_dev *reg)
-{
-        return reg->desc->min_uV;
-}
-
 static struct regulator_ops regulator_ops_fixed = {
         .list_voltage = regulator_list_voltage_linear,
         .enable      = ab3100_enable_regulator,
         .disable     = ab3100_disable_regulator,
         .is_enabled  = ab3100_is_enabled_regulator,
-        .get_voltage = ab3100_get_fixed_voltage_regulator,
 };
 
 static struct regulator_ops regulator_ops_variable = {
diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c
index 10f2f4d4d190..e3d1d063025a 100644
--- a/drivers/regulator/ab8500.c
+++ b/drivers/regulator/ab8500.c
@@ -37,6 +37,7 @@
  * @voltage_bank: bank to control regulator voltage
  * @voltage_reg: register to control regulator voltage
  * @voltage_mask: mask to control regulator voltage
+ * @voltage_shift: shift to control regulator voltage
  * @delay: startup/set voltage delay in us
  */
 struct ab8500_regulator_info {
@@ -50,6 +51,7 @@ struct ab8500_regulator_info {
         u8 voltage_bank;
         u8 voltage_reg;
         u8 voltage_mask;
+        u8 voltage_shift;
         unsigned int delay;
 };
 
@@ -195,17 +197,14 @@ static int ab8500_regulator_get_voltage_sel(struct regulator_dev *rdev)
         }
 
         dev_vdbg(rdev_get_dev(rdev),
-                "%s-get_voltage (bank, reg, mask, value): 0x%x, 0x%x, 0x%x,"
-                " 0x%x\n",
-                info->desc.name, info->voltage_bank, info->voltage_reg,
-                info->voltage_mask, regval);
+                "%s-get_voltage (bank, reg, mask, shift, value): "
+                "0x%x, 0x%x, 0x%x, 0x%x, 0x%x\n",
+                info->desc.name, info->voltage_bank,
+                info->voltage_reg, info->voltage_mask,
+                info->voltage_shift, regval);
 
-        /* vintcore has a different layout */
         val = regval & info->voltage_mask;
-        if (info->desc.id == AB8500_LDO_INTCORE)
-                return val >> 0x3;
-        else
-                return val;
+        return val >> info->voltage_shift;
 }
 
 static int ab8500_regulator_set_voltage_sel(struct regulator_dev *rdev,
@@ -221,7 +220,7 @@ static int ab8500_regulator_set_voltage_sel(struct regulator_dev *rdev,
         }
 
         /* set the registers for the request */
-        regval = (u8)selector;
+        regval = (u8)selector << info->voltage_shift;
         ret = abx500_mask_and_set_register_interruptible(info->dev,
                         info->voltage_bank, info->voltage_reg,
                         info->voltage_mask, regval);
@@ -238,13 +237,6 @@ static int ab8500_regulator_set_voltage_sel(struct regulator_dev *rdev,
         return ret;
 }
 
-static int ab8500_regulator_enable_time(struct regulator_dev *rdev)
-{
-        struct ab8500_regulator_info *info = rdev_get_drvdata(rdev);
-
-        return info->delay;
-}
-
 static int ab8500_regulator_set_voltage_time_sel(struct regulator_dev *rdev,
                                              unsigned int old_sel,
                                              unsigned int new_sel)
@@ -261,22 +253,14 @@ static struct regulator_ops ab8500_regulator_ops = {
         .get_voltage_sel = ab8500_regulator_get_voltage_sel,
         .set_voltage_sel = ab8500_regulator_set_voltage_sel,
         .list_voltage   = regulator_list_voltage_table,
-        .enable_time    = ab8500_regulator_enable_time,
         .set_voltage_time_sel = ab8500_regulator_set_voltage_time_sel,
 };
 
-static int ab8500_fixed_get_voltage(struct regulator_dev *rdev)
-{
-        return rdev->desc->min_uV;
-}
-
 static struct regulator_ops ab8500_regulator_fixed_ops = {
         .enable         = ab8500_regulator_enable,
         .disable        = ab8500_regulator_disable,
         .is_enabled     = ab8500_regulator_is_enabled,
-        .get_voltage    = ab8500_fixed_get_voltage,
         .list_voltage   = regulator_list_voltage_linear,
-        .enable_time    = ab8500_regulator_enable_time,
 };
 
 static struct ab8500_regulator_info
@@ -358,6 +342,7 @@ static struct ab8500_regulator_info
                 .voltage_bank           = 0x03,
                 .voltage_reg            = 0x80,
                 .voltage_mask           = 0x38,
+                .voltage_shift          = 3,
         },
 
         /*
@@ -374,6 +359,7 @@ static struct ab8500_regulator_info
                         .owner          = THIS_MODULE,
                         .n_voltages     = 1,
                         .min_uV         = 2000000,
+                        .enable_time    = 10000,
                 },
                 .delay                  = 10000,
                 .update_bank            = 0x03,
diff --git a/drivers/regulator/arizona-ldo1.c b/drivers/regulator/arizona-ldo1.c
index c8f95c07adb6..d184aa35abcb 100644
--- a/drivers/regulator/arizona-ldo1.c
+++ b/drivers/regulator/arizona-ldo1.c
@@ -39,6 +39,8 @@ static struct regulator_ops arizona_ldo1_ops = {
         .map_voltage = regulator_map_voltage_linear,
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
         .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_bypass = regulator_get_bypass_regmap,
+        .set_bypass = regulator_set_bypass_regmap,
 };
 
 static const struct regulator_desc arizona_ldo1 = {
@@ -49,9 +51,11 @@ static const struct regulator_desc arizona_ldo1 = {
 
         .vsel_reg = ARIZONA_LDO1_CONTROL_1,
         .vsel_mask = ARIZONA_LDO1_VSEL_MASK,
+        .bypass_reg = ARIZONA_LDO1_CONTROL_1,
+        .bypass_mask = ARIZONA_LDO1_BYPASS,
         .min_uV = 900000,
         .uV_step = 50000,
-        .n_voltages = 7,
+        .n_voltages = 6,
 
         .owner = THIS_MODULE,
 };
diff --git a/drivers/regulator/arizona-micsupp.c b/drivers/regulator/arizona-micsupp.c
index 450a069aa9b6..d9b1f82cc5bd 100644
--- a/drivers/regulator/arizona-micsupp.c
+++ b/drivers/regulator/arizona-micsupp.c
@@ -82,6 +82,9 @@ static struct regulator_ops arizona_micsupp_ops = {
 
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
         .set_voltage_sel = regulator_set_voltage_sel_regmap,
+
+        .get_bypass = regulator_get_bypass_regmap,
+        .set_bypass = regulator_set_bypass_regmap,
 };
 
 static const struct regulator_desc arizona_micsupp = {
@@ -95,6 +98,8 @@ static const struct regulator_desc arizona_micsupp = {
         .vsel_mask = ARIZONA_LDO2_VSEL_MASK,
         .enable_reg = ARIZONA_MIC_CHARGE_PUMP_1,
         .enable_mask = ARIZONA_CPMIC_ENA,
+        .bypass_reg = ARIZONA_MIC_CHARGE_PUMP_1,
+        .bypass_mask = ARIZONA_CPMIC_BYPASS,
 
         .owner = THIS_MODULE,
 };
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 48385318175a..2e0352dc26bd 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -77,6 +77,7 @@ struct regulator {
         struct device *dev;
         struct list_head list;
         unsigned int always_on:1;
+        unsigned int bypass:1;
         int uA_load;
         int min_uV;
         int max_uV;
@@ -394,6 +395,9 @@ static ssize_t regulator_status_show(struct device *dev,
         case REGULATOR_STATUS_STANDBY:
                 label = "standby";
                 break;
+        case REGULATOR_STATUS_BYPASS:
+                label = "bypass";
+                break;
         case REGULATOR_STATUS_UNDEFINED:
                 label = "undefined";
                 break;
@@ -585,6 +589,27 @@ static ssize_t regulator_suspend_standby_state_show(struct device *dev,
 static DEVICE_ATTR(suspend_standby_state, 0444,
                 regulator_suspend_standby_state_show, NULL);
 
+static ssize_t regulator_bypass_show(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        struct regulator_dev *rdev = dev_get_drvdata(dev);
+        const char *report;
+        bool bypass;
+        int ret;
+
+        ret = rdev->desc->ops->get_bypass(rdev, &bypass);
+
+        if (ret != 0)
+                report = "unknown";
+        else if (bypass)
+                report = "enabled";
+        else
+                report = "disabled";
+
+        return sprintf(buf, "%s\n", report);
+}
+static DEVICE_ATTR(bypass, 0444,
+                   regulator_bypass_show, NULL);
 
 /*
  * These are the only attributes are present for all regulators.
@@ -778,6 +803,9 @@ static void print_constraints(struct regulator_dev *rdev)
         if (constraints->valid_modes_mask & REGULATOR_MODE_STANDBY)
                 count += sprintf(buf + count, "standby");
 
+        if (!count)
+                sprintf(buf, "no parameters");
+
         rdev_info(rdev, "%s\n", buf);
 
         if ((constraints->min_uV != constraints->max_uV) &&
@@ -974,6 +1002,7 @@ static int set_supply(struct regulator_dev *rdev,
                 err = -ENOMEM;
                 return err;
         }
+        supply_rdev->open_count++;
 
         return 0;
 }
@@ -1720,6 +1749,9 @@ int regulator_disable_deferred(struct regulator *regulator, int ms)
         if (regulator->always_on)
                 return 0;
 
+        if (!ms)
+                return regulator_disable(regulator);
+
         mutex_lock(&rdev->mutex);
         rdev->deferred_disables++;
         mutex_unlock(&rdev->mutex);
@@ -2178,9 +2210,12 @@ static int _regulator_do_set_voltage(struct regulator_dev *rdev,
                 }
         }
 
-        if (ret == 0 && best_val >= 0)
+        if (ret == 0 && best_val >= 0) {
+                unsigned long data = best_val;
+
                 _notifier_call_chain(rdev, REGULATOR_EVENT_VOLTAGE_CHANGE,
-                                     (void *)best_val);
+                                     (void *)data);
+        }
 
         trace_regulator_set_voltage_complete(rdev_get_name(rdev), best_val);
 
@@ -2291,8 +2326,8 @@ int regulator_set_voltage_time(struct regulator *regulator,
 EXPORT_SYMBOL_GPL(regulator_set_voltage_time);
 
 /**
- *regulator_set_voltage_time_sel - get raise/fall time
- * @regulator: regulator source
+ * regulator_set_voltage_time_sel - get raise/fall time
+ * @rdev: regulator source device
  * @old_selector: selector for starting voltage
  * @new_selector: selector for target voltage
  *
@@ -2388,6 +2423,8 @@ static int _regulator_get_voltage(struct regulator_dev *rdev)
                 ret = rdev->desc->ops->list_voltage(rdev, sel);
         } else if (rdev->desc->ops->get_voltage) {
                 ret = rdev->desc->ops->get_voltage(rdev);
+        } else if (rdev->desc->ops->list_voltage) {
+                ret = rdev->desc->ops->list_voltage(rdev, 0);
         } else {
                 return -EINVAL;
         }
@@ -2674,6 +2711,100 @@ out:
 EXPORT_SYMBOL_GPL(regulator_set_optimum_mode);
 
 /**
+ * regulator_set_bypass_regmap - Default set_bypass() using regmap
+ *
+ * @rdev: device to operate on.
+ * @enable: state to set.
+ */
+int regulator_set_bypass_regmap(struct regulator_dev *rdev, bool enable)
+{
+        unsigned int val;
+
+        if (enable)
+                val = rdev->desc->bypass_mask;
+        else
+                val = 0;
+
+        return regmap_update_bits(rdev->regmap, rdev->desc->bypass_reg,
+                                  rdev->desc->bypass_mask, val);
+}
+EXPORT_SYMBOL_GPL(regulator_set_bypass_regmap);
+
+/**
+ * regulator_get_bypass_regmap - Default get_bypass() using regmap
+ *
+ * @rdev: device to operate on.
+ * @enable: current state.
+ */
+int regulator_get_bypass_regmap(struct regulator_dev *rdev, bool *enable)
+{
+        unsigned int val;
+        int ret;
+
+        ret = regmap_read(rdev->regmap, rdev->desc->bypass_reg, &val);
+        if (ret != 0)
+                return ret;
+
+        *enable = val & rdev->desc->bypass_mask;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(regulator_get_bypass_regmap);
+
+/**
+ * regulator_allow_bypass - allow the regulator to go into bypass mode
+ *
+ * @regulator: Regulator to configure
+ * @allow: enable or disable bypass mode
+ *
+ * Allow the regulator to go into bypass mode if all other consumers
+ * for the regulator also enable bypass mode and the machine
+ * constraints allow this.  Bypass mode means that the regulator is
+ * simply passing the input directly to the output with no regulation.
+ */
+int regulator_allow_bypass(struct regulator *regulator, bool enable)
+{
+        struct regulator_dev *rdev = regulator->rdev;
+        int ret = 0;
+
+        if (!rdev->desc->ops->set_bypass)
+                return 0;
+
+        if (rdev->constraints &&
+            !(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_BYPASS))
+                return 0;
+
+        mutex_lock(&rdev->mutex);
+
+        if (enable && !regulator->bypass) {
+                rdev->bypass_count++;
+
+                if (rdev->bypass_count == rdev->open_count) {
+                        ret = rdev->desc->ops->set_bypass(rdev, enable);
+                        if (ret != 0)
+                                rdev->bypass_count--;
+                }
+
+        } else if (!enable && regulator->bypass) {
+                rdev->bypass_count--;
+
+                if (rdev->bypass_count != rdev->open_count) {
+                        ret = rdev->desc->ops->set_bypass(rdev, enable);
+                        if (ret != 0)
+                                rdev->bypass_count++;
+                }
+        }
+
+        if (ret == 0)
+                regulator->bypass = enable;
+
+        mutex_unlock(&rdev->mutex);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(regulator_allow_bypass);
+
+/**
  * regulator_register_notifier - register regulator event notifier
  * @regulator: regulator source
  * @nb: notifier block
@@ -3011,7 +3142,8 @@ static int add_regulator_attributes(struct regulator_dev *rdev)
 
         /* some attributes need specific methods to be displayed */
         if ((ops->get_voltage && ops->get_voltage(rdev) >= 0) ||
-            (ops->get_voltage_sel && ops->get_voltage_sel(rdev) >= 0)) {
+            (ops->get_voltage_sel && ops->get_voltage_sel(rdev) >= 0) ||
+            (ops->list_voltage && ops->list_voltage(rdev, 0) >= 0)) {
                 status = device_create_file(dev, &dev_attr_microvolts);
                 if (status < 0)
                         return status;
@@ -3036,6 +3168,11 @@ static int add_regulator_attributes(struct regulator_dev *rdev)
                 if (status < 0)
                         return status;
         }
+        if (ops->get_bypass) {
+                status = device_create_file(dev, &dev_attr_bypass);
+                if (status < 0)
+                        return status;
+        }
 
         /* some attributes are type-specific */
         if (rdev->desc->type == REGULATOR_CURRENT) {
@@ -3124,6 +3261,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
                            &rdev->use_count);
         debugfs_create_u32("open_count", 0444, rdev->debugfs,
                            &rdev->open_count);
+        debugfs_create_u32("bypass_count", 0444, rdev->debugfs,
+                           &rdev->bypass_count);
 }
 
 /**
@@ -3189,8 +3328,10 @@ regulator_register(const struct regulator_desc *regulator_desc,
         rdev->desc = regulator_desc;
         if (config->regmap)
                 rdev->regmap = config->regmap;
-        else
+        else if (dev_get_regmap(dev, NULL))
                 rdev->regmap = dev_get_regmap(dev, NULL);
+        else if (dev->parent)
+                rdev->regmap = dev_get_regmap(dev->parent, NULL);
         INIT_LIST_HEAD(&rdev->consumer_list);
         INIT_LIST_HEAD(&rdev->list);
         BLOCKING_INIT_NOTIFIER_HEAD(&rdev->notifier);
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 903299cf15cf..27355b1199e5 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -133,8 +133,8 @@ static int da9052_dcdc_set_current_limit(struct regulator_dev *rdev, int min_uA,
             max_uA < da9052_current_limits[row][DA9052_MIN_UA])
                 return -EINVAL;
 
-        for (i = 0; i < DA9052_CURRENT_RANGE; i++) {
-                if (min_uA <= da9052_current_limits[row][i]) {
+        for (i = DA9052_CURRENT_RANGE - 1; i >= 0; i--) {
+                if (da9052_current_limits[row][i] <= max_uA) {
                         reg_val = i;
                         break;
                 }
diff --git a/drivers/regulator/dummy.c b/drivers/regulator/dummy.c
index 86f655c7f7a1..03a1d7c11ef2 100644
--- a/drivers/regulator/dummy.c
+++ b/drivers/regulator/dummy.c
@@ -30,7 +30,7 @@ static struct regulator_init_data dummy_initdata;
 static struct regulator_ops dummy_ops;
 
 static struct regulator_desc dummy_desc = {
-        .name = "dummy",
+        .name = "regulator-dummy",
         .id = -1,
         .type = REGULATOR_VOLTAGE,
         .owner = THIS_MODULE,
diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c
new file mode 100644
index 000000000000..339f4d732e97
--- /dev/null
+++ b/drivers/regulator/fan53555.c
@@ -0,0 +1,322 @@
+/*
+ * FAN53555 Fairchild Digitally Programmable TinyBuck Regulator Driver.
+ *
+ * Supported Part Numbers:
+ * FAN53555UC00X/01X/03X/04X/05X
+ *
+ * Copyright (c) 2012 Marvell Technology Ltd.
+ * Yunfan Zhang <yfzhang@marvell.com>
+ *
+ * This package is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/module.h>
+#include <linux/param.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/regmap.h>
+#include <linux/regulator/fan53555.h>
+
+/* Voltage setting */
+#define FAN53555_VSEL0          0x00
+#define FAN53555_VSEL1          0x01
+/* Control register */
+#define FAN53555_CONTROL        0x02
+/* IC Type */
+#define FAN53555_ID1            0x03
+/* IC mask version */
+#define FAN53555_ID2            0x04
+/* Monitor register */
+#define FAN53555_MONITOR        0x05
+
+/* VSEL bit definitions */
+#define VSEL_BUCK_EN    (1 << 7)
+#define VSEL_MODE               (1 << 6)
+#define VSEL_NSEL_MASK  0x3F
+/* Chip ID and Verison */
+#define DIE_ID          0x0F    /* ID1 */
+#define DIE_REV         0x0F    /* ID2 */
+/* Control bit definitions */
+#define CTL_OUTPUT_DISCHG       (1 << 7)
+#define CTL_SLEW_MASK           (0x7 << 4)
+#define CTL_SLEW_SHIFT          4
+#define CTL_RESET                       (1 << 2)
+
+#define FAN53555_NVOLTAGES      64      /* Numbers of voltages */
+
+/* IC Type */
+enum {
+        FAN53555_CHIP_ID_00 = 0,
+        FAN53555_CHIP_ID_01,
+        FAN53555_CHIP_ID_02,
+        FAN53555_CHIP_ID_03,
+        FAN53555_CHIP_ID_04,
+        FAN53555_CHIP_ID_05,
+};
+
+struct fan53555_device_info {
+        struct regmap *regmap;
+        struct device *dev;
+        struct regulator_desc desc;
+        struct regulator_dev *rdev;
+        struct regulator_init_data *regulator;
+        /* IC Type and Rev */
+        int chip_id;
+        int chip_rev;
+        /* Voltage setting register */
+        unsigned int vol_reg;
+        unsigned int sleep_reg;
+        /* Voltage range and step(linear) */
+        unsigned int vsel_min;
+        unsigned int vsel_step;
+        /* Voltage slew rate limiting */
+        unsigned int slew_rate;
+        /* Sleep voltage cache */
+        unsigned int sleep_vol_cache;
+};
+
+static int fan53555_set_suspend_voltage(struct regulator_dev *rdev, int uV)
+{
+        struct fan53555_device_info *di = rdev_get_drvdata(rdev);
+        int ret;
+
+        if (di->sleep_vol_cache == uV)
+                return 0;
+        ret = regulator_map_voltage_linear(rdev, uV, uV);
+        if (ret < 0)
+                return -EINVAL;
+        ret = regmap_update_bits(di->regmap, di->sleep_reg,
+                                        VSEL_NSEL_MASK, ret);
+        if (ret < 0)
+                return -EINVAL;
+        /* Cache the sleep voltage setting.
+         * Might not be the real voltage which is rounded */
+        di->sleep_vol_cache = uV;
+
+        return 0;
+}
+
+static int fan53555_set_mode(struct regulator_dev *rdev, unsigned int mode)
+{
+        struct fan53555_device_info *di = rdev_get_drvdata(rdev);
+
+        switch (mode) {
+        case REGULATOR_MODE_FAST:
+                regmap_update_bits(di->regmap, di->vol_reg,
+                                VSEL_MODE, VSEL_MODE);
+                break;
+        case REGULATOR_MODE_NORMAL:
+                regmap_update_bits(di->regmap, di->vol_reg, VSEL_MODE, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static unsigned int fan53555_get_mode(struct regulator_dev *rdev)
+{
+        struct fan53555_device_info *di = rdev_get_drvdata(rdev);
+        unsigned int val;
+        int ret = 0;
+
+        ret = regmap_read(di->regmap, di->vol_reg, &val);
+        if (ret < 0)
+                return ret;
+        if (val & VSEL_MODE)
+                return REGULATOR_MODE_FAST;
+        else
+                return REGULATOR_MODE_NORMAL;
+}
+
+static struct regulator_ops fan53555_regulator_ops = {
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+        .map_voltage = regulator_map_voltage_linear,
+        .list_voltage = regulator_list_voltage_linear,
+        .set_suspend_voltage = fan53555_set_suspend_voltage,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+        .set_mode = fan53555_set_mode,
+        .get_mode = fan53555_get_mode,
+};
+
+/* For 00,01,03,05 options:
+ * VOUT = 0.60V + NSELx * 10mV, from 0.60 to 1.23V.
+ * For 04 option:
+ * VOUT = 0.603V + NSELx * 12.826mV, from 0.603 to 1.411V.
+ * */
+static int fan53555_device_setup(struct fan53555_device_info *di,
+                                struct fan53555_platform_data *pdata)
+{
+        unsigned int reg, data, mask;
+
+        /* Setup voltage control register */
+        switch (pdata->sleep_vsel_id) {
+        case FAN53555_VSEL_ID_0:
+                di->sleep_reg = FAN53555_VSEL0;
+                di->vol_reg = FAN53555_VSEL1;
+                break;
+        case FAN53555_VSEL_ID_1:
+                di->sleep_reg = FAN53555_VSEL1;
+                di->vol_reg = FAN53555_VSEL0;
+                break;
+        default:
+                dev_err(di->dev, "Invalid VSEL ID!\n");
+                return -EINVAL;
+        }
+        /* Init voltage range and step */
+        switch (di->chip_id) {
+        case FAN53555_CHIP_ID_00:
+        case FAN53555_CHIP_ID_01:
+        case FAN53555_CHIP_ID_03:
+        case FAN53555_CHIP_ID_05:
+                di->vsel_min = 600000;
+                di->vsel_step = 10000;
+                break;
+        case FAN53555_CHIP_ID_04:
+                di->vsel_min = 603000;
+                di->vsel_step = 12826;
+                break;
+        default:
+                dev_err(di->dev,
+                        "Chip ID[%d]\n not supported!\n", di->chip_id);
+                return -EINVAL;
+        }
+        /* Init slew rate */
+        if (pdata->slew_rate & 0x7)
+                di->slew_rate = pdata->slew_rate;
+        else
+                di->slew_rate = FAN53555_SLEW_RATE_64MV;
+        reg = FAN53555_CONTROL;
+        data = di->slew_rate << CTL_SLEW_SHIFT;
+        mask = CTL_SLEW_MASK;
+        return regmap_update_bits(di->regmap, reg, mask, data);
+}
+
+static int fan53555_regulator_register(struct fan53555_device_info *di,
+                        struct regulator_config *config)
+{
+        struct regulator_desc *rdesc = &di->desc;
+
+        rdesc->name = "fan53555-reg";
+        rdesc->ops = &fan53555_regulator_ops;
+        rdesc->type = REGULATOR_VOLTAGE;
+        rdesc->n_voltages = FAN53555_NVOLTAGES;
+        rdesc->enable_reg = di->vol_reg;
+        rdesc->enable_mask = VSEL_BUCK_EN;
+        rdesc->min_uV = di->vsel_min;
+        rdesc->uV_step = di->vsel_step;
+        rdesc->vsel_reg = di->vol_reg;
+        rdesc->vsel_mask = VSEL_NSEL_MASK;
+        rdesc->owner = THIS_MODULE;
+
+        di->rdev = regulator_register(&di->desc, config);
+        if (IS_ERR(di->rdev))
+                return PTR_ERR(di->rdev);
+        return 0;
+
+}
+
+static struct regmap_config fan53555_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+};
+
+static int __devinit fan53555_regulator_probe(struct i2c_client *client,
+                                const struct i2c_device_id *id)
+{
+        struct fan53555_device_info *di;
+        struct fan53555_platform_data *pdata;
+        struct regulator_config config = { };
+        unsigned int val;
+        int ret;
+
+        pdata = client->dev.platform_data;
+        if (!pdata || !pdata->regulator) {
+                dev_err(&client->dev, "Platform data not found!\n");
+                return -ENODEV;
+        }
+
+        di = devm_kzalloc(&client->dev, sizeof(struct fan53555_device_info),
+                                        GFP_KERNEL);
+        if (!di) {
+                dev_err(&client->dev, "Failed to allocate device info data!\n");
+                return -ENOMEM;
+        }
+        di->regmap = devm_regmap_init_i2c(client, &fan53555_regmap_config);
+        if (IS_ERR(di->regmap)) {
+                dev_err(&client->dev, "Failed to allocate regmap!\n");
+                return PTR_ERR(di->regmap);
+        }
+        di->dev = &client->dev;
+        di->regulator = pdata->regulator;
+        i2c_set_clientdata(client, di);
+        /* Get chip ID */
+        ret = regmap_read(di->regmap, FAN53555_ID1, &val);
+        if (ret < 0) {
+                dev_err(&client->dev, "Failed to get chip ID!\n");
+                return -ENODEV;
+        }
+        di->chip_id = val & DIE_ID;
+        /* Get chip revision */
+        ret = regmap_read(di->regmap, FAN53555_ID2, &val);
+        if (ret < 0) {
+                dev_err(&client->dev, "Failed to get chip Rev!\n");
+                return -ENODEV;
+        }
+        di->chip_rev = val & DIE_REV;
+        dev_info(&client->dev, "FAN53555 Option[%d] Rev[%d] Detected!\n",
+                                di->chip_id, di->chip_rev);
+        /* Device init */
+        ret = fan53555_device_setup(di, pdata);
+        if (ret < 0) {
+                dev_err(&client->dev, "Failed to setup device!\n");
+                return ret;
+        }
+        /* Register regulator */
+        config.dev = di->dev;
+        config.init_data = di->regulator;
+        config.regmap = di->regmap;
+        config.driver_data = di;
+        ret = fan53555_regulator_register(di, &config);
+        if (ret < 0)
+                dev_err(&client->dev, "Failed to register regulator!\n");
+        return ret;
+
+}
+
+static int __devexit fan53555_regulator_remove(struct i2c_client *client)
+{
+        struct fan53555_device_info *di = i2c_get_clientdata(client);
+
+        regulator_unregister(di->rdev);
+        return 0;
+}
+
+static const struct i2c_device_id fan53555_id[] = {
+        {"fan53555", -1},
+        { },
+};
+
+static struct i2c_driver fan53555_regulator_driver = {
+        .driver = {
+                .name = "fan53555-regulator",
+        },
+        .probe = fan53555_regulator_probe,
+        .remove = __devexit_p(fan53555_regulator_remove),
+        .id_table = fan53555_id,
+};
+
+module_i2c_driver(fan53555_regulator_driver);
+
+MODULE_AUTHOR("Yunfan Zhang <yfzhang@marvell.com>");
+MODULE_DESCRIPTION("FAN53555 regulator driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index 1d145a07ada9..d8ecf49a5777 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -73,13 +73,7 @@ static struct regulator_ops isl_core_ops = {
         .map_voltage    = regulator_map_voltage_linear,
 };
 
-static int isl6271a_get_fixed_voltage(struct regulator_dev *dev)
-{
-        return dev->desc->min_uV;
-}
-
 static struct regulator_ops isl_fixed_ops = {
-        .get_voltage    = isl6271a_get_fixed_voltage,
         .list_voltage   = regulator_list_voltage_linear,
 };
 
diff --git a/drivers/regulator/lp872x.c b/drivers/regulator/lp872x.c
index 212c38eaba70..708f4b6a17dc 100644
--- a/drivers/regulator/lp872x.c
+++ b/drivers/regulator/lp872x.c
@@ -86,6 +86,10 @@
 #define EXTERN_DVS_USED                 0
 #define MAX_DELAY                       6
 
+/* Default DVS Mode */
+#define LP8720_DEFAULT_DVS              0
+#define LP8725_DEFAULT_DVS              BIT(2)
+
 /* dump registers in regmap-debugfs */
 #define MAX_REGISTERS                   0x0F
 
@@ -269,9 +273,9 @@ static int lp872x_regulator_enable_time(struct regulator_dev *rdev)
         return val > MAX_DELAY ? 0 : val * time_step_us;
 }
 
-static void lp872x_set_dvs(struct lp872x *lp, int gpio)
+static void lp872x_set_dvs(struct lp872x *lp, enum lp872x_dvs_sel dvs_sel,
+                        int gpio)
 {
-        enum lp872x_dvs_sel dvs_sel = lp->pdata->dvs->vsel;
         enum lp872x_dvs_state state;
 
         state = dvs_sel == SEL_V1 ? DVS_HIGH : DVS_LOW;
@@ -339,10 +343,10 @@ static int lp872x_buck_set_voltage_sel(struct regulator_dev *rdev,
         struct lp872x *lp = rdev_get_drvdata(rdev);
         enum lp872x_regulator_id buck = rdev_get_id(rdev);
         u8 addr, mask = LP872X_VOUT_M;
-        struct lp872x_dvs *dvs = lp->pdata->dvs;
+        struct lp872x_dvs *dvs = lp->pdata ? lp->pdata->dvs : NULL;
 
         if (dvs && gpio_is_valid(dvs->gpio))
-                lp872x_set_dvs(lp, dvs->gpio);
+                lp872x_set_dvs(lp, dvs->vsel, dvs->gpio);
 
         addr = lp872x_select_buck_vout_addr(lp, buck);
         if (!lp872x_is_valid_buck_addr(addr))
@@ -374,8 +378,8 @@ static int lp8725_buck_set_current_limit(struct regulator_dev *rdev,
 {
         struct lp872x *lp = rdev_get_drvdata(rdev);
         enum lp872x_regulator_id buck = rdev_get_id(rdev);
-        int i, max = ARRAY_SIZE(lp8725_buck_uA);
-        u8 addr, val;
+        int i;
+        u8 addr;
 
         switch (buck) {
         case LP8725_ID_BUCK1:
@@ -388,17 +392,15 @@ static int lp8725_buck_set_current_limit(struct regulator_dev *rdev,
                 return -EINVAL;
         }
 
-        for (i = 0 ; i < max ; i++)
+        for (i = ARRAY_SIZE(lp8725_buck_uA) - 1 ; i >= 0; i--) {
                 if (lp8725_buck_uA[i] >= min_uA &&
                         lp8725_buck_uA[i] <= max_uA)
-                        break;
-
-        if (i == max)
-                return -EINVAL;
-
-        val = i << LP8725_BUCK_CL_S;
+                        return lp872x_update_bits(lp, addr,
+                                                  LP8725_BUCK_CL_M,
+                                                  i << LP8725_BUCK_CL_S);
+        }
 
-        return lp872x_update_bits(lp, addr, LP8725_BUCK_CL_M, val);
+        return -EINVAL;
 }
 
 static int lp8725_buck_get_current_limit(struct regulator_dev *rdev)
@@ -727,39 +729,16 @@ static struct regulator_desc lp8725_regulator_desc[] = {
         },
 };
 
-static int lp872x_check_dvs_validity(struct lp872x *lp)
-{
-        struct lp872x_dvs *dvs = lp->pdata->dvs;
-        u8 val = 0;
-        int ret;
-
-        ret = lp872x_read_byte(lp, LP872X_GENERAL_CFG, &val);
-        if (ret)
-                return ret;
-
-        ret = 0;
-        if (lp->chipid == LP8720) {
-                if (val & LP8720_EXT_DVS_M)
-                        ret = dvs ? 0 : -EINVAL;
-        } else {
-                if ((val & LP8725_DVS1_M) == EXTERN_DVS_USED)
-                        ret = dvs ? 0 : -EINVAL;
-        }
-
-        return ret;
-}
-
 static int lp872x_init_dvs(struct lp872x *lp)
 {
         int ret, gpio;
-        struct lp872x_dvs *dvs = lp->pdata->dvs;
+        struct lp872x_dvs *dvs = lp->pdata ? lp->pdata->dvs : NULL;
         enum lp872x_dvs_state pinstate;
+        u8 mask[] = { LP8720_EXT_DVS_M, LP8725_DVS1_M | LP8725_DVS2_M };
+        u8 default_dvs_mode[] = { LP8720_DEFAULT_DVS, LP8725_DEFAULT_DVS };
 
-        ret = lp872x_check_dvs_validity(lp);
-        if (ret) {
-                dev_warn(lp->dev, "invalid dvs data: %d\n", ret);
-                return ret;
-        }
+        if (!dvs)
+                goto set_default_dvs_mode;
 
         gpio = dvs->gpio;
         if (!gpio_is_valid(gpio)) {
@@ -778,6 +757,10 @@ static int lp872x_init_dvs(struct lp872x *lp)
         lp->dvs_gpio = gpio;
 
         return 0;
+
+set_default_dvs_mode:
+        return lp872x_update_bits(lp, LP872X_GENERAL_CFG, mask[lp->chipid],
+                                default_dvs_mode[lp->chipid]);
 }
 
 static int lp872x_config(struct lp872x *lp)
@@ -785,24 +768,29 @@ static int lp872x_config(struct lp872x *lp)
         struct lp872x_platform_data *pdata = lp->pdata;
         int ret;
 
-        if (!pdata->update_config)
-                return 0;
+        if (!pdata || !pdata->update_config)
+                goto init_dvs;
 
         ret = lp872x_write_byte(lp, LP872X_GENERAL_CFG, pdata->general_config);
         if (ret)
                 return ret;
 
+init_dvs:
         return lp872x_init_dvs(lp);
 }
 
 static struct regulator_init_data
 *lp872x_find_regulator_init_data(int id, struct lp872x *lp)
 {
+        struct lp872x_platform_data *pdata = lp->pdata;
         int i;
 
+        if (!pdata)
+                return NULL;
+
         for (i = 0; i < lp->num_regulators; i++) {
-                if (lp->pdata->regulator_data[i].id == id)
-                        return lp->pdata->regulator_data[i].init_data;
+                if (pdata->regulator_data[i].id == id)
+                        return pdata->regulator_data[i].init_data;
         }
 
         return NULL;
@@ -863,18 +851,12 @@ static const struct regmap_config lp872x_regmap_config = {
 static int lp872x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
 {
         struct lp872x *lp;
-        struct lp872x_platform_data *pdata = cl->dev.platform_data;
         int ret, size, num_regulators;
         const int lp872x_num_regulators[] = {
                 [LP8720] = LP8720_NUM_REGULATORS,
                 [LP8725] = LP8725_NUM_REGULATORS,
         };
 
-        if (!pdata) {
-                dev_err(&cl->dev, "no platform data\n");
-                return -EINVAL;
-        }
-
         lp = devm_kzalloc(&cl->dev, sizeof(struct lp872x), GFP_KERNEL);
         if (!lp)
                 goto err_mem;
@@ -894,7 +876,7 @@ static int lp872x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
         }
 
         lp->dev = &cl->dev;
-        lp->pdata = pdata;
+        lp->pdata = cl->dev.platform_data;
         lp->chipid = id->driver_data;
         lp->num_regulators = num_regulators;
         i2c_set_clientdata(cl, lp);
diff --git a/drivers/regulator/lp8788-buck.c b/drivers/regulator/lp8788-buck.c
index 6356e821400f..ba3e0aa402de 100644
--- a/drivers/regulator/lp8788-buck.c
+++ b/drivers/regulator/lp8788-buck.c
@@ -69,6 +69,9 @@
 #define PIN_HIGH                        1
 #define ENABLE_TIME_USEC                32
 
+#define BUCK_FPWM_MASK(x)               (1 << (x))
+#define BUCK_FPWM_SHIFT(x)              (x)
+
 enum lp8788_dvs_state {
         DVS_LOW  = GPIOF_OUT_INIT_LOW,
         DVS_HIGH = GPIOF_OUT_INIT_HIGH,
@@ -86,15 +89,9 @@ enum lp8788_buck_id {
         BUCK4,
 };
 
-struct lp8788_pwm_map {
-        u8 mask;
-        u8 shift;
-};
-
 struct lp8788_buck {
         struct lp8788 *lp;
         struct regulator_dev *regulator;
-        struct lp8788_pwm_map *pmap;
         void *dvs;
 };
 
@@ -106,29 +103,6 @@ static const int lp8788_buck_vtbl[] = {
         1950000, 2000000,
 };
 
-/* buck pwm mode selection : used for set/get_mode in regulator ops
- * @forced pwm : fast mode
- * @auto pwm   : normal mode
- */
-static struct lp8788_pwm_map buck_pmap[] = {
-        [BUCK1] = {
-                .mask = LP8788_FPWM_BUCK1_M,
-                .shift = LP8788_FPWM_BUCK1_S,
-        },
-        [BUCK2] = {
-                .mask = LP8788_FPWM_BUCK2_M,
-                .shift = LP8788_FPWM_BUCK2_S,
-        },
-        [BUCK3] = {
-                .mask = LP8788_FPWM_BUCK3_M,
-                .shift = LP8788_FPWM_BUCK3_S,
-        },
-        [BUCK4] = {
-                .mask = LP8788_FPWM_BUCK4_M,
-                .shift = LP8788_FPWM_BUCK4_S,
-        },
-};
-
 static const u8 buck1_vout_addr[] = {
         LP8788_BUCK1_VOUT0, LP8788_BUCK1_VOUT1,
         LP8788_BUCK1_VOUT2, LP8788_BUCK1_VOUT3,
@@ -347,41 +321,37 @@ static int lp8788_buck_enable_time(struct regulator_dev *rdev)
 static int lp8788_buck_set_mode(struct regulator_dev *rdev, unsigned int mode)
 {
         struct lp8788_buck *buck = rdev_get_drvdata(rdev);
-        struct lp8788_pwm_map *pmap = buck->pmap;
-        u8 val;
-
-        if (!pmap)
-                return -EINVAL;
+        enum lp8788_buck_id id = rdev_get_id(rdev);
+        u8 mask, val;
 
+        mask = BUCK_FPWM_MASK(id);
         switch (mode) {
         case REGULATOR_MODE_FAST:
-                val = LP8788_FORCE_PWM << pmap->shift;
+                val = LP8788_FORCE_PWM << BUCK_FPWM_SHIFT(id);
                 break;
         case REGULATOR_MODE_NORMAL:
-                val = LP8788_AUTO_PWM << pmap->shift;
+                val = LP8788_AUTO_PWM << BUCK_FPWM_SHIFT(id);
                 break;
         default:
                 return -EINVAL;
         }
 
-        return lp8788_update_bits(buck->lp, LP8788_BUCK_PWM, pmap->mask, val);
+        return lp8788_update_bits(buck->lp, LP8788_BUCK_PWM, mask, val);
 }
 
 static unsigned int lp8788_buck_get_mode(struct regulator_dev *rdev)
 {
         struct lp8788_buck *buck = rdev_get_drvdata(rdev);
-        struct lp8788_pwm_map *pmap = buck->pmap;
+        enum lp8788_buck_id id = rdev_get_id(rdev);
         u8 val;
         int ret;
 
-        if (!pmap)
-                return -EINVAL;
-
         ret = lp8788_read_byte(buck->lp, LP8788_BUCK_PWM, &val);
         if (ret)
                 return ret;
 
-        return val & pmap->mask ? REGULATOR_MODE_FAST : REGULATOR_MODE_NORMAL;
+        return val & BUCK_FPWM_MASK(id) ?
+                                REGULATOR_MODE_FAST : REGULATOR_MODE_NORMAL;
 }
 
 static struct regulator_ops lp8788_buck12_ops = {
@@ -459,27 +429,6 @@ static struct regulator_desc lp8788_buck_desc[] = {
         },
 };
 
-static int lp8788_set_default_dvs_ctrl_mode(struct lp8788 *lp,
-                                        enum lp8788_buck_id id)
-{
-        u8 mask, val;
-
-        switch (id) {
-        case BUCK1:
-                mask = LP8788_BUCK1_DVS_SEL_M;
-                val  = LP8788_BUCK1_DVS_I2C;
-                break;
-        case BUCK2:
-                mask = LP8788_BUCK2_DVS_SEL_M;
-                val  = LP8788_BUCK2_DVS_I2C;
-                break;
-        default:
-                return 0;
-        }
-
-        return lp8788_update_bits(lp, LP8788_BUCK_DVS_SEL, mask, val);
-}
-
 static int _gpio_request(struct lp8788_buck *buck, int gpio, char *name)
 {
         struct device *dev = buck->lp->dev;
@@ -530,6 +479,7 @@ static int lp8788_init_dvs(struct lp8788_buck *buck, enum lp8788_buck_id id)
         struct lp8788_platform_data *pdata = buck->lp->pdata;
         u8 mask[] = { LP8788_BUCK1_DVS_SEL_M, LP8788_BUCK2_DVS_SEL_M };
         u8 val[]  = { LP8788_BUCK1_DVS_PIN, LP8788_BUCK2_DVS_PIN };
+        u8 default_dvs_mode[] = { LP8788_BUCK1_DVS_I2C, LP8788_BUCK2_DVS_I2C };
 
         /* no dvs for buck3, 4 */
         if (id == BUCK3 || id == BUCK4)
@@ -550,7 +500,8 @@ static int lp8788_init_dvs(struct lp8788_buck *buck, enum lp8788_buck_id id)
                                 val[id]);
 
 set_default_dvs_mode:
-        return lp8788_set_default_dvs_ctrl_mode(buck->lp, id);
+        return lp8788_update_bits(buck->lp, LP8788_BUCK_DVS_SEL, mask[id],
+                                  default_dvs_mode[id]);
 }
 
 static __devinit int lp8788_buck_probe(struct platform_device *pdev)
@@ -567,7 +518,6 @@ static __devinit int lp8788_buck_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         buck->lp = lp;
-        buck->pmap = &buck_pmap[id];
 
         ret = lp8788_init_dvs(buck, id);
         if (ret)
diff --git a/drivers/regulator/lp8788-ldo.c b/drivers/regulator/lp8788-ldo.c
index d2122e41a96d..6796eeb47dc6 100644
--- a/drivers/regulator/lp8788-ldo.c
+++ b/drivers/regulator/lp8788-ldo.c
@@ -496,6 +496,7 @@ static struct regulator_desc lp8788_dldo_desc[] = {
                 .name = "dldo12",
                 .id = DLDO12,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -521,6 +522,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo2",
                 .id = ALDO2,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -530,6 +532,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo3",
                 .id = ALDO3,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -539,6 +542,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo4",
                 .id = ALDO4,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -548,6 +552,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo5",
                 .id = ALDO5,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
@@ -583,6 +588,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo8",
                 .id = ALDO8,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
@@ -592,6 +598,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo9",
                 .id = ALDO9,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
@@ -601,6 +608,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo10",
                 .id = ALDO10,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index c564af6f05a3..2a67d08658ad 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -66,7 +66,7 @@ enum max77686_ramp_rate {
 };
 
 struct max77686_data {
-        struct regulator_dev **rdev;
+        struct regulator_dev *rdev[MAX77686_REGULATORS];
 };
 
 static int max77686_set_ramp_delay(struct regulator_dev *rdev, int ramp_delay)
@@ -265,6 +265,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
                 rmatch.of_node = NULL;
                 of_regulator_match(iodev->dev, regulators_np, &rmatch, 1);
                 rdata[i].initdata = rmatch.init_data;
+                rdata[i].of_node = rmatch.of_node;
         }
 
         pdata->regulators = rdata;
@@ -283,10 +284,8 @@ static __devinit int max77686_pmic_probe(struct platform_device *pdev)
 {
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct max77686_platform_data *pdata = dev_get_platdata(iodev->dev);
-        struct regulator_dev **rdev;
         struct max77686_data *max77686;
-        int i,  size;
-        int ret = 0;
+        int i, ret = 0;
         struct regulator_config config = { };
 
         dev_dbg(&pdev->dev, "%s\n", __func__);
@@ -313,45 +312,38 @@ static __devinit int max77686_pmic_probe(struct platform_device *pdev)
         if (!max77686)
                 return -ENOMEM;
 
-        size = sizeof(struct regulator_dev *) * MAX77686_REGULATORS;
-        max77686->rdev = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
-        if (!max77686->rdev)
-                return -ENOMEM;
-
-        rdev = max77686->rdev;
         config.dev = &pdev->dev;
         config.regmap = iodev->regmap;
         platform_set_drvdata(pdev, max77686);
 
         for (i = 0; i < MAX77686_REGULATORS; i++) {
                 config.init_data = pdata->regulators[i].initdata;
+                config.of_node = pdata->regulators[i].of_node;
 
-                rdev[i] = regulator_register(&regulators[i], &config);
-                if (IS_ERR(rdev[i])) {
-                        ret = PTR_ERR(rdev[i]);
+                max77686->rdev[i] = regulator_register(&regulators[i], &config);
+                if (IS_ERR(max77686->rdev[i])) {
+                        ret = PTR_ERR(max77686->rdev[i]);
                         dev_err(&pdev->dev,
                                 "regulator init failed for %d\n", i);
-                                rdev[i] = NULL;
-                                goto err;
+                        max77686->rdev[i] = NULL;
+                        goto err;
                 }
         }
 
         return 0;
 err:
         while (--i >= 0)
-                regulator_unregister(rdev[i]);
+                regulator_unregister(max77686->rdev[i]);
         return ret;
 }
 
 static int __devexit max77686_pmic_remove(struct platform_device *pdev)
 {
         struct max77686_data *max77686 = platform_get_drvdata(pdev);
-        struct regulator_dev **rdev = max77686->rdev;
         int i;
 
         for (i = 0; i < MAX77686_REGULATORS; i++)
-                if (rdev[i])
-                        regulator_unregister(rdev[i]);
+                regulator_unregister(max77686->rdev[i]);
 
         return 0;
 }
diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c
new file mode 100644
index 000000000000..af7607515ab9
--- /dev/null
+++ b/drivers/regulator/max8907-regulator.c
@@ -0,0 +1,408 @@
+/*
+ * max8907-regulator.c -- support regulators in max8907
+ *
+ * Copyright (C) 2010 Gyungoh Yoo <jack.yoo@maxim-ic.com>
+ * Copyright (C) 2010-2012, NVIDIA CORPORATION. All rights reserved.
+ *
+ * Portions based on drivers/regulator/tps65910-regulator.c,
+ *     Copyright 2010 Texas Instruments Inc.
+ *     Author: Graeme Gregory <gg@slimlogic.co.uk>
+ *     Author: Jorge Eduardo Candelaria <jedu@slimlogic.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/mfd/core.h>
+#include <linux/mfd/max8907.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/of_regulator.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+
+#define MAX8907_II2RR_VERSION_MASK      0xF0
+#define MAX8907_II2RR_VERSION_REV_A     0x00
+#define MAX8907_II2RR_VERSION_REV_B     0x10
+#define MAX8907_II2RR_VERSION_REV_C     0x30
+
+struct max8907_regulator {
+        struct regulator_desc desc[MAX8907_NUM_REGULATORS];
+        struct regulator_dev *rdev[MAX8907_NUM_REGULATORS];
+};
+
+#define REG_MBATT() \
+        [MAX8907_MBATT] = { \
+                .name = "MBATT", \
+                .supply_name = "mbatt", \
+                .id = MAX8907_MBATT, \
+                .ops = &max8907_mbatt_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+        }
+
+#define REG_LDO(ids, supply, base, min, max, step) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = ((max) - (min)) / (step) + 1, \
+                .ops = &max8907_ldo_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (min), \
+                .uV_step = (step), \
+                .vsel_reg = (base) + MAX8907_VOUT, \
+                .vsel_mask = 0x3f, \
+                .enable_reg = (base) + MAX8907_CTL, \
+                .enable_mask = MAX8907_MASK_LDO_EN, \
+        }
+
+#define REG_FIXED(ids, supply, voltage) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = 1, \
+                .ops = &max8907_fixed_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (voltage), \
+        }
+
+#define REG_OUT5V(ids, supply, base, voltage) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = 1, \
+                .ops = &max8907_out5v_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (voltage), \
+                .enable_reg = (base), \
+                .enable_mask = MAX8907_MASK_OUT5V_EN, \
+        }
+
+#define REG_BBAT(ids, supply, base, min, max, step) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = ((max) - (min)) / (step) + 1, \
+                .ops = &max8907_bbat_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (min), \
+                .uV_step = (step), \
+                .vsel_reg = (base), \
+                .vsel_mask = MAX8907_MASK_VBBATTCV, \
+        }
+
+#define LDO_750_50(id, supply, base) REG_LDO(id, supply, (base), \
+                        750000, 3900000, 50000)
+#define LDO_650_25(id, supply, base) REG_LDO(id, supply, (base), \
+                        650000, 2225000, 25000)
+
+static struct regulator_ops max8907_mbatt_ops = {
+};
+
+static struct regulator_ops max8907_ldo_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+};
+
+static struct regulator_ops max8907_ldo_hwctl_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+};
+
+static struct regulator_ops max8907_fixed_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+};
+
+static struct regulator_ops max8907_out5v_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+};
+
+static struct regulator_ops max8907_out5v_hwctl_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+};
+
+static struct regulator_ops max8907_bbat_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+};
+
+static struct regulator_desc max8907_regulators[] = {
+        REG_MBATT(),
+        REG_LDO(SD1, "in-v1", MAX8907_REG_SDCTL1, 650000, 2225000, 25000),
+        REG_LDO(SD2, "in-v2", MAX8907_REG_SDCTL2, 637500, 1425000, 12500),
+        REG_LDO(SD3, "in-v3", MAX8907_REG_SDCTL3, 750000, 3900000, 50000),
+        LDO_750_50(LDO1, "in1", MAX8907_REG_LDOCTL1),
+        LDO_650_25(LDO2, "in2", MAX8907_REG_LDOCTL2),
+        LDO_650_25(LDO3, "in3", MAX8907_REG_LDOCTL3),
+        LDO_750_50(LDO4, "in4", MAX8907_REG_LDOCTL4),
+        LDO_750_50(LDO5, "in5", MAX8907_REG_LDOCTL5),
+        LDO_750_50(LDO6, "in6", MAX8907_REG_LDOCTL6),
+        LDO_750_50(LDO7, "in7", MAX8907_REG_LDOCTL7),
+        LDO_750_50(LDO8, "in8", MAX8907_REG_LDOCTL8),
+        LDO_750_50(LDO9, "in9", MAX8907_REG_LDOCTL9),
+        LDO_750_50(LDO10, "in10", MAX8907_REG_LDOCTL10),
+        LDO_750_50(LDO11, "in11", MAX8907_REG_LDOCTL11),
+        LDO_750_50(LDO12, "in12", MAX8907_REG_LDOCTL12),
+        LDO_750_50(LDO13, "in13", MAX8907_REG_LDOCTL13),
+        LDO_750_50(LDO14, "in14", MAX8907_REG_LDOCTL14),
+        LDO_750_50(LDO15, "in15", MAX8907_REG_LDOCTL15),
+        LDO_750_50(LDO16, "in16", MAX8907_REG_LDOCTL16),
+        LDO_650_25(LDO17, "in17", MAX8907_REG_LDOCTL17),
+        LDO_650_25(LDO18, "in18", MAX8907_REG_LDOCTL18),
+        LDO_750_50(LDO19, "in19", MAX8907_REG_LDOCTL19),
+        LDO_750_50(LDO20, "in20", MAX8907_REG_LDOCTL20),
+        REG_OUT5V(OUT5V, "mbatt", MAX8907_REG_OUT5VEN, 5000000),
+        REG_OUT5V(OUT33V, "mbatt",  MAX8907_REG_OUT33VEN, 3300000),
+        REG_BBAT(BBAT, "MBATT", MAX8907_REG_BBAT_CNFG,
+                                                2400000, 3000000, 200000),
+        REG_FIXED(SDBY, "MBATT", 1200000),
+        REG_FIXED(VRTC, "MBATT", 3300000),
+};
+
+#ifdef CONFIG_OF
+
+#define MATCH(_name, _id) \
+        [MAX8907_##_id] = { \
+                .name = #_name, \
+                .driver_data = (void *)&max8907_regulators[MAX8907_##_id], \
+        }
+
+static struct of_regulator_match max8907_matches[] = {
+        MATCH(mbatt, MBATT),
+        MATCH(sd1, SD1),
+        MATCH(sd2, SD2),
+        MATCH(sd3, SD3),
+        MATCH(ldo1, LDO1),
+        MATCH(ldo2, LDO2),
+        MATCH(ldo3, LDO3),
+        MATCH(ldo4, LDO4),
+        MATCH(ldo5, LDO5),
+        MATCH(ldo6, LDO6),
+        MATCH(ldo7, LDO7),
+        MATCH(ldo8, LDO8),
+        MATCH(ldo9, LDO9),
+        MATCH(ldo10, LDO10),
+        MATCH(ldo11, LDO11),
+        MATCH(ldo12, LDO12),
+        MATCH(ldo13, LDO13),
+        MATCH(ldo14, LDO14),
+        MATCH(ldo15, LDO15),
+        MATCH(ldo16, LDO16),
+        MATCH(ldo17, LDO17),
+        MATCH(ldo18, LDO18),
+        MATCH(ldo19, LDO19),
+        MATCH(ldo20, LDO20),
+        MATCH(out5v, OUT5V),
+        MATCH(out33v, OUT33V),
+        MATCH(bbat, BBAT),
+        MATCH(sdby, SDBY),
+        MATCH(vrtc, VRTC),
+};
+
+static int max8907_regulator_parse_dt(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.parent->of_node;
+        struct device_node *regulators;
+        int ret;
+
+        if (!pdev->dev.parent->of_node)
+                return 0;
+
+        regulators = of_find_node_by_name(np, "regulators");
+        if (!regulators) {
+                dev_err(&pdev->dev, "regulators node not found\n");
+                return -EINVAL;
+        }
+
+        ret = of_regulator_match(pdev->dev.parent, regulators,
+                                 max8907_matches,
+                                 ARRAY_SIZE(max8907_matches));
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
+                        ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static inline struct regulator_init_data *match_init_data(int index)
+{
+        return max8907_matches[index].init_data;
+}
+
+static inline struct device_node *match_of_node(int index)
+{
+        return max8907_matches[index].of_node;
+}
+#else
+static int max8907_regulator_parse_dt(struct platform_device *pdev)
+{
+        return 0;
+}
+
+static inline struct regulator_init_data *match_init_data(int index)
+{
+        return NULL;
+}
+
+static inline struct device_node *match_of_node(int index)
+{
+        return NULL;
+}
+#endif
+
+static __devinit int max8907_regulator_probe(struct platform_device *pdev)
+{
+        struct max8907 *max8907 = dev_get_drvdata(pdev->dev.parent);
+        struct max8907_platform_data *pdata = dev_get_platdata(max8907->dev);
+        int ret;
+        struct max8907_regulator *pmic;
+        unsigned int val;
+        int i;
+        struct regulator_config config = {};
+        struct regulator_init_data *idata;
+        const char *mbatt_rail_name = NULL;
+
+        ret = max8907_regulator_parse_dt(pdev);
+        if (ret)
+                return ret;
+
+        pmic = devm_kzalloc(&pdev->dev, sizeof(*pmic), GFP_KERNEL);
+        if (!pmic) {
+                dev_err(&pdev->dev, "Failed to alloc pmic\n");
+                return -ENOMEM;
+        }
+        platform_set_drvdata(pdev, pmic);
+
+        memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc));
+
+        /* Backwards compatibility with MAX8907B; SD1 uses different voltages */
+        regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val);
+        if ((val & MAX8907_II2RR_VERSION_MASK) ==
+            MAX8907_II2RR_VERSION_REV_B) {
+                pmic->desc[MAX8907_SD1].min_uV = 637500;
+                pmic->desc[MAX8907_SD1].uV_step = 12500;
+                pmic->desc[MAX8907_SD1].n_voltages =
+                                                (1425000 - 637500) / 12500 + 1;
+        }
+
+        for (i = 0; i < MAX8907_NUM_REGULATORS; i++) {
+                config.dev = pdev->dev.parent;
+                if (pdata)
+                        idata = pdata->init_data[i];
+                else
+                        idata = match_init_data(i);
+                config.init_data = idata;
+                config.driver_data = pmic;
+                config.regmap = max8907->regmap_gen;
+                config.of_node = match_of_node(i);
+
+                switch (pmic->desc[i].id) {
+                case MAX8907_MBATT:
+                        if (idata && idata->constraints.name)
+                                mbatt_rail_name = idata->constraints.name;
+                        else
+                                mbatt_rail_name = pmic->desc[i].name;
+                        break;
+                case MAX8907_BBAT:
+                case MAX8907_SDBY:
+                case MAX8907_VRTC:
+                        idata->supply_regulator = mbatt_rail_name;
+                        break;
+                }
+
+                if (pmic->desc[i].ops == &max8907_ldo_ops) {
+                        regmap_read(config.regmap, pmic->desc[i].enable_reg,
+                                    &val);
+                        if ((val & MAX8907_MASK_LDO_SEQ) !=
+                            MAX8907_MASK_LDO_SEQ)
+                                pmic->desc[i].ops = &max8907_ldo_hwctl_ops;
+                } else if (pmic->desc[i].ops == &max8907_out5v_ops) {
+                        regmap_read(config.regmap, pmic->desc[i].enable_reg,
+                                    &val);
+                        if ((val & (MAX8907_MASK_OUT5V_VINEN |
+                                                MAX8907_MASK_OUT5V_ENSRC)) !=
+                            MAX8907_MASK_OUT5V_ENSRC)
+                                pmic->desc[i].ops = &max8907_out5v_hwctl_ops;
+                }
+
+                pmic->rdev[i] = regulator_register(&pmic->desc[i], &config);
+                if (IS_ERR(pmic->rdev[i])) {
+                        dev_err(&pdev->dev,
+                                "failed to register %s regulator\n",
+                                pmic->desc[i].name);
+                        ret = PTR_ERR(pmic->rdev[i]);
+                        goto err_unregister_regulator;
+                }
+        }
+
+        return 0;
+
+err_unregister_regulator:
+        while (--i >= 0)
+                regulator_unregister(pmic->rdev[i]);
+        return ret;
+}
+
+static __devexit int max8907_regulator_remove(struct platform_device *pdev)
+{
+        struct max8907_regulator *pmic = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < MAX8907_NUM_REGULATORS; i++)
+                regulator_unregister(pmic->rdev[i]);
+
+        return 0;
+}
+
+static struct platform_driver max8907_regulator_driver = {
+        .driver = {
+                   .name = "max8907-regulator",
+                   .owner = THIS_MODULE,
+                   },
+        .probe = max8907_regulator_probe,
+        .remove = __devexit_p(max8907_regulator_remove),
+};
+
+static int __init max8907_regulator_init(void)
+{
+        return platform_driver_register(&max8907_regulator_driver);
+}
+
+subsys_initcall(max8907_regulator_init);
+
+static void __exit max8907_reg_exit(void)
+{
+        platform_driver_unregister(&max8907_regulator_driver);
+}
+
+module_exit(max8907_reg_exit);
+
+MODULE_DESCRIPTION("MAX8907 regulator driver");
+MODULE_AUTHOR("Gyungoh Yoo <jack.yoo@maxim-ic.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:max8907-regulator");
diff --git a/drivers/regulator/mc13783-regulator.c b/drivers/regulator/mc13783-regulator.c
index 4932e3449fe1..0801a6d0c122 100644
--- a/drivers/regulator/mc13783-regulator.c
+++ b/drivers/regulator/mc13783-regulator.c
@@ -21,6 +21,30 @@
 #include <linux/module.h>
 #include "mc13xxx.h"
 
+#define MC13783_REG_SWITCHERS0                  24
+/* Enable does not exist for SW1A */
+#define MC13783_REG_SWITCHERS0_SW1AEN                   0
+#define MC13783_REG_SWITCHERS0_SW1AVSEL                 0
+#define MC13783_REG_SWITCHERS0_SW1AVSEL_M               (63 << 0)
+
+#define MC13783_REG_SWITCHERS1                  25
+/* Enable does not exist for SW1B */
+#define MC13783_REG_SWITCHERS1_SW1BEN                   0
+#define MC13783_REG_SWITCHERS1_SW1BVSEL                 0
+#define MC13783_REG_SWITCHERS1_SW1BVSEL_M               (63 << 0)
+
+#define MC13783_REG_SWITCHERS2                  26
+/* Enable does not exist for SW2A */
+#define MC13783_REG_SWITCHERS2_SW2AEN                   0
+#define MC13783_REG_SWITCHERS2_SW2AVSEL                 0
+#define MC13783_REG_SWITCHERS2_SW2AVSEL_M               (63 << 0)
+
+#define MC13783_REG_SWITCHERS3                  27
+/* Enable does not exist for SW2B */
+#define MC13783_REG_SWITCHERS3_SW2BEN                   0
+#define MC13783_REG_SWITCHERS3_SW2BVSEL                 0
+#define MC13783_REG_SWITCHERS3_SW2BVSEL_M               (63 << 0)
+
 #define MC13783_REG_SWITCHERS5                  29
 #define MC13783_REG_SWITCHERS5_SW3EN                    (1 << 20)
 #define MC13783_REG_SWITCHERS5_SW3VSEL                  18
@@ -93,6 +117,44 @@
 
 
 /* Voltage Values */
+static const int mc13783_sw1x_val[] = {
+        900000, 925000, 950000, 975000,
+        1000000, 1025000, 1050000, 1075000,
+        1100000, 1125000, 1150000, 1175000,
+        1200000, 1225000, 1250000, 1275000,
+        1300000, 1325000, 1350000, 1375000,
+        1400000, 1425000, 1450000, 1475000,
+        1500000, 1525000, 1550000, 1575000,
+        1600000, 1625000, 1650000, 1675000,
+        1700000, 1700000, 1700000, 1700000,
+        1800000, 1800000, 1800000, 1800000,
+        1850000, 1850000, 1850000, 1850000,
+        2000000, 2000000, 2000000, 2000000,
+        2100000, 2100000, 2100000, 2100000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+};
+
+static const int mc13783_sw2x_val[] = {
+        900000, 925000, 950000, 975000,
+        1000000, 1025000, 1050000, 1075000,
+        1100000, 1125000, 1150000, 1175000,
+        1200000, 1225000, 1250000, 1275000,
+        1300000, 1325000, 1350000, 1375000,
+        1400000, 1425000, 1450000, 1475000,
+        1500000, 1525000, 1550000, 1575000,
+        1600000, 1625000, 1650000, 1675000,
+        1700000, 1700000, 1700000, 1700000,
+        1800000, 1800000, 1800000, 1800000,
+        1900000, 1900000, 1900000, 1900000,
+        2000000, 2000000, 2000000, 2000000,
+        2100000, 2100000, 2100000, 2100000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+};
+
 static const unsigned int mc13783_sw3_val[] = {
         5000000, 5000000, 5000000, 5500000,
 };
@@ -188,6 +250,10 @@ static struct regulator_ops mc13783_gpo_regulator_ops;
         MC13783_DEFINE(REG, _name, _reg, _vsel_reg, _voltages)
 
 static struct mc13xxx_regulator mc13783_regulators[] = {
+        MC13783_DEFINE_SW(SW1A, SWITCHERS0, SWITCHERS0, mc13783_sw1x_val),
+        MC13783_DEFINE_SW(SW1B, SWITCHERS1, SWITCHERS1, mc13783_sw1x_val),
+        MC13783_DEFINE_SW(SW2A, SWITCHERS2, SWITCHERS2, mc13783_sw2x_val),
+        MC13783_DEFINE_SW(SW2B, SWITCHERS3, SWITCHERS3, mc13783_sw2x_val),
         MC13783_DEFINE_SW(SW3, SWITCHERS5, SWITCHERS5, mc13783_sw3_val),
 
         MC13783_FIXED_DEFINE(REG, VAUDIO, REGULATORMODE0, mc13783_vaudio_val),
@@ -238,9 +304,10 @@ static int mc13783_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
 
         BUG_ON(val & ~mask);
 
+        mc13xxx_lock(priv->mc13xxx);
         ret = mc13xxx_reg_read(mc13783, MC13783_REG_POWERMISC, &valread);
         if (ret)
-                return ret;
+                goto out;
 
         /* Update the stored state for Power Gates. */
         priv->powermisc_pwgt_state =
@@ -253,7 +320,10 @@ static int mc13783_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
         valread = (valread & ~MC13783_REG_POWERMISC_PWGTSPI_M) |
                                                 priv->powermisc_pwgt_state;
 
-        return mc13xxx_reg_write(mc13783, MC13783_REG_POWERMISC, valread);
+        ret = mc13xxx_reg_write(mc13783, MC13783_REG_POWERMISC, valread);
+out:
+        mc13xxx_unlock(priv->mc13xxx);
+        return ret;
 }
 
 static int mc13783_gpo_regulator_enable(struct regulator_dev *rdev)
@@ -261,7 +331,6 @@ static int mc13783_gpo_regulator_enable(struct regulator_dev *rdev)
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         struct mc13xxx_regulator *mc13xxx_regulators = priv->mc13xxx_regulators;
         int id = rdev_get_id(rdev);
-        int ret;
         u32 en_val = mc13xxx_regulators[id].enable_bit;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
@@ -271,12 +340,8 @@ static int mc13783_gpo_regulator_enable(struct regulator_dev *rdev)
             id == MC13783_REG_PWGT2SPI)
                 en_val = 0;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
+        return mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
                                         en_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
 }
 
 static int mc13783_gpo_regulator_disable(struct regulator_dev *rdev)
@@ -284,7 +349,6 @@ static int mc13783_gpo_regulator_disable(struct regulator_dev *rdev)
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         struct mc13xxx_regulator *mc13xxx_regulators = priv->mc13xxx_regulators;
         int id = rdev_get_id(rdev);
-        int ret;
         u32 dis_val = 0;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
@@ -294,12 +358,8 @@ static int mc13783_gpo_regulator_disable(struct regulator_dev *rdev)
             id == MC13783_REG_PWGT2SPI)
                 dis_val = mc13xxx_regulators[id].enable_bit;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
+        return mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
                                         dis_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
 }
 
 static int mc13783_gpo_regulator_is_enabled(struct regulator_dev *rdev)
@@ -330,7 +390,6 @@ static struct regulator_ops mc13783_gpo_regulator_ops = {
         .is_enabled = mc13783_gpo_regulator_is_enabled,
         .list_voltage = regulator_list_voltage_table,
         .set_voltage = mc13xxx_fixed_regulator_set_voltage,
-        .get_voltage = mc13xxx_fixed_regulator_get_voltage,
 };
 
 static int __devinit mc13783_regulator_probe(struct platform_device *pdev)
diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
index b388b746452e..1fa63812f7ac 100644
--- a/drivers/regulator/mc13892-regulator.c
+++ b/drivers/regulator/mc13892-regulator.c
@@ -305,9 +305,10 @@ static int mc13892_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
 
         BUG_ON(val & ~mask);
 
+        mc13xxx_lock(priv->mc13xxx);
         ret = mc13xxx_reg_read(mc13892, MC13892_POWERMISC, &valread);
         if (ret)
-                return ret;
+                goto out;
 
         /* Update the stored state for Power Gates. */
         priv->powermisc_pwgt_state =
@@ -320,14 +321,16 @@ static int mc13892_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
         valread = (valread & ~MC13892_POWERMISC_PWGTSPI_M) |
                 priv->powermisc_pwgt_state;
 
-        return mc13xxx_reg_write(mc13892, MC13892_POWERMISC, valread);
+        ret = mc13xxx_reg_write(mc13892, MC13892_POWERMISC, valread);
+out:
+        mc13xxx_unlock(priv->mc13xxx);
+        return ret;
 }
 
 static int mc13892_gpo_regulator_enable(struct regulator_dev *rdev)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         int id = rdev_get_id(rdev);
-        int ret;
         u32 en_val = mc13892_regulators[id].enable_bit;
         u32 mask = mc13892_regulators[id].enable_bit;
 
@@ -340,18 +343,13 @@ static int mc13892_gpo_regulator_enable(struct regulator_dev *rdev)
         if (id == MC13892_GPO4)
                 mask |= MC13892_POWERMISC_GPO4ADINEN;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13892_powermisc_rmw(priv, mask, en_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
+        return mc13892_powermisc_rmw(priv, mask, en_val);
 }
 
 static int mc13892_gpo_regulator_disable(struct regulator_dev *rdev)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         int id = rdev_get_id(rdev);
-        int ret;
         u32 dis_val = 0;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
@@ -360,12 +358,8 @@ static int mc13892_gpo_regulator_disable(struct regulator_dev *rdev)
         if (id == MC13892_PWGT1SPI || id == MC13892_PWGT2SPI)
                 dis_val = mc13892_regulators[id].enable_bit;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13892_powermisc_rmw(priv, mc13892_regulators[id].enable_bit,
+        return mc13892_powermisc_rmw(priv, mc13892_regulators[id].enable_bit,
                 dis_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
 }
 
 static int mc13892_gpo_regulator_is_enabled(struct regulator_dev *rdev)
@@ -396,14 +390,13 @@ static struct regulator_ops mc13892_gpo_regulator_ops = {
         .is_enabled = mc13892_gpo_regulator_is_enabled,
         .list_voltage = regulator_list_voltage_table,
         .set_voltage = mc13xxx_fixed_regulator_set_voltage,
-        .get_voltage = mc13xxx_fixed_regulator_get_voltage,
 };
 
-static int mc13892_sw_regulator_get_voltage(struct regulator_dev *rdev)
+static int mc13892_sw_regulator_get_voltage_sel(struct regulator_dev *rdev)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         int ret, id = rdev_get_id(rdev);
-        unsigned int val, hi;
+        unsigned int val;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
 
@@ -414,17 +407,11 @@ static int mc13892_sw_regulator_get_voltage(struct regulator_dev *rdev)
         if (ret)
                 return ret;
 
-        hi  = val & MC13892_SWITCHERS0_SWxHI;
         val = (val & mc13892_regulators[id].vsel_mask)
                 >> mc13892_regulators[id].vsel_shift;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d val: %d\n", __func__, id, val);
 
-        if (hi)
-                val = (25000 * val) + 1100000;
-        else
-                val = (25000 * val) + 600000;
-
         return val;
 }
 
@@ -432,37 +419,25 @@ static int mc13892_sw_regulator_set_voltage_sel(struct regulator_dev *rdev,
                                                 unsigned selector)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
-        int hi, value, mask, id = rdev_get_id(rdev);
-        u32 valread;
+        int volt, mask, id = rdev_get_id(rdev);
+        u32 reg_value;
         int ret;
 
-        value = rdev->desc->volt_table[selector];
+        volt = rdev->desc->volt_table[selector];
+        mask = mc13892_regulators[id].vsel_mask;
+        reg_value = selector << mc13892_regulators[id].vsel_shift;
+
+        if (volt > 1375000) {
+                mask |= MC13892_SWITCHERS0_SWxHI;
+                reg_value |= MC13892_SWITCHERS0_SWxHI;
+        } else if (volt < 1100000) {
+                mask |= MC13892_SWITCHERS0_SWxHI;
+                reg_value &= ~MC13892_SWITCHERS0_SWxHI;
+        }
 
         mc13xxx_lock(priv->mc13xxx);
-        ret = mc13xxx_reg_read(priv->mc13xxx,
-                mc13892_regulators[id].vsel_reg, &valread);
-        if (ret)
-                goto err;
-
-        if (value > 1375000)
-                hi = 1;
-        else if (value < 1100000)
-                hi = 0;
-        else
-                hi = valread & MC13892_SWITCHERS0_SWxHI;
-
-        if (hi) {
-                value = (value - 1100000) / 25000;
-                value |= MC13892_SWITCHERS0_SWxHI;
-        } else
-                value = (value - 600000) / 25000;
-
-        mask = mc13892_regulators[id].vsel_mask | MC13892_SWITCHERS0_SWxHI;
-        valread = (valread & ~mask) |
-                        (value << mc13892_regulators[id].vsel_shift);
-        ret = mc13xxx_reg_write(priv->mc13xxx, mc13892_regulators[id].vsel_reg,
-                        valread);
-err:
+        ret = mc13xxx_reg_rmw(priv->mc13xxx, mc13892_regulators[id].reg, mask,
+                              reg_value);
         mc13xxx_unlock(priv->mc13xxx);
 
         return ret;
@@ -471,7 +446,7 @@ err:
 static struct regulator_ops mc13892_sw_regulator_ops = {
         .list_voltage = regulator_list_voltage_table,
         .set_voltage_sel = mc13892_sw_regulator_set_voltage_sel,
-        .get_voltage = mc13892_sw_regulator_get_voltage,
+        .get_voltage_sel = mc13892_sw_regulator_get_voltage_sel,
 };
 
 static int mc13892_vcam_set_mode(struct regulator_dev *rdev, unsigned int mode)
diff --git a/drivers/regulator/mc13xxx-regulator-core.c b/drivers/regulator/mc13xxx-regulator-core.c
index d6eda28ca5d0..88cbb832d555 100644
--- a/drivers/regulator/mc13xxx-regulator-core.c
+++ b/drivers/regulator/mc13xxx-regulator-core.c
@@ -143,30 +143,21 @@ int mc13xxx_fixed_regulator_set_voltage(struct regulator_dev *rdev, int min_uV,
                 __func__, id, min_uV, max_uV);
 
         if (min_uV <= rdev->desc->volt_table[0] &&
-            rdev->desc->volt_table[0] <= max_uV)
+            rdev->desc->volt_table[0] <= max_uV) {
+                *selector = 0;
                 return 0;
-        else
+        } else {
                 return -EINVAL;
+        }
 }
 EXPORT_SYMBOL_GPL(mc13xxx_fixed_regulator_set_voltage);
 
-int mc13xxx_fixed_regulator_get_voltage(struct regulator_dev *rdev)
-{
-        int id = rdev_get_id(rdev);
-
-        dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
-
-        return rdev->desc->volt_table[0];
-}
-EXPORT_SYMBOL_GPL(mc13xxx_fixed_regulator_get_voltage);
-
 struct regulator_ops mc13xxx_fixed_regulator_ops = {
         .enable = mc13xxx_regulator_enable,
         .disable = mc13xxx_regulator_disable,
         .is_enabled = mc13xxx_regulator_is_enabled,
         .list_voltage = regulator_list_voltage_table,
         .set_voltage = mc13xxx_fixed_regulator_set_voltage,
-        .get_voltage = mc13xxx_fixed_regulator_get_voltage,
 };
 EXPORT_SYMBOL_GPL(mc13xxx_fixed_regulator_ops);
 
diff --git a/drivers/regulator/mc13xxx.h b/drivers/regulator/mc13xxx.h
index eaff5510b6df..06c8903f182a 100644
--- a/drivers/regulator/mc13xxx.h
+++ b/drivers/regulator/mc13xxx.h
@@ -34,7 +34,6 @@ struct mc13xxx_regulator_priv {
 
 extern int mc13xxx_fixed_regulator_set_voltage(struct regulator_dev *rdev,
                 int min_uV, int max_uV, unsigned *selector);
-extern int mc13xxx_fixed_regulator_get_voltage(struct regulator_dev *rdev);
 
 #ifdef CONFIG_OF
 extern int mc13xxx_get_num_regulators_dt(struct platform_device *pdev);
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 3e4106f2bda9..6f684916fd79 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -92,16 +92,18 @@ struct regulator_init_data *of_get_regulator_init_data(struct device *dev,
 EXPORT_SYMBOL_GPL(of_get_regulator_init_data);
 
 /**
- * of_regulator_match - extract regulator init data when node
- * property "regulator-compatible" matches with the regulator name.
+ * of_regulator_match - extract multiple regulator init data from device tree.
  * @dev: device requesting the data
  * @node: parent device node of the regulators
  * @matches: match table for the regulators
  * @num_matches: number of entries in match table
  *
- * This function uses a match table specified by the regulator driver and
- * looks up the corresponding init data in the device tree  if
- * regulator-compatible matches. Note that the match table is modified
+ * This function uses a match table specified by the regulator driver to
+ * parse regulator init data from the device tree. @node is expected to
+ * contain a set of child nodes, each providing the init data for one
+ * regulator. The data parsed from a child node will be matched to a regulator
+ * based on either the deprecated property regulator-compatible if present,
+ * or otherwise the child node's name. Note that the match table is modified
  * in place.
  *
  * Returns the number of matches found or a negative error code on failure.
@@ -112,26 +114,23 @@ int of_regulator_match(struct device *dev, struct device_node *node,
 {
         unsigned int count = 0;
         unsigned int i;
-        const char *regulator_comp;
+        const char *name;
         struct device_node *child;
 
         if (!dev || !node)
                 return -EINVAL;
 
         for_each_child_of_node(node, child) {
-                regulator_comp = of_get_property(child,
+                name = of_get_property(child,
                                         "regulator-compatible", NULL);
-                if (!regulator_comp) {
-                        dev_err(dev, "regulator-compatible is missing for node %s\n",
-                                child->name);
-                        continue;
-                }
+                if (!name)
+                        name = child->name;
                 for (i = 0; i < num_matches; i++) {
                         struct of_regulator_match *match = &matches[i];
                         if (match->of_node)
                                 continue;
 
-                        if (strcmp(match->name, regulator_comp))
+                        if (strcmp(match->name, name))
                                 continue;
 
                         match->init_data =
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 46c7e88f8381..2ba7502fa3b2 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -443,44 +443,6 @@ static int palmas_list_voltage_ldo(struct regulator_dev *dev,
         return  850000 + (selector * 50000);
 }
 
-static int palmas_get_voltage_ldo_sel(struct regulator_dev *dev)
-{
-        struct palmas_pmic *pmic = rdev_get_drvdata(dev);
-        int id = rdev_get_id(dev);
-        int selector;
-        unsigned int reg;
-        unsigned int addr;
-
-        addr = palmas_regs_info[id].vsel_addr;
-
-        palmas_ldo_read(pmic->palmas, addr, &reg);
-
-        selector = reg & PALMAS_LDO1_VOLTAGE_VSEL_MASK;
-
-        /* Adjust selector to match list_voltage ranges */
-        if (selector > 49)
-                selector = 49;
-
-        return selector;
-}
-
-static int palmas_set_voltage_ldo_sel(struct regulator_dev *dev,
-                unsigned selector)
-{
-        struct palmas_pmic *pmic = rdev_get_drvdata(dev);
-        int id = rdev_get_id(dev);
-        unsigned int reg = 0;
-        unsigned int addr;
-
-        addr = palmas_regs_info[id].vsel_addr;
-
-        reg = selector;
-
-        palmas_ldo_write(pmic->palmas, addr, reg);
-
-        return 0;
-}
-
 static int palmas_map_voltage_ldo(struct regulator_dev *rdev,
                 int min_uV, int max_uV)
 {
@@ -505,8 +467,8 @@ static struct regulator_ops palmas_ops_ldo = {
         .is_enabled             = palmas_is_enabled_ldo,
         .enable                 = regulator_enable_regmap,
         .disable                = regulator_disable_regmap,
-        .get_voltage_sel        = palmas_get_voltage_ldo_sel,
-        .set_voltage_sel        = palmas_set_voltage_ldo_sel,
+        .get_voltage_sel        = regulator_get_voltage_sel_regmap,
+        .set_voltage_sel        = regulator_set_voltage_sel_regmap,
         .list_voltage           = palmas_list_voltage_ldo,
         .map_voltage            = palmas_map_voltage_ldo,
 };
@@ -757,6 +719,9 @@ static __devinit int palmas_probe(struct platform_device *pdev)
 
                 pmic->desc[id].type = REGULATOR_VOLTAGE;
                 pmic->desc[id].owner = THIS_MODULE;
+                pmic->desc[id].vsel_reg = PALMAS_BASE_TO_REG(PALMAS_LDO_BASE,
+                                                palmas_regs_info[id].vsel_addr);
+                pmic->desc[id].vsel_mask = PALMAS_LDO1_VOLTAGE_VSEL_MASK;
                 pmic->desc[id].enable_reg = PALMAS_BASE_TO_REG(PALMAS_LDO_BASE,
                                                 palmas_regs_info[id].ctrl_addr);
                 pmic->desc[id].enable_mask = PALMAS_LDO1_CTRL_MODE_ACTIVE;
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 4669dc9ac74a..926f9c8f2fac 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -24,7 +24,7 @@
 #include <linux/mfd/samsung/s2mps11.h>
 
 struct s2mps11_info {
-        struct regulator_dev **rdev;
+        struct regulator_dev *rdev[S2MPS11_REGULATOR_MAX];
 
         int ramp_delay2;
         int ramp_delay34;
@@ -236,9 +236,8 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
         struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct sec_platform_data *pdata = dev_get_platdata(iodev->dev);
         struct regulator_config config = { };
-        struct regulator_dev **rdev;
         struct s2mps11_info *s2mps11;
-        int i, ret, size;
+        int i, ret;
         unsigned char ramp_enable, ramp_reg = 0;
 
         if (!pdata) {
@@ -251,13 +250,6 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
         if (!s2mps11)
                 return -ENOMEM;
 
-        size = sizeof(struct regulator_dev *) * S2MPS11_REGULATOR_MAX;
-        s2mps11->rdev = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
-        if (!s2mps11->rdev) {
-                return -ENOMEM;
-        }
-
-        rdev = s2mps11->rdev;
         platform_set_drvdata(pdev, s2mps11);
 
         s2mps11->ramp_delay2 = pdata->buck2_ramp_delay;
@@ -297,12 +289,12 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
                 config.init_data = pdata->regulators[i].initdata;
                 config.driver_data = s2mps11;
 
-                rdev[i] = regulator_register(&regulators[i], &config);
-                if (IS_ERR(rdev[i])) {
-                        ret = PTR_ERR(rdev[i]);
+                s2mps11->rdev[i] = regulator_register(&regulators[i], &config);
+                if (IS_ERR(s2mps11->rdev[i])) {
+                        ret = PTR_ERR(s2mps11->rdev[i]);
                         dev_err(&pdev->dev, "regulator init failed for %d\n",
                                 i);
-                        rdev[i] = NULL;
+                        s2mps11->rdev[i] = NULL;
                         goto err;
                 }
         }
@@ -310,8 +302,7 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
         return 0;
 err:
         for (i = 0; i < S2MPS11_REGULATOR_MAX; i++)
-                if (rdev[i])
-                        regulator_unregister(rdev[i]);
+                regulator_unregister(s2mps11->rdev[i]);
 
         return ret;
 }
@@ -319,12 +310,10 @@ err:
 static int __devexit s2mps11_pmic_remove(struct platform_device *pdev)
 {
         struct s2mps11_info *s2mps11 = platform_get_drvdata(pdev);
-        struct regulator_dev **rdev = s2mps11->rdev;
         int i;
 
         for (i = 0; i < S2MPS11_REGULATOR_MAX; i++)
-                if (rdev[i])
-                        regulator_unregister(rdev[i]);
+                regulator_unregister(s2mps11->rdev[i]);
 
         return 0;
 }
diff --git a/drivers/regulator/tps65217-regulator.c b/drivers/regulator/tps65217-regulator.c
index 6caa222af77a..ab00cab905b7 100644
--- a/drivers/regulator/tps65217-regulator.c
+++ b/drivers/regulator/tps65217-regulator.c
@@ -22,6 +22,7 @@
 #include <linux/err.h>
 #include <linux/platform_device.h>
 
+#include <linux/regulator/of_regulator.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
 #include <linux/mfd/tps65217.h>
@@ -281,37 +282,130 @@ static const struct regulator_desc regulators[] = {
                            NULL),
 };
 
+#ifdef CONFIG_OF
+static struct of_regulator_match reg_matches[] = {
+        { .name = "dcdc1", .driver_data = (void *)TPS65217_DCDC_1 },
+        { .name = "dcdc2", .driver_data = (void *)TPS65217_DCDC_2 },
+        { .name = "dcdc3", .driver_data = (void *)TPS65217_DCDC_3 },
+        { .name = "ldo1", .driver_data = (void *)TPS65217_LDO_1 },
+        { .name = "ldo2", .driver_data = (void *)TPS65217_LDO_2 },
+        { .name = "ldo3", .driver_data = (void *)TPS65217_LDO_3 },
+        { .name = "ldo4", .driver_data = (void *)TPS65217_LDO_4 },
+};
+
+static struct tps65217_board *tps65217_parse_dt(struct platform_device *pdev)
+{
+        struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
+        struct device_node *node = tps->dev->of_node;
+        struct tps65217_board *pdata;
+        struct device_node *regs;
+        int i, count;
+
+        regs = of_find_node_by_name(node, "regulators");
+        if (!regs)
+                return NULL;
+
+        count = of_regulator_match(pdev->dev.parent, regs,
+                                reg_matches, TPS65217_NUM_REGULATOR);
+        of_node_put(regs);
+        if ((count < 0) || (count > TPS65217_NUM_REGULATOR))
+                return NULL;
+
+        pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+        if (!pdata)
+                return NULL;
+
+        for (i = 0; i < count; i++) {
+                if (!reg_matches[i].init_data || !reg_matches[i].of_node)
+                        continue;
+
+                pdata->tps65217_init_data[i] = reg_matches[i].init_data;
+                pdata->of_node[i] = reg_matches[i].of_node;
+        }
+
+        return pdata;
+}
+#else
+static struct tps65217_board *tps65217_parse_dt(struct platform_device *pdev)
+{
+        return NULL;
+}
+#endif
+
 static int __devinit tps65217_regulator_probe(struct platform_device *pdev)
 {
+        struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
+        struct tps65217_board *pdata = dev_get_platdata(tps->dev);
+        struct regulator_init_data *reg_data;
         struct regulator_dev *rdev;
-        struct tps65217 *tps;
-        struct tps_info *info = &tps65217_pmic_regs[pdev->id];
         struct regulator_config config = { };
+        int i, ret;
 
-        /* Already set by core driver */
-        tps = dev_to_tps65217(pdev->dev.parent);
-        tps->info[pdev->id] = info;
+        if (tps->dev->of_node)
+                pdata = tps65217_parse_dt(pdev);
 
-        config.dev = &pdev->dev;
-        config.of_node = pdev->dev.of_node;
-        config.init_data = pdev->dev.platform_data;
-        config.driver_data = tps;
+        if (!pdata) {
+                dev_err(&pdev->dev, "Platform data not found\n");
+                return -EINVAL;
+        }
 
-        rdev = regulator_register(&regulators[pdev->id], &config);
-        if (IS_ERR(rdev))
-                return PTR_ERR(rdev);
+        if (tps65217_chip_id(tps) != TPS65217) {
+                dev_err(&pdev->dev, "Invalid tps chip version\n");
+                return -ENODEV;
+        }
 
-        platform_set_drvdata(pdev, rdev);
+        platform_set_drvdata(pdev, tps);
 
+        for (i = 0; i < TPS65217_NUM_REGULATOR; i++) {
+
+                reg_data = pdata->tps65217_init_data[i];
+
+                /*
+                 * Regulator API handles empty constraints but not NULL
+                 * constraints
+                 */
+                if (!reg_data)
+                        continue;
+
+                /* Register the regulators */
+                tps->info[i] = &tps65217_pmic_regs[i];
+
+                config.dev = tps->dev;
+                config.init_data = reg_data;
+                config.driver_data = tps;
+                config.regmap = tps->regmap;
+                if (tps->dev->of_node)
+                        config.of_node = pdata->of_node[i];
+
+                rdev = regulator_register(&regulators[i], &config);
+                if (IS_ERR(rdev)) {
+                        dev_err(tps->dev, "failed to register %s regulator\n",
+                                pdev->name);
+                        ret = PTR_ERR(rdev);
+                        goto err_unregister_regulator;
+                }
+
+                /* Save regulator for cleanup */
+                tps->rdev[i] = rdev;
+        }
         return 0;
+
+err_unregister_regulator:
+        while (--i >= 0)
+                regulator_unregister(tps->rdev[i]);
+
+        return ret;
 }
 
 static int __devexit tps65217_regulator_remove(struct platform_device *pdev)
 {
-        struct regulator_dev *rdev = platform_get_drvdata(pdev);
+        struct tps65217 *tps = platform_get_drvdata(pdev);
+        unsigned int i;
+
+        for (i = 0; i < TPS65217_NUM_REGULATOR; i++)
+                regulator_unregister(tps->rdev[i]);
 
         platform_set_drvdata(pdev, NULL);
-        regulator_unregister(rdev);
 
         return 0;
 }
diff --git a/drivers/regulator/tps6524x-regulator.c b/drivers/regulator/tps6524x-regulator.c
index 947ece933d90..058d2f2675e9 100644
--- a/drivers/regulator/tps6524x-regulator.c
+++ b/drivers/regulator/tps6524x-regulator.c
@@ -502,15 +502,13 @@ static int set_current_limit(struct regulator_dev *rdev, int min_uA,
         if (info->n_ilimsels == 1)
                 return -EINVAL;
 
-        for (i = 0; i < info->n_ilimsels; i++)
+        for (i = info->n_ilimsels - 1; i >= 0; i--) {
                 if (min_uA <= info->ilimsels[i] &&
                     max_uA >= info->ilimsels[i])
-                        break;
-
-        if (i >= info->n_ilimsels)
-                return -EINVAL;
+                        return write_field(hw, &info->ilimsel, i);
+        }
 
-        return write_field(hw, &info->ilimsel, i);
+        return -EINVAL;
 }
 
 static int get_current_limit(struct regulator_dev *rdev)
diff --git a/drivers/regulator/tps6586x-regulator.c b/drivers/regulator/tps6586x-regulator.c
index 19241fc30050..ce1e7cb8d513 100644
--- a/drivers/regulator/tps6586x-regulator.c
+++ b/drivers/regulator/tps6586x-regulator.c
@@ -57,9 +57,6 @@
 struct tps6586x_regulator {
         struct regulator_desc desc;
 
-        int volt_reg;
-        int volt_shift;
-        int volt_nbits;
         int enable_bit[2];
         int enable_reg[2];
 
@@ -81,10 +78,10 @@ static int tps6586x_set_voltage_sel(struct regulator_dev *rdev,
         int ret, val, rid = rdev_get_id(rdev);
         uint8_t mask;
 
-        val = selector << ri->volt_shift;
-        mask = ((1 << ri->volt_nbits) - 1) << ri->volt_shift;
+        val = selector << (ffs(rdev->desc->vsel_mask) - 1);
+        mask = rdev->desc->vsel_mask;
 
-        ret = tps6586x_update(parent, ri->volt_reg, val, mask);
+        ret = tps6586x_update(parent, rdev->desc->vsel_reg, val, mask);
         if (ret)
                 return ret;
 
@@ -100,66 +97,17 @@ static int tps6586x_set_voltage_sel(struct regulator_dev *rdev,
         return ret;
 }
 
-static int tps6586x_get_voltage_sel(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-        uint8_t val, mask;
-        int ret;
-
-        ret = tps6586x_read(parent, ri->volt_reg, &val);
-        if (ret)
-                return ret;
-
-        mask = ((1 << ri->volt_nbits) - 1) << ri->volt_shift;
-        val = (val & mask) >> ri->volt_shift;
-
-        if (val >= ri->desc.n_voltages)
-                BUG();
-
-        return val;
-}
-
-static int tps6586x_regulator_enable(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-
-        return tps6586x_set_bits(parent, ri->enable_reg[0],
-                                 1 << ri->enable_bit[0]);
-}
-
-static int tps6586x_regulator_disable(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-
-        return tps6586x_clr_bits(parent, ri->enable_reg[0],
-                                 1 << ri->enable_bit[0]);
-}
-
-static int tps6586x_regulator_is_enabled(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-        uint8_t reg_val;
-        int ret;
-
-        ret = tps6586x_read(parent, ri->enable_reg[0], &reg_val);
-        if (ret)
-                return ret;
-
-        return !!(reg_val & (1 << ri->enable_bit[0]));
-}
-
 static struct regulator_ops tps6586x_regulator_ops = {
         .list_voltage = regulator_list_voltage_table,
-        .get_voltage_sel = tps6586x_get_voltage_sel,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
         .set_voltage_sel = tps6586x_set_voltage_sel,
 
-        .is_enabled = tps6586x_regulator_is_enabled,
-        .enable = tps6586x_regulator_enable,
-        .disable = tps6586x_regulator_disable,
+        .is_enabled = regulator_is_enabled_regmap,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+};
+
+static struct regulator_ops tps6586x_sys_regulator_ops = {
 };
 
 static const unsigned int tps6586x_ldo0_voltages[] = {
@@ -202,10 +150,11 @@ static const unsigned int tps6586x_dvm_voltages[] = {
                 .n_voltages = ARRAY_SIZE(tps6586x_##vdata##_voltages),  \
                 .volt_table = tps6586x_##vdata##_voltages,              \
                 .owner  = THIS_MODULE,                                  \
+                .enable_reg = TPS6586X_SUPPLY##ereg0,                   \
+                .enable_mask = 1 << (ebit0),                            \
+                .vsel_reg = TPS6586X_##vreg,                            \
+                .vsel_mask = ((1 << (nbits)) - 1) << (shift),           \
         },                                                              \
-        .volt_reg       = TPS6586X_##vreg,                              \
-        .volt_shift     = (shift),                                      \
-        .volt_nbits     = (nbits),                                      \
         .enable_reg[0]  = TPS6586X_SUPPLY##ereg0,                       \
         .enable_bit[0]  = (ebit0),                                      \
         .enable_reg[1]  = TPS6586X_SUPPLY##ereg1,                       \
@@ -230,15 +179,28 @@ static const unsigned int tps6586x_dvm_voltages[] = {
         TPS6586X_REGULATOR_DVM_GOREG(goreg, gobit)                      \
 }
 
+#define TPS6586X_SYS_REGULATOR()                                        \
+{                                                                       \
+        .desc   = {                                                     \
+                .supply_name = "sys",                                   \
+                .name   = "REG-SYS",                                    \
+                .ops    = &tps6586x_sys_regulator_ops,                  \
+                .type   = REGULATOR_VOLTAGE,                            \
+                .id     = TPS6586X_ID_SYS,                              \
+                .owner  = THIS_MODULE,                                  \
+        },                                                              \
+}
+
 static struct tps6586x_regulator tps6586x_regulator[] = {
+        TPS6586X_SYS_REGULATOR(),
         TPS6586X_LDO(LDO_0, "vinldo01", ldo0, SUPPLYV1, 5, 3, ENC, 0, END, 0),
         TPS6586X_LDO(LDO_3, "vinldo23", ldo, SUPPLYV4, 0, 3, ENC, 2, END, 2),
-        TPS6586X_LDO(LDO_5, NULL, ldo, SUPPLYV6, 0, 3, ENE, 6, ENE, 6),
+        TPS6586X_LDO(LDO_5, "REG-SYS", ldo, SUPPLYV6, 0, 3, ENE, 6, ENE, 6),
         TPS6586X_LDO(LDO_6, "vinldo678", ldo, SUPPLYV3, 0, 3, ENC, 4, END, 4),
         TPS6586X_LDO(LDO_7, "vinldo678", ldo, SUPPLYV3, 3, 3, ENC, 5, END, 5),
         TPS6586X_LDO(LDO_8, "vinldo678", ldo, SUPPLYV2, 5, 3, ENC, 6, END, 6),
         TPS6586X_LDO(LDO_9, "vinldo9", ldo, SUPPLYV6, 3, 3, ENE, 7, ENE, 7),
-        TPS6586X_LDO(LDO_RTC, NULL, ldo, SUPPLYV4, 3, 3, V4, 7, V4, 7),
+        TPS6586X_LDO(LDO_RTC, "REG-SYS", ldo, SUPPLYV4, 3, 3, V4, 7, V4, 7),
         TPS6586X_LDO(LDO_1, "vinldo01", dvm, SUPPLYV1, 0, 5, ENC, 1, END, 1),
         TPS6586X_LDO(SM_2, "vin-sm2", sm2, SUPPLYV2, 0, 5, ENC, 7, END, 7),
 
diff --git a/drivers/regulator/twl-regulator.c b/drivers/regulator/twl-regulator.c
index 77a71a5c17c3..7eb986a40746 100644
--- a/drivers/regulator/twl-regulator.c
+++ b/drivers/regulator/twl-regulator.c
@@ -10,6 +10,8 @@
  */
 
 #include <linux/module.h>
+#include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/err.h>
 #include <linux/platform_device.h>
@@ -624,18 +626,9 @@ static int twlfixed_list_voltage(struct regulator_dev *rdev, unsigned index)
         return info->min_mV * 1000;
 }
 
-static int twlfixed_get_voltage(struct regulator_dev *rdev)
-{
-        struct twlreg_info      *info = rdev_get_drvdata(rdev);
-
-        return info->min_mV * 1000;
-}
-
 static struct regulator_ops twl4030fixed_ops = {
         .list_voltage   = twlfixed_list_voltage,
 
-        .get_voltage    = twlfixed_get_voltage,
-
         .enable         = twl4030reg_enable,
         .disable        = twl4030reg_disable,
         .is_enabled     = twl4030reg_is_enabled,
@@ -648,8 +641,6 @@ static struct regulator_ops twl4030fixed_ops = {
 static struct regulator_ops twl6030fixed_ops = {
         .list_voltage   = twlfixed_list_voltage,
 
-        .get_voltage    = twlfixed_get_voltage,
-
         .enable         = twl6030reg_enable,
         .disable        = twl6030reg_disable,
         .is_enabled     = twl6030reg_is_enabled,
@@ -659,13 +650,6 @@ static struct regulator_ops twl6030fixed_ops = {
         .get_status     = twl6030reg_get_status,
 };
 
-static struct regulator_ops twl6030_fixed_resource = {
-        .enable         = twl6030reg_enable,
-        .disable        = twl6030reg_disable,
-        .is_enabled     = twl6030reg_is_enabled,
-        .get_status     = twl6030reg_get_status,
-};
-
 /*
  * SMPS status and control
  */
@@ -757,37 +741,32 @@ static int twl6030smps_list_voltage(struct regulator_dev *rdev, unsigned index)
         return voltage;
 }
 
-static int
-twl6030smps_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
-                        unsigned int *selector)
+static int twl6030smps_map_voltage(struct regulator_dev *rdev, int min_uV,
+                                   int max_uV)
 {
-        struct twlreg_info      *info = rdev_get_drvdata(rdev);
-        int     vsel = 0;
+        struct twlreg_info *info = rdev_get_drvdata(rdev);
+        int vsel = 0;
 
         switch (info->flags) {
         case 0:
                 if (min_uV == 0)
                         vsel = 0;
                 else if ((min_uV >= 600000) && (min_uV <= 1300000)) {
-                        int calc_uV;
                         vsel = DIV_ROUND_UP(min_uV - 600000, 12500);
                         vsel++;
-                        calc_uV = twl6030smps_list_voltage(rdev, vsel);
-                        if (calc_uV > max_uV)
-                                return -EINVAL;
                 }
                 /* Values 1..57 for vsel are linear and can be calculated
                  * values 58..62 are non linear.
                  */
-                else if ((min_uV > 1900000) && (max_uV >= 2100000))
+                else if ((min_uV > 1900000) && (min_uV <= 2100000))
                         vsel = 62;
-                else if ((min_uV > 1800000) && (max_uV >= 1900000))
+                else if ((min_uV > 1800000) && (min_uV <= 1900000))
                         vsel = 61;
-                else if ((min_uV > 1500000) && (max_uV >= 1800000))
+                else if ((min_uV > 1500000) && (min_uV <= 1800000))
                         vsel = 60;
-                else if ((min_uV > 1350000) && (max_uV >= 1500000))
+                else if ((min_uV > 1350000) && (min_uV <= 1500000))
                         vsel = 59;
-                else if ((min_uV > 1300000) && (max_uV >= 1350000))
+                else if ((min_uV > 1300000) && (min_uV <= 1350000))
                         vsel = 58;
                 else
                         return -EINVAL;
@@ -796,25 +775,21 @@ twl6030smps_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
                 if (min_uV == 0)
                         vsel = 0;
                 else if ((min_uV >= 700000) && (min_uV <= 1420000)) {
-                        int calc_uV;
                         vsel = DIV_ROUND_UP(min_uV - 700000, 12500);
                         vsel++;
-                        calc_uV = twl6030smps_list_voltage(rdev, vsel);
-                        if (calc_uV > max_uV)
-                                return -EINVAL;
                 }
                 /* Values 1..57 for vsel are linear and can be calculated
                  * values 58..62 are non linear.
                  */
-                else if ((min_uV > 1900000) && (max_uV >= 2100000))
+                else if ((min_uV > 1900000) && (min_uV <= 2100000))
                         vsel = 62;
-                else if ((min_uV > 1800000) && (max_uV >= 1900000))
+                else if ((min_uV > 1800000) && (min_uV <= 1900000))
                         vsel = 61;
-                else if ((min_uV > 1350000) && (max_uV >= 1800000))
+                else if ((min_uV > 1350000) && (min_uV <= 1800000))
                         vsel = 60;
-                else if ((min_uV > 1350000) && (max_uV >= 1500000))
+                else if ((min_uV > 1350000) && (min_uV <= 1500000))
                         vsel = 59;
-                else if ((min_uV > 1300000) && (max_uV >= 1350000))
+                else if ((min_uV > 1300000) && (min_uV <= 1350000))
                         vsel = 58;
                 else
                         return -EINVAL;
@@ -830,17 +805,23 @@ twl6030smps_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
         case SMPS_OFFSET_EN|SMPS_EXTENDED_EN:
                 if (min_uV == 0) {
                         vsel = 0;
-                } else if ((min_uV >= 2161000) && (max_uV <= 4321000)) {
+                } else if ((min_uV >= 2161000) && (min_uV <= 4321000)) {
                         vsel = DIV_ROUND_UP(min_uV - 2161000, 38600);
                         vsel++;
                 }
                 break;
         }
 
-        *selector = vsel;
+        return vsel;
+}
+
+static int twl6030smps_set_voltage_sel(struct regulator_dev *rdev,
+                                       unsigned int selector)
+{
+        struct twlreg_info *info = rdev_get_drvdata(rdev);
 
         return twlreg_write(info, TWL_MODULE_PM_RECEIVER, VREG_VOLTAGE_SMPS,
-                                                        vsel);
+                            selector);
 }
 
 static int twl6030smps_get_voltage_sel(struct regulator_dev *rdev)
@@ -852,8 +833,9 @@ static int twl6030smps_get_voltage_sel(struct regulator_dev *rdev)
 
 static struct regulator_ops twlsmps_ops = {
         .list_voltage           = twl6030smps_list_voltage,
+        .map_voltage            = twl6030smps_map_voltage,
 
-        .set_voltage            = twl6030smps_set_voltage,
+        .set_voltage_sel        = twl6030smps_set_voltage_sel,
         .get_voltage_sel        = twl6030smps_get_voltage_sel,
 
         .enable                 = twl6030reg_enable,
@@ -876,7 +858,7 @@ static struct regulator_ops twlsmps_ops = {
                         0x0, TWL6030, twl6030fixed_ops)
 
 #define TWL4030_ADJUSTABLE_LDO(label, offset, num, turnon_delay, remap_conf) \
-static struct twlreg_info TWL4030_INFO_##label = { \
+static const struct twlreg_info TWL4030_INFO_##label = { \
         .base = offset, \
         .id = num, \
         .table_len = ARRAY_SIZE(label##_VSEL_table), \
@@ -894,7 +876,7 @@ static struct twlreg_info TWL4030_INFO_##label = { \
         }
 
 #define TWL4030_ADJUSTABLE_SMPS(label, offset, num, turnon_delay, remap_conf) \
-static struct twlreg_info TWL4030_INFO_##label = { \
+static const struct twlreg_info TWL4030_INFO_##label = { \
         .base = offset, \
         .id = num, \
         .remap = remap_conf, \
@@ -909,7 +891,7 @@ static struct twlreg_info TWL4030_INFO_##label = { \
         }
 
 #define TWL6030_ADJUSTABLE_SMPS(label) \
-static struct twlreg_info TWL6030_INFO_##label = { \
+static const struct twlreg_info TWL6030_INFO_##label = { \
         .desc = { \
                 .name = #label, \
                 .id = TWL6030_REG_##label, \
@@ -920,7 +902,7 @@ static struct twlreg_info TWL6030_INFO_##label = { \
         }
 
 #define TWL6030_ADJUSTABLE_LDO(label, offset, min_mVolts, max_mVolts) \
-static struct twlreg_info TWL6030_INFO_##label = { \
+static const struct twlreg_info TWL6030_INFO_##label = { \
         .base = offset, \
         .min_mV = min_mVolts, \
         .max_mV = max_mVolts, \
@@ -935,7 +917,7 @@ static struct twlreg_info TWL6030_INFO_##label = { \
         }
 
 #define TWL6025_ADJUSTABLE_LDO(label, offset, min_mVolts, max_mVolts) \
-static struct twlreg_info TWL6025_INFO_##label = { \
+static const struct twlreg_info TWL6025_INFO_##label = { \
         .base = offset, \
         .min_mV = min_mVolts, \
         .max_mV = max_mVolts, \
@@ -951,7 +933,7 @@ static struct twlreg_info TWL6025_INFO_##label = { \
 
 #define TWL_FIXED_LDO(label, offset, mVolts, num, turnon_delay, remap_conf, \
                 family, operations) \
-static struct twlreg_info TWLFIXED_INFO_##label = { \
+static const struct twlreg_info TWLFIXED_INFO_##label = { \
         .base = offset, \
         .id = num, \
         .min_mV = mVolts, \
@@ -981,7 +963,7 @@ static struct twlreg_info TWLRES_INFO_##label = { \
         }
 
 #define TWL6025_ADJUSTABLE_SMPS(label, offset) \
-static struct twlreg_info TWLSMPS_INFO_##label = { \
+static const struct twlreg_info TWLSMPS_INFO_##label = { \
         .base = offset, \
         .min_mV = 600, \
         .max_mV = 2100, \
@@ -1138,6 +1120,7 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
 {
         int                             i, id;
         struct twlreg_info              *info;
+        const struct twlreg_info        *template;
         struct regulator_init_data      *initdata;
         struct regulation_constraints   *c;
         struct regulator_dev            *rdev;
@@ -1147,17 +1130,17 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
 
         match = of_match_device(twl_of_match, &pdev->dev);
         if (match) {
-                info = match->data;
-                id = info->desc.id;
+                template = match->data;
+                id = template->desc.id;
                 initdata = of_get_regulator_init_data(&pdev->dev,
                                                       pdev->dev.of_node);
                 drvdata = NULL;
         } else {
                 id = pdev->id;
                 initdata = pdev->dev.platform_data;
-                for (i = 0, info = NULL; i < ARRAY_SIZE(twl_of_match); i++) {
-                        info = twl_of_match[i].data;
-                        if (info && info->desc.id == id)
+                for (i = 0, template = NULL; i < ARRAY_SIZE(twl_of_match); i++) {
+                        template = twl_of_match[i].data;
+                        if (template && template->desc.id == id)
                                 break;
                 }
                 if (i == ARRAY_SIZE(twl_of_match))
@@ -1168,12 +1151,16 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
                         return -EINVAL;
         }
 
-        if (!info)
+        if (!template)
                 return -ENODEV;
 
         if (!initdata)
                 return -EINVAL;
 
+        info = kmemdup(template, sizeof (*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
         if (drvdata) {
                 /* copy the driver data into regulator data */
                 info->features = drvdata->features;
@@ -1234,6 +1221,7 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
         if (IS_ERR(rdev)) {
                 dev_err(&pdev->dev, "can't register %s, %ld\n",
                                 info->desc.name, PTR_ERR(rdev));
+                kfree(info);
                 return PTR_ERR(rdev);
         }
         platform_set_drvdata(pdev, rdev);
@@ -1255,7 +1243,11 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
 
 static int __devexit twlreg_remove(struct platform_device *pdev)
 {
-        regulator_unregister(platform_get_drvdata(pdev));
+        struct regulator_dev *rdev = platform_get_drvdata(pdev);
+        struct twlreg_info *info = rdev->reg_data;
+
+        regulator_unregister(rdev);
+        kfree(info);
         return 0;
 }
 
diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
index 7413885be01b..90cbcc683704 100644
--- a/drivers/regulator/wm831x-dcdc.c
+++ b/drivers/regulator/wm831x-dcdc.c
@@ -339,16 +339,15 @@ static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
         u16 reg = dcdc->base + WM831X_DCDC_CONTROL_2;
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(wm831x_dcdc_ilim); i++) {
+        for (i = ARRAY_SIZE(wm831x_dcdc_ilim) - 1; i >= 0; i--) {
                 if ((min_uA <= wm831x_dcdc_ilim[i]) &&
                     (wm831x_dcdc_ilim[i] <= max_uA))
-                        break;
+                        return wm831x_set_bits(wm831x, reg,
+                                               WM831X_DC1_HC_THR_MASK,
+                                                i << WM831X_DC1_HC_THR_SHIFT);
         }
-        if (i == ARRAY_SIZE(wm831x_dcdc_ilim))
-                return -EINVAL;
 
-        return wm831x_set_bits(wm831x, reg, WM831X_DC1_HC_THR_MASK,
-                               i << WM831X_DC1_HC_THR_SHIFT);
+        return -EINVAL;
 }
 
 static int wm831x_buckv_get_current_limit(struct regulator_dev *rdev)
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index 5cb70ca1e98d..9af512672be1 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -205,6 +205,8 @@ static int wm831x_gp_ldo_get_status(struct regulator_dev *rdev)
 
         /* Is it reporting under voltage? */
         ret = wm831x_reg_read(wm831x, WM831X_LDO_UV_STATUS);
+        if (ret < 0)
+                return ret;
         if (ret & mask)
                 return REGULATOR_STATUS_ERROR;
 
@@ -237,6 +239,8 @@ static struct regulator_ops wm831x_gp_ldo_ops = {
         .set_mode = wm831x_gp_ldo_set_mode,
         .get_status = wm831x_gp_ldo_get_status,
         .get_optimum_mode = wm831x_gp_ldo_get_optimum_mode,
+        .get_bypass = regulator_get_bypass_regmap,
+        .set_bypass = regulator_set_bypass_regmap,
 
         .is_enabled = regulator_is_enabled_regmap,
         .enable = regulator_enable_regmap,
@@ -293,6 +297,8 @@ static __devinit int wm831x_gp_ldo_probe(struct platform_device *pdev)
         ldo->desc.vsel_mask = WM831X_LDO1_ON_VSEL_MASK;
         ldo->desc.enable_reg = WM831X_LDO_ENABLE;
         ldo->desc.enable_mask = 1 << id;
+        ldo->desc.bypass_reg = ldo->base;
+        ldo->desc.bypass_mask = WM831X_LDO1_SWI;
 
         config.dev = pdev->dev.parent;
         if (pdata)
@@ -469,6 +475,8 @@ static int wm831x_aldo_get_status(struct regulator_dev *rdev)
 
         /* Is it reporting under voltage? */
         ret = wm831x_reg_read(wm831x, WM831X_LDO_UV_STATUS);
+        if (ret < 0)
+                return ret;
         if (ret & mask)
                 return REGULATOR_STATUS_ERROR;
 
@@ -488,6 +496,8 @@ static struct regulator_ops wm831x_aldo_ops = {
         .get_mode = wm831x_aldo_get_mode,
         .set_mode = wm831x_aldo_set_mode,
         .get_status = wm831x_aldo_get_status,
+        .set_bypass = regulator_set_bypass_regmap,
+        .get_bypass = regulator_get_bypass_regmap,
 
         .is_enabled = regulator_is_enabled_regmap,
         .enable = regulator_enable_regmap,
@@ -544,6 +554,8 @@ static __devinit int wm831x_aldo_probe(struct platform_device *pdev)
         ldo->desc.vsel_mask = WM831X_LDO7_ON_VSEL_MASK;
         ldo->desc.enable_reg = WM831X_LDO_ENABLE;
         ldo->desc.enable_mask = 1 << id;
+        ldo->desc.bypass_reg = ldo->base;
+        ldo->desc.bypass_mask = WM831X_LDO7_SWI;
 
         config.dev = pdev->dev.parent;
         if (pdata)
diff --git a/drivers/regulator/wm8400-regulator.c b/drivers/regulator/wm8400-regulator.c
index 9035dd053611..27c746ef0636 100644
--- a/drivers/regulator/wm8400-regulator.c
+++ b/drivers/regulator/wm8400-regulator.c
@@ -120,13 +120,8 @@ static int wm8400_dcdc_set_mode(struct regulator_dev *dev, unsigned int mode)
 
         case REGULATOR_MODE_IDLE:
                 /* Datasheet: standby */
-                ret = wm8400_set_bits(wm8400, WM8400_DCDC1_CONTROL_1 + offset,
-                                      WM8400_DC1_ACTIVE, 0);
-                if (ret != 0)
-                        return ret;
                 return wm8400_set_bits(wm8400, WM8400_DCDC1_CONTROL_1 + offset,
-                                       WM8400_DC1_SLEEP, 0);
-
+                                       WM8400_DC1_ACTIVE | WM8400_DC1_SLEEP, 0);
         default:
                 return -EINVAL;
         }
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 590cfafc7c17..1859f71372e2 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -1008,8 +1008,8 @@ static int rpmsg_probe(struct virtio_device *vdev)
         return 0;
 
 free_coherent:
-        dma_free_coherent(vdev->dev.parent, RPMSG_TOTAL_BUF_SPACE, bufs_va,
-                                        vrp->bufs_dma);
+        dma_free_coherent(vdev->dev.parent->parent, RPMSG_TOTAL_BUF_SPACE,
+                                        bufs_va, vrp->bufs_dma);
 vqs_del:
         vdev->config->del_vqs(vrp->vdev);
 free_vrp:
@@ -1043,7 +1043,7 @@ static void __devexit rpmsg_remove(struct virtio_device *vdev)
 
         vdev->config->del_vqs(vrp->vdev);
 
-        dma_free_coherent(vdev->dev.parent, RPMSG_TOTAL_BUF_SPACE,
+        dma_free_coherent(vdev->dev.parent->parent, RPMSG_TOTAL_BUF_SPACE,
                                         vrp->rbufs, vrp->bufs_dma);
 
         kfree(vrp);
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index c5d06fe83bba..9277d945bf48 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out1;
 
+        /* ensure interrupts are disabled, bootloaders can be strange */
+        ret = twl_rtc_write_u8(0, REG_RTC_INTERRUPTS_REG);
+        if (ret < 0)
+                dev_warn(&pdev->dev, "unable to disable interrupt\n");
+
         /* init cached IRQ enable bits */
         ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
         if (ret < 0)
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 15370a2c5ff0..0595c763dafd 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -534,11 +534,11 @@ static void dasd_change_state(struct dasd_device *device)
         if (rc)
                 device->target = device->state;
 
-        if (device->state == device->target)
-                wake_up(&dasd_init_waitq);
-
         /* let user-space know that the device status changed */
         kobject_uevent(&device->cdev->dev.kobj, KOBJ_CHANGE);
+
+        if (device->state == device->target)
+                wake_up(&dasd_init_waitq);
 }
 
 /*
@@ -2157,6 +2157,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
                     test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
                     (!dasd_eer_enabled(device))) {
                         cqr->status = DASD_CQR_FAILED;
+                        cqr->intrc = -EAGAIN;
                         continue;
                 }
                 /* Don't try to start requests if device is stopped */
@@ -3270,6 +3271,16 @@ void dasd_generic_path_event(struct ccw_device *cdev, int *path_event)
                         dasd_schedule_device_bh(device);
                 }
                 if (path_event[chp] & PE_PATHGROUP_ESTABLISHED) {
+                        if (!(device->path_data.opm & eventlpm) &&
+                            !(device->path_data.tbvpm & eventlpm)) {
+                                /*
+                                 * we can not establish a pathgroup on an
+                                 * unavailable path, so trigger a path
+                                 * verification first
+                                 */
+                                device->path_data.tbvpm |= eventlpm;
+                                dasd_schedule_device_bh(device);
+                        }
                         DBF_DEV_EVENT(DBF_WARNING, device, "%s",
                                       "Pathgroup re-established\n");
                         if (device->discipline->kick_validate)
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 157defe5e069..6b556995bb33 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -384,6 +384,29 @@ static void _remove_device_from_lcu(struct alias_lcu *lcu,
                 group->next = NULL;
 };
 
+static int
+suborder_not_supported(struct dasd_ccw_req *cqr)
+{
+        char *sense;
+        char reason;
+        char msg_format;
+        char msg_no;
+
+        sense = dasd_get_sense(&cqr->irb);
+        if (!sense)
+                return 0;
+
+        reason = sense[0];
+        msg_format = (sense[7] & 0xF0);
+        msg_no = (sense[7] & 0x0F);
+
+        /* command reject, Format 0 MSG 4 - invalid parameter */
+        if ((reason == 0x80) && (msg_format == 0x00) && (msg_no == 0x04))
+                return 1;
+
+        return 0;
+}
+
 static int read_unit_address_configuration(struct dasd_device *device,
                                            struct alias_lcu *lcu)
 {
@@ -435,6 +458,8 @@ static int read_unit_address_configuration(struct dasd_device *device,
 
         do {
                 rc = dasd_sleep_on(cqr);
+                if (rc && suborder_not_supported(cqr))
+                        return -EOPNOTSUPP;
         } while (rc && (cqr->retries > 0));
         if (rc) {
                 spin_lock_irqsave(&lcu->lock, flags);
@@ -521,7 +546,7 @@ static void lcu_update_work(struct work_struct *work)
          * processing the data
          */
         spin_lock_irqsave(&lcu->lock, flags);
-        if (rc || (lcu->flags & NEED_UAC_UPDATE)) {
+        if ((rc && (rc != -EOPNOTSUPP)) || (lcu->flags & NEED_UAC_UPDATE)) {
                 DBF_DEV_EVENT(DBF_WARNING, device, "could not update"
                             " alias data in lcu (rc = %d), retry later", rc);
                 schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ);
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 2fb2b9ea97ec..c48c72abbefc 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -1507,7 +1507,8 @@ static struct dasd_ccw_req *dasd_eckd_build_psf_ssc(struct dasd_device *device,
  * call might change behaviour of DASD devices.
  */
 static int
-dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
+dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav,
+                  unsigned long flags)
 {
         struct dasd_ccw_req *cqr;
         int rc;
@@ -1516,10 +1517,19 @@ dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
         if (IS_ERR(cqr))
                 return PTR_ERR(cqr);
 
+        /*
+         * set flags e.g. turn on failfast, to prevent blocking
+         * the calling function should handle failed requests
+         */
+        cqr->flags |= flags;
+
         rc = dasd_sleep_on(cqr);
         if (!rc)
                 /* trigger CIO to reprobe devices */
                 css_schedule_reprobe();
+        else if (cqr->intrc == -EAGAIN)
+                rc = -EAGAIN;
+
         dasd_sfree_request(cqr, cqr->memdev);
         return rc;
 }
@@ -1527,7 +1537,8 @@ dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
 /*
  * Valide storage server of current device.
  */
-static void dasd_eckd_validate_server(struct dasd_device *device)
+static int dasd_eckd_validate_server(struct dasd_device *device,
+                                     unsigned long flags)
 {
         int rc;
         struct dasd_eckd_private *private;
@@ -1536,17 +1547,18 @@ static void dasd_eckd_validate_server(struct dasd_device *device)
         private = (struct dasd_eckd_private *) device->private;
         if (private->uid.type == UA_BASE_PAV_ALIAS ||
             private->uid.type == UA_HYPER_PAV_ALIAS)
-                return;
+                return 0;
         if (dasd_nopav || MACHINE_IS_VM)
                 enable_pav = 0;
         else
                 enable_pav = 1;
-        rc = dasd_eckd_psf_ssc(device, enable_pav);
+        rc = dasd_eckd_psf_ssc(device, enable_pav, flags);
 
         /* may be requested feature is not available on server,
          * therefore just report error and go ahead */
         DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "PSF-SSC for SSID %04x "
                         "returned rc=%d", private->uid.ssid, rc);
+        return rc;
 }
 
 /*
@@ -1556,7 +1568,13 @@ static void dasd_eckd_do_validate_server(struct work_struct *work)
 {
         struct dasd_device *device = container_of(work, struct dasd_device,
                                                   kick_validate);
-        dasd_eckd_validate_server(device);
+        if (dasd_eckd_validate_server(device, DASD_CQR_FLAGS_FAILFAST)
+            == -EAGAIN) {
+                /* schedule worker again if failed */
+                schedule_work(&device->kick_validate);
+                return;
+        }
+
         dasd_put_device(device);
 }
 
@@ -1685,7 +1703,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
         if (rc)
                 goto out_err2;
 
-        dasd_eckd_validate_server(device);
+        dasd_eckd_validate_server(device, 0);
 
         /* device may report different configuration data after LCU setup */
         rc = dasd_eckd_read_conf(device);
@@ -4153,7 +4171,7 @@ static int dasd_eckd_restore_device(struct dasd_device *device)
         rc = dasd_alias_make_device_known_to_lcu(device);
         if (rc)
                 return rc;
-        dasd_eckd_validate_server(device);
+        dasd_eckd_validate_server(device, DASD_CQR_FLAGS_FAILFAST);
 
         /* RE-Read Configuration Data */
         rc = dasd_eckd_read_conf(device);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index ed25c8740a9c..fc916f5d7314 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1426,6 +1426,8 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
                 return IO_SCH_REPROBE;
         if (cdev->online)
                 return IO_SCH_VERIFY;
+        if (cdev->private->state == DEV_STATE_NOT_OPER)
+                return IO_SCH_UNREG_ATTACH;
         return IO_SCH_NOP;
 }
 
@@ -1519,11 +1521,14 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
                         goto out;
                 break;
         case IO_SCH_UNREG_ATTACH:
+                spin_lock_irqsave(sch->lock, flags);
                 if (cdev->private->flags.resuming) {
                         /* Device will be handled later. */
                         rc = 0;
-                        goto out;
+                        goto out_unlock;
                 }
+                sch_set_cdev(sch, NULL);
+                spin_unlock_irqrestore(sch->lock, flags);
                 /* Unregister ccw device. */
                 ccw_device_unregister(cdev);
                 break;
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 25417d0e7acb..0bcacf71aef8 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -2888,7 +2888,7 @@ ahd_handle_lqiphase_error(struct ahd_softc *ahd, u_int lqistat1)
                 ahd_outb(ahd, CLRINT, CLRSCSIINT);
                 ahd_unpause(ahd);
         } else {
-                printk("Reseting Channel for LQI Phase error\n");
+                printk("Resetting Channel for LQI Phase error\n");
                 ahd_dump_card_state(ahd);
                 ahd_reset_channel(ahd, 'A', /*Initiate Reset*/TRUE);
         }
diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
index 8cdb79c2fcdf..21ad2902e5ce 100644
--- a/drivers/scsi/bfa/bfa_ioc.c
+++ b/drivers/scsi/bfa/bfa_ioc.c
@@ -5587,7 +5587,7 @@ static bfa_status_t bfa_dconf_flash_write(struct bfa_dconf_mod_s *dconf);
 static void bfa_dconf_init_cb(void *arg, bfa_status_t status);
 
 /*
- * Begining state of dconf module. Waiting for an event to start.
+ * Beginning state of dconf module. Waiting for an event to start.
  */
 static void
 bfa_dconf_sm_uninit(struct bfa_dconf_mod_s *dconf, enum bfa_dconf_event event)
diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
index 1a99d4b5b50f..7b916e04ca56 100644
--- a/drivers/scsi/bfa/bfa_ioc.h
+++ b/drivers/scsi/bfa/bfa_ioc.h
@@ -530,7 +530,7 @@ struct bfa_diag_results_fwping {
 
 struct bfa_diag_qtest_result_s {
         u32     status;
-        u16     count;  /* sucessful queue test count */
+        u16     count;  /* successful queue test count */
         u8      queue;
         u8      rsvd;   /* 64-bit align */
 };
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index ae1cb7639d99..e0558656c646 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -908,7 +908,7 @@ static void bnx2fc_indicate_netevent(void *context, unsigned long event,
                 return;
 
         default:
-                printk(KERN_ERR PFX "Unkonwn netevent %ld", event);
+                printk(KERN_ERR PFX "Unknown netevent %ld", event);
                 return;
         }
 
@@ -1738,7 +1738,7 @@ static int bnx2fc_ulp_get_stats(void *handle)
 /**
  * bnx2fc_ulp_start - cnic callback to initialize & start adapter instance
  *
- * @handle:     transport handle pointing to adapter struture
+ * @handle:     transport handle pointing to adapter structure
  *
  * This function maps adapter structure to pcidev structure and initiates
  *      firmware handshake to enable/initialize on-chip FCoE components.
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index 33d6630529de..91eec60252ee 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
         int rc = 0;
         u64 mask64;
 
+        memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
+        memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
+
         bnx2i_adjust_qp_size(hba);
 
         iscsi_init.flags =
diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
index d3e4d7c6f577..fbf6f0f4b0dd 100644
--- a/drivers/scsi/gdth.h
+++ b/drivers/scsi/gdth.h
@@ -49,15 +49,6 @@
 /* GDT_ISA */
 #define GDT2_ID         0x0120941c              /* GDT2000/2020 */
 
-/* vendor ID, device IDs (PCI) */
-/* these defines should already exist in <linux/pci.h> */
-#ifndef PCI_VENDOR_ID_VORTEX
-#define PCI_VENDOR_ID_VORTEX            0x1119  /* PCI controller vendor ID */
-#endif
-#ifndef PCI_VENDOR_ID_INTEL
-#define PCI_VENDOR_ID_INTEL             0x8086  
-#endif
-
 #ifndef PCI_DEVICE_ID_VORTEX_GDT60x0
 /* GDT_PCI */
 #define PCI_DEVICE_ID_VORTEX_GDT60x0    0       /* GDT6000/6020/6050 */
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 796482badf13..2b4261cb7742 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct CommandList *cp)
         }
                 break;
         case CMD_PROTOCOL_ERR:
+                cmd->result = DID_ERROR << 16;
                 dev_warn(&h->pdev->dev, "cp %p has "
-                        "protocol error \n", cp);
+                        "protocol error\n", cp);
                 break;
         case CMD_HARDWARE_ERR:
                 cmd->result = DID_ERROR << 16;
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 467dc38246f9..1059c99690e6 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -192,7 +192,7 @@ static const struct ipr_chip_t ipr_chip[] = {
         { PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CROCODILE, IPR_USE_MSI, IPR_SIS64, IPR_MMIO, &ipr_chip_cfg[2] }
 };
 
-static int ipr_max_bus_speeds [] = {
+static int ipr_max_bus_speeds[] = {
         IPR_80MBs_SCSI_RATE, IPR_U160_SCSI_RATE, IPR_U320_SCSI_RATE
 };
 
@@ -562,7 +562,7 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd,
         trace_entry->u.add_data = add_data;
 }
 #else
-#define ipr_trc_hook(ipr_cmd, type, add_data) do { } while(0)
+#define ipr_trc_hook(ipr_cmd, type, add_data) do { } while (0)
 #endif
 
 /**
@@ -1002,7 +1002,7 @@ static void ipr_send_hcam(struct ipr_ioa_cfg *ioa_cfg, u8 type,
  **/
 static void ipr_update_ata_class(struct ipr_resource_entry *res, unsigned int proto)
 {
-        switch(proto) {
+        switch (proto) {
         case IPR_PROTO_SATA:
         case IPR_PROTO_SAS_STP:
                 res->ata_class = ATA_DEV_ATA;
@@ -3043,7 +3043,7 @@ static void ipr_get_ioa_dump(struct ipr_ioa_cfg *ioa_cfg, struct ipr_dump *dump)
 }
 
 #else
-#define ipr_get_ioa_dump(ioa_cfg, dump) do { } while(0)
+#define ipr_get_ioa_dump(ioa_cfg, dump) do { } while (0)
 #endif
 
 /**
@@ -3055,7 +3055,7 @@ static void ipr_get_ioa_dump(struct ipr_ioa_cfg *ioa_cfg, struct ipr_dump *dump)
  **/
 static void ipr_release_dump(struct kref *kref)
 {
-        struct ipr_dump *dump = container_of(kref,struct ipr_dump,kref);
+        struct ipr_dump *dump = container_of(kref, struct ipr_dump, kref);
         struct ipr_ioa_cfg *ioa_cfg = dump->ioa_cfg;
         unsigned long lock_flags = 0;
         int i;
@@ -3142,7 +3142,7 @@ restart:
                                 break;
                         }
                 }
-        } while(did_work);
+        } while (did_work);
 
         list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
                 if (res->add_to_ml) {
@@ -3268,7 +3268,7 @@ static ssize_t ipr_show_log_level(struct device *dev,
  *      number of bytes printed to buffer
  **/
 static ssize_t ipr_store_log_level(struct device *dev,
-                                   struct device_attribute *attr,
+                                   struct device_attribute *attr,
                                    const char *buf, size_t count)
 {
         struct Scsi_Host *shost = class_to_shost(dev);
@@ -3315,7 +3315,7 @@ static ssize_t ipr_store_diagnostics(struct device *dev,
                 return -EACCES;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -3682,7 +3682,7 @@ static int ipr_update_ioa_ucode(struct ipr_ioa_cfg *ioa_cfg,
         unsigned long lock_flags;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -3746,7 +3746,7 @@ static ssize_t ipr_store_update_fw(struct device *dev,
         len = snprintf(fname, 99, "%s", buf);
         fname[len-1] = '\0';
 
-        if(request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
+        if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
                 dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname);
                 return -EIO;
         }
@@ -4612,7 +4612,7 @@ static int ipr_slave_alloc(struct scsi_device *sdev)
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int __ipr_eh_host_reset(struct scsi_cmnd * scsi_cmd)
+static int __ipr_eh_host_reset(struct scsi_cmnd *scsi_cmd)
 {
         struct ipr_ioa_cfg *ioa_cfg;
         int rc;
@@ -4634,7 +4634,7 @@ static int __ipr_eh_host_reset(struct scsi_cmnd * scsi_cmd)
         return rc;
 }
 
-static int ipr_eh_host_reset(struct scsi_cmnd * cmd)
+static int ipr_eh_host_reset(struct scsi_cmnd *cmd)
 {
         int rc;
 
@@ -4701,7 +4701,7 @@ static int ipr_device_reset(struct ipr_ioa_cfg *ioa_cfg,
         }
 
         LEAVE;
-        return (IPR_IOASC_SENSE_KEY(ioasc) ? -EIO : 0);
+        return IPR_IOASC_SENSE_KEY(ioasc) ? -EIO : 0;
 }
 
 /**
@@ -4725,7 +4725,7 @@ static int ipr_sata_reset(struct ata_link *link, unsigned int *classes,
 
         ENTER;
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -4753,7 +4753,7 @@ static int ipr_sata_reset(struct ata_link *link, unsigned int *classes,
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int __ipr_eh_dev_reset(struct scsi_cmnd * scsi_cmd)
+static int __ipr_eh_dev_reset(struct scsi_cmnd *scsi_cmd)
 {
         struct ipr_cmnd *ipr_cmd;
         struct ipr_ioa_cfg *ioa_cfg;
@@ -4811,10 +4811,10 @@ static int __ipr_eh_dev_reset(struct scsi_cmnd * scsi_cmd)
         res->resetting_device = 0;
 
         LEAVE;
-        return (rc ? FAILED : SUCCESS);
+        return rc ? FAILED : SUCCESS;
 }
 
-static int ipr_eh_dev_reset(struct scsi_cmnd * cmd)
+static int ipr_eh_dev_reset(struct scsi_cmnd *cmd)
 {
         int rc;
 
@@ -4910,7 +4910,7 @@ static void ipr_abort_timeout(struct ipr_cmnd *ipr_cmd)
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
+static int ipr_cancel_op(struct scsi_cmnd *scsi_cmd)
 {
         struct ipr_cmnd *ipr_cmd;
         struct ipr_ioa_cfg *ioa_cfg;
@@ -4979,7 +4979,7 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
                 res->needs_sync_complete = 1;
 
         LEAVE;
-        return (IPR_IOASC_SENSE_KEY(ioasc) ? FAILED : SUCCESS);
+        return IPR_IOASC_SENSE_KEY(ioasc) ? FAILED : SUCCESS;
 }
 
 /**
@@ -4989,7 +4989,7 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int ipr_eh_abort(struct scsi_cmnd * scsi_cmd)
+static int ipr_eh_abort(struct scsi_cmnd *scsi_cmd)
 {
         unsigned long flags;
         int rc;
@@ -5907,7 +5907,7 @@ static int ipr_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
  * Return value:
  *      pointer to buffer with description string
  **/
-static const char * ipr_ioa_info(struct Scsi_Host *host)
+static const char *ipr_ioa_info(struct Scsi_Host *host)
 {
         static char buffer[512];
         struct ipr_ioa_cfg *ioa_cfg;
@@ -5965,7 +5965,7 @@ static void ipr_ata_phy_reset(struct ata_port *ap)
 
         ENTER;
         spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
@@ -6005,7 +6005,7 @@ static void ipr_ata_post_internal(struct ata_queued_cmd *qc)
         unsigned long flags;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
@@ -6330,7 +6330,7 @@ static int ipr_invalid_adapter(struct ipr_ioa_cfg *ioa_cfg)
         int i;
 
         if ((ioa_cfg->type == 0x5702) && (ioa_cfg->pdev->revision < 4)) {
-                for (i = 0; i < ARRAY_SIZE(ipr_blocked_processors); i++){
+                for (i = 0; i < ARRAY_SIZE(ipr_blocked_processors); i++) {
                         if (__is_processor(ipr_blocked_processors[i]))
                                 return 1;
                 }
@@ -6608,7 +6608,7 @@ static void ipr_scsi_bus_speed_limit(struct ipr_ioa_cfg *ioa_cfg)
  *      none
  **/
 static void ipr_modify_ioafp_mode_page_28(struct ipr_ioa_cfg *ioa_cfg,
-                                                struct ipr_mode_pages *mode_pages)
+                                          struct ipr_mode_pages *mode_pages)
 {
         int i, entry_length;
         struct ipr_dev_bus_entry *bus;
@@ -8022,7 +8022,7 @@ static void ipr_reset_ioa_job(struct ipr_cmnd *ipr_cmd)
                 ipr_reinit_ipr_cmnd(ipr_cmd);
                 ipr_cmd->job_step_failed = ipr_reset_cmd_failed;
                 rc = ipr_cmd->job_step(ipr_cmd);
-        } while(rc == IPR_RC_JOB_CONTINUE);
+        } while (rc == IPR_RC_JOB_CONTINUE);
 }
 
 /**
@@ -8283,7 +8283,7 @@ static void ipr_free_cmd_blks(struct ipr_ioa_cfg *ioa_cfg)
         }
 
         if (ioa_cfg->ipr_cmd_pool)
-                pci_pool_destroy (ioa_cfg->ipr_cmd_pool);
+                pci_pool_destroy(ioa_cfg->ipr_cmd_pool);
 
         kfree(ioa_cfg->ipr_cmnd_list);
         kfree(ioa_cfg->ipr_cmnd_list_dma);
@@ -8363,8 +8363,8 @@ static int __devinit ipr_alloc_cmd_blks(struct ipr_ioa_cfg *ioa_cfg)
         dma_addr_t dma_addr;
         int i;
 
-        ioa_cfg->ipr_cmd_pool = pci_pool_create (IPR_NAME, ioa_cfg->pdev,
-                                                 sizeof(struct ipr_cmnd), 512, 0);
+        ioa_cfg->ipr_cmd_pool = pci_pool_create(IPR_NAME, ioa_cfg->pdev,
+                                                sizeof(struct ipr_cmnd), 512, 0);
 
         if (!ioa_cfg->ipr_cmd_pool)
                 return -ENOMEM;
@@ -8378,7 +8378,7 @@ static int __devinit ipr_alloc_cmd_blks(struct ipr_ioa_cfg *ioa_cfg)
         }
 
         for (i = 0; i < IPR_NUM_CMD_BLKS; i++) {
-                ipr_cmd = pci_pool_alloc (ioa_cfg->ipr_cmd_pool, GFP_KERNEL, &dma_addr);
+                ipr_cmd = pci_pool_alloc(ioa_cfg->ipr_cmd_pool, GFP_KERNEL, &dma_addr);
 
                 if (!ipr_cmd) {
                         ipr_free_cmd_blks(ioa_cfg);
@@ -8964,7 +8964,7 @@ static void ipr_scan_vsets(struct ipr_ioa_cfg *ioa_cfg)
         int target, lun;
 
         for (target = 0; target < IPR_MAX_NUM_TARGETS_PER_BUS; target++)
-                for (lun = 0; lun < IPR_MAX_NUM_VSET_LUNS_PER_TARGET; lun++ )
+                for (lun = 0; lun < IPR_MAX_NUM_VSET_LUNS_PER_TARGET; lun++)
                         scsi_add_device(ioa_cfg->host, IPR_VSET_BUS, target, lun);
 }
 
@@ -9010,7 +9010,7 @@ static void __ipr_remove(struct pci_dev *pdev)
         ENTER;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, host_lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, host_lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, host_lock_flags);
@@ -9139,7 +9139,7 @@ static void ipr_shutdown(struct pci_dev *pdev)
         unsigned long lock_flags = 0;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
index 45385f531649..b334fdc1726a 100644
--- a/drivers/scsi/isci/host.c
+++ b/drivers/scsi/isci/host.c
@@ -492,7 +492,7 @@ static void sci_controller_process_completions(struct isci_host *ihost)
         u32 event_cycle;
 
         dev_dbg(&ihost->pdev->dev,
-                "%s: completion queue begining get:0x%08x\n",
+                "%s: completion queue beginning get:0x%08x\n",
                 __func__,
                 ihost->completion_queue_get);
 
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 92c1d86d1fc6..9be45a2b2232 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -222,7 +222,7 @@ static struct sas_domain_function_template isci_transport_ops  = {
  * @isci_host: This parameter specifies the lldd specific wrapper for the
  *    libsas sas_ha struct.
  *
- * This method returns an error code indicating sucess or failure. The user
+ * This method returns an error code indicating success or failure. The user
  * should check for possible memory allocation error return otherwise, a zero
  * indicates success.
  */
diff --git a/drivers/scsi/isci/port.c b/drivers/scsi/isci/port.c
index 2fb85bf75449..13098b09a824 100644
--- a/drivers/scsi/isci/port.c
+++ b/drivers/scsi/isci/port.c
@@ -212,7 +212,7 @@ static void isci_port_link_up(struct isci_host *isci_host,
                 memcpy(iphy->sas_phy.attached_sas_addr,
                        iphy->frame_rcvd.iaf.sas_addr, SAS_ADDR_SIZE);
         } else {
-                dev_err(&isci_host->pdev->dev, "%s: unkown target\n", __func__);
+                dev_err(&isci_host->pdev->dev, "%s: unknown target\n", __func__);
                 success = false;
         }
 
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index 7a0431c73493..c1bafc3f3fb1 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -2240,7 +2240,7 @@ static enum sci_status atapi_data_tc_completion_handler(struct isci_request *ire
                         status = ireq->sci_status;
                         sci_change_state(&idev->sm, SCI_STP_DEV_ATAPI_ERROR);
                 } else {
-                        /* If receiving any non-sucess TC status, no UF
+                        /* If receiving any non-success TC status, no UF
                          * received yet, then an UF for the status fis
                          * is coming after (XXX: suspect this is
                          * actually a protocol error or a bug like the
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 6bc74eb012c9..b6f19a1db780 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -532,7 +532,7 @@ int isci_task_abort_task(struct sas_task *task)
                 /* The request has already completed and there
                 * is nothing to do here other than to set the task
                 * done bit, and indicate that the task abort function
-                * was sucessful.
+                * was successful.
                 */
                 spin_lock_irqsave(&task->task_state_lock, flags);
                 task->task_state_flags |= SAS_TASK_STATE_DONE;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 45c15208be9f..29937b606c84 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -6607,7 +6607,7 @@ out_error:
  * we just use some constant number as place holder.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      -ENOMEM - No availble memory
  *      -EIO - The mailbox failed to complete successfully.
  **/
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 9cbd20b1328b..0e7e144507b2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -4739,7 +4739,7 @@ lpfc_sli4_read_rev(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq,
  * is attached to.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      otherwise - failed to retrieve physical port name
  **/
 static int
@@ -15209,7 +15209,7 @@ lpfc_check_next_fcf_pri_level(struct lpfc_hba *phba)
         /*
          * if next_fcf_pri was not set above and the list is not empty then
          * we have failed flogis on all of them. So reset flogi failed
-         * and start at the begining.
+         * and start at the beginning.
          */
         if (!next_fcf_pri && !list_empty(&phba->fcf.fcf_pri_list)) {
                 list_for_each_entry(fcf_pri, &phba->fcf.fcf_pri_list, list) {
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 97825f116954..76ad72d32c3f 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -305,12 +305,11 @@ mega_query_adapter(adapter_t *adapter)
 
         adapter->host->sg_tablesize = adapter->sglen;
 
-
         /* use HP firmware and bios version encoding
            Note: fw_version[0|1] and bios_version[0|1] were originally shifted
            right 8 bits making them zero. This 0 value was hardcoded to fix
            sparse warnings. */
-        if (adapter->product_info.subsysvid == HP_SUBSYS_VID) {
+        if (adapter->product_info.subsysvid == PCI_VENDOR_ID_HP) {
                 sprintf (adapter->fw_version, "%c%d%d.%d%d",
                          adapter->product_info.fw_version[2],
                          0,
@@ -4716,7 +4715,7 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
          * support, since this firmware cannot handle 64 bit
          * addressing
          */
-        if ((subsysvid == HP_SUBSYS_VID) &&
+        if ((subsysvid == PCI_VENDOR_ID_HP) &&
             ((subsysid == 0x60E7) || (subsysid == 0x60E8))) {
                 /*
                  * which firmware
diff --git a/drivers/scsi/megaraid.h b/drivers/scsi/megaraid.h
index 9a7897f8ca43..4fb2adf6b80d 100644
--- a/drivers/scsi/megaraid.h
+++ b/drivers/scsi/megaraid.h
@@ -45,45 +45,10 @@
 
 #define MAX_DEV_TYPE    32
 
-#ifndef PCI_VENDOR_ID_LSI_LOGIC
-#define PCI_VENDOR_ID_LSI_LOGIC         0x1000
-#endif
-
-#ifndef PCI_VENDOR_ID_AMI
-#define PCI_VENDOR_ID_AMI               0x101E
-#endif
-
-#ifndef PCI_VENDOR_ID_DELL
-#define PCI_VENDOR_ID_DELL              0x1028
-#endif
-
-#ifndef PCI_VENDOR_ID_INTEL
-#define PCI_VENDOR_ID_INTEL             0x8086
-#endif
-
-#ifndef PCI_DEVICE_ID_AMI_MEGARAID
-#define PCI_DEVICE_ID_AMI_MEGARAID      0x9010
-#endif
-
-#ifndef PCI_DEVICE_ID_AMI_MEGARAID2
-#define PCI_DEVICE_ID_AMI_MEGARAID2     0x9060
-#endif
-
-#ifndef PCI_DEVICE_ID_AMI_MEGARAID3
-#define PCI_DEVICE_ID_AMI_MEGARAID3     0x1960
-#endif
-
 #define PCI_DEVICE_ID_DISCOVERY         0x000E
 #define PCI_DEVICE_ID_PERC4_DI          0x000F
 #define PCI_DEVICE_ID_PERC4_QC_VERDE    0x0407
 
-/* Sub-System Vendor IDs */
-#define AMI_SUBSYS_VID                  0x101E
-#define DELL_SUBSYS_VID                 0x1028
-#define HP_SUBSYS_VID                   0x103C
-#define LSI_SUBSYS_VID                  0x1000
-#define INTEL_SUBSYS_VID                0x8086
-
 #define HBA_SIGNATURE                   0x3344
 #define HBA_SIGNATURE_471               0xCCCC
 #define HBA_SIGNATURE_64BIT             0x0299
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index dc27598785e5..ed38454228c6 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4066,7 +4066,6 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         spin_lock_init(&instance->cmd_pool_lock);
         spin_lock_init(&instance->hba_lock);
         spin_lock_init(&instance->completion_lock);
-        spin_lock_init(&poll_aen_lock);
 
         mutex_init(&instance->aen_mutex);
         mutex_init(&instance->reset_mutex);
@@ -5392,6 +5391,8 @@ static int __init megasas_init(void)
         printk(KERN_INFO "megasas: %s %s\n", MEGASAS_VERSION,
                MEGASAS_EXT_VERSION);
 
+        spin_lock_init(&poll_aen_lock);
+
         support_poll_for_event = 2;
         support_device_change = 1;
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 9d46fcbe7755..9d5a56c4b332 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_ADAPTER *ioc)
         u16 message_control;
 
 
+        /* Check whether controller SAS2008 B0 controller,
+           if it is SAS2008 B0 controller use IO-APIC instead of MSIX */
+        if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 &&
+            ioc->pdev->revision == 0x01) {
+                return -EINVAL;
+        }
+
         base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX);
         if (!base) {
                 dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
@@ -2424,10 +2431,13 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
         }
 
         /* command line tunables  for max controller queue depth */
-        if (max_queue_depth != -1)
-                max_request_credit = (max_queue_depth < facts->RequestCredit)
-                    ? max_queue_depth : facts->RequestCredit;
-        else
+        if (max_queue_depth != -1 && max_queue_depth != 0) {
+                max_request_credit = min_t(u16, max_queue_depth +
+                        ioc->hi_priority_depth + ioc->internal_depth,
+                        facts->RequestCredit);
+                if (max_request_credit > MAX_HBA_QUEUE_DEPTH)
+                        max_request_credit =  MAX_HBA_QUEUE_DEPTH;
+        } else
                 max_request_credit = min_t(u16, facts->RequestCredit,
                     MAX_HBA_QUEUE_DEPTH);
 
@@ -2502,7 +2512,7 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
         /* set the scsi host can_queue depth
          * with some internal commands that could be outstanding
          */
-        ioc->shost->can_queue = ioc->scsiio_depth - (2);
+        ioc->shost->can_queue = ioc->scsiio_depth;
         dinitprintk(ioc, printk(MPT2SAS_INFO_FMT "scsi host: "
             "can_queue depth (%d)\n", ioc->name, ioc->shost->can_queue));
 
diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
index 88cf1db21a79..783edc7c6b98 100644
--- a/drivers/scsi/mvumi.c
+++ b/drivers/scsi/mvumi.c
@@ -122,7 +122,7 @@ static struct mvumi_res *mvumi_alloc_mem_resource(struct mvumi_hba *mhba,
 
         if (!res) {
                 dev_err(&mhba->pdev->dev,
-                        "Failed to allocate memory for resouce manager.\n");
+                        "Failed to allocate memory for resource manager.\n");
                 return NULL;
         }
 
@@ -1007,13 +1007,13 @@ static int mvumi_handshake(struct mvumi_hba *mhba)
                 tmp |= INT_MAP_COMAOUT | INT_MAP_COMAERR;
                 iowrite32(tmp, regs + CPU_ENPOINTA_MASK_REG);
                 iowrite32(mhba->list_num_io, mhba->ib_shadow);
-                /* Set InBound List Avaliable count shadow */
+                /* Set InBound List Available count shadow */
                 iowrite32(lower_32_bits(mhba->ib_shadow_phys),
                                         regs + CLA_INB_AVAL_COUNT_BASEL);
                 iowrite32(upper_32_bits(mhba->ib_shadow_phys),
                                         regs + CLA_INB_AVAL_COUNT_BASEH);
 
-                /* Set OutBound List Avaliable count shadow */
+                /* Set OutBound List Available count shadow */
                 iowrite32((mhba->list_num_io-1) | CL_POINTER_TOGGLE,
                                                 mhba->ob_shadow);
                 iowrite32(lower_32_bits(mhba->ob_shadow_phys), regs + 0x5B0);
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 9da426628b97..487e3c8411c9 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -803,7 +803,7 @@ static void qla4xxx_conn_get_stats(struct iscsi_cls_conn *cls_conn,
                                      iscsi_stats_dma);
         if (ret != QLA_SUCCESS) {
                 ql4_printk(KERN_ERR, ha,
-                           "Unable to retreive iscsi stats\n");
+                           "Unable to retrieve iscsi stats\n");
                 goto free_stats;
         }
 
@@ -4338,7 +4338,7 @@ static int qla4xxx_compare_tuple_ddb(struct scsi_qla_host *ha,
                 return QLA_ERROR;
 
         /* For multi sessions, driver generates the ISID, so do not compare
-         * ISID in reset path since it would be a comparision between the
+         * ISID in reset path since it would be a comparison between the
          * driver generated ISID and firmware generated ISID. This could
          * lead to adding duplicated DDBs in the list as driver generated
          * ISID would not match firmware generated ISID.
@@ -5326,7 +5326,7 @@ static void qla4xxx_destroy_fw_ddb_session(struct scsi_qla_host *ha)
         }
 }
 /**
- * qla4xxx_remove_adapter - calback function to remove adapter.
+ * qla4xxx_remove_adapter - callback function to remove adapter.
  * @pci_dev: PCI device pointer
  **/
 static void __devexit qla4xxx_remove_adapter(struct pci_dev *pdev)
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 4a6381c87253..de2337f255a7 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -42,6 +42,8 @@
 
 #include <trace/events/scsi.h>
 
+static void scsi_eh_done(struct scsi_cmnd *scmd);
+
 #define SENSE_TIMEOUT           (10*HZ)
 
 /*
@@ -241,6 +243,14 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
         if (! scsi_command_normalize_sense(scmd, &sshdr))
                 return FAILED;  /* no valid sense data */
 
+        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
+                /*
+                 * nasty: for mid-layer issued TURs, we need to return the
+                 * actual sense data without any recovery attempt.  For eh
+                 * issued ones, we need to try to recover and interpret
+                 */
+                return SUCCESS;
+
         if (scsi_sense_is_deferred(&sshdr))
                 return NEEDS_RETRY;
 
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ffd77739ae3e..faa790fba134 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -776,7 +776,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
         }
 
         if (req->cmd_type == REQ_TYPE_BLOCK_PC) { /* SG_IO ioctl from block level */
-                req->errors = result;
                 if (result) {
                         if (sense_valid && req->sense) {
                                 /*
@@ -792,6 +791,10 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                         if (!sense_deferred)
                                 error = __scsi_error_from_host_byte(cmd, result);
                 }
+                /*
+                 * __scsi_error_from_host_byte may have reset the host_byte
+                 */
+                req->errors = cmd->result;
 
                 req->resid_len = scsi_get_resid(cmd);
 
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 56a93794c470..d947ffc20ceb 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -764,6 +764,16 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         sdev->model = (char *) (sdev->inquiry + 16);
         sdev->rev = (char *) (sdev->inquiry + 32);
 
+        if (strncmp(sdev->vendor, "ATA     ", 8) == 0) {
+                /*
+                 * sata emulation layer device.  This is a hack to work around
+                 * the SATL power management specifications which state that
+                 * when the SATL detects the device has gone into standby
+                 * mode, it shall respond with NOT READY.
+                 */
+                sdev->allow_restart = 1;
+        }
+
         if (*bflags & BLIST_ISROM) {
                 sdev->type = TYPE_ROM;
                 sdev->removable = 1;
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index c7030fbee79c..3e79a2f00042 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -331,7 +331,7 @@ static void virtscsi_map_sgl(struct scatterlist *sg, unsigned int *p_idx,
         int i;
 
         for_each_sg(table->sgl, sg_elem, table->nents, i)
-                sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
+                sg[idx++] = *sg_elem;
 
         *p_idx = idx;
 }
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 4411d4224401..20b3a483c2cc 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -295,7 +295,7 @@ static void ll_adapter_reset(const struct pvscsi_adapter *adapter)
 
 static void ll_bus_reset(const struct pvscsi_adapter *adapter)
 {
-        dev_dbg(pvscsi_dev(adapter), "Reseting bus on %p\n", adapter);
+        dev_dbg(pvscsi_dev(adapter), "Resetting bus on %p\n", adapter);
 
         pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_BUS, NULL, 0);
 }
@@ -304,7 +304,7 @@ static void ll_device_reset(const struct pvscsi_adapter *adapter, u32 target)
 {
         struct PVSCSICmdDescResetDevice cmd = { 0 };
 
-        dev_dbg(pvscsi_dev(adapter), "Reseting device: target=%u\n", target);
+        dev_dbg(pvscsi_dev(adapter), "Resetting device: target=%u\n", target);
 
         cmd.target = target;
 
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 32c26d795ed0..8f32a1323a79 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -355,7 +355,7 @@ int __init register_intc_controller(struct intc_desc *desc)
                         if (unlikely(res)) {
                                 if (res == -EEXIST) {
                                         res = irq_domain_associate(d->domain,
-                                                                   irq, irq);
+                                                                   irq2, irq2);
                                         if (unlikely(res)) {
                                                 pr_err("domain association "
                                                        "failure\n");
diff --git a/drivers/sh/pfc/pinctrl.c b/drivers/sh/pfc/pinctrl.c
index 2804eaae804e..0646bf6e7889 100644
--- a/drivers/sh/pfc/pinctrl.c
+++ b/drivers/sh/pfc/pinctrl.c
@@ -208,10 +208,13 @@ static int sh_pfc_gpio_request_enable(struct pinctrl_dev *pctldev,
 
                 break;
         case PINMUX_TYPE_GPIO:
+        case PINMUX_TYPE_INPUT:
+        case PINMUX_TYPE_OUTPUT:
                 break;
         default:
                 pr_err("Unsupported mux type (%d), bailing...\n", pinmux_type);
-                return -ENOTSUPP;
+                ret = -ENOTSUPP;
+                goto err;
         }
 
         ret = 0;
diff --git a/drivers/spi/spi-au1550.c b/drivers/spi/spi-au1550.c
index 5784c8799616..4de66d1cfe51 100644
--- a/drivers/spi/spi-au1550.c
+++ b/drivers/spi/spi-au1550.c
@@ -475,7 +475,7 @@ static irqreturn_t au1550_spi_dma_irq_callback(struct au1550_spi *hw)
                 /*
                  * due to an spi error we consider transfer as done,
                  * so mask all events until before next transfer start
-                 * and stop the possibly running dma immediatelly
+                 * and stop the possibly running dma immediately
                  */
                 au1550_spi_mask_ack_all(hw);
                 au1xxx_dbdma_stop(hw->dma_rx_ch);
diff --git a/drivers/spi/spi-bfin-sport.c b/drivers/spi/spi-bfin-sport.c
index 1fe51198a622..6555ecd07302 100644
--- a/drivers/spi/spi-bfin-sport.c
+++ b/drivers/spi/spi-bfin-sport.c
@@ -467,7 +467,7 @@ bfin_sport_spi_pump_transfers(unsigned long data)
                 dev_dbg(drv_data->dev, "IO write error!\n");
                 drv_data->state = ERROR_STATE;
         } else {
-                /* Update total byte transfered */
+                /* Update total byte transferred */
                 message->actual_length += transfer->len;
                 /* Move to next transfer of this msg */
                 drv_data->state = bfin_sport_spi_next_transfer(drv_data);
diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c
index 698018fd992b..9d9071b730be 100644
--- a/drivers/spi/spi-oc-tiny.c
+++ b/drivers/spi/spi-oc-tiny.c
@@ -129,7 +129,7 @@ static int tiny_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
         unsigned int i;
 
         if (hw->irq >= 0) {
-                /* use intrrupt driven data transfer */
+                /* use interrupt driven data transfer */
                 hw->len = t->len;
                 hw->txp = t->tx_buf;
                 hw->rxp = t->rx_buf;
diff --git a/drivers/spi/spi-ppc4xx.c b/drivers/spi/spi-ppc4xx.c
index 75ac9d48ef46..7a85f22b6474 100644
--- a/drivers/spi/spi-ppc4xx.c
+++ b/drivers/spi/spi-ppc4xx.c
@@ -101,7 +101,7 @@ struct spi_ppc4xx_regs {
         u8 dummy;
         /*
          * Clock divisor modulus register
-         * This uses the follwing formula:
+         * This uses the following formula:
          *    SCPClkOut = OPBCLK/(4(CDM + 1))
          * or
          *    CDM = (OPBCLK/4*SCPClkOut) - 1
@@ -201,7 +201,7 @@ static int spi_ppc4xx_setupxfer(struct spi_device *spi, struct spi_transfer *t)
                 return -EINVAL;
         }
 
-        /* Write new configration */
+        /* Write new configuration */
         out_8(&hw->regs->mode, cs->mode);
 
         /* Set the clock */
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index cd56dcf46320..1284c9b74653 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -505,7 +505,7 @@ static int pch_spi_transfer(struct spi_device *pspi, struct spi_message *pmsg)
         }
 
         if (unlikely(pspi->max_speed_hz == 0)) {
-                dev_err(&pspi->dev, "%s pch_spi_tranfer maxspeed=%d\n",
+                dev_err(&pspi->dev, "%s pch_spi_transfer maxspeed=%d\n",
                         __func__, pspi->max_speed_hz);
                 retval = -EINVAL;
                 goto err_out;
diff --git a/drivers/staging/android/android_alarm.h b/drivers/staging/android/android_alarm.h
index d0cafd637199..f2ffd963f1c3 100644
--- a/drivers/staging/android/android_alarm.h
+++ b/drivers/staging/android/android_alarm.h
@@ -51,10 +51,12 @@ enum android_alarm_return_flags {
 #define ANDROID_ALARM_WAIT                  _IO('a', 1)
 
 #define ALARM_IOW(c, type, size)            _IOW('a', (c) | ((type) << 4), size)
+#define ALARM_IOR(c, type, size)            _IOR('a', (c) | ((type) << 4), size)
+
 /* Set alarm */
 #define ANDROID_ALARM_SET(type)             ALARM_IOW(2, type, struct timespec)
 #define ANDROID_ALARM_SET_AND_WAIT(type)    ALARM_IOW(3, type, struct timespec)
-#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOW(4, type, struct timespec)
+#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOR(4, type, struct timespec)
 #define ANDROID_ALARM_SET_RTC               _IOW('a', 5, struct timespec)
 #define ANDROID_ALARM_BASE_CMD(cmd)         (cmd & ~(_IOC(0, 0, 0xf0, 0)))
 #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd)    (_IOC_NR(cmd) >> 4)
diff --git a/drivers/staging/comedi/drivers/amplc_dio200.c b/drivers/staging/comedi/drivers/amplc_dio200.c
index 6c81e377262c..cc8931fde839 100644
--- a/drivers/staging/comedi/drivers/amplc_dio200.c
+++ b/drivers/staging/comedi/drivers/amplc_dio200.c
@@ -1412,6 +1412,13 @@ static int __devinit dio200_attach_pci(struct comedi_device *dev,
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in dio200_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via dio200_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return dio200_pci_common_attach(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pc236.c b/drivers/staging/comedi/drivers/amplc_pc236.c
index aabba9886b7d..f50287903038 100644
--- a/drivers/staging/comedi/drivers/amplc_pc236.c
+++ b/drivers/staging/comedi/drivers/amplc_pc236.c
@@ -565,6 +565,13 @@ static int __devinit pc236_attach_pci(struct comedi_device *dev,
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pc236_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pc236_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pc236_pci_common_attach(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pc263.c b/drivers/staging/comedi/drivers/amplc_pc263.c
index 40ec1ffebba6..8191c4e28e0a 100644
--- a/drivers/staging/comedi/drivers/amplc_pc263.c
+++ b/drivers/staging/comedi/drivers/amplc_pc263.c
@@ -298,6 +298,13 @@ static int __devinit pc263_attach_pci(struct comedi_device *dev,
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pc263_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pc263_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pc263_pci_common_attach(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pci224.c b/drivers/staging/comedi/drivers/amplc_pci224.c
index 4e17f13e57f6..8bf109e7bb05 100644
--- a/drivers/staging/comedi/drivers/amplc_pci224.c
+++ b/drivers/staging/comedi/drivers/amplc_pci224.c
@@ -1503,6 +1503,13 @@ pci224_attach_pci(struct comedi_device *dev, struct pci_dev *pci_dev)
                         DRIVER_NAME ": BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pci224_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pci224_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pci224_attach_common(dev, pci_dev, NULL);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pci230.c b/drivers/staging/comedi/drivers/amplc_pci230.c
index 1b67d0c61fa7..66e74bd12267 100644
--- a/drivers/staging/comedi/drivers/amplc_pci230.c
+++ b/drivers/staging/comedi/drivers/amplc_pci230.c
@@ -2925,6 +2925,13 @@ static int __devinit pci230_attach_pci(struct comedi_device *dev,
                         "amplc_pci230: BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pci230_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pci230_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pci230_attach_common(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
index 874e02e47668..67a914a10b55 100644
--- a/drivers/staging/comedi/drivers/das08.c
+++ b/drivers/staging/comedi/drivers/das08.c
@@ -378,7 +378,7 @@ das08jr_ao_winsn(struct comedi_device *dev, struct comedi_subdevice *s,
         int chan;
 
         lsb = data[0] & 0xff;
-        msb = (data[0] >> 8) & 0xf;
+        msb = (data[0] >> 8) & 0xff;
 
         chan = CR_CHAN(insn->chanspec);
 
@@ -623,7 +623,7 @@ static const struct das08_board_struct das08_boards[] = {
                 .ai = das08_ai_rinsn,
                 .ai_nbits = 16,
                 .ai_pg = das08_pg_none,
-                .ai_encoding = das08_encode12,
+                .ai_encoding = das08_encode16,
                 .ao = das08jr_ao_winsn,
                 .ao_nbits = 16,
                 .di = das08jr_di_rbits,
@@ -922,6 +922,13 @@ das08_attach_pci(struct comedi_device *dev, struct pci_dev *pdev)
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in das08_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via das08_attach()
+         * has been removed.
+         */
+        pci_dev_get(pdev);
         return das08_pci_attach_common(dev, pdev);
 }
 
diff --git a/drivers/staging/iio/accel/lis3l02dq_ring.c b/drivers/staging/iio/accel/lis3l02dq_ring.c
index 18d108fd967a..f3da59063ed2 100644
--- a/drivers/staging/iio/accel/lis3l02dq_ring.c
+++ b/drivers/staging/iio/accel/lis3l02dq_ring.c
@@ -121,8 +121,10 @@ static int lis3l02dq_get_buffer_element(struct iio_dev *indio_dev,
         if (rx_array == NULL)
                 return -ENOMEM;
         ret = lis3l02dq_read_all(indio_dev, rx_array);
-        if (ret < 0)
+        if (ret < 0) {
+                kfree(rx_array);
                 return ret;
+        }
         for (i = 0; i < scan_count; i++)
                 data[i] = combine_8_to_16(rx_array[i*4+1],
                                         rx_array[i*4+3]);
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index 095837285f4f..19a064d649e3 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -647,6 +647,8 @@ static ssize_t ad7192_write_frequency(struct device *dev,
         ret = strict_strtoul(buf, 10, &lval);
         if (ret)
                 return ret;
+        if (lval == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
         if (iio_buffer_enabled(indio_dev)) {
diff --git a/drivers/staging/iio/gyro/adis16260_core.c b/drivers/staging/iio/gyro/adis16260_core.c
index 93aa431287ac..eb8e9d69efd3 100644
--- a/drivers/staging/iio/gyro/adis16260_core.c
+++ b/drivers/staging/iio/gyro/adis16260_core.c
@@ -195,6 +195,8 @@ static ssize_t adis16260_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
         if (spi_get_device_id(st->us)) {
diff --git a/drivers/staging/iio/imu/adis16400_core.c b/drivers/staging/iio/imu/adis16400_core.c
index 1f4c17779b5a..a618327e06ed 100644
--- a/drivers/staging/iio/imu/adis16400_core.c
+++ b/drivers/staging/iio/imu/adis16400_core.c
@@ -234,6 +234,8 @@ static ssize_t adis16400_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/iio/meter/ade7753.c b/drivers/staging/iio/meter/ade7753.c
index f04ece7fbc2f..3ccff189f258 100644
--- a/drivers/staging/iio/meter/ade7753.c
+++ b/drivers/staging/iio/meter/ade7753.c
@@ -425,6 +425,8 @@ static ssize_t ade7753_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/iio/meter/ade7754.c b/drivers/staging/iio/meter/ade7754.c
index 6cee28a5e877..abb1e9c8d094 100644
--- a/drivers/staging/iio/meter/ade7754.c
+++ b/drivers/staging/iio/meter/ade7754.c
@@ -445,6 +445,8 @@ static ssize_t ade7754_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/iio/meter/ade7759.c b/drivers/staging/iio/meter/ade7759.c
index b3f7e0fa9612..eb0a2a98f388 100644
--- a/drivers/staging/iio/meter/ade7759.c
+++ b/drivers/staging/iio/meter/ade7759.c
@@ -385,6 +385,8 @@ static ssize_t ade7759_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 695ea35f75b0..d0a7e408efe9 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -837,7 +837,7 @@ static int __devinit tegra_nvec_probe(struct platform_device *pdev)
         }
 
         ret = mfd_add_devices(nvec->dev, -1, nvec_devices,
-                              ARRAY_SIZE(nvec_devices), base, 0);
+                              ARRAY_SIZE(nvec_devices), base, 0, NULL);
         if (ret)
                 dev_err(nvec->dev, "error adding subdevices\n");
 
diff --git a/drivers/staging/omapdrm/omap_connector.c b/drivers/staging/omapdrm/omap_connector.c
index 5e2856c0e0bb..55e9c8655850 100644
--- a/drivers/staging/omapdrm/omap_connector.c
+++ b/drivers/staging/omapdrm/omap_connector.c
@@ -48,13 +48,20 @@ static inline void copy_timings_omap_to_drm(struct drm_display_mode *mode,
         mode->vsync_end = mode->vsync_start + timings->vsw;
         mode->vtotal = mode->vsync_end + timings->vbp;
 
-        /* note: whether or not it is interlaced, +/- h/vsync, etc,
-         * which should be set in the mode flags, is not exposed in
-         * the omap_video_timings struct.. but hdmi driver tracks
-         * those separately so all we have to have to set the mode
-         * is the way to recover these timings values, and the
-         * omap_dss_driver would do the rest.
-         */
+        mode->flags = 0;
+
+        if (timings->interlace)
+                mode->flags |= DRM_MODE_FLAG_INTERLACE;
+
+        if (timings->hsync_level == OMAPDSS_SIG_ACTIVE_HIGH)
+                mode->flags |= DRM_MODE_FLAG_PHSYNC;
+        else
+                mode->flags |= DRM_MODE_FLAG_NHSYNC;
+
+        if (timings->vsync_level == OMAPDSS_SIG_ACTIVE_HIGH)
+                mode->flags |= DRM_MODE_FLAG_PVSYNC;
+        else
+                mode->flags |= DRM_MODE_FLAG_NVSYNC;
 }
 
 static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
@@ -71,6 +78,22 @@ static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
         timings->vfp = mode->vsync_start - mode->vdisplay;
         timings->vsw = mode->vsync_end - mode->vsync_start;
         timings->vbp = mode->vtotal - mode->vsync_end;
+
+        timings->interlace = !!(mode->flags & DRM_MODE_FLAG_INTERLACE);
+
+        if (mode->flags & DRM_MODE_FLAG_PHSYNC)
+                timings->hsync_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        else
+                timings->hsync_level = OMAPDSS_SIG_ACTIVE_LOW;
+
+        if (mode->flags & DRM_MODE_FLAG_PVSYNC)
+                timings->vsync_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        else
+                timings->vsync_level = OMAPDSS_SIG_ACTIVE_LOW;
+
+        timings->data_pclk_edge = OMAPDSS_DRIVE_SIG_RISING_EDGE;
+        timings->de_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        timings->sync_pclk_edge = OMAPDSS_DRIVE_SIG_OPPOSITE_EDGES;
 }
 
 static void omap_connector_dpms(struct drm_connector *connector, int mode)
@@ -187,7 +210,7 @@ static int omap_connector_get_modes(struct drm_connector *connector)
                 }
         } else {
                 struct drm_display_mode *mode = drm_mode_create(dev);
-                struct omap_video_timings timings;
+                struct omap_video_timings timings = {0};
 
                 dssdrv->get_timings(dssdev, &timings);
 
@@ -291,7 +314,7 @@ void omap_connector_mode_set(struct drm_connector *connector,
         struct omap_connector *omap_connector = to_omap_connector(connector);
         struct omap_dss_device *dssdev = omap_connector->dssdev;
         struct omap_dss_driver *dssdrv = dssdev->driver;
-        struct omap_video_timings timings;
+        struct omap_video_timings timings = {0};
 
         copy_timings_drm_to_omap(&timings, mode);
 
diff --git a/drivers/staging/ozwpan/ozcdev.c b/drivers/staging/ozwpan/ozcdev.c
index d98321945802..758ce0a8d82e 100644
--- a/drivers/staging/ozwpan/ozcdev.c
+++ b/drivers/staging/ozwpan/ozcdev.c
@@ -8,6 +8,7 @@
 #include <linux/cdev.h>
 #include <linux/uaccess.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
 #include "ozconfig.h"
@@ -213,7 +214,7 @@ static int oz_set_active_pd(u8 *addr)
                 if (old_pd)
                         oz_pd_put(old_pd);
         } else {
-                if (!memcmp(addr, "\0\0\0\0\0\0", sizeof(addr))) {
+                if (is_zero_ether_addr(addr)) {
                         spin_lock_bh(&g_cdev.lock);
                         pd = g_cdev.active_pd;
                         g_cdev.active_pd = 0;
diff --git a/drivers/staging/rtl8712/recv_linux.c b/drivers/staging/rtl8712/recv_linux.c
index 0e26d5f6cf2d..495ee1205e02 100644
--- a/drivers/staging/rtl8712/recv_linux.c
+++ b/drivers/staging/rtl8712/recv_linux.c
@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adapter *padapter,
         if (skb == NULL)
                 goto _recv_indicatepkt_drop;
         skb->data = precv_frame->u.hdr.rx_data;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
-                     precv_frame->u.hdr.rx_head);
-#else
-        skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
-#endif
         skb->len = precv_frame->u.hdr.len;
+        skb_set_tail_pointer(skb, skb->len);
         if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c
index e4bdf2a2b582..3aa895ec6507 100644
--- a/drivers/staging/vt6656/dpc.c
+++ b/drivers/staging/vt6656/dpc.c
@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
     } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
         cbHeaderSize += 6;
         pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
-        if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
+        if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
             (*pwType == cpu_to_le16(0xF380))) {
                 cbHeaderSize -= 8;
             pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index bb464527fc1b..b6e04e7b629b 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -1699,7 +1699,7 @@ s_bPacketToWirelessUsb(
     // 802.1H
     if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
         if (pDevice->dwDiagRefCount == 0) {
-                if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
+                if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
                     (psEthHeader->wType == cpu_to_le16(0xF380))) {
                         memcpy((PBYTE) (pbyPayloadHead),
                                abySNAP_Bridgetunnel, 6);
@@ -2838,10 +2838,10 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
     Packet_Type = skb->data[ETH_HLEN+1];
     Descriptor_type = skb->data[ETH_HLEN+1+1+2];
     Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
-        /* 802.1x OR eapol-key challenge frame transfer */
-        if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
-                (Packet_Type == 3)) {
+        if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
+                /* 802.1x OR eapol-key challenge frame transfer */
+                if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
+                        (Packet_Type == 3)) {
                         bTxeapol_key = TRUE;
                        if(!(Key_info & BIT3) &&  //WPA or RSN group-key challenge
                            (Key_info & BIT8) && (Key_info & BIT9)) {    //send 2/2 key
@@ -2987,19 +2987,19 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
         }
     }
 
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
-        if (pDevice->byBBType != BB_TYPE_11A) {
-            pDevice->wCurrentRate = RATE_1M;
-            pDevice->byACKRate = RATE_1M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
-        } else {
-            pDevice->wCurrentRate = RATE_6M;
-            pDevice->byACKRate = RATE_6M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
-        }
-    }
+        if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
+                if (pDevice->byBBType != BB_TYPE_11A) {
+                        pDevice->wCurrentRate = RATE_1M;
+                        pDevice->byACKRate = RATE_1M;
+                        pDevice->byTopCCKBasicRate = RATE_1M;
+                        pDevice->byTopOFDMBasicRate = RATE_6M;
+                } else {
+                        pDevice->wCurrentRate = RATE_6M;
+                        pDevice->byACKRate = RATE_6M;
+                        pDevice->byTopCCKBasicRate = RATE_1M;
+                        pDevice->byTopOFDMBasicRate = RATE_6M;
+                }
+        }
 
     DBG_PRT(MSG_LEVEL_DEBUG,
             KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
@@ -3015,7 +3015,7 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
 
     if (bNeedEncryption == TRUE) {
         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
-        if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
+        if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
                 bNeedEncryption = FALSE;
             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index fabff4d650ef..0970127344e6 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -327,9 +327,9 @@ int prism2_get_station(struct wiphy *wiphy, struct net_device *dev,
         return result;
 }
 
-int prism2_scan(struct wiphy *wiphy, struct net_device *dev,
-                struct cfg80211_scan_request *request)
+int prism2_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
 {
+        struct net_device *dev = request->wdev->netdev;
         struct prism2_wiphy_private *priv = wiphy_priv(wiphy);
         wlandevice_t *wlandev = dev->ml_priv;
         struct p80211msg_dot11req_scan msg1;
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index c214977b4ab4..52b43b7b83d7 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1251,13 +1251,12 @@ static int zcache_pampd_get_data_and_free(char *data, size_t *bufsize, bool raw,
                                         void *pampd, struct tmem_pool *pool,
                                         struct tmem_oid *oid, uint32_t index)
 {
-        int ret = 0;
-
         BUG_ON(!is_ephemeral(pool));
-        zbud_decompress((struct page *)(data), pampd);
+        if (zbud_decompress((struct page *)(data), pampd) < 0)
+                return -EINVAL;
         zbud_free_and_delist((struct zbud_hdr *)pampd);
         atomic_dec(&zcache_curr_eph_pampd_count);
-        return ret;
+        return 0;
 }
 
 /*
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 0694d9b1bce6..6aba4395e8d8 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -221,6 +221,7 @@ static int iscsi_login_zero_tsih_s1(
 {
         struct iscsi_session *sess = NULL;
         struct iscsi_login_req *pdu = (struct iscsi_login_req *)buf;
+        int ret;
 
         sess = kzalloc(sizeof(struct iscsi_session), GFP_KERNEL);
         if (!sess) {
@@ -257,9 +258,17 @@ static int iscsi_login_zero_tsih_s1(
                 return -ENOMEM;
         }
         spin_lock(&sess_idr_lock);
-        idr_get_new(&sess_idr, NULL, &sess->session_index);
+        ret = idr_get_new(&sess_idr, NULL, &sess->session_index);
         spin_unlock(&sess_idr_lock);
 
+        if (ret < 0) {
+                pr_err("idr_get_new() for sess_idr failed\n");
+                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                kfree(sess);
+                return -ENOMEM;
+        }
+
         sess->creation_time = get_jiffies_64();
         spin_lock_init(&sess->session_stats_lock);
         /*
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 0c4760fabfc0..240f7aa76ed1 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -662,7 +662,7 @@ int iscsi_extract_key_value(char *textbuf, char **key, char **value)
 {
         *value = strchr(textbuf, '=');
         if (!*value) {
-                pr_err("Unable to locate \"=\" seperator for key,"
+                pr_err("Unable to locate \"=\" separator for key,"
                                 " ignoring request.\n");
                 return -1;
         }
@@ -1269,7 +1269,7 @@ static int iscsi_check_value(struct iscsi_param *param, char *value)
                 comma_ptr = strchr(value, ',');
 
                 if (comma_ptr && !IS_TYPE_VALUE_LIST(param)) {
-                        pr_err("Detected value seperator \",\", but"
+                        pr_err("Detected value separator \",\", but"
                                 " key \"%s\" does not allow a value list,"
                                 " protocol error.\n", param->name);
                         return -1;
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 91799973081a..41641ba54828 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -218,6 +218,13 @@ int target_emulate_set_target_port_groups(struct se_cmd *cmd)
                 cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 return -EINVAL;
         }
+        if (cmd->data_length < 4) {
+                pr_warn("SET TARGET PORT GROUPS parameter list length %u too"
+                        " small\n", cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
+        }
+
         buf = transport_kmap_data_sg(cmd);
 
         /*
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index cf2c66f3c116..9fc9a6006ca0 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -669,6 +669,13 @@ int target_report_luns(struct se_cmd *se_cmd)
         unsigned char *buf;
         u32 lun_count = 0, offset = 8, i;
 
+        if (se_cmd->data_length < 16) {
+                pr_warn("REPORT LUNS allocation length %u too small\n",
+                        se_cmd->data_length);
+                se_cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
+        }
+
         buf = transport_kmap_data_sg(se_cmd);
         if (!buf)
                 return -ENOMEM;
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 76db75e836ed..9ba495477fd2 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -325,17 +325,30 @@ static int iblock_execute_unmap(struct se_cmd *cmd)
         struct iblock_dev *ibd = dev->dev_ptr;
         unsigned char *buf, *ptr = NULL;
         sector_t lba;
-        int size = cmd->data_length;
+        int size;
         u32 range;
         int ret = 0;
         int dl, bd_dl;
 
+        if (cmd->data_length < 8) {
+                pr_warn("UNMAP parameter list length %u too small\n",
+                        cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
+        }
+
         buf = transport_kmap_data_sg(cmd);
 
         dl = get_unaligned_be16(&buf[0]);
         bd_dl = get_unaligned_be16(&buf[2]);
 
-        size = min(size - 8, bd_dl);
+        size = cmd->data_length - 8;
+        if (bd_dl > size)
+                pr_warn("UNMAP parameter list length %u too small, ignoring bd_dl %u\n",
+                        cmd->data_length, bd_dl);
+        else
+                size = bd_dl;
+
         if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
                 cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
                 ret = -EINVAL;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 1e946502c378..956c84c6b666 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1540,6 +1540,14 @@ static int core_scsi3_decode_spec_i_port(
         tidh_new->dest_local_nexus = 1;
         list_add_tail(&tidh_new->dest_list, &tid_dest_list);
 
+        if (cmd->data_length < 28) {
+                pr_warn("SPC-PR: Received PR OUT parameter list"
+                        " length too small: %u\n", cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
+                goto out;
+        }
+
         buf = transport_kmap_data_sg(cmd);
         /*
          * For a PERSISTENT RESERVE OUT specify initiator ports payload,
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 5552fa7426bc..9d7ce3daa262 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -667,7 +667,8 @@ static void pscsi_free_device(void *p)
         kfree(pdv);
 }
 
-static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
+static void pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg,
+                                     unsigned char *sense_buffer)
 {
         struct pscsi_dev_virt *pdv = cmd->se_dev->dev_ptr;
         struct scsi_device *sd = pdv->pdv_sd;
@@ -679,7 +680,7 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
          * not been allocated because TCM is handling the emulation directly.
          */
         if (!pt)
-                return 0;
+                return;
 
         cdb = &pt->pscsi_cdb[0];
         result = pt->pscsi_result;
@@ -687,11 +688,11 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
          * Hack to make sure that Write-Protect modepage is set if R/O mode is
          * forced.
          */
+        if (!cmd->se_deve || !cmd->data_length)
+                goto after_mode_sense;
+
         if (((cdb[0] == MODE_SENSE) || (cdb[0] == MODE_SENSE_10)) &&
              (status_byte(result) << 1) == SAM_STAT_GOOD) {
-                if (!cmd->se_deve)
-                        goto after_mode_sense;
-
                 if (cmd->se_deve->lun_flags & TRANSPORT_LUNFLAGS_READ_ONLY) {
                         unsigned char *buf = transport_kmap_data_sg(cmd);
 
@@ -708,7 +709,7 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
         }
 after_mode_sense:
 
-        if (sd->type != TYPE_TAPE)
+        if (sd->type != TYPE_TAPE || !cmd->data_length)
                 goto after_mode_select;
 
         /*
@@ -750,10 +751,10 @@ after_mode_sense:
         }
 after_mode_select:
 
-        if (status_byte(result) & CHECK_CONDITION)
-                return 1;
-
-        return 0;
+        if (sense_buffer && (status_byte(result) & CHECK_CONDITION)) {
+                memcpy(sense_buffer, pt->pscsi_sense, TRANSPORT_SENSE_BUFFER);
+                cmd->se_cmd_flags |= SCF_TRANSPORT_TASK_SENSE;
+        }
 }
 
 enum {
@@ -1184,13 +1185,6 @@ fail:
         return -ENOMEM;
 }
 
-static unsigned char *pscsi_get_sense_buffer(struct se_cmd *cmd)
-{
-        struct pscsi_plugin_task *pt = cmd->priv;
-
-        return pt->pscsi_sense;
-}
-
 /*      pscsi_get_device_rev():
  *
  *
@@ -1273,7 +1267,6 @@ static struct se_subsystem_api pscsi_template = {
         .check_configfs_dev_params = pscsi_check_configfs_dev_params,
         .set_configfs_dev_params = pscsi_set_configfs_dev_params,
         .show_configfs_dev_params = pscsi_show_configfs_dev_params,
-        .get_sense_buffer       = pscsi_get_sense_buffer,
         .get_device_rev         = pscsi_get_device_rev,
         .get_device_type        = pscsi_get_device_type,
         .get_blocks             = pscsi_get_blocks,
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 4c861de538c9..388a922c8f6d 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -877,9 +877,11 @@ static int spc_emulate_modesense(struct se_cmd *cmd)
 static int spc_emulate_request_sense(struct se_cmd *cmd)
 {
         unsigned char *cdb = cmd->t_task_cdb;
-        unsigned char *buf;
+        unsigned char *rbuf;
         u8 ua_asc = 0, ua_ascq = 0;
-        int err = 0;
+        unsigned char buf[SE_SENSE_BUF];
+
+        memset(buf, 0, SE_SENSE_BUF);
 
         if (cdb[1] & 0x01) {
                 pr_err("REQUEST_SENSE description emulation not"
@@ -888,20 +890,21 @@ static int spc_emulate_request_sense(struct se_cmd *cmd)
                 return -ENOSYS;
         }
 
-        buf = transport_kmap_data_sg(cmd);
-
-        if (!core_scsi3_ua_clear_for_request_sense(cmd, &ua_asc, &ua_ascq)) {
+        rbuf = transport_kmap_data_sg(cmd);
+        if (cmd->scsi_sense_reason != 0) {
+                /*
+                 * Out of memory.  We will fail with CHECK CONDITION, so
+                 * we must not clear the unit attention condition.
+                 */
+                target_complete_cmd(cmd, CHECK_CONDITION);
+                return 0;
+        } else if (!core_scsi3_ua_clear_for_request_sense(cmd, &ua_asc, &ua_ascq)) {
                 /*
                  * CURRENT ERROR, UNIT ATTENTION
                  */
                 buf[0] = 0x70;
                 buf[SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
 
-                if (cmd->data_length < 18) {
-                        buf[7] = 0x00;
-                        err = -EINVAL;
-                        goto end;
-                }
                 /*
                  * The Additional Sense Code (ASC) from the UNIT ATTENTION
                  */
@@ -915,11 +918,6 @@ static int spc_emulate_request_sense(struct se_cmd *cmd)
                 buf[0] = 0x70;
                 buf[SPC_SENSE_KEY_OFFSET] = NO_SENSE;
 
-                if (cmd->data_length < 18) {
-                        buf[7] = 0x00;
-                        err = -EINVAL;
-                        goto end;
-                }
                 /*
                  * NO ADDITIONAL SENSE INFORMATION
                  */
@@ -927,8 +925,11 @@ static int spc_emulate_request_sense(struct se_cmd *cmd)
                 buf[7] = 0x0A;
         }
 
-end:
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
+
         target_complete_cmd(cmd, GOOD);
         return 0;
 }
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 4de3186dc44e..269f54488397 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -567,6 +567,34 @@ static void target_complete_failure_work(struct work_struct *work)
         transport_generic_request_failure(cmd);
 }
 
+/*
+ * Used when asking transport to copy Sense Data from the underlying
+ * Linux/SCSI struct scsi_cmnd
+ */
+static unsigned char *transport_get_sense_buffer(struct se_cmd *cmd)
+{
+        unsigned char *buffer = cmd->sense_buffer;
+        struct se_device *dev = cmd->se_dev;
+        u32 offset = 0;
+
+        WARN_ON(!cmd->se_lun);
+
+        if (!dev)
+                return NULL;
+
+        if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION)
+                return NULL;
+
+        offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
+
+        /* Automatically padded */
+        cmd->scsi_sense_length = TRANSPORT_SENSE_BUFFER + offset;
+
+        pr_debug("HBA_[%u]_PLUG[%s]: Requesting sense for SAM STATUS: 0x%02x\n",
+                dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
+        return &buffer[offset];
+}
+
 void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
 {
         struct se_device *dev = cmd->se_dev;
@@ -580,11 +608,11 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
         cmd->transport_state &= ~CMD_T_BUSY;
 
         if (dev && dev->transport->transport_complete) {
-                if (dev->transport->transport_complete(cmd,
-                                cmd->t_data_sg) != 0) {
-                        cmd->se_cmd_flags |= SCF_TRANSPORT_TASK_SENSE;
+                dev->transport->transport_complete(cmd,
+                                cmd->t_data_sg,
+                                transport_get_sense_buffer(cmd));
+                if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE)
                         success = 1;
-                }
         }
 
         /*
@@ -1181,15 +1209,20 @@ int target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
                         /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
                         goto out_invalid_cdb_field;
                 }
-
+                /*
+                 * For the overflow case keep the existing fabric provided
+                 * ->data_length.  Otherwise for the underflow case, reset
+                 * ->data_length to the smaller SCSI expected data transfer
+                 * length.
+                 */
                 if (size > cmd->data_length) {
                         cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
                         cmd->residual_count = (size - cmd->data_length);
                 } else {
                         cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
                         cmd->residual_count = (cmd->data_length - size);
+                        cmd->data_length = size;
                 }
-                cmd->data_length = size;
         }
 
         return 0;
@@ -1816,61 +1849,6 @@ execute:
 EXPORT_SYMBOL(target_execute_cmd);
 
 /*
- * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd
- */
-static int transport_get_sense_data(struct se_cmd *cmd)
-{
-        unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL;
-        struct se_device *dev = cmd->se_dev;
-        unsigned long flags;
-        u32 offset = 0;
-
-        WARN_ON(!cmd->se_lun);
-
-        if (!dev)
-                return 0;
-
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                return 0;
-        }
-
-        if (!(cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE))
-                goto out;
-
-        if (!dev->transport->get_sense_buffer) {
-                pr_err("dev->transport->get_sense_buffer is NULL\n");
-                goto out;
-        }
-
-        sense_buffer = dev->transport->get_sense_buffer(cmd);
-        if (!sense_buffer) {
-                pr_err("ITT 0x%08x cmd %p: Unable to locate"
-                        " sense buffer for task with sense\n",
-                        cmd->se_tfo->get_task_tag(cmd), cmd);
-                goto out;
-        }
-
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-
-        offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
-
-        memcpy(&buffer[offset], sense_buffer, TRANSPORT_SENSE_BUFFER);
-
-        /* Automatically padded */
-        cmd->scsi_sense_length = TRANSPORT_SENSE_BUFFER + offset;
-
-        pr_debug("HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x and sense\n",
-                dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
-        return 0;
-
-out:
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-        return -1;
-}
-
-/*
  * Process all commands up to the last received ORDERED task attribute which
  * requires another blocking boundary
  */
@@ -1985,7 +1963,7 @@ static void transport_handle_queue_full(
 static void target_complete_ok_work(struct work_struct *work)
 {
         struct se_cmd *cmd = container_of(work, struct se_cmd, work);
-        int reason = 0, ret;
+        int ret;
 
         /*
          * Check if we need to move delayed/dormant tasks from cmds on the
@@ -2002,23 +1980,19 @@ static void target_complete_ok_work(struct work_struct *work)
                 schedule_work(&cmd->se_dev->qf_work_queue);
 
         /*
-         * Check if we need to retrieve a sense buffer from
+         * Check if we need to send a sense buffer from
          * the struct se_cmd in question.
          */
         if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
-                if (transport_get_sense_data(cmd) < 0)
-                        reason = TCM_NON_EXISTENT_LUN;
-
-                if (cmd->scsi_status) {
-                        ret = transport_send_check_condition_and_sense(
-                                        cmd, reason, 1);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
-                                goto queue_full;
+                WARN_ON(!cmd->scsi_status);
+                ret = transport_send_check_condition_and_sense(
+                                        cmd, 0, 1);
+                if (ret == -EAGAIN || ret == -ENOMEM)
+                        goto queue_full;
 
-                        transport_lun_remove_cmd(cmd);
-                        transport_cmd_check_stop_to_fabric(cmd);
-                        return;
-                }
+                transport_lun_remove_cmd(cmd);
+                transport_cmd_check_stop_to_fabric(cmd);
+                return;
         }
         /*
          * Check for a callback, used by amongst other things
@@ -2216,7 +2190,6 @@ void *transport_kmap_data_sg(struct se_cmd *cmd)
         struct page **pages;
         int i;
 
-        BUG_ON(!sg);
         /*
          * We need to take into account a possible offset here for fabrics like
          * tcm_loop who may be using a contig buffer from the SCSI midlayer for
@@ -2224,13 +2197,17 @@ void *transport_kmap_data_sg(struct se_cmd *cmd)
          */
         if (!cmd->t_data_nents)
                 return NULL;
-        else if (cmd->t_data_nents == 1)
+
+        BUG_ON(!sg);
+        if (cmd->t_data_nents == 1)
                 return kmap(sg_page(sg)) + sg->offset;
 
         /* >1 page. use vmap */
         pages = kmalloc(sizeof(*pages) * cmd->t_data_nents, GFP_KERNEL);
-        if (!pages)
+        if (!pages) {
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 return NULL;
+        }
 
         /* convert sg[] to pages[] */
         for_each_sg(cmd->t_data_sg, sg, cmd->t_data_nents, i) {
@@ -2239,8 +2216,10 @@ void *transport_kmap_data_sg(struct se_cmd *cmd)
 
         cmd->t_data_vmap = vmap(pages, cmd->t_data_nents,  VM_MAP, PAGE_KERNEL);
         kfree(pages);
-        if (!cmd->t_data_vmap)
+        if (!cmd->t_data_vmap) {
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 return NULL;
+        }
 
         return cmd->t_data_vmap + cmd->t_data_sg[0].offset;
 }
@@ -2326,19 +2305,14 @@ int transport_generic_new_cmd(struct se_cmd *cmd)
          * into the fabric for data transfers, go ahead and complete it right
          * away.
          */
-        if (!cmd->data_length) {
+        if (!cmd->data_length &&
+            cmd->t_task_cdb[0] != REQUEST_SENSE &&
+            cmd->se_dev->transport->transport_type != TRANSPORT_PLUGIN_PHBA_PDEV) {
                 spin_lock_irq(&cmd->t_state_lock);
                 cmd->t_state = TRANSPORT_COMPLETE;
                 cmd->transport_state |= CMD_T_ACTIVE;
                 spin_unlock_irq(&cmd->t_state_lock);
 
-                if (cmd->t_task_cdb[0] == REQUEST_SENSE) {
-                        u8 ua_asc = 0, ua_ascq = 0;
-
-                        core_scsi3_ua_clear_for_request_sense(cmd,
-                                        &ua_asc, &ua_ascq);
-                }
-
                 INIT_WORK(&cmd->work, target_complete_ok_work);
                 queue_work(target_completion_wq, &cmd->work);
                 return 0;
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index d5c689d6217e..e309e8b0aaba 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -132,6 +132,7 @@
 #define  UCR4_OREN       (1<<1)  /* Receiver overrun interrupt enable */
 #define  UCR4_DREN       (1<<0)  /* Recv data ready interrupt enable */
 #define  UFCR_RXTL_SHF   0       /* Receiver trigger level shift */
+#define  UFCR_DCEDTE     (1<<6)  /* DCE/DTE mode select */
 #define  UFCR_RFDIV      (7<<7)  /* Reference freq divider mask */
 #define  UFCR_RFDIV_REG(x)      (((x) < 7 ? 6 - (x) : 6) << 7)
 #define  UFCR_TXTL_SHF   10      /* Transmitter trigger level shift */
@@ -667,22 +668,11 @@ static void imx_break_ctl(struct uart_port *port, int break_state)
 static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
 {
         unsigned int val;
-        unsigned int ufcr_rfdiv;
-
-        /* set receiver / transmitter trigger level.
-         * RFDIV is set such way to satisfy requested uartclk value
-         */
-        val = TXTL << 10 | RXTL;
-        ufcr_rfdiv = (clk_get_rate(sport->clk_per) + sport->port.uartclk / 2)
-                        / sport->port.uartclk;
-
-        if(!ufcr_rfdiv)
-                ufcr_rfdiv = 1;
-
-        val |= UFCR_RFDIV_REG(ufcr_rfdiv);
 
+        /* set receiver / transmitter trigger level */
+        val = readl(sport->port.membase + UFCR) & (UFCR_RFDIV | UFCR_DCEDTE);
+        val |= TXTL << UFCR_TXTL_SHF | RXTL;
         writel(val, sport->port.membase + UFCR);
-
         return 0;
 }
 
@@ -754,6 +744,7 @@ static int imx_startup(struct uart_port *port)
                 }
         }
 
+        spin_lock_irqsave(&sport->port.lock, flags);
         /*
          * Finally, clear and enable interrupts
          */
@@ -807,7 +798,6 @@ static int imx_startup(struct uart_port *port)
         /*
          * Enable modem status interrupts
          */
-        spin_lock_irqsave(&sport->port.lock,flags);
         imx_enable_ms(&sport->port);
         spin_unlock_irqrestore(&sport->port.lock,flags);
 
@@ -837,10 +827,13 @@ static void imx_shutdown(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
         unsigned long temp;
+        unsigned long flags;
 
+        spin_lock_irqsave(&sport->port.lock, flags);
         temp = readl(sport->port.membase + UCR2);
         temp &= ~(UCR2_TXEN);
         writel(temp, sport->port.membase + UCR2);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 
         if (USE_IRDA(sport)) {
                 struct imxuart_platform_data *pdata;
@@ -869,12 +862,14 @@ static void imx_shutdown(struct uart_port *port)
          * Disable all interrupts, port and break condition.
          */
 
+        spin_lock_irqsave(&sport->port.lock, flags);
         temp = readl(sport->port.membase + UCR1);
         temp &= ~(UCR1_TXMPTYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN);
         if (USE_IRDA(sport))
                 temp &= ~(UCR1_IREN);
 
         writel(temp, sport->port.membase + UCR1);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 
 static void
@@ -1217,6 +1212,9 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
         struct imx_port *sport = imx_ports[co->index];
         struct imx_port_ucrs old_ucr;
         unsigned int ucr1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&sport->port.lock, flags);
 
         /*
          *      First, save UCR1/2/3 and then disable interrupts
@@ -1242,6 +1240,8 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
         while (!(readl(sport->port.membase + USR2) & USR2_TXDC));
 
         imx_port_ucrs_restore(&sport->port, &old_ucr);
+
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 
 /*
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index c7a032a4f0c5..d214448b677e 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -78,8 +78,7 @@ static inline int ep_to_bit(struct ci13xxx *ci, int n)
 }
 
 /**
- * hw_device_state: enables/disables interrupts & starts/stops device (execute
- *                  without interruption)
+ * hw_device_state: enables/disables interrupts (execute without interruption)
  * @dma: 0 => disable, !0 => enable and set dma engine
  *
  * This function returns an error code
@@ -91,9 +90,7 @@ static int hw_device_state(struct ci13xxx *ci, u32 dma)
                 /* interrupt, error, port change, reset, sleep/suspend */
                 hw_write(ci, OP_USBINTR, ~0,
                              USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
-                hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
         } else {
-                hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
                 hw_write(ci, OP_USBINTR, ~0, 0);
         }
         return 0;
@@ -774,10 +771,7 @@ __acquires(mEp->lock)
 {
         struct ci13xxx_req *mReq, *mReqTemp;
         struct ci13xxx_ep *mEpTemp = mEp;
-        int uninitialized_var(retval);
-
-        if (list_empty(&mEp->qh.queue))
-                return -EINVAL;
+        int retval = 0;
 
         list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
                         queue) {
@@ -1420,6 +1414,21 @@ static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
         return -ENOTSUPP;
 }
 
+/* Change Data+ pullup status
+ * this func is used by usb_gadget_connect/disconnet
+ */
+static int ci13xxx_pullup(struct usb_gadget *_gadget, int is_on)
+{
+        struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
+
+        if (is_on)
+                hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
+        else
+                hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
+
+        return 0;
+}
+
 static int ci13xxx_start(struct usb_gadget *gadget,
                          struct usb_gadget_driver *driver);
 static int ci13xxx_stop(struct usb_gadget *gadget,
@@ -1432,6 +1441,7 @@ static int ci13xxx_stop(struct usb_gadget *gadget,
 static const struct usb_gadget_ops usb_gadget_ops = {
         .vbus_session   = ci13xxx_vbus_session,
         .wakeup         = ci13xxx_wakeup,
+        .pullup         = ci13xxx_pullup,
         .vbus_draw      = ci13xxx_vbus_draw,
         .udc_start      = ci13xxx_start,
         .udc_stop       = ci13xxx_stop,
@@ -1455,7 +1465,12 @@ static int init_eps(struct ci13xxx *ci)
 
                         mEp->ep.name      = mEp->name;
                         mEp->ep.ops       = &usb_ep_ops;
-                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+                        /*
+                         * for ep0: maxP defined in desc, for other
+                         * eps, maxP is set by epautoconfig() called
+                         * by gadget layer
+                         */
+                        mEp->ep.maxpacket = (unsigned short)~0;
 
                         INIT_LIST_HEAD(&mEp->qh.queue);
                         mEp->qh.ptr = dma_pool_alloc(ci->qh_pool, GFP_KERNEL,
@@ -1475,6 +1490,7 @@ static int init_eps(struct ci13xxx *ci)
                                 else
                                         ci->ep0in = mEp;
 
+                                mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
                                 continue;
                         }
 
@@ -1484,6 +1500,17 @@ static int init_eps(struct ci13xxx *ci)
         return retval;
 }
 
+static void destroy_eps(struct ci13xxx *ci)
+{
+        int i;
+
+        for (i = 0; i < ci->hw_ep_max; i++) {
+                struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];
+
+                dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);
+        }
+}
+
 /**
  * ci13xxx_start: register a gadget driver
  * @gadget: our gadget
@@ -1691,7 +1718,7 @@ static int udc_start(struct ci13xxx *ci)
         if (ci->platdata->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
                 if (ci->transceiver == NULL) {
                         retval = -ENODEV;
-                        goto free_pools;
+                        goto destroy_eps;
                 }
         }
 
@@ -1729,7 +1756,7 @@ static int udc_start(struct ci13xxx *ci)
 
 remove_trans:
         if (!IS_ERR_OR_NULL(ci->transceiver)) {
-                otg_set_peripheral(ci->transceiver->otg, &ci->gadget);
+                otg_set_peripheral(ci->transceiver->otg, NULL);
                 if (ci->global_phy)
                         usb_put_phy(ci->transceiver);
         }
@@ -1742,6 +1769,8 @@ unreg_device:
 put_transceiver:
         if (!IS_ERR_OR_NULL(ci->transceiver) && ci->global_phy)
                 usb_put_phy(ci->transceiver);
+destroy_eps:
+        destroy_eps(ci);
 free_pools:
         dma_pool_destroy(ci->td_pool);
 free_qh_pool:
@@ -1756,18 +1785,12 @@ free_qh_pool:
  */
 static void udc_stop(struct ci13xxx *ci)
 {
-        int i;
-
         if (ci == NULL)
                 return;
 
         usb_del_gadget_udc(&ci->gadget);
 
-        for (i = 0; i < ci->hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];
-
-                dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);
-        }
+        destroy_eps(ci);
 
         dma_pool_destroy(ci->td_pool);
         dma_pool_destroy(ci->qh_pool);
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 65a55abb791f..5f0cb417b736 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -109,12 +109,14 @@ static struct usb_driver wdm_driver;
 /* return intfdata if we own the interface, else look up intf in the list */
 static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 {
-        struct wdm_device *desc = NULL;
+        struct wdm_device *desc;
 
         spin_lock(&wdm_device_list_lock);
         list_for_each_entry(desc, &wdm_device_list, device_list)
                 if (desc->intf == intf)
-                        break;
+                        goto found;
+        desc = NULL;
+found:
         spin_unlock(&wdm_device_list_lock);
 
         return desc;
@@ -122,12 +124,14 @@ static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 
 static struct wdm_device *wdm_find_device_by_minor(int minor)
 {
-        struct wdm_device *desc = NULL;
+        struct wdm_device *desc;
 
         spin_lock(&wdm_device_list_lock);
         list_for_each_entry(desc, &wdm_device_list, device_list)
                 if (desc->intf->minor == minor)
-                        break;
+                        goto found;
+        desc = NULL;
+found:
         spin_unlock(&wdm_device_list_lock);
 
         return desc;
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index d95696584762..3440812b4a84 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -624,7 +624,7 @@ static ssize_t usb_device_read(struct file *file, char __user *buf,
         /* print devices for all busses */
         list_for_each_entry(bus, &usb_bus_list, bus_list) {
                 /* recurse through all children of the root hub */
-                if (!bus->root_hub)
+                if (!bus_to_hcd(bus)->rh_registered)
                         continue;
                 usb_lock_device(bus->root_hub);
                 ret = usb_device_dump(&buf, &nbytes, &skip_bytes, ppos,
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index bc84106ac057..75ba2091f9b4 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1011,10 +1011,7 @@ static int register_root_hub(struct usb_hcd *hcd)
         if (retval) {
                 dev_err (parent_dev, "can't register root hub for %s, %d\n",
                                 dev_name(&usb_dev->dev), retval);
-        }
-        mutex_unlock(&usb_bus_list_lock);
-
-        if (retval == 0) {
+        } else {
                 spin_lock_irq (&hcd_root_hub_lock);
                 hcd->rh_registered = 1;
                 spin_unlock_irq (&hcd_root_hub_lock);
@@ -1023,6 +1020,7 @@ static int register_root_hub(struct usb_hcd *hcd)
                 if (HCD_DEAD(hcd))
                         usb_hc_died (hcd);      /* This time clean up */
         }
+        mutex_unlock(&usb_bus_list_lock);
 
         return retval;
 }
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f15501f4c585..e77a8e8eaa23 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -71,6 +71,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04b4, 0x0526), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* Microchip Joss Optical infrared touchboard device */
+        { USB_DEVICE(0x04d8, 0x000c), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
+
         /* Samsung Android phone modem - ID conflict with SPH-I500 */
         { USB_DEVICE(0x04e8, 0x6601), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index c34452a7304f..a68ff53124dc 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -436,16 +436,21 @@ static int __devinit dwc3_probe(struct platform_device *pdev)
                 dev_err(dev, "missing IRQ\n");
                 return -ENODEV;
         }
-        dwc->xhci_resources[1] = *res;
+        dwc->xhci_resources[1].start = res->start;
+        dwc->xhci_resources[1].end = res->end;
+        dwc->xhci_resources[1].flags = res->flags;
+        dwc->xhci_resources[1].name = res->name;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!res) {
                 dev_err(dev, "missing memory resource\n");
                 return -ENODEV;
         }
-        dwc->xhci_resources[0] = *res;
+        dwc->xhci_resources[0].start = res->start;
         dwc->xhci_resources[0].end = dwc->xhci_resources[0].start +
                                         DWC3_XHCI_REGS_END;
+        dwc->xhci_resources[0].flags = res->flags;
+        dwc->xhci_resources[0].name = res->name;
 
          /*
           * Request memory region but exclude xHCI regs,
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 9b94886b66e5..e4d5ca86b9da 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -720,7 +720,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 transferred = min_t(u32, ur->length,
                                 transfer_size - length);
                 memcpy(ur->buf, dwc->ep0_bounce, transferred);
-                dwc->ep0_bounced = false;
         } else {
                 transferred = ur->length - length;
         }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 58fdfad96b4d..c2813c2b005a 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -263,8 +263,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         if (req->request.status == -EINPROGRESS)
                 req->request.status = status;
 
-        usb_gadget_unmap_request(&dwc->gadget, &req->request,
-                        req->direction);
+        if (dwc->ep0_bounced && dep->number == 0)
+                dwc->ep0_bounced = false;
+        else
+                usb_gadget_unmap_request(&dwc->gadget, &req->request,
+                                req->direction);
 
         dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n",
                         req, dep->name, req->request.actual,
@@ -1026,6 +1029,7 @@ static void __dwc3_gadget_start_isoc(struct dwc3 *dwc,
         if (list_empty(&dep->request_list)) {
                 dev_vdbg(dwc->dev, "ISOC ep %s run out for requests.\n",
                         dep->name);
+                dep->flags |= DWC3_EP_PENDING_REQUEST;
                 return;
         }
 
@@ -1089,6 +1093,17 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
         if (dep->flags & DWC3_EP_PENDING_REQUEST) {
                 int     ret;
 
+                /*
+                 * If xfernotready is already elapsed and it is a case
+                 * of isoc transfer, then issue END TRANSFER, so that
+                 * you can receive xfernotready again and can have
+                 * notion of current microframe.
+                 */
+                if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                        dwc3_stop_active_transfer(dwc, dep->number);
+                        return 0;
+                }
+
                 ret = __dwc3_gadget_kick_transfer(dep, 0, true);
                 if (ret && ret != -EBUSY) {
                         struct dwc3     *dwc = dep->dwc;
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index c9e66dfb02e6..1e35963bd4ed 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -475,8 +475,7 @@ static int at91_ep_enable(struct usb_ep *_ep,
         unsigned long   flags;
 
         if (!_ep || !ep
-                        || !desc || ep->ep.desc
-                        || _ep->name == ep0name
+                        || !desc || _ep->name == ep0name
                         || desc->bDescriptorType != USB_DT_ENDPOINT
                         || (maxpacket = usb_endpoint_maxp(desc)) == 0
                         || maxpacket > ep->maxpacket) {
@@ -530,7 +529,6 @@ ok:
         tmp |= AT91_UDP_EPEDS;
         __raw_writel(tmp, ep->creg);
 
-        ep->ep.desc = desc;
         ep->ep.maxpacket = maxpacket;
 
         /*
@@ -1635,7 +1633,6 @@ static int at91_start(struct usb_gadget *gadget,
         udc->driver = driver;
         udc->gadget.dev.driver = &driver->driver;
         udc->gadget.dev.of_node = udc->pdev->dev.of_node;
-        dev_set_drvdata(&udc->gadget.dev, &driver->driver);
         udc->enabled = 1;
         udc->selfpowered = 1;
 
@@ -1656,7 +1653,6 @@ static int at91_stop(struct usb_gadget *gadget,
         spin_unlock_irqrestore(&udc->lock, flags);
 
         udc->gadget.dev.driver = NULL;
-        dev_set_drvdata(&udc->gadget.dev, NULL);
         udc->driver = NULL;
 
         DBG("unbound from %s\n", driver->driver.name);
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index b799106027ad..afdbb1cbf5d9 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -1916,6 +1916,27 @@ done:
         return retval;
 }
 
+/* usb 3.0 root hub device descriptor */
+struct {
+        struct usb_bos_descriptor bos;
+        struct usb_ss_cap_descriptor ss_cap;
+} __packed usb3_bos_desc = {
+
+        .bos = {
+                .bLength                = USB_DT_BOS_SIZE,
+                .bDescriptorType        = USB_DT_BOS,
+                .wTotalLength           = cpu_to_le16(sizeof(usb3_bos_desc)),
+                .bNumDeviceCaps         = 1,
+        },
+        .ss_cap = {
+                .bLength                = USB_DT_USB_SS_CAP_SIZE,
+                .bDescriptorType        = USB_DT_DEVICE_CAPABILITY,
+                .bDevCapabilityType     = USB_SS_CAP_TYPE,
+                .wSpeedSupported        = cpu_to_le16(USB_5GBPS_OPERATION),
+                .bFunctionalitySupport  = ilog2(USB_5GBPS_OPERATION),
+        },
+};
+
 static inline void
 ss_hub_descriptor(struct usb_hub_descriptor *desc)
 {
@@ -2006,6 +2027,18 @@ static int dummy_hub_control(
                 else
                         hub_descriptor((struct usb_hub_descriptor *) buf);
                 break;
+
+        case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
+                if (hcd->speed != HCD_USB3)
+                        goto error;
+
+                if ((wValue >> 8) != USB_DT_BOS)
+                        goto error;
+
+                memcpy(buf, &usb3_bos_desc, sizeof(usb3_bos_desc));
+                retval = sizeof(usb3_bos_desc);
+                break;
+
         case GetHubStatus:
                 *(__le32 *) buf = cpu_to_le32(0);
                 break;
@@ -2503,10 +2536,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
         hs_hcd->has_tt = 1;
 
         retval = usb_add_hcd(hs_hcd, 0, 0);
-        if (retval != 0) {
-                usb_put_hcd(hs_hcd);
-                return retval;
-        }
+        if (retval)
+                goto put_usb2_hcd;
 
         if (mod_data.is_super_speed) {
                 ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
@@ -2525,6 +2556,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
 put_usb3_hcd:
         usb_put_hcd(ss_hcd);
 dealloc_usb2_hcd:
+        usb_remove_hcd(hs_hcd);
+put_usb2_hcd:
         usb_put_hcd(hs_hcd);
         the_controller.hs_hcd = the_controller.ss_hcd = NULL;
         return retval;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 8adc79d1b402..829aba75a6df 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -34,11 +34,15 @@
 /* Debugging ****************************************************************/
 
 #ifdef VERBOSE_DEBUG
+#ifndef pr_vdebug
 #  define pr_vdebug pr_debug
+#endif /* pr_vdebug */
 #  define ffs_dump_mem(prefix, ptr, len) \
         print_hex_dump_bytes(pr_fmt(prefix ": "), DUMP_PREFIX_NONE, ptr, len)
 #else
+#ifndef pr_vdebug
 #  define pr_vdebug(...)                 do { } while (0)
+#endif /* pr_vdebug */
 #  define ffs_dump_mem(prefix, ptr, len) do { } while (0)
 #endif /* VERBOSE_DEBUG */
 
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index b13e0bb5f5b8..0bb617e1dda2 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -3599,6 +3599,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
 
         if (hsotg->num_of_eps == 0) {
                 dev_err(dev, "wrong number of EPs (zero)\n");
+                ret = -EINVAL;
                 goto err_supplies;
         }
 
@@ -3606,6 +3607,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
                       GFP_KERNEL);
         if (!eps) {
                 dev_err(dev, "cannot get memory\n");
+                ret = -ENOMEM;
                 goto err_supplies;
         }
 
@@ -3622,6 +3624,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
                                                      GFP_KERNEL);
         if (!hsotg->ctrl_req) {
                 dev_err(dev, "failed to allocate ctrl req\n");
+                ret = -ENOMEM;
                 goto err_ep_mem;
         }
 
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 5b3f5fffea92..da6d479ff9a6 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -132,11 +132,15 @@ static unsigned	n_ports;
 
 
 #ifdef VERBOSE_DEBUG
+#ifndef pr_vdebug
 #define pr_vdebug(fmt, arg...) \
         pr_debug(fmt, ##arg)
+#endif /* pr_vdebug */
 #else
+#ifndef pr_vdebig
 #define pr_vdebug(fmt, arg...) \
         ({ if (0) pr_debug(fmt, ##arg); })
+#endif /* pr_vdebug */
 #endif
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 9bc39ca460c8..4b66374bdc8e 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -128,9 +128,17 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
         else {
                 qtd = list_entry (qh->qtd_list.next,
                                 struct ehci_qtd, qtd_list);
-                /* first qtd may already be partially processed */
-                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
+                /*
+                 * first qtd may already be partially processed.
+                 * If we come here during unlink, the QH overlay region
+                 * might have reference to the just unlinked qtd. The
+                 * qtd is updated in qh_completions(). Update the QH
+                 * overlay here.
+                 */
+                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
+                        qh->hw->hw_qtd_next = qtd->hw_next;
                         qtd = NULL;
+                }
         }
 
         if (qtd)
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index a665b3eaa746..0bf72f943b00 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -467,7 +467,8 @@ static irqreturn_t ohci_hcd_at91_overcurrent_irq(int irq, void *data)
         /* From the GPIO notifying the over-current situation, find
          * out the corresponding port */
         at91_for_each_port(port) {
-                if (gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
+                if (gpio_is_valid(pdata->overcurrent_pin[port]) &&
+                                gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
                         gpio = pdata->overcurrent_pin[port];
                         break;
                 }
@@ -570,6 +571,16 @@ static int __devinit ohci_hcd_at91_drv_probe(struct platform_device *pdev)
 
         if (pdata) {
                 at91_for_each_port(i) {
+                        /*
+                         * do not configure PIO if not in relation with
+                         * real USB port on board
+                         */
+                        if (i >= pdata->ports) {
+                                pdata->vbus_pin[i] = -EINVAL;
+                                pdata->overcurrent_pin[i] = -EINVAL;
+                                break;
+                        }
+
                         if (!gpio_is_valid(pdata->vbus_pin[i]))
                                 continue;
                         gpio = pdata->vbus_pin[i];
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index c5e9e4a76f14..966d1484ee79 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -75,7 +75,9 @@
 #define NB_PIF0_PWRDOWN_1       0x01100013
 
 #define USB_INTEL_XUSB2PR      0xD0
+#define USB_INTEL_USB2PRM      0xD4
 #define USB_INTEL_USB3_PSSEN   0xD8
+#define USB_INTEL_USB3PRM      0xDC
 
 static struct amd_chipset_info {
         struct pci_dev  *nb_dev;
@@ -772,10 +774,18 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
                 return;
         }
 
-        ports_available = 0xffffffff;
+        /* Read USB3PRM, the USB 3.0 Port Routing Mask Register
+         * Indicate the ports that can be changed from OS.
+         */
+        pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM,
+                        &ports_available);
+
+        dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n",
+                        ports_available);
+
         /* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
-         * Register, to turn on SuperSpeed terminations for all
-         * available ports.
+         * Register, to turn on SuperSpeed terminations for the
+         * switchable ports.
          */
         pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
                         cpu_to_le32(ports_available));
@@ -785,7 +795,16 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
         dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled "
                         "under xHCI: 0x%x\n", ports_available);
 
-        ports_available = 0xffffffff;
+        /* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register
+         * Indicate the USB 2.0 ports to be controlled by the xHCI host.
+         */
+
+        pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM,
+                        &ports_available);
+
+        dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n",
+                        ports_available);
+
         /* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to
          * switch the USB 2.0 power and data lines over to the xHCI
          * host.
@@ -822,12 +841,12 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
         void __iomem *op_reg_base;
         u32 val;
         int timeout;
+        int len = pci_resource_len(pdev, 0);
 
         if (!mmio_resource_enabled(pdev, 0))
                 return;
 
-        base = ioremap_nocache(pci_resource_start(pdev, 0),
-                                pci_resource_len(pdev, 0));
+        base = ioremap_nocache(pci_resource_start(pdev, 0), len);
         if (base == NULL)
                 return;
 
@@ -837,9 +856,17 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
          */
         ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
         do {
+                if ((ext_cap_offset + sizeof(val)) > len) {
+                        /* We're reading garbage from the controller */
+                        dev_warn(&pdev->dev,
+                                 "xHCI controller failing to respond");
+                        return;
+                }
+
                 if (!ext_cap_offset)
                         /* We've reached the end of the extended capabilities */
                         goto hc_init;
+
                 val = readl(base + ext_cap_offset);
                 if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
                         break;
@@ -870,9 +897,10 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
         /* Disable any BIOS SMIs and clear all SMI events*/
         writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
 
+hc_init:
         if (usb_is_intel_switchable_xhci(pdev))
                 usb_enable_xhci_ports(pdev);
-hc_init:
+
         op_reg_base = base + XHCI_HC_LENGTH(readl(base));
 
         /* Wait for the host controller to be ready before writing any
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index ef004a5de20f..7f69a39163ce 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 static inline void usb_amd_quirk_pll_disable(void) {}
 static inline void usb_amd_quirk_pll_enable(void) {}
 static inline void usb_amd_dev_put(void) {}
+static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 #endif  /* CONFIG_PCI */
 
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 74bfc868b7ad..d5eb357aa5c4 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -493,11 +493,48 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
                  * when this bit is set.
                  */
                 pls |= USB_PORT_STAT_CONNECTION;
+        } else {
+                /*
+                 * If CAS bit isn't set but the Port is already at
+                 * Compliance Mode, fake a connection so the USB core
+                 * notices the Compliance state and resets the port.
+                 * This resolves an issue generated by the SN65LVPE502CP
+                 * in which sometimes the port enters compliance mode
+                 * caused by a delay on the host-device negotiation.
+                 */
+                if (pls == USB_SS_PORT_LS_COMP_MOD)
+                        pls |= USB_PORT_STAT_CONNECTION;
         }
+
         /* update status field */
         *status |= pls;
 }
 
+/*
+ * Function for Compliance Mode Quirk.
+ *
+ * This Function verifies if all xhc USB3 ports have entered U0, if so,
+ * the compliance mode timer is deleted. A port won't enter
+ * compliance mode if it has previously entered U0.
+ */
+void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
+{
+        u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1);
+        bool port_in_u0 = ((status & PORT_PLS_MASK) == XDEV_U0);
+
+        if (!(xhci->quirks & XHCI_COMP_MODE_QUIRK))
+                return;
+
+        if ((xhci->port_status_u0 != all_ports_seen_u0) && port_in_u0) {
+                xhci->port_status_u0 |= 1 << wIndex;
+                if (xhci->port_status_u0 == all_ports_seen_u0) {
+                        del_timer_sync(&xhci->comp_mode_recovery_timer);
+                        xhci_dbg(xhci, "All USB3 ports have entered U0 already!\n");
+                        xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted.\n");
+                }
+        }
+}
+
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 u16 wIndex, char *buf, u16 wLength)
 {
@@ -651,6 +688,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 /* Update Port Link State for super speed ports*/
                 if (hcd->speed == HCD_USB3) {
                         xhci_hub_report_link_state(&status, temp);
+                        /*
+                         * Verify if all USB3 Ports Have entered U0 already.
+                         * Delete Compliance Mode Timer if so.
+                         */
+                        xhci_del_comp_mod_timer(xhci, temp, wIndex);
                 }
                 if (bus_state->port_c_suspend & (1 << wIndex))
                         status |= 1 << USB_PORT_FEAT_C_SUSPEND;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 689bc18b051d..df90fe51b4aa 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -118,7 +118,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
                 goto put_hcd;
         }
 
-        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
         if (!hcd->regs) {
                 dev_dbg(&pdev->dev, "error mapping memory\n");
                 ret = -EFAULT;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index c59d5b5b6c7d..6ece0ed288d4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -26,6 +26,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 
 #include "xhci.h"
 
@@ -398,6 +399,95 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
 
 #endif
 
+static void compliance_mode_recovery(unsigned long arg)
+{
+        struct xhci_hcd *xhci;
+        struct usb_hcd *hcd;
+        u32 temp;
+        int i;
+
+        xhci = (struct xhci_hcd *)arg;
+
+        for (i = 0; i < xhci->num_usb3_ports; i++) {
+                temp = xhci_readl(xhci, xhci->usb3_ports[i]);
+                if ((temp & PORT_PLS_MASK) == USB_SS_PORT_LS_COMP_MOD) {
+                        /*
+                         * Compliance Mode Detected. Letting USB Core
+                         * handle the Warm Reset
+                         */
+                        xhci_dbg(xhci, "Compliance Mode Detected->Port %d!\n",
+                                        i + 1);
+                        xhci_dbg(xhci, "Attempting Recovery routine!\n");
+                        hcd = xhci->shared_hcd;
+
+                        if (hcd->state == HC_STATE_SUSPENDED)
+                                usb_hcd_resume_root_hub(hcd);
+
+                        usb_hcd_poll_rh_status(hcd);
+                }
+        }
+
+        if (xhci->port_status_u0 != ((1 << xhci->num_usb3_ports)-1))
+                mod_timer(&xhci->comp_mode_recovery_timer,
+                        jiffies + msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+}
+
+/*
+ * Quirk to work around issue generated by the SN65LVPE502CP USB3.0 re-driver
+ * that causes ports behind that hardware to enter compliance mode sometimes.
+ * The quirk creates a timer that polls every 2 seconds the link state of
+ * each host controller's port and recovers it by issuing a Warm reset
+ * if Compliance mode is detected, otherwise the port will become "dead" (no
+ * device connections or disconnections will be detected anymore). Becasue no
+ * status event is generated when entering compliance mode (per xhci spec),
+ * this quirk is needed on systems that have the failing hardware installed.
+ */
+static void compliance_mode_recovery_timer_init(struct xhci_hcd *xhci)
+{
+        xhci->port_status_u0 = 0;
+        init_timer(&xhci->comp_mode_recovery_timer);
+
+        xhci->comp_mode_recovery_timer.data = (unsigned long) xhci;
+        xhci->comp_mode_recovery_timer.function = compliance_mode_recovery;
+        xhci->comp_mode_recovery_timer.expires = jiffies +
+                        msecs_to_jiffies(COMP_MODE_RCVRY_MSECS);
+
+        set_timer_slack(&xhci->comp_mode_recovery_timer,
+                        msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+        add_timer(&xhci->comp_mode_recovery_timer);
+        xhci_dbg(xhci, "Compliance Mode Recovery Timer Initialized.\n");
+}
+
+/*
+ * This function identifies the systems that have installed the SN65LVPE502CP
+ * USB3.0 re-driver and that need the Compliance Mode Quirk.
+ * Systems:
+ * Vendor: Hewlett-Packard -> System Models: Z420, Z620 and Z820
+ */
+static bool compliance_mode_recovery_timer_quirk_check(void)
+{
+        const char *dmi_product_name, *dmi_sys_vendor;
+
+        dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
+        dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+
+        if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
+                return false;
+
+        if (strstr(dmi_product_name, "Z420") ||
+                        strstr(dmi_product_name, "Z620") ||
+                        strstr(dmi_product_name, "Z820"))
+                return true;
+
+        return false;
+}
+
+static int xhci_all_ports_seen_u0(struct xhci_hcd *xhci)
+{
+        return (xhci->port_status_u0 == ((1 << xhci->num_usb3_ports)-1));
+}
+
+
 /*
  * Initialize memory for HCD and xHC (one-time init).
  *
@@ -421,6 +511,12 @@ int xhci_init(struct usb_hcd *hcd)
         retval = xhci_mem_init(xhci, GFP_KERNEL);
         xhci_dbg(xhci, "Finished xhci_init\n");
 
+        /* Initializing Compliance Mode Recovery Data If Needed */
+        if (compliance_mode_recovery_timer_quirk_check()) {
+                xhci->quirks |= XHCI_COMP_MODE_QUIRK;
+                compliance_mode_recovery_timer_init(xhci);
+        }
+
         return retval;
 }
 
@@ -629,6 +725,11 @@ void xhci_stop(struct usb_hcd *hcd)
         del_timer_sync(&xhci->event_ring_timer);
 #endif
 
+        /* Deleting Compliance Mode Recovery Timer */
+        if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+                        (!(xhci_all_ports_seen_u0(xhci))))
+                del_timer_sync(&xhci->comp_mode_recovery_timer);
+
         if (xhci->quirks & XHCI_AMD_PLL_FIX)
                 usb_amd_dev_put();
 
@@ -659,7 +760,7 @@ void xhci_shutdown(struct usb_hcd *hcd)
 {
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
-        if (xhci->quirks && XHCI_SPURIOUS_REBOOT)
+        if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
                 usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
 
         spin_lock_irq(&xhci->lock);
@@ -806,6 +907,16 @@ int xhci_suspend(struct xhci_hcd *xhci)
         }
         spin_unlock_irq(&xhci->lock);
 
+        /*
+         * Deleting Compliance Mode Recovery Timer because the xHCI Host
+         * is about to be suspended.
+         */
+        if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+                        (!(xhci_all_ports_seen_u0(xhci)))) {
+                del_timer_sync(&xhci->comp_mode_recovery_timer);
+                xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted!\n");
+        }
+
         /* step 5: remove core well power */
         /* synchronize irq when using MSI-X */
         xhci_msix_sync_irqs(xhci);
@@ -938,6 +1049,16 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 usb_hcd_resume_root_hub(hcd);
                 usb_hcd_resume_root_hub(xhci->shared_hcd);
         }
+
+        /*
+         * If system is subject to the Quirk, Compliance Mode Timer needs to
+         * be re-initialized Always after a system resume. Ports are subject
+         * to suffer the Compliance Mode issue again. It doesn't matter if
+         * ports have entered previously to U0 before system's suspension.
+         */
+        if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
+                compliance_mode_recovery_timer_init(xhci);
+
         return retval;
 }
 #endif  /* CONFIG_PM */
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index c713256297ac..1a05908c6673 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1495,6 +1495,7 @@ struct xhci_hcd {
 #define XHCI_LPM_SUPPORT        (1 << 11)
 #define XHCI_INTEL_HOST         (1 << 12)
 #define XHCI_SPURIOUS_REBOOT    (1 << 13)
+#define XHCI_COMP_MODE_QUIRK    (1 << 14)
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
         /* There are two roothubs to keep track of bus suspend info for */
@@ -1511,6 +1512,11 @@ struct xhci_hcd {
         unsigned                sw_lpm_support:1;
         /* support xHCI 1.0 spec USB2 hardware LPM */
         unsigned                hw_lpm_support:1;
+        /* Compliance Mode Recovery Data */
+        struct timer_list       comp_mode_recovery_timer;
+        u32                     port_status_u0;
+/* Compliance Mode Timer Triggered every 2 seconds */
+#define COMP_MODE_RCVRY_MSECS 2000
 };
 
 /* convert between an HCD pointer and the corresponding EHCI_HCD */
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 4bb717d0bd41..1ae378d5fc6f 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2049,7 +2049,7 @@ static int musb_urb_enqueue(
          * we only have work to do in the former case.
          */
         spin_lock_irqsave(&musb->lock, flags);
-        if (hep->hcpriv) {
+        if (hep->hcpriv || !next_urb(qh)) {
                 /* some concurrent activity submitted another urb to hep...
                  * odd, rare, error prone, but legal.
                  */
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 57a608584e16..c1be687e00ec 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -388,7 +388,7 @@ dma_controller_create(struct musb *musb, void __iomem *base)
         struct platform_device *pdev = to_platform_device(dev);
         int irq = platform_get_irq_byname(pdev, "dma");
 
-        if (irq == 0) {
+        if (irq <= 0) {
                 dev_err(dev, "No DMA interrupt line!\n");
                 return NULL;
         }
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 1a1bd9cf40c5..341625442377 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1215,7 +1215,7 @@ static int __devinit tusb_probe(struct platform_device *pdev)
         ret = platform_device_add(musb);
         if (ret) {
                 dev_err(&pdev->dev, "failed to register musb device\n");
-                goto err1;
+                goto err2;
         }
 
         return 0;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index ecd173032fd4..143c4e9e1be4 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -818,7 +818,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
             usbhs_pipe_is_dcp(pipe))
                 goto usbhsf_pio_prepare_push;
 
-        if (len % 4) /* 32bit alignment */
+        if (len & 0x7) /* 8byte alignment */
                 goto usbhsf_pio_prepare_push;
 
         if ((uintptr_t)(pkt->buf + pkt->actual) & 0x7) /* 8byte alignment */
@@ -905,7 +905,7 @@ static int usbhsf_dma_try_pop(struct usbhs_pkt *pkt, int *is_done)
         /* use PIO if packet is less than pio_dma_border */
         len = usbhsf_fifo_rcv_len(priv, fifo);
         len = min(pkt->length - pkt->actual, len);
-        if (len % 4) /* 32bit alignment */
+        if (len & 0x7) /* 8byte alignment */
                 goto usbhsf_pio_prepare_pop_unselect;
 
         if (len < usbhs_get_dparam(priv, pio_dma_border))
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 5620db6469e5..f906b3aec217 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -704,6 +704,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) },
         { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
         { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
         { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
@@ -804,13 +805,32 @@ static struct usb_device_id id_table_combined [] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
+                                        USB_CLASS_VENDOR_SPEC,
+                                        USB_SUBCLASS_VENDOR_SPEC, 0x00) },
         { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
         { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
         { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
+        { USB_DEVICE(FTDI_VID, PI_C865_PID) },
+        { USB_DEVICE(FTDI_VID, PI_C857_PID) },
+        { USB_DEVICE(PI_VID, PI_C866_PID) },
+        { USB_DEVICE(PI_VID, PI_C663_PID) },
+        { USB_DEVICE(PI_VID, PI_C725_PID) },
+        { USB_DEVICE(PI_VID, PI_E517_PID) },
+        { USB_DEVICE(PI_VID, PI_C863_PID) },
         { USB_DEVICE(PI_VID, PI_E861_PID) },
+        { USB_DEVICE(PI_VID, PI_C867_PID) },
+        { USB_DEVICE(PI_VID, PI_E609_PID) },
+        { USB_DEVICE(PI_VID, PI_E709_PID) },
+        { USB_DEVICE(PI_VID, PI_100F_PID) },
+        { USB_DEVICE(PI_VID, PI_1011_PID) },
+        { USB_DEVICE(PI_VID, PI_1012_PID) },
+        { USB_DEVICE(PI_VID, PI_1013_PID) },
+        { USB_DEVICE(PI_VID, PI_1014_PID) },
+        { USB_DEVICE(PI_VID, PI_1015_PID) },
+        { USB_DEVICE(PI_VID, PI_1016_PID) },
         { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
         { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
         { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 5dd96ca6c380..41fe5826100c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -75,6 +75,9 @@
 #define FTDI_OPENDCC_GATEWAY_PID        0xBFDB
 #define FTDI_OPENDCC_GBM_PID    0xBFDC
 
+/* NZR SEM 16+ USB (http://www.nzr.de) */
+#define FTDI_NZR_SEM_USB_PID    0xC1E0  /* NZR SEM-LOG16+ */
+
 /*
  * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
  */
@@ -539,7 +542,10 @@
 /*
  * Microchip Technology, Inc.
  *
- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by:
+ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
+ * used by single function CDC ACM class based firmware demo
+ * applications.  The VID/PID has also been used in firmware
+ * emulating FTDI serial chips by:
  * Hornby Elite - Digital Command Control Console
  * http://www.hornby.com/hornby-dcc/controllers/
  */
@@ -791,8 +797,27 @@
  * Physik Instrumente
  * http://www.physikinstrumente.com/en/products/
  */
+/* These two devices use the VID of FTDI */
+#define PI_C865_PID     0xe0a0  /* PI C-865 Piezomotor Controller */
+#define PI_C857_PID     0xe0a1  /* PI Encoder Trigger Box */
+
 #define PI_VID              0x1a72  /* Vendor ID */
-#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
+#define PI_C866_PID     0x1000  /* PI C-866 Piezomotor Controller */
+#define PI_C663_PID     0x1001  /* PI C-663 Mercury-Step */
+#define PI_C725_PID     0x1002  /* PI C-725 Piezomotor Controller */
+#define PI_E517_PID     0x1005  /* PI E-517 Digital Piezo Controller Operation Module */
+#define PI_C863_PID     0x1007  /* PI C-863 */
+#define PI_E861_PID     0x1008  /* PI E-861 Piezomotor Controller */
+#define PI_C867_PID     0x1009  /* PI C-867 Piezomotor Controller */
+#define PI_E609_PID     0x100D  /* PI E-609 Digital Piezo Controller */
+#define PI_E709_PID     0x100E  /* PI E-709 Digital Piezo Controller */
+#define PI_100F_PID     0x100F  /* PI Digital Piezo Controller */
+#define PI_1011_PID     0x1011  /* PI Digital Piezo Controller */
+#define PI_1012_PID     0x1012  /* PI Motion Controller */
+#define PI_1013_PID     0x1013  /* PI Motion Controller */
+#define PI_1014_PID     0x1014  /* PI Device */
+#define PI_1015_PID     0x1015  /* PI Device */
+#define PI_1016_PID     0x1016  /* PI Digital Servo Module */
 
 /*
  * Kondo Kagaku Co.Ltd.
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index cc40f47ecea1..5ce88d1bc6f1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -886,8 +886,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff),
-          .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
@@ -1092,6 +1090,10 @@ static const struct usb_device_id option_ids[] = {
          .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
          .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
         { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 211a4920b88a..d8dedc7d3910 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -76,9 +76,24 @@ static int virqfd_wakeup(wait_queue_t *wait, unsigned mode, int sync, void *key)
                         schedule_work(&virqfd->inject);
         }
 
-        if (flags & POLLHUP)
-                /* The eventfd is closing, detach from VFIO */
-                virqfd_deactivate(virqfd);
+        if (flags & POLLHUP) {
+                unsigned long flags;
+                spin_lock_irqsave(&virqfd->vdev->irqlock, flags);
+
+                /*
+                 * The eventfd is closing, if the virqfd has not yet been
+                 * queued for release, as determined by testing whether the
+                 * vdev pointer to it is still valid, queue it now.  As
+                 * with kvm irqfds, we know we won't race against the virqfd
+                 * going away because we hold wqh->lock to get here.
+                 */
+                if (*(virqfd->pvirqfd) == virqfd) {
+                        *(virqfd->pvirqfd) = NULL;
+                        virqfd_deactivate(virqfd);
+                }
+
+                spin_unlock_irqrestore(&virqfd->vdev->irqlock, flags);
+        }
 
         return 0;
 }
@@ -93,7 +108,6 @@ static void virqfd_ptable_queue_proc(struct file *file,
 static void virqfd_shutdown(struct work_struct *work)
 {
         struct virqfd *virqfd = container_of(work, struct virqfd, shutdown);
-        struct virqfd **pvirqfd = virqfd->pvirqfd;
         u64 cnt;
 
         eventfd_ctx_remove_wait_queue(virqfd->eventfd, &virqfd->wait, &cnt);
@@ -101,7 +115,6 @@ static void virqfd_shutdown(struct work_struct *work)
         eventfd_ctx_put(virqfd->eventfd);
 
         kfree(virqfd);
-        *pvirqfd = NULL;
 }
 
 static void virqfd_inject(struct work_struct *work)
@@ -122,15 +135,11 @@ static int virqfd_enable(struct vfio_pci_device *vdev,
         int ret = 0;
         unsigned int events;
 
-        if (*pvirqfd)
-                return -EBUSY;
-
         virqfd = kzalloc(sizeof(*virqfd), GFP_KERNEL);
         if (!virqfd)
                 return -ENOMEM;
 
         virqfd->pvirqfd = pvirqfd;
-        *pvirqfd = virqfd;
         virqfd->vdev = vdev;
         virqfd->handler = handler;
         virqfd->thread = thread;
@@ -154,6 +163,23 @@ static int virqfd_enable(struct vfio_pci_device *vdev,
         virqfd->eventfd = ctx;
 
         /*
+         * virqfds can be released by closing the eventfd or directly
+         * through ioctl.  These are both done through a workqueue, so
+         * we update the pointer to the virqfd under lock to avoid
+         * pushing multiple jobs to release the same virqfd.
+         */
+        spin_lock_irq(&vdev->irqlock);
+
+        if (*pvirqfd) {
+                spin_unlock_irq(&vdev->irqlock);
+                ret = -EBUSY;
+                goto fail;
+        }
+        *pvirqfd = virqfd;
+
+        spin_unlock_irq(&vdev->irqlock);
+
+        /*
          * Install our own custom wake-up handling so we are notified via
          * a callback whenever someone signals the underlying eventfd.
          */
@@ -187,19 +213,29 @@ fail:
                 fput(file);
 
         kfree(virqfd);
-        *pvirqfd = NULL;
 
         return ret;
 }
 
-static void virqfd_disable(struct virqfd *virqfd)
+static void virqfd_disable(struct vfio_pci_device *vdev,
+                           struct virqfd **pvirqfd)
 {
-        if (!virqfd)
-                return;
+        unsigned long flags;
+
+        spin_lock_irqsave(&vdev->irqlock, flags);
+
+        if (*pvirqfd) {
+                virqfd_deactivate(*pvirqfd);
+                *pvirqfd = NULL;
+        }
 
-        virqfd_deactivate(virqfd);
+        spin_unlock_irqrestore(&vdev->irqlock, flags);
 
-        /* Block until we know all outstanding shutdown jobs have completed. */
+        /*
+         * Block until we know all outstanding shutdown jobs have completed.
+         * Even if we don't queue the job, flush the wq to be sure it's
+         * been released.
+         */
         flush_workqueue(vfio_irqfd_cleanup_wq);
 }
 
@@ -392,8 +428,8 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd)
 static void vfio_intx_disable(struct vfio_pci_device *vdev)
 {
         vfio_intx_set_signal(vdev, -1);
-        virqfd_disable(vdev->ctx[0].unmask);
-        virqfd_disable(vdev->ctx[0].mask);
+        virqfd_disable(vdev, &vdev->ctx[0].unmask);
+        virqfd_disable(vdev, &vdev->ctx[0].mask);
         vdev->irq_type = VFIO_PCI_NUM_IRQS;
         vdev->num_ctx = 0;
         kfree(vdev->ctx);
@@ -539,8 +575,8 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix)
         vfio_msi_set_block(vdev, 0, vdev->num_ctx, NULL, msix);
 
         for (i = 0; i < vdev->num_ctx; i++) {
-                virqfd_disable(vdev->ctx[i].unmask);
-                virqfd_disable(vdev->ctx[i].mask);
+                virqfd_disable(vdev, &vdev->ctx[i].unmask);
+                virqfd_disable(vdev, &vdev->ctx[i].mask);
         }
 
         if (msix) {
@@ -577,7 +613,7 @@ static int vfio_pci_set_intx_unmask(struct vfio_pci_device *vdev,
                                              vfio_send_intx_eventfd, NULL,
                                              &vdev->ctx[0].unmask, fd);
 
-                virqfd_disable(vdev->ctx[0].unmask);
+                virqfd_disable(vdev, &vdev->ctx[0].unmask);
         }
 
         return 0;
diff --git a/drivers/video/backlight/88pm860x_bl.c b/drivers/video/backlight/88pm860x_bl.c
index f75da8758adc..f49181c73113 100644
--- a/drivers/video/backlight/88pm860x_bl.c
+++ b/drivers/video/backlight/88pm860x_bl.c
@@ -228,7 +228,6 @@ static int pm860x_backlight_probe(struct platform_device *pdev)
         data->port = pdata->flags;
         if (data->port < 0) {
                 dev_err(&pdev->dev, "wrong platform data is assigned");
-                kfree(data);
                 return -EINVAL;
         }
 
diff --git a/drivers/video/exynos/exynos_mipi_dsi.c b/drivers/video/exynos/exynos_mipi_dsi.c
index 4bc2b8a5dd8b..663c308d0e73 100644
--- a/drivers/video/exynos/exynos_mipi_dsi.c
+++ b/drivers/video/exynos/exynos_mipi_dsi.c
@@ -461,7 +461,7 @@ static int exynos_mipi_dsi_probe(struct platform_device *pdev)
 done:
         platform_set_drvdata(pdev, dsim);
 
-        dev_dbg(&pdev->dev, "%s() completed sucessfuly (%s mode)\n", __func__,
+        dev_dbg(&pdev->dev, "%s() completed successfully (%s mode)\n", __func__,
                 dsim_config->e_interface == DSIM_COMMAND ? "CPU" : "RGB");
 
         return 0;
diff --git a/drivers/video/tmiofb.c b/drivers/video/tmiofb.c
index 8e4a446b5ed1..b244f060f151 100644
--- a/drivers/video/tmiofb.c
+++ b/drivers/video/tmiofb.c
@@ -694,6 +694,10 @@ static int __devinit tmiofb_probe(struct platform_device *dev)
                 dev_err(&dev->dev, "NULL platform data!\n");
                 return -EINVAL;
         }
+        if (ccr == NULL || lcr == NULL || vram == NULL || irq < 0) {
+                dev_err(&dev->dev, "missing resources\n");
+                return -EINVAL;
+        }
 
         info = framebuffer_alloc(sizeof(struct tmiofb_par), &dev->dev);
 
diff --git a/drivers/w1/masters/ds1wm.c b/drivers/w1/masters/ds1wm.c
index 530a2d309063..7c294f4dc0ed 100644
--- a/drivers/w1/masters/ds1wm.c
+++ b/drivers/w1/masters/ds1wm.c
@@ -349,7 +349,7 @@ static void ds1wm_search(void *data, struct w1_master *master_dev,
                         "pass: %d entering ASM\n", pass);
                 ds1wm_write_register(ds1wm_data, DS1WM_CMD, DS1WM_CMD_SRA);
                 dev_dbg(&ds1wm_data->pdev->dev,
-                        "pass: %d begining nibble loop\n", pass);
+                        "pass: %d beginning nibble loop\n", pass);
 
                 r_prime = 0;
                 d = 0;
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 1eff743ec497..ae60406ea8a1 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev,
         hpwdt_timer_reg = pci_mem_addr + 0x70;
         hpwdt_timer_con = pci_mem_addr + 0x72;
 
+        /* Make sure that timer is disabled until /dev/watchdog is opened */
+        hpwdt_stop();
+
         /* Make sure that we have a valid soft_margin */
         if (hpwdt_change_timer(soft_margin))
                 hpwdt_change_timer(DEFAULT_MARGIN);
diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 6aa46a90ff02..3796434991fa 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -128,11 +128,12 @@ EXPORT_SYMBOL_GPL(watchdog_register_device);
 void watchdog_unregister_device(struct watchdog_device *wdd)
 {
         int ret;
-        int devno = wdd->cdev.dev;
+        int devno;
 
         if (wdd == NULL)
                 return;
 
+        devno = wdd->cdev.dev;
         ret = watchdog_dev_unregister(wdd);
         if (ret)
                 pr_err("error unregistering /dev/watchdog (err=%d)\n", ret);
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 1ffd03bf8e10..7f1241608489 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -314,8 +314,9 @@ static int __unmap_grant_pages(struct grant_map *map, int offset, int pages)
                 }
         }
 
-        err = gnttab_unmap_refs(map->unmap_ops + offset, map->pages + offset,
-                                pages, true);
+        err = gnttab_unmap_refs(map->unmap_ops + offset,
+                        use_ptemod ? map->kmap_ops + offset : NULL, map->pages + offset,
+                        pages);
         if (err)
                 return err;
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 0bfc1ef11259..006726688baf 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -870,7 +870,8 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
 EXPORT_SYMBOL_GPL(gnttab_map_refs);
 
 int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
-                      struct page **pages, unsigned int count, bool clear_pte)
+                      struct gnttab_map_grant_ref *kmap_ops,
+                      struct page **pages, unsigned int count)
 {
         int i, ret;
         bool lazy = false;
@@ -888,7 +889,8 @@ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
         }
 
         for (i = 0; i < count; i++) {
-                ret = m2p_remove_override(pages[i], clear_pte);
+                ret = m2p_remove_override(pages[i], kmap_ops ?
+                                       &kmap_ops[i] : NULL);
                 if (ret)
                         return ret;
         }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0d195b507660..9821b672f5a2 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -116,7 +116,7 @@ struct btrfs_ordered_sum;
 #define BTRFS_FREE_SPACE_OBJECTID -11ULL
 
 /*
- * The inode number assigned to the special inode for sotring
+ * The inode number assigned to the special inode for storing
  * free ino cache
  */
 #define BTRFS_FREE_INO_OBJECTID -12ULL
diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
index ab5300595847..c9d703693df0 100644
--- a/fs/btrfs/delayed-ref.h
+++ b/fs/btrfs/delayed-ref.h
@@ -18,7 +18,7 @@
 #ifndef __DELAYED_REF__
 #define __DELAYED_REF__
 
-/* these are the possible values of struct btrfs_delayed_ref->action */
+/* these are the possible values of struct btrfs_delayed_ref_node->action */
 #define BTRFS_ADD_DELAYED_REF    1 /* add one backref to the tree */
 #define BTRFS_DROP_DELAYED_REF   2 /* delete one backref from the tree */
 #define BTRFS_ADD_DELAYED_EXTENT 3 /* record a full extent allocation */
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index ec154f954646..316b07a866d2 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1971,8 +1971,8 @@ out:
                                       ordered_extent->len - 1, NULL, GFP_NOFS);
 
         /*
-         * This needs to be dont to make sure anybody waiting knows we are done
-         * upating everything for this ordered extent.
+         * This needs to be done to make sure anybody waiting knows we are done
+         * updating everything for this ordered extent.
          */
         btrfs_remove_ordered_extent(inode, ordered_extent);
 
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 38b42e7bc91d..b65015581744 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1371,10 +1371,8 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans,
 
         if (srcid) {
                 srcgroup = find_qgroup_rb(fs_info, srcid);
-                if (!srcgroup) {
-                        ret = -EINVAL;
+                if (!srcgroup)
                         goto unlock;
-                }
                 dstgroup->rfer = srcgroup->rfer - level_size;
                 dstgroup->rfer_cmpr = srcgroup->rfer_cmpr - level_size;
                 srcgroup->excl = level_size;
@@ -1383,10 +1381,8 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans,
                 qgroup_dirty(fs_info, srcgroup);
         }
 
-        if (!inherit) {
-                ret = -EINVAL;
+        if (!inherit)
                 goto unlock;
-        }
 
         i_qgroups = (u64 *)(inherit + 1);
         for (i = 0; i < inherit->num_qgroups; ++i) {
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 7dab9c04ad52..53cf2aabce87 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -328,7 +328,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
         }
 
 ctoUTF16_out:
-        return i;
+        return j;
 }
 
 #ifdef CONFIG_CIFS_SMB2
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 9154192b0683..71e9ad9f5961 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -917,7 +917,7 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
         if (!buf) {
                 mutex_unlock(&cinode->lock_mutex);
                 free_xid(xid);
-                return rc;
+                return -ENOMEM;
         }
 
         for (i = 0; i < 2; i++) {
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index c5fbfac5d576..15dc8eea8273 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -96,7 +96,7 @@
  *
  */
 
-#define SMB2_HEADER_STRUCTURE_SIZE __constant_le16_to_cpu(64)
+#define SMB2_HEADER_STRUCTURE_SIZE __constant_cpu_to_le16(64)
 
 struct smb2_hdr {
         __be32 smb2_buf_length; /* big endian on wire */
@@ -140,7 +140,7 @@ struct smb2_pdu {
  *
  */
 
-#define SMB2_ERROR_STRUCTURE_SIZE2 __constant_le16_to_cpu(9)
+#define SMB2_ERROR_STRUCTURE_SIZE2 __constant_cpu_to_le16(9)
 
 struct smb2_err_rsp {
         struct smb2_hdr hdr;
diff --git a/fs/dcache.c b/fs/dcache.c
index 8086636bf796..693f95bf1cae 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
          * Inform try_to_ascend() that we are no longer attached to the
          * dentry tree
          */
-        dentry->d_flags |= DCACHE_DISCONNECTED;
+        dentry->d_flags |= DCACHE_DENTRY_KILLED;
         if (parent)
                 spin_unlock(&parent->d_lock);
         dentry_iput(dentry);
@@ -1048,7 +1048,7 @@ static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq
          * or deletion
          */
         if (new != old->d_parent ||
-                 (old->d_flags & DCACHE_DISCONNECTED) ||
+                 (old->d_flags & DCACHE_DENTRY_KILLED) ||
                  (!locked && read_seqretry(&rename_lock, seq))) {
                 spin_unlock(&new->d_lock);
                 new = NULL;
@@ -1134,6 +1134,8 @@ positive:
         return 1;
 
 rename_retry:
+        if (locked)
+                goto again;
         locked = 1;
         write_seqlock(&rename_lock);
         goto again;
@@ -1141,7 +1143,7 @@ rename_retry:
 EXPORT_SYMBOL(have_submounts);
 
 /*
- * Search the dentry child list for the specified parent,
+ * Search the dentry child list of the specified parent,
  * and move any unused dentries to the end of the unused
  * list for prune_dcache(). We descend to the next level
  * whenever the d_subdirs list is non-empty and continue
@@ -1236,6 +1238,8 @@ out:
 rename_retry:
         if (found)
                 return found;
+        if (locked)
+                goto again;
         locked = 1;
         write_seqlock(&rename_lock);
         goto again;
@@ -3035,6 +3039,8 @@ resume:
         return;
 
 rename_retry:
+        if (locked)
+                goto again;
         locked = 1;
         write_seqlock(&rename_lock);
         goto again;
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 2340f6978d6e..c5ca6ae5a30c 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -526,73 +526,51 @@ struct array_data {
         u32 elements;
 };
 
-static int u32_array_open(struct inode *inode, struct file *file)
-{
-        file->private_data = NULL;
-        return nonseekable_open(inode, file);
-}
-
-static size_t format_array(char *buf, size_t bufsize, const char *fmt,
-                           u32 *array, u32 array_size)
+static size_t u32_format_array(char *buf, size_t bufsize,
+                               u32 *array, int array_size)
 {
         size_t ret = 0;
-        u32 i;
 
-        for (i = 0; i < array_size; i++) {
+        while (--array_size >= 0) {
                 size_t len;
+                char term = array_size ? ' ' : '\n';
 
-                len = snprintf(buf, bufsize, fmt, array[i]);
-                len++;  /* ' ' or '\n' */
+                len = snprintf(buf, bufsize, "%u%c", *array++, term);
                 ret += len;
 
-                if (buf) {
-                        buf += len;
-                        bufsize -= len;
-                        buf[-1] = (i == array_size-1) ? '\n' : ' ';
-                }
+                buf += len;
+                bufsize -= len;
         }
-
-        ret++;          /* \0 */
-        if (buf)
-                *buf = '\0';
-
         return ret;
 }
 
-static char *format_array_alloc(const char *fmt, u32 *array,
-                                                u32 array_size)
+static int u32_array_open(struct inode *inode, struct file *file)
 {
-        size_t len = format_array(NULL, 0, fmt, array, array_size);
-        char *ret;
-
-        ret = kmalloc(len, GFP_KERNEL);
-        if (ret == NULL)
-                return NULL;
+        struct array_data *data = inode->i_private;
+        int size, elements = data->elements;
+        char *buf;
+
+        /*
+         * Max size:
+         *  - 10 digits + ' '/'\n' = 11 bytes per number
+         *  - terminating NUL character
+         */
+        size = elements*11;
+        buf = kmalloc(size+1, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        buf[size] = 0;
+
+        file->private_data = buf;
+        u32_format_array(buf, size, data->array, data->elements);
 
-        format_array(ret, len, fmt, array, array_size);
-        return ret;
+        return nonseekable_open(inode, file);
 }
 
 static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len,
                               loff_t *ppos)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
-        struct array_data *data = inode->i_private;
-        size_t size;
-
-        if (*ppos == 0) {
-                if (file->private_data) {
-                        kfree(file->private_data);
-                        file->private_data = NULL;
-                }
-
-                file->private_data = format_array_alloc("%u", data->array,
-                                                              data->elements);
-        }
-
-        size = 0;
-        if (file->private_data)
-                size = strlen(file->private_data);
+        size_t size = strlen(file->private_data);
 
         return simple_read_from_buffer(buf, len, ppos,
                                         file->private_data, size);
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 44ce5c6a541d..d45ba4568128 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -275,8 +275,14 @@ out:
 
 static int ecryptfs_flush(struct file *file, fl_owner_t td)
 {
-        return file->f_mode & FMODE_WRITE
-               ? filemap_write_and_wait(file->f_mapping) : 0;
+        struct file *lower_file = ecryptfs_file_to_lower(file);
+
+        if (lower_file->f_op && lower_file->f_op->flush) {
+                filemap_write_and_wait(file->f_mapping);
+                return lower_file->f_op->flush(lower_file, td);
+        }
+
+        return 0;
 }
 
 static int ecryptfs_release(struct inode *inode, struct file *file)
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 534b129ea676..cc7709e7c508 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -619,6 +619,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct dentry *lower_old_dir_dentry;
         struct dentry *lower_new_dir_dentry;
         struct dentry *trap = NULL;
+        struct inode *target_inode;
 
         lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
         lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
@@ -626,6 +627,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         dget(lower_new_dentry);
         lower_old_dir_dentry = dget_parent(lower_old_dentry);
         lower_new_dir_dentry = dget_parent(lower_new_dentry);
+        target_inode = new_dentry->d_inode;
         trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
         /* source should not be ancestor of target */
         if (trap == lower_old_dentry) {
@@ -641,6 +643,9 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                         lower_new_dir_dentry->d_inode, lower_new_dentry);
         if (rc)
                 goto out_lock;
+        if (target_inode)
+                fsstack_copy_attr_all(target_inode,
+                                      ecryptfs_inode_to_lower(target_inode));
         fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
         if (new_dir != old_dir)
                 fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 2768138eefee..9b627c15010a 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -162,6 +162,7 @@ void ecryptfs_put_lower_file(struct inode *inode)
         inode_info = ecryptfs_inode_to_private(inode);
         if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,
                                       &inode_info->lower_file_mutex)) {
+                filemap_write_and_wait(inode->i_mapping);
                 fput(inode_info->lower_file);
                 inode_info->lower_file = NULL;
                 mutex_unlock(&inode_info->lower_file_mutex);
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 376aa77f3ca7..2616d0ea5c5c 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -479,7 +479,7 @@ void ext2_discard_reservation(struct inode *inode)
 /**
  * ext2_free_blocks() -- Free given blocks and update quota and i_blocks
  * @inode:              inode
- * @block:              start physcial block to free
+ * @block:              start physical block to free
  * @count:              number of blocks to free
  */
 void ext2_free_blocks (struct inode * inode, unsigned long block,
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index 90d901f0486b..7320a66e958f 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -483,7 +483,7 @@ void ext3_discard_reservation(struct inode *inode)
  * ext3_free_blocks_sb() -- Free given blocks and update quota
  * @handle:                     handle to this transaction
  * @sb:                         super block
- * @block:                      start physcial block to free
+ * @block:                      start physical block to free
  * @count:                      number of blocks to free
  * @pdquot_freed_blocks:        pointer to quota
  */
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index a07597307fd1..7e87e37a372a 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -3072,6 +3072,8 @@ static int ext3_do_update_inode(handle_t *handle,
         struct ext3_inode_info *ei = EXT3_I(inode);
         struct buffer_head *bh = iloc->bh;
         int err = 0, rc, block;
+        int need_datasync = 0;
+        __le32 disksize;
         uid_t i_uid;
         gid_t i_gid;
 
@@ -3113,7 +3115,11 @@ again:
                 raw_inode->i_gid_high = 0;
         }
         raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
-        raw_inode->i_size = cpu_to_le32(ei->i_disksize);
+        disksize = cpu_to_le32(ei->i_disksize);
+        if (disksize != raw_inode->i_size) {
+                need_datasync = 1;
+                raw_inode->i_size = disksize;
+        }
         raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
         raw_inode->i_ctime = cpu_to_le32(inode->i_ctime.tv_sec);
         raw_inode->i_mtime = cpu_to_le32(inode->i_mtime.tv_sec);
@@ -3129,8 +3135,11 @@ again:
         if (!S_ISREG(inode->i_mode)) {
                 raw_inode->i_dir_acl = cpu_to_le32(ei->i_dir_acl);
         } else {
-                raw_inode->i_size_high =
-                        cpu_to_le32(ei->i_disksize >> 32);
+                disksize = cpu_to_le32(ei->i_disksize >> 32);
+                if (disksize != raw_inode->i_size_high) {
+                        raw_inode->i_size_high = disksize;
+                        need_datasync = 1;
+                }
                 if (ei->i_disksize > 0x7fffffffULL) {
                         struct super_block *sb = inode->i_sb;
                         if (!EXT3_HAS_RO_COMPAT_FEATURE(sb,
@@ -3183,6 +3192,8 @@ again:
         ext3_clear_inode_state(inode, EXT3_STATE_NEW);
 
         atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
+        if (need_datasync)
+                atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
 out_brelse:
         brelse (bh);
         ext3_std_error(inode->i_sb, err);
@@ -3196,7 +3207,7 @@ out_brelse:
  *
  * - Within generic_file_write() for O_SYNC files.
  *   Here, there will be no transaction running. We wait for any running
- *   trasnaction to commit.
+ *   transaction to commit.
  *
  * - Within sys_sync(), kupdate and such.
  *   We wait on commit, if tol to.
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index dff171c3a123..c862ee5fe79d 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3313,7 +3313,7 @@ int ext4_discard_partial_page_buffers(handle_t *handle,
  * handle: The journal handle
  * inode:  The files inode
  * page:   A locked page that contains the offset "from"
- * from:   The starting byte offset (from the begining of the file)
+ * from:   The starting byte offset (from the beginning of the file)
  *         to begin discarding
  * len:    The length of bytes to discard
  * flags:  Optional flags that may be used:
@@ -3321,11 +3321,11 @@ int ext4_discard_partial_page_buffers(handle_t *handle,
  *         EXT4_DISCARD_PARTIAL_PG_ZERO_UNMAPPED
  *         Only zero the regions of the page whose buffer heads
  *         have already been unmapped.  This flag is appropriate
- *         for updateing the contents of a page whose blocks may
+ *         for updating the contents of a page whose blocks may
  *         have already been released, and we only want to zero
  *         out the regions that correspond to those released blocks.
  *
- * Returns zero on sucess or negative on failure.
+ * Returns zero on success or negative on failure.
  */
 static int ext4_discard_partial_page_buffers_no_lock(handle_t *handle,
                 struct inode *inode, struct page *page, loff_t from,
@@ -3486,7 +3486,7 @@ int ext4_can_truncate(struct inode *inode)
  * @offset: The offset where the hole will begin
  * @len:    The length of the hole
  *
- * Returns: 0 on sucess or negative on failure
+ * Returns: 0 on success or negative on failure
  */
 
 int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)
@@ -4008,7 +4008,7 @@ static int ext4_inode_blocks_set(handle_t *handle,
 
         if (i_blocks <= ~0U) {
                 /*
-                 * i_blocks can be represnted in a 32 bit variable
+                 * i_blocks can be represented in a 32 bit variable
                  * as multiple of 512 bytes
                  */
                 raw_inode->i_blocks_lo   = cpu_to_le32(i_blocks);
@@ -4169,7 +4169,7 @@ out_brelse:
  *
  * - Within generic_file_write() for O_SYNC files.
  *   Here, there will be no transaction running. We wait for any running
- *   trasnaction to commit.
+ *   transaction to commit.
  *
  * - Within sys_sync(), kupdate and such.
  *   We wait on commit, if tol to.
@@ -4413,7 +4413,7 @@ static int ext4_index_trans_blocks(struct inode *inode, int nrblocks, int chunk)
  * worse case, the indexs blocks spread over different block groups
  *
  * If datablocks are discontiguous, they are possible to spread over
- * different block groups too. If they are contiuguous, with flexbg,
+ * different block groups too. If they are contiguous, with flexbg,
  * they could still across block group boundary.
  *
  * Also account for superblock, inode, quota and xattr blocks
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 8eae94771c45..08778f6cdfe9 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4709,7 +4709,7 @@ error_return:
  * ext4_group_add_blocks() -- Add given blocks to an existing group
  * @handle:                     handle to this transaction
  * @sb:                         super block
- * @block:                      start physcial block to add to the block group
+ * @block:                      start physical block to add to the block group
  * @count:                      number of blocks to free
  *
  * This marks the blocks as free in the bitmap and buddy.
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index be3efc4f64f4..6d46c0d78338 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -577,10 +577,6 @@ static long writeback_chunk_size(struct backing_dev_info *bdi,
 /*
  * Write a portion of b_io inodes which belong to @sb.
  *
- * If @only_this_sb is true, then find and write all such
- * inodes. Otherwise write only ones which go sequentially
- * in reverse order.
- *
  * Return the number of pages and/or inodes written.
  */
 static long writeback_sb_inodes(struct super_block *sb,
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index 03ff5b1eba93..75a20c092dd4 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -117,7 +117,7 @@ static ssize_t fuse_conn_max_background_write(struct file *file,
                                               const char __user *buf,
                                               size_t count, loff_t *ppos)
 {
-        unsigned val;
+        unsigned uninitialized_var(val);
         ssize_t ret;
 
         ret = fuse_conn_limit_write(file, buf, count, ppos, &val,
@@ -154,7 +154,7 @@ static ssize_t fuse_conn_congestion_threshold_write(struct file *file,
                                                     const char __user *buf,
                                                     size_t count, loff_t *ppos)
 {
-        unsigned val;
+        unsigned uninitialized_var(val);
         ssize_t ret;
 
         ret = fuse_conn_limit_write(file, buf, count, ppos, &val,
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index 3426521f3205..ee8d55042298 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -396,7 +396,7 @@ err_device:
 err_region:
         unregister_chrdev_region(devt, 1);
 err:
-        fc->conn_error = 1;
+        fuse_conn_kill(fc);
         goto out;
 }
 
@@ -532,8 +532,6 @@ static int cuse_channel_release(struct inode *inode, struct file *file)
                 cdev_del(cc->cdev);
         }
 
-        /* kill connection and shutdown channel */
-        fuse_conn_kill(&cc->fc);
         rc = fuse_dev_release(inode, file);     /* puts the base reference */
 
         return rc;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 7df2b5e8fbe1..f4246cfc8d87 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1576,6 +1576,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
                 req->pages[req->num_pages] = page;
                 req->num_pages++;
 
+                offset = 0;
                 num -= this_num;
                 total_len += this_num;
                 index++;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index ce0a2838ccd0..fca222dabe3c 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -367,11 +367,6 @@ void fuse_conn_kill(struct fuse_conn *fc)
         wake_up_all(&fc->waitq);
         wake_up_all(&fc->blocked_waitq);
         wake_up_all(&fc->reserved_req_waitq);
-        mutex_lock(&fuse_mutex);
-        list_del(&fc->entry);
-        fuse_ctl_remove_conn(fc);
-        mutex_unlock(&fuse_mutex);
-        fuse_bdi_destroy(fc);
 }
 EXPORT_SYMBOL_GPL(fuse_conn_kill);
 
@@ -380,7 +375,14 @@ static void fuse_put_super(struct super_block *sb)
         struct fuse_conn *fc = get_fuse_conn_super(sb);
 
         fuse_send_destroy(fc);
+
         fuse_conn_kill(fc);
+        mutex_lock(&fuse_mutex);
+        list_del(&fc->entry);
+        fuse_ctl_remove_conn(fc);
+        mutex_unlock(&fuse_mutex);
+        fuse_bdi_destroy(fc);
+
         fuse_conn_put(fc);
 }
 
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index d6526347d386..01c4975da4bc 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -612,6 +612,7 @@ static int gfs2_write_begin(struct file *file, struct address_space *mapping,
         struct gfs2_sbd *sdp = GFS2_SB(mapping->host);
         struct gfs2_inode *m_ip = GFS2_I(sdp->sd_statfs_inode);
         unsigned int data_blocks = 0, ind_blocks = 0, rblocks;
+        unsigned requested = 0;
         int alloc_required;
         int error = 0;
         pgoff_t index = pos >> PAGE_CACHE_SHIFT;
@@ -641,7 +642,8 @@ static int gfs2_write_begin(struct file *file, struct address_space *mapping,
                 if (error)
                         goto out_unlock;
 
-                error = gfs2_inplace_reserve(ip, data_blocks + ind_blocks);
+                requested = data_blocks + ind_blocks;
+                error = gfs2_inplace_reserve(ip, requested);
                 if (error)
                         goto out_qunlock;
         }
@@ -654,7 +656,7 @@ static int gfs2_write_begin(struct file *file, struct address_space *mapping,
         if (&ip->i_inode == sdp->sd_rindex)
                 rblocks += 2 * RES_STATFS;
         if (alloc_required)
-                rblocks += gfs2_rg_blocks(ip);
+                rblocks += gfs2_rg_blocks(ip, requested);
 
         error = gfs2_trans_begin(sdp, rblocks,
                                  PAGE_CACHE_SIZE/sdp->sd_sb.sb_bsize);
@@ -868,8 +870,7 @@ static int gfs2_write_end(struct file *file, struct address_space *mapping,
         brelse(dibh);
 failed:
         gfs2_trans_end(sdp);
-        if (gfs2_mb_reserved(ip))
-                gfs2_inplace_release(ip);
+        gfs2_inplace_release(ip);
         if (ip->i_res->rs_qa_qd_num)
                 gfs2_quota_unlock(ip);
         if (inode == sdp->sd_rindex) {
@@ -1023,7 +1024,7 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
                                   offset, nr_segs, gfs2_get_block_direct,
                                   NULL, NULL, 0);
 out:
-        gfs2_glock_dq_m(1, &gh);
+        gfs2_glock_dq(&gh);
         gfs2_holder_uninit(&gh);
         return rv;
 }
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 49cd7dd4a9fa..1fd3ae237bdd 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -786,7 +786,7 @@ static int do_strip(struct gfs2_inode *ip, struct buffer_head *dibh,
                 goto out_rlist;
 
         if (gfs2_rs_active(ip->i_res)) /* needs to be done with the rgrp glock held */
-                gfs2_rs_deltree(ip->i_res);
+                gfs2_rs_deltree(ip, ip->i_res);
 
         error = gfs2_trans_begin(sdp, rg_blocks + RES_DINODE +
                                  RES_INDIRECT + RES_STATFS + RES_QUOTA,
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index d1d791ef38de..30e21997a1a1 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -323,6 +323,29 @@ static long gfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 }
 
 /**
+ * gfs2_size_hint - Give a hint to the size of a write request
+ * @file: The struct file
+ * @offset: The file offset of the write
+ * @size: The length of the write
+ *
+ * When we are about to do a write, this function records the total
+ * write size in order to provide a suitable hint to the lower layers
+ * about how many blocks will be required.
+ *
+ */
+
+static void gfs2_size_hint(struct file *filep, loff_t offset, size_t size)
+{
+        struct inode *inode = filep->f_dentry->d_inode;
+        struct gfs2_sbd *sdp = GFS2_SB(inode);
+        struct gfs2_inode *ip = GFS2_I(inode);
+        size_t blks = (size + sdp->sd_sb.sb_bsize - 1) >> sdp->sd_sb.sb_bsize_shift;
+        int hint = min_t(size_t, INT_MAX, blks);
+
+        atomic_set(&ip->i_res->rs_sizehint, hint);
+}
+
+/**
  * gfs2_allocate_page_backing - Use bmap to allocate blocks
  * @page: The (locked) page to allocate backing for
  *
@@ -382,8 +405,7 @@ static int gfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         if (ret)
                 return ret;
 
-        atomic_set(&ip->i_res->rs_sizehint,
-                   PAGE_CACHE_SIZE >> sdp->sd_sb.sb_bsize_shift);
+        gfs2_size_hint(vma->vm_file, pos, PAGE_CACHE_SIZE);
 
         gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         ret = gfs2_glock_nq(&gh);
@@ -419,7 +441,7 @@ static int gfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
                 rblocks += data_blocks ? data_blocks : 1;
         if (ind_blocks || data_blocks) {
                 rblocks += RES_STATFS + RES_QUOTA;
-                rblocks += gfs2_rg_blocks(ip);
+                rblocks += gfs2_rg_blocks(ip, data_blocks + ind_blocks);
         }
         ret = gfs2_trans_begin(sdp, rblocks, 0);
         if (ret)
@@ -663,7 +685,8 @@ static ssize_t gfs2_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         if (ret)
                 return ret;
 
-        atomic_set(&ip->i_res->rs_sizehint, writesize >> sdp->sd_sb.sb_bsize_shift);
+        gfs2_size_hint(file, pos, writesize);
+
         if (file->f_flags & O_APPEND) {
                 struct gfs2_holder gh;
 
@@ -789,7 +812,7 @@ static long gfs2_fallocate(struct file *file, int mode, loff_t offset,
         if (unlikely(error))
                 goto out_uninit;
 
-        atomic_set(&ip->i_res->rs_sizehint, len >> sdp->sd_sb.sb_bsize_shift);
+        gfs2_size_hint(file, offset, len);
 
         while (len > 0) {
                 if (len < bytes)
@@ -822,7 +845,7 @@ retry:
                                 &max_bytes, &data_blocks, &ind_blocks);
 
                 rblocks = RES_DINODE + ind_blocks + RES_STATFS + RES_QUOTA +
-                          RES_RG_HDR + gfs2_rg_blocks(ip);
+                          RES_RG_HDR + gfs2_rg_blocks(ip, data_blocks + ind_blocks);
                 if (gfs2_is_jdata(ip))
                         rblocks += data_blocks ? data_blocks : 1;
 
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 1ed81f40da0d..e6c2fd53cab2 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -186,20 +186,6 @@ static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
 }
 
 /**
- * __gfs2_glock_schedule_for_reclaim - Add a glock to the reclaim list
- * @gl: the glock
- *
- * If the glock is demotable, then we add it (or move it) to the end
- * of the glock LRU list.
- */
-
-static void __gfs2_glock_schedule_for_reclaim(struct gfs2_glock *gl)
-{
-        if (demote_ok(gl))
-                gfs2_glock_add_to_lru(gl);
-}
-
-/**
  * gfs2_glock_put_nolock() - Decrement reference count on glock
  * @gl: The glock to put
  *
@@ -883,7 +869,14 @@ static int gfs2_glock_demote_wait(void *word)
         return 0;
 }
 
-static void wait_on_holder(struct gfs2_holder *gh)
+/**
+ * gfs2_glock_wait - wait on a glock acquisition
+ * @gh: the glock holder
+ *
+ * Returns: 0 on success
+ */
+
+int gfs2_glock_wait(struct gfs2_holder *gh)
 {
         unsigned long time1 = jiffies;
 
@@ -894,12 +887,7 @@ static void wait_on_holder(struct gfs2_holder *gh)
                 gh->gh_gl->gl_hold_time = min(gh->gh_gl->gl_hold_time +
                                               GL_GLOCK_HOLD_INCR,
                                               GL_GLOCK_MAX_HOLD);
-}
-
-static void wait_on_demote(struct gfs2_glock *gl)
-{
-        might_sleep();
-        wait_on_bit(&gl->gl_flags, GLF_DEMOTE, gfs2_glock_demote_wait, TASK_UNINTERRUPTIBLE);
+        return gh->gh_error;
 }
 
 /**
@@ -929,19 +917,6 @@ static void handle_callback(struct gfs2_glock *gl, unsigned int state,
         trace_gfs2_demote_rq(gl);
 }
 
-/**
- * gfs2_glock_wait - wait on a glock acquisition
- * @gh: the glock holder
- *
- * Returns: 0 on success
- */
-
-int gfs2_glock_wait(struct gfs2_holder *gh)
-{
-        wait_on_holder(gh);
-        return gh->gh_error;
-}
-
 void gfs2_print_dbg(struct seq_file *seq, const char *fmt, ...)
 {
         struct va_format vaf;
@@ -979,7 +954,7 @@ __acquires(&gl->gl_spin)
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct list_head *insert_pt = NULL;
         struct gfs2_holder *gh2;
-        int try_lock = 0;
+        int try_futile = 0;
 
         BUG_ON(gh->gh_owner_pid == NULL);
         if (test_and_set_bit(HIF_WAIT, &gh->gh_iflags))
@@ -987,7 +962,7 @@ __acquires(&gl->gl_spin)
 
         if (gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) {
                 if (test_bit(GLF_LOCK, &gl->gl_flags))
-                        try_lock = 1;
+                        try_futile = !may_grant(gl, gh);
                 if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags))
                         goto fail;
         }
@@ -996,9 +971,8 @@ __acquires(&gl->gl_spin)
                 if (unlikely(gh2->gh_owner_pid == gh->gh_owner_pid &&
                     (gh->gh_gl->gl_ops->go_type != LM_TYPE_FLOCK)))
                         goto trap_recursive;
-                if (try_lock &&
-                    !(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) &&
-                    !may_grant(gl, gh)) {
+                if (try_futile &&
+                    !(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB))) {
 fail:
                         gh->gh_error = GLR_TRYFAILED;
                         gfs2_holder_wake(gh);
@@ -1121,8 +1095,9 @@ void gfs2_glock_dq(struct gfs2_holder *gh)
                     !test_bit(GLF_DEMOTE, &gl->gl_flags))
                         fast_path = 1;
         }
-        if (!test_bit(GLF_LFLUSH, &gl->gl_flags))
-                __gfs2_glock_schedule_for_reclaim(gl);
+        if (!test_bit(GLF_LFLUSH, &gl->gl_flags) && demote_ok(gl))
+                gfs2_glock_add_to_lru(gl);
+
         trace_gfs2_glock_queue(gh, 0);
         spin_unlock(&gl->gl_spin);
         if (likely(fast_path))
@@ -1141,7 +1116,8 @@ void gfs2_glock_dq_wait(struct gfs2_holder *gh)
 {
         struct gfs2_glock *gl = gh->gh_gl;
         gfs2_glock_dq(gh);
-        wait_on_demote(gl);
+        might_sleep();
+        wait_on_bit(&gl->gl_flags, GLF_DEMOTE, gfs2_glock_demote_wait, TASK_UNINTERRUPTIBLE);
 }
 
 /**
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 4bdcf3784187..32cc4fde975c 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -94,6 +94,7 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
         /* A shortened, inline version of gfs2_trans_begin() */
         tr.tr_reserved = 1 + gfs2_struct2blk(sdp, tr.tr_revokes, sizeof(u64));
         tr.tr_ip = (unsigned long)__builtin_return_address(0);
+        sb_start_intwrite(sdp->sd_vfs);
         gfs2_log_reserve(sdp, tr.tr_reserved);
         BUG_ON(current->journal_info);
         current->journal_info = &tr;
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index aaecc8085fc5..3d469d37345e 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -99,9 +99,26 @@ struct gfs2_rgrpd {
 #define GFS2_RDF_MASK           0xf0000000 /* mask for internal flags */
         spinlock_t rd_rsspin;           /* protects reservation related vars */
         struct rb_root rd_rstree;       /* multi-block reservation tree */
-        u32 rd_rs_cnt;                  /* count of current reservations */
 };
 
+struct gfs2_rbm {
+        struct gfs2_rgrpd *rgd;
+        struct gfs2_bitmap *bi; /* Bitmap must belong to the rgd */
+        u32 offset;             /* The offset is bitmap relative */
+};
+
+static inline u64 gfs2_rbm_to_block(const struct gfs2_rbm *rbm)
+{
+        return rbm->rgd->rd_data0 + (rbm->bi->bi_start * GFS2_NBBY) + rbm->offset;
+}
+
+static inline bool gfs2_rbm_eq(const struct gfs2_rbm *rbm1,
+                               const struct gfs2_rbm *rbm2)
+{
+        return (rbm1->rgd == rbm2->rgd) && (rbm1->bi == rbm2->bi) && 
+               (rbm1->offset == rbm2->offset);
+}
+
 enum gfs2_state_bits {
         BH_Pinned = BH_PrivateStart,
         BH_Escaped = BH_PrivateStart + 1,
@@ -250,18 +267,11 @@ struct gfs2_blkreserv {
         /* components used during write (step 1): */
         atomic_t rs_sizehint;         /* hint of the write size */
 
-        /* components used during inplace_reserve (step 2): */
-        u32 rs_requested; /* Filled in by caller of gfs2_inplace_reserve() */
-
-        /* components used during get_local_rgrp (step 3): */
-        struct gfs2_rgrpd *rs_rgd;    /* pointer to the gfs2_rgrpd */
         struct gfs2_holder rs_rgd_gh; /* Filled in by get_local_rgrp */
         struct rb_node rs_node;       /* link to other block reservations */
-
-        /* components used during block searches and assignments (step 4): */
-        struct gfs2_bitmap *rs_bi;    /* bitmap for the current allocation */
-        u32 rs_biblk;                 /* start block relative to the bi */
+        struct gfs2_rbm rs_rbm;       /* Start of reservation */
         u32 rs_free;                  /* how many blocks are still free */
+        u64 rs_inum;                  /* Inode number for reservation */
 
         /* ancillary quota stuff */
         struct gfs2_quota_data *rs_qa_qd[2 * MAXQUOTAS];
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 4ce22e547308..381893ceefa4 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -712,14 +712,9 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
         if (error)
                 goto fail_gunlock2;
 
-        /* The newly created inode needs a reservation so it can allocate
-           xattrs. At the same time, we want new blocks allocated to the new
-           dinode to be as contiguous as possible. Since we allocated the
-           dinode block under the directory's reservation, we transfer
-           ownership of that reservation to the new inode. The directory
-           doesn't need a reservation unless it needs a new allocation. */
-        ip->i_res = dip->i_res;
-        dip->i_res = NULL;
+        error = gfs2_rs_alloc(ip);
+        if (error)
+                goto fail_gunlock2;
 
         error = gfs2_acl_create(dip, inode);
         if (error)
@@ -737,10 +732,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
                 brelse(bh);
 
         gfs2_trans_end(sdp);
-        /* Check if we reserved space in the rgrp. Function link_dinode may
-           not, depending on whether alloc is required. */
-        if (gfs2_mb_reserved(dip))
-                gfs2_inplace_release(dip);
+        gfs2_inplace_release(dip);
         gfs2_quota_unlock(dip);
         mark_inode_dirty(inode);
         gfs2_glock_dq_uninit_m(2, ghs);
@@ -897,7 +889,7 @@ static int gfs2_link(struct dentry *old_dentry, struct inode *dir,
                         goto out_gunlock_q;
 
                 error = gfs2_trans_begin(sdp, sdp->sd_max_dirres +
-                                         gfs2_rg_blocks(dip) +
+                                         gfs2_rg_blocks(dip, sdp->sd_max_dirres) +
                                          2 * RES_DINODE + RES_STATFS +
                                          RES_QUOTA, 0);
                 if (error)
@@ -1378,7 +1370,7 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
                         goto out_gunlock_q;
 
                 error = gfs2_trans_begin(sdp, sdp->sd_max_dirres +
-                                         gfs2_rg_blocks(ndip) +
+                                         gfs2_rg_blocks(ndip, sdp->sd_max_dirres) +
                                          4 * RES_DINODE + 4 * RES_LEAF +
                                          RES_STATFS + RES_QUOTA + 4, 0);
                 if (error)
@@ -1722,7 +1714,9 @@ static int gfs2_setxattr(struct dentry *dentry, const char *name,
         gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         ret = gfs2_glock_nq(&gh);
         if (ret == 0) {
-                ret = generic_setxattr(dentry, name, data, size, flags);
+                ret = gfs2_rs_alloc(ip);
+                if (ret == 0)
+                        ret = generic_setxattr(dentry, name, data, size, flags);
                 gfs2_glock_dq(&gh);
         }
         gfs2_holder_uninit(&gh);
@@ -1757,7 +1751,9 @@ static int gfs2_removexattr(struct dentry *dentry, const char *name)
         gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         ret = gfs2_glock_nq(&gh);
         if (ret == 0) {
-                ret = generic_removexattr(dentry, name);
+                ret = gfs2_rs_alloc(ip);
+                if (ret == 0)
+                        ret = generic_removexattr(dentry, name);
                 gfs2_glock_dq(&gh);
         }
         gfs2_holder_uninit(&gh);
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index e5af9dc420ef..e443966c8106 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -19,6 +19,7 @@
 #include <linux/mount.h>
 #include <linux/gfs2_ondisk.h>
 #include <linux/quotaops.h>
+#include <linux/lockdep.h>
 
 #include "gfs2.h"
 #include "incore.h"
@@ -766,6 +767,7 @@ fail:
         return error;
 }
 
+static struct lock_class_key gfs2_quota_imutex_key;
 
 static int init_inodes(struct gfs2_sbd *sdp, int undo)
 {
@@ -803,6 +805,12 @@ static int init_inodes(struct gfs2_sbd *sdp, int undo)
                 fs_err(sdp, "can't get quota file inode: %d\n", error);
                 goto fail_rindex;
         }
+        /*
+         * i_mutex on quota files is special. Since this inode is hidden system
+         * file, we are safe to define locking ourselves.
+         */
+        lockdep_set_class(&sdp->sd_quota_inode->i_mutex,
+                          &gfs2_quota_imutex_key);
 
         error = gfs2_rindex_update(sdp);
         if (error)
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index a3bde91645c2..4021deca61ef 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -765,6 +765,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
         struct gfs2_holder *ghs, i_gh;
         unsigned int qx, x;
         struct gfs2_quota_data *qd;
+        unsigned reserved;
         loff_t offset;
         unsigned int nalloc = 0, blocks;
         int error;
@@ -781,7 +782,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
                 return -ENOMEM;
 
         sort(qda, num_qd, sizeof(struct gfs2_quota_data *), sort_qd, NULL);
-        mutex_lock_nested(&ip->i_inode.i_mutex, I_MUTEX_QUOTA);
+        mutex_lock(&ip->i_inode.i_mutex);
         for (qx = 0; qx < num_qd; qx++) {
                 error = gfs2_glock_nq_init(qda[qx]->qd_gl, LM_ST_EXCLUSIVE,
                                            GL_NOCACHE, &ghs[qx]);
@@ -811,13 +812,13 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
          * two blocks need to be updated instead of 1 */
         blocks = num_qd * data_blocks + RES_DINODE + num_qd + 3;
 
-        error = gfs2_inplace_reserve(ip, 1 +
-                                     (nalloc * (data_blocks + ind_blocks)));
+        reserved = 1 + (nalloc * (data_blocks + ind_blocks));
+        error = gfs2_inplace_reserve(ip, reserved);
         if (error)
                 goto out_alloc;
 
         if (nalloc)
-                blocks += gfs2_rg_blocks(ip) + nalloc * ind_blocks + RES_STATFS;
+                blocks += gfs2_rg_blocks(ip, reserved) + nalloc * ind_blocks + RES_STATFS;
 
         error = gfs2_trans_begin(sdp, blocks, 0);
         if (error)
@@ -1598,7 +1599,7 @@ static int gfs2_set_dqblk(struct super_block *sb, int type, qid_t id,
                 error = gfs2_inplace_reserve(ip, blocks);
                 if (error)
                         goto out_i;
-                blocks += gfs2_rg_blocks(ip);
+                blocks += gfs2_rg_blocks(ip, blocks);
         }
 
         /* Some quotas span block boundaries and can update two blocks,
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 4d34887a601d..3cc402ce6fea 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -35,9 +35,6 @@
 #define BFITNOENT ((u32)~0)
 #define NO_BLOCK ((u64)~0)
 
-#define RSRV_CONTENTION_FACTOR 4
-#define RGRP_RSRV_MAX_CONTENDERS 2
-
 #if BITS_PER_LONG == 32
 #define LBITMASK   (0x55555555UL)
 #define LBITSKIP55 (0x55555555UL)
@@ -67,53 +64,48 @@ static const char valid_change[16] = {
                 1, 0, 0, 0
 };
 
-static u32 rgblk_search(struct gfs2_rgrpd *rgd, u32 goal,
-                        unsigned char old_state,
-                        struct gfs2_bitmap **rbi);
+static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 minext,
+                         const struct gfs2_inode *ip, bool nowrap);
+
 
 /**
  * gfs2_setbit - Set a bit in the bitmaps
- * @rgd: the resource group descriptor
- * @buf2: the clone buffer that holds the bitmaps
- * @bi: the bitmap structure
- * @block: the block to set
+ * @rbm: The position of the bit to set
+ * @do_clone: Also set the clone bitmap, if it exists
  * @new_state: the new state of the block
  *
  */
 
-static inline void gfs2_setbit(struct gfs2_rgrpd *rgd, unsigned char *buf2,
-                               struct gfs2_bitmap *bi, u32 block,
+static inline void gfs2_setbit(const struct gfs2_rbm *rbm, bool do_clone,
                                unsigned char new_state)
 {
         unsigned char *byte1, *byte2, *end, cur_state;
-        unsigned int buflen = bi->bi_len;
-        const unsigned int bit = (block % GFS2_NBBY) * GFS2_BIT_SIZE;
+        unsigned int buflen = rbm->bi->bi_len;
+        const unsigned int bit = (rbm->offset % GFS2_NBBY) * GFS2_BIT_SIZE;
 
-        byte1 = bi->bi_bh->b_data + bi->bi_offset + (block / GFS2_NBBY);
-        end = bi->bi_bh->b_data + bi->bi_offset + buflen;
+        byte1 = rbm->bi->bi_bh->b_data + rbm->bi->bi_offset + (rbm->offset / GFS2_NBBY);
+        end = rbm->bi->bi_bh->b_data + rbm->bi->bi_offset + buflen;
 
         BUG_ON(byte1 >= end);
 
         cur_state = (*byte1 >> bit) & GFS2_BIT_MASK;
 
         if (unlikely(!valid_change[new_state * 4 + cur_state])) {
-                printk(KERN_WARNING "GFS2: buf_blk = 0x%llx old_state=%d, "
-                       "new_state=%d\n",
-                       (unsigned long long)block, cur_state, new_state);
-                printk(KERN_WARNING "GFS2: rgrp=0x%llx bi_start=0x%lx\n",
-                       (unsigned long long)rgd->rd_addr,
-                       (unsigned long)bi->bi_start);
-                printk(KERN_WARNING "GFS2: bi_offset=0x%lx bi_len=0x%lx\n",
-                       (unsigned long)bi->bi_offset,
-                       (unsigned long)bi->bi_len);
+                printk(KERN_WARNING "GFS2: buf_blk = 0x%x old_state=%d, "
+                       "new_state=%d\n", rbm->offset, cur_state, new_state);
+                printk(KERN_WARNING "GFS2: rgrp=0x%llx bi_start=0x%x\n",
+                       (unsigned long long)rbm->rgd->rd_addr,
+                       rbm->bi->bi_start);
+                printk(KERN_WARNING "GFS2: bi_offset=0x%x bi_len=0x%x\n",
+                       rbm->bi->bi_offset, rbm->bi->bi_len);
                 dump_stack();
-                gfs2_consist_rgrpd(rgd);
+                gfs2_consist_rgrpd(rbm->rgd);
                 return;
         }
         *byte1 ^= (cur_state ^ new_state) << bit;
 
-        if (buf2) {
-                byte2 = buf2 + bi->bi_offset + (block / GFS2_NBBY);
+        if (do_clone && rbm->bi->bi_clone) {
+                byte2 = rbm->bi->bi_clone + rbm->bi->bi_offset + (rbm->offset / GFS2_NBBY);
                 cur_state = (*byte2 >> bit) & GFS2_BIT_MASK;
                 *byte2 ^= (cur_state ^ new_state) << bit;
         }
@@ -121,30 +113,21 @@ static inline void gfs2_setbit(struct gfs2_rgrpd *rgd, unsigned char *buf2,
 
 /**
  * gfs2_testbit - test a bit in the bitmaps
- * @rgd: the resource group descriptor
- * @buffer: the buffer that holds the bitmaps
- * @buflen: the length (in bytes) of the buffer
- * @block: the block to read
+ * @rbm: The bit to test
  *
+ * Returns: The two bit block state of the requested bit
  */
 
-static inline unsigned char gfs2_testbit(struct gfs2_rgrpd *rgd,
-                                         const unsigned char *buffer,
-                                         unsigned int buflen, u32 block)
+static inline u8 gfs2_testbit(const struct gfs2_rbm *rbm)
 {
-        const unsigned char *byte, *end;
-        unsigned char cur_state;
+        const u8 *buffer = rbm->bi->bi_bh->b_data + rbm->bi->bi_offset;
+        const u8 *byte;
         unsigned int bit;
 
-        byte = buffer + (block / GFS2_NBBY);
-        bit = (block % GFS2_NBBY) * GFS2_BIT_SIZE;
-        end = buffer + buflen;
-
-        gfs2_assert(rgd->rd_sbd, byte < end);
+        byte = buffer + (rbm->offset / GFS2_NBBY);
+        bit = (rbm->offset % GFS2_NBBY) * GFS2_BIT_SIZE;
 
-        cur_state = (*byte >> bit) & GFS2_BIT_MASK;
-
-        return cur_state;
+        return (*byte >> bit) & GFS2_BIT_MASK;
 }
 
 /**
@@ -192,7 +175,7 @@ static inline u64 gfs2_bit_search(const __le64 *ptr, u64 mask, u8 state)
  */
 static inline int rs_cmp(u64 blk, u32 len, struct gfs2_blkreserv *rs)
 {
-        u64 startblk = gfs2_rs_startblk(rs);
+        u64 startblk = gfs2_rbm_to_block(&rs->rs_rbm);
 
         if (blk >= startblk + rs->rs_free)
                 return 1;
@@ -202,36 +185,6 @@ static inline int rs_cmp(u64 blk, u32 len, struct gfs2_blkreserv *rs)
 }
 
 /**
- * rs_find - Find a rgrp multi-block reservation that contains a given block
- * @rgd: The rgrp
- * @rgblk: The block we're looking for, relative to the rgrp
- */
-static struct gfs2_blkreserv *rs_find(struct gfs2_rgrpd *rgd, u32 rgblk)
-{
-        struct rb_node **newn;
-        int rc;
-        u64 fsblk = rgblk + rgd->rd_data0;
-
-        spin_lock(&rgd->rd_rsspin);
-        newn = &rgd->rd_rstree.rb_node;
-        while (*newn) {
-                struct gfs2_blkreserv *cur =
-                        rb_entry(*newn, struct gfs2_blkreserv, rs_node);
-                rc = rs_cmp(fsblk, 1, cur);
-                if (rc < 0)
-                        newn = &((*newn)->rb_left);
-                else if (rc > 0)
-                        newn = &((*newn)->rb_right);
-                else {
-                        spin_unlock(&rgd->rd_rsspin);
-                        return cur;
-                }
-        }
-        spin_unlock(&rgd->rd_rsspin);
-        return NULL;
-}
-
-/**
  * gfs2_bitfit - Search an rgrp's bitmap buffer to find a bit-pair representing
  *       a block in a given allocation state.
  * @buf: the buffer that holds the bitmaps
@@ -262,8 +215,6 @@ static u32 gfs2_bitfit(const u8 *buf, const unsigned int len,
         u64 mask = 0x5555555555555555ULL;
         u32 bit;
 
-        BUG_ON(state > 3);
-
         /* Mask off bits we don't care about at the start of the search */
         mask <<= spoint;
         tmp = gfs2_bit_search(ptr, mask, state);
@@ -285,6 +236,131 @@ static u32 gfs2_bitfit(const u8 *buf, const unsigned int len,
 }
 
 /**
+ * gfs2_rbm_from_block - Set the rbm based upon rgd and block number
+ * @rbm: The rbm with rgd already set correctly
+ * @block: The block number (filesystem relative)
+ *
+ * This sets the bi and offset members of an rbm based on a
+ * resource group and a filesystem relative block number. The
+ * resource group must be set in the rbm on entry, the bi and
+ * offset members will be set by this function.
+ *
+ * Returns: 0 on success, or an error code
+ */
+
+static int gfs2_rbm_from_block(struct gfs2_rbm *rbm, u64 block)
+{
+        u64 rblock = block - rbm->rgd->rd_data0;
+        u32 goal = (u32)rblock;
+        int x;
+
+        if (WARN_ON_ONCE(rblock > UINT_MAX))
+                return -EINVAL;
+        if (block >= rbm->rgd->rd_data0 + rbm->rgd->rd_data)
+                return -E2BIG;
+
+        for (x = 0; x < rbm->rgd->rd_length; x++) {
+                rbm->bi = rbm->rgd->rd_bits + x;
+                if (goal < (rbm->bi->bi_start + rbm->bi->bi_len) * GFS2_NBBY) {
+                        rbm->offset = goal - (rbm->bi->bi_start * GFS2_NBBY);
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+/**
+ * gfs2_unaligned_extlen - Look for free blocks which are not byte aligned
+ * @rbm: Position to search (value/result)
+ * @n_unaligned: Number of unaligned blocks to check
+ * @len: Decremented for each block found (terminate on zero)
+ *
+ * Returns: true if a non-free block is encountered
+ */
+
+static bool gfs2_unaligned_extlen(struct gfs2_rbm *rbm, u32 n_unaligned, u32 *len)
+{
+        u64 block;
+        u32 n;
+        u8 res;
+
+        for (n = 0; n < n_unaligned; n++) {
+                res = gfs2_testbit(rbm);
+                if (res != GFS2_BLKST_FREE)
+                        return true;
+                (*len)--;
+                if (*len == 0)
+                        return true;
+                block = gfs2_rbm_to_block(rbm);
+                if (gfs2_rbm_from_block(rbm, block + 1))
+                        return true;
+        }
+
+        return false;
+}
+
+/**
+ * gfs2_free_extlen - Return extent length of free blocks
+ * @rbm: Starting position
+ * @len: Max length to check
+ *
+ * Starting at the block specified by the rbm, see how many free blocks
+ * there are, not reading more than len blocks ahead. This can be done
+ * using memchr_inv when the blocks are byte aligned, but has to be done
+ * on a block by block basis in case of unaligned blocks. Also this
+ * function can cope with bitmap boundaries (although it must stop on
+ * a resource group boundary)
+ *
+ * Returns: Number of free blocks in the extent
+ */
+
+static u32 gfs2_free_extlen(const struct gfs2_rbm *rrbm, u32 len)
+{
+        struct gfs2_rbm rbm = *rrbm;
+        u32 n_unaligned = rbm.offset & 3;
+        u32 size = len;
+        u32 bytes;
+        u32 chunk_size;
+        u8 *ptr, *start, *end;
+        u64 block;
+
+        if (n_unaligned &&
+            gfs2_unaligned_extlen(&rbm, 4 - n_unaligned, &len))
+                goto out;
+
+        n_unaligned = len & 3;
+        /* Start is now byte aligned */
+        while (len > 3) {
+                start = rbm.bi->bi_bh->b_data;
+                if (rbm.bi->bi_clone)
+                        start = rbm.bi->bi_clone;
+                end = start + rbm.bi->bi_bh->b_size;
+                start += rbm.bi->bi_offset;
+                BUG_ON(rbm.offset & 3);
+                start += (rbm.offset / GFS2_NBBY);
+                bytes = min_t(u32, len / GFS2_NBBY, (end - start));
+                ptr = memchr_inv(start, 0, bytes);
+                chunk_size = ((ptr == NULL) ? bytes : (ptr - start));
+                chunk_size *= GFS2_NBBY;
+                BUG_ON(len < chunk_size);
+                len -= chunk_size;
+                block = gfs2_rbm_to_block(&rbm);
+                gfs2_rbm_from_block(&rbm, block + chunk_size);
+                n_unaligned = 3;
+                if (ptr)
+                        break;
+                n_unaligned = len & 3;
+        }
+
+        /* Deal with any bits left over at the end */
+        if (n_unaligned)
+                gfs2_unaligned_extlen(&rbm, n_unaligned, &len);
+out:
+        return size - len;
+}
+
+/**
  * gfs2_bitcount - count the number of bits in a certain state
  * @rgd: the resource group descriptor
  * @buffer: the buffer that holds the bitmaps
@@ -487,6 +563,8 @@ int gfs2_rs_alloc(struct gfs2_inode *ip)
         if (!res)
                 error = -ENOMEM;
 
+        RB_CLEAR_NODE(&res->rs_node);
+
         down_write(&ip->i_rw_mutex);
         if (ip->i_res)
                 kmem_cache_free(gfs2_rsrv_cachep, res);
@@ -496,11 +574,12 @@ int gfs2_rs_alloc(struct gfs2_inode *ip)
         return error;
 }
 
-static void dump_rs(struct seq_file *seq, struct gfs2_blkreserv *rs)
+static void dump_rs(struct seq_file *seq, const struct gfs2_blkreserv *rs)
 {
-        gfs2_print_dbg(seq, "  r: %llu s:%llu b:%u f:%u\n",
-                       rs->rs_rgd->rd_addr, gfs2_rs_startblk(rs), rs->rs_biblk,
-                       rs->rs_free);
+        gfs2_print_dbg(seq, "  B: n:%llu s:%llu b:%u f:%u\n",
+                       (unsigned long long)rs->rs_inum,
+                       (unsigned long long)gfs2_rbm_to_block(&rs->rs_rbm),
+                       rs->rs_rbm.offset, rs->rs_free);
 }
 
 /**
@@ -508,41 +587,26 @@ static void dump_rs(struct seq_file *seq, struct gfs2_blkreserv *rs)
  * @rs: The reservation to remove
  *
  */
-static void __rs_deltree(struct gfs2_blkreserv *rs)
+static void __rs_deltree(struct gfs2_inode *ip, struct gfs2_blkreserv *rs)
 {
         struct gfs2_rgrpd *rgd;
 
         if (!gfs2_rs_active(rs))
                 return;
 
-        rgd = rs->rs_rgd;
-        /* We can't do this: The reason is that when the rgrp is invalidated,
-           it's in the "middle" of acquiring the glock, but the HOLDER bit
-           isn't set yet:
-           BUG_ON(!gfs2_glock_is_locked_by_me(rs->rs_rgd->rd_gl));*/
-        trace_gfs2_rs(NULL, rs, TRACE_RS_TREEDEL);
-
-        if (!RB_EMPTY_ROOT(&rgd->rd_rstree))
-                rb_erase(&rs->rs_node, &rgd->rd_rstree);
-        BUG_ON(!rgd->rd_rs_cnt);
-        rgd->rd_rs_cnt--;
+        rgd = rs->rs_rbm.rgd;
+        trace_gfs2_rs(rs, TRACE_RS_TREEDEL);
+        rb_erase(&rs->rs_node, &rgd->rd_rstree);
+        RB_CLEAR_NODE(&rs->rs_node);
 
         if (rs->rs_free) {
                 /* return reserved blocks to the rgrp and the ip */
-                BUG_ON(rs->rs_rgd->rd_reserved < rs->rs_free);
-                rs->rs_rgd->rd_reserved -= rs->rs_free;
+                BUG_ON(rs->rs_rbm.rgd->rd_reserved < rs->rs_free);
+                rs->rs_rbm.rgd->rd_reserved -= rs->rs_free;
                 rs->rs_free = 0;
-                clear_bit(GBF_FULL, &rs->rs_bi->bi_flags);
+                clear_bit(GBF_FULL, &rs->rs_rbm.bi->bi_flags);
                 smp_mb__after_clear_bit();
         }
-        /* We can't change any of the step 1 or step 2 components of the rs.
-           E.g. We can't set rs_rgd to NULL because the rgd glock is held and
-           dequeued through this pointer.
-           Can't: atomic_set(&rs->rs_sizehint, 0);
-           Can't: rs->rs_requested = 0;
-           Can't: rs->rs_rgd = NULL;*/
-        rs->rs_bi = NULL;
-        rs->rs_biblk = 0;
 }
 
 /**
@@ -550,17 +614,16 @@ static void __rs_deltree(struct gfs2_blkreserv *rs)
  * @rs: The reservation to remove
  *
  */
-void gfs2_rs_deltree(struct gfs2_blkreserv *rs)
+void gfs2_rs_deltree(struct gfs2_inode *ip, struct gfs2_blkreserv *rs)
 {
         struct gfs2_rgrpd *rgd;
 
-        if (!gfs2_rs_active(rs))
-                return;
-
-        rgd = rs->rs_rgd;
-        spin_lock(&rgd->rd_rsspin);
-        __rs_deltree(rs);
-        spin_unlock(&rgd->rd_rsspin);
+        rgd = rs->rs_rbm.rgd;
+        if (rgd) {
+                spin_lock(&rgd->rd_rsspin);
+                __rs_deltree(ip, rs);
+                spin_unlock(&rgd->rd_rsspin);
+        }
 }
 
 /**
@@ -572,8 +635,7 @@ void gfs2_rs_delete(struct gfs2_inode *ip)
 {
         down_write(&ip->i_rw_mutex);
         if (ip->i_res) {
-                gfs2_rs_deltree(ip->i_res);
-                trace_gfs2_rs(ip, ip->i_res, TRACE_RS_DELETE);
+                gfs2_rs_deltree(ip, ip->i_res);
                 BUG_ON(ip->i_res->rs_free);
                 kmem_cache_free(gfs2_rsrv_cachep, ip->i_res);
                 ip->i_res = NULL;
@@ -597,7 +659,7 @@ static void return_all_reservations(struct gfs2_rgrpd *rgd)
         spin_lock(&rgd->rd_rsspin);
         while ((n = rb_first(&rgd->rd_rstree))) {
                 rs = rb_entry(n, struct gfs2_blkreserv, rs_node);
-                __rs_deltree(rs);
+                __rs_deltree(NULL, rs);
         }
         spin_unlock(&rgd->rd_rsspin);
 }
@@ -1270,211 +1332,276 @@ out:
 
 /**
  * rs_insert - insert a new multi-block reservation into the rgrp's rb_tree
- * @bi: the bitmap with the blocks
  * @ip: the inode structure
- * @biblk: the 32-bit block number relative to the start of the bitmap
- * @amount: the number of blocks to reserve
  *
- * Returns: NULL - reservation was already taken, so not inserted
- *          pointer to the inserted reservation
  */
-static struct gfs2_blkreserv *rs_insert(struct gfs2_bitmap *bi,
-                                       struct gfs2_inode *ip, u32 biblk,
-                                       int amount)
+static void rs_insert(struct gfs2_inode *ip)
 {
         struct rb_node **newn, *parent = NULL;
         int rc;
         struct gfs2_blkreserv *rs = ip->i_res;
-        struct gfs2_rgrpd *rgd = rs->rs_rgd;
-        u64 fsblock = gfs2_bi2rgd_blk(bi, biblk) + rgd->rd_data0;
+        struct gfs2_rgrpd *rgd = rs->rs_rbm.rgd;
+        u64 fsblock = gfs2_rbm_to_block(&rs->rs_rbm);
+
+        BUG_ON(gfs2_rs_active(rs));
 
         spin_lock(&rgd->rd_rsspin);
         newn = &rgd->rd_rstree.rb_node;
-        BUG_ON(!ip->i_res);
-        BUG_ON(gfs2_rs_active(rs));
-        /* Figure out where to put new node */
-        /*BUG_ON(!gfs2_glock_is_locked_by_me(rgd->rd_gl));*/
         while (*newn) {
                 struct gfs2_blkreserv *cur =
                         rb_entry(*newn, struct gfs2_blkreserv, rs_node);
 
                 parent = *newn;
-                rc = rs_cmp(fsblock, amount, cur);
+                rc = rs_cmp(fsblock, rs->rs_free, cur);
                 if (rc > 0)
                         newn = &((*newn)->rb_right);
                 else if (rc < 0)
                         newn = &((*newn)->rb_left);
                 else {
                         spin_unlock(&rgd->rd_rsspin);
-                        return NULL; /* reservation already in use */
+                        WARN_ON(1);
+                        return;
                 }
         }
 
-        /* Do our reservation work */
-        rs = ip->i_res;
-        rs->rs_free = amount;
-        rs->rs_biblk = biblk;
-        rs->rs_bi = bi;
         rb_link_node(&rs->rs_node, parent, newn);
         rb_insert_color(&rs->rs_node, &rgd->rd_rstree);
 
-        /* Do our inode accounting for the reservation */
-        /*BUG_ON(!gfs2_glock_is_locked_by_me(ip->i_gl));*/
-
         /* Do our rgrp accounting for the reservation */
-        rgd->rd_reserved += amount; /* blocks reserved */
-        rgd->rd_rs_cnt++; /* number of in-tree reservations */
+        rgd->rd_reserved += rs->rs_free; /* blocks reserved */
         spin_unlock(&rgd->rd_rsspin);
-        trace_gfs2_rs(ip, rs, TRACE_RS_INSERT);
-        return rs;
+        trace_gfs2_rs(rs, TRACE_RS_INSERT);
 }
 
 /**
- * unclaimed_blocks - return number of blocks that aren't spoken for
- */
-static u32 unclaimed_blocks(struct gfs2_rgrpd *rgd)
-{
-        return rgd->rd_free_clone - rgd->rd_reserved;
-}
-
-/**
- * rg_mblk_search - find a group of multiple free blocks
+ * rg_mblk_search - find a group of multiple free blocks to form a reservation
  * @rgd: the resource group descriptor
- * @rs: the block reservation
  * @ip: pointer to the inode for which we're reserving blocks
+ * @requested: number of blocks required for this allocation
  *
- * This is very similar to rgblk_search, except we're looking for whole
- * 64-bit words that represent a chunk of 32 free blocks. I'm only focusing
- * on aligned dwords for speed's sake.
- *
- * Returns: 0 if successful or BFITNOENT if there isn't enough free space
  */
 
-static int rg_mblk_search(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip)
+static void rg_mblk_search(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip,
+                           unsigned requested)
 {
-        struct gfs2_bitmap *bi = rgd->rd_bits;
-        const u32 length = rgd->rd_length;
-        u32 blk;
-        unsigned int buf, x, search_bytes;
-        u8 *buffer = NULL;
-        u8 *ptr, *end, *nonzero;
-        u32 goal, rsv_bytes;
-        struct gfs2_blkreserv *rs;
-        u32 best_rs_bytes, unclaimed;
-        int best_rs_blocks;
+        struct gfs2_rbm rbm = { .rgd = rgd, };
+        u64 goal;
+        struct gfs2_blkreserv *rs = ip->i_res;
+        u32 extlen;
+        u32 free_blocks = rgd->rd_free_clone - rgd->rd_reserved;
+        int ret;
+
+        extlen = max_t(u32, atomic_read(&rs->rs_sizehint), requested);
+        extlen = clamp(extlen, RGRP_RSRV_MINBLKS, free_blocks);
+        if ((rgd->rd_free_clone < rgd->rd_reserved) || (free_blocks < extlen))
+                return;
 
         /* Find bitmap block that contains bits for goal block */
         if (rgrp_contains_block(rgd, ip->i_goal))
-                goal = ip->i_goal - rgd->rd_data0;
+                goal = ip->i_goal;
         else
-                goal = rgd->rd_last_alloc;
-        for (buf = 0; buf < length; buf++) {
-                bi = rgd->rd_bits + buf;
-                /* Convert scope of "goal" from rgrp-wide to within
-                   found bit block */
-                if (goal < (bi->bi_start + bi->bi_len) * GFS2_NBBY) {
-                        goal -= bi->bi_start * GFS2_NBBY;
-                        goto do_search;
-                }
+                goal = rgd->rd_last_alloc + rgd->rd_data0;
+
+        if (WARN_ON(gfs2_rbm_from_block(&rbm, goal)))
+                return;
+
+        ret = gfs2_rbm_find(&rbm, GFS2_BLKST_FREE, extlen, ip, true);
+        if (ret == 0) {
+                rs->rs_rbm = rbm;
+                rs->rs_free = extlen;
+                rs->rs_inum = ip->i_no_addr;
+                rs_insert(ip);
         }
-        buf = 0;
-        goal = 0;
-
-do_search:
-        best_rs_blocks = max_t(int, atomic_read(&ip->i_res->rs_sizehint),
-                               (RGRP_RSRV_MINBLKS * rgd->rd_length));
-        best_rs_bytes = (best_rs_blocks *
-                         (1 + (RSRV_CONTENTION_FACTOR * rgd->rd_rs_cnt))) /
-                GFS2_NBBY; /* 1 + is for our not-yet-created reservation */
-        best_rs_bytes = ALIGN(best_rs_bytes, sizeof(u64));
-        unclaimed = unclaimed_blocks(rgd);
-        if (best_rs_bytes * GFS2_NBBY > unclaimed)
-                best_rs_bytes = unclaimed >> GFS2_BIT_SIZE;
-
-        for (x = 0; x <= length; x++) {
-                bi = rgd->rd_bits + buf;
+}
 
-                if (test_bit(GBF_FULL, &bi->bi_flags))
-                        goto skip;
+/**
+ * gfs2_next_unreserved_block - Return next block that is not reserved
+ * @rgd: The resource group
+ * @block: The starting block
+ * @length: The required length
+ * @ip: Ignore any reservations for this inode
+ *
+ * If the block does not appear in any reservation, then return the
+ * block number unchanged. If it does appear in the reservation, then
+ * keep looking through the tree of reservations in order to find the
+ * first block number which is not reserved.
+ */
 
-                WARN_ON(!buffer_uptodate(bi->bi_bh));
-                if (bi->bi_clone)
-                        buffer = bi->bi_clone + bi->bi_offset;
+static u64 gfs2_next_unreserved_block(struct gfs2_rgrpd *rgd, u64 block,
+                                      u32 length,
+                                      const struct gfs2_inode *ip)
+{
+        struct gfs2_blkreserv *rs;
+        struct rb_node *n;
+        int rc;
+
+        spin_lock(&rgd->rd_rsspin);
+        n = rgd->rd_rstree.rb_node;
+        while (n) {
+                rs = rb_entry(n, struct gfs2_blkreserv, rs_node);
+                rc = rs_cmp(block, length, rs);
+                if (rc < 0)
+                        n = n->rb_left;
+                else if (rc > 0)
+                        n = n->rb_right;
                 else
-                        buffer = bi->bi_bh->b_data + bi->bi_offset;
-
-                /* We have to keep the reservations aligned on u64 boundaries
-                   otherwise we could get situations where a byte can't be
-                   used because it's after a reservation, but a free bit still
-                   is within the reservation's area. */
-                ptr = buffer + ALIGN(goal >> GFS2_BIT_SIZE, sizeof(u64));
-                end = (buffer + bi->bi_len);
-                while (ptr < end) {
-                        rsv_bytes = 0;
-                        if ((ptr + best_rs_bytes) <= end)
-                                search_bytes = best_rs_bytes;
-                        else
-                                search_bytes = end - ptr;
-                        BUG_ON(!search_bytes);
-                        nonzero = memchr_inv(ptr, 0, search_bytes);
-                        /* If the lot is all zeroes, reserve the whole size. If
-                           there's enough zeroes to satisfy the request, use
-                           what we can. If there's not enough, keep looking. */
-                        if (nonzero == NULL)
-                                rsv_bytes = search_bytes;
-                        else if ((nonzero - ptr) * GFS2_NBBY >=
-                                 ip->i_res->rs_requested)
-                                rsv_bytes = (nonzero - ptr);
-
-                        if (rsv_bytes) {
-                                blk = ((ptr - buffer) * GFS2_NBBY);
-                                BUG_ON(blk >= bi->bi_len * GFS2_NBBY);
-                                rs = rs_insert(bi, ip, blk,
-                                               rsv_bytes * GFS2_NBBY);
-                                if (IS_ERR(rs))
-                                        return PTR_ERR(rs);
-                                if (rs)
-                                        return 0;
-                        }
-                        ptr += ALIGN(search_bytes, sizeof(u64));
+                        break;
+        }
+
+        if (n) {
+                while ((rs_cmp(block, length, rs) == 0) && (ip->i_res != rs)) {
+                        block = gfs2_rbm_to_block(&rs->rs_rbm) + rs->rs_free;
+                        n = n->rb_right;
+                        if (n == NULL)
+                                break;
+                        rs = rb_entry(n, struct gfs2_blkreserv, rs_node);
                 }
-skip:
-                /* Try next bitmap block (wrap back to rgrp header
-                   if at end) */
-                buf++;
-                buf %= length;
-                goal = 0;
         }
 
-        return BFITNOENT;
+        spin_unlock(&rgd->rd_rsspin);
+        return block;
 }
 
 /**
- * try_rgrp_fit - See if a given reservation will fit in a given RG
- * @rgd: the RG data
- * @ip: the inode
+ * gfs2_reservation_check_and_update - Check for reservations during block alloc
+ * @rbm: The current position in the resource group
+ * @ip: The inode for which we are searching for blocks
+ * @minext: The minimum extent length
  *
- * If there's room for the requested blocks to be allocated from the RG:
- * This will try to get a multi-block reservation first, and if that doesn't
- * fit, it will take what it can.
+ * This checks the current position in the rgrp to see whether there is
+ * a reservation covering this block. If not then this function is a
+ * no-op. If there is, then the position is moved to the end of the
+ * contiguous reservation(s) so that we are pointing at the first
+ * non-reserved block.
  *
- * Returns: 1 on success (it fits), 0 on failure (it doesn't fit)
+ * Returns: 0 if no reservation, 1 if @rbm has changed, otherwise an error
  */
 
-static int try_rgrp_fit(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip)
+static int gfs2_reservation_check_and_update(struct gfs2_rbm *rbm,
+                                             const struct gfs2_inode *ip,
+                                             u32 minext)
 {
-        struct gfs2_blkreserv *rs = ip->i_res;
+        u64 block = gfs2_rbm_to_block(rbm);
+        u32 extlen = 1;
+        u64 nblock;
+        int ret;
 
-        if (rgd->rd_flags & (GFS2_RGF_NOALLOC | GFS2_RDF_ERROR))
+        /*
+         * If we have a minimum extent length, then skip over any extent
+         * which is less than the min extent length in size.
+         */
+        if (minext) {
+                extlen = gfs2_free_extlen(rbm, minext);
+                nblock = block + extlen;
+                if (extlen < minext)
+                        goto fail;
+        }
+
+        /*
+         * Check the extent which has been found against the reservations
+         * and skip if parts of it are already reserved
+         */
+        nblock = gfs2_next_unreserved_block(rbm->rgd, block, extlen, ip);
+        if (nblock == block)
                 return 0;
-        /* Look for a multi-block reservation. */
-        if (unclaimed_blocks(rgd) >= RGRP_RSRV_MINBLKS &&
-            rg_mblk_search(rgd, ip) != BFITNOENT)
-                return 1;
-        if (unclaimed_blocks(rgd) >= rs->rs_requested)
-                return 1;
+fail:
+        ret = gfs2_rbm_from_block(rbm, nblock);
+        if (ret < 0)
+                return ret;
+        return 1;
+}
 
-        return 0;
+/**
+ * gfs2_rbm_find - Look for blocks of a particular state
+ * @rbm: Value/result starting position and final position
+ * @state: The state which we want to find
+ * @minext: The requested extent length (0 for a single block)
+ * @ip: If set, check for reservations
+ * @nowrap: Stop looking at the end of the rgrp, rather than wrapping
+ *          around until we've reached the starting point.
+ *
+ * Side effects:
+ * - If looking for free blocks, we set GBF_FULL on each bitmap which
+ *   has no free blocks in it.
+ *
+ * Returns: 0 on success, -ENOSPC if there is no block of the requested state
+ */
+
+static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 minext,
+                         const struct gfs2_inode *ip, bool nowrap)
+{
+        struct buffer_head *bh;
+        struct gfs2_bitmap *initial_bi;
+        u32 initial_offset;
+        u32 offset;
+        u8 *buffer;
+        int index;
+        int n = 0;
+        int iters = rbm->rgd->rd_length;
+        int ret;
+
+        /* If we are not starting at the beginning of a bitmap, then we
+         * need to add one to the bitmap count to ensure that we search
+         * the starting bitmap twice.
+         */
+        if (rbm->offset != 0)
+                iters++;
+
+        while(1) {
+                if (test_bit(GBF_FULL, &rbm->bi->bi_flags) &&
+                    (state == GFS2_BLKST_FREE))
+                        goto next_bitmap;
+
+                bh = rbm->bi->bi_bh;
+                buffer = bh->b_data + rbm->bi->bi_offset;
+                WARN_ON(!buffer_uptodate(bh));
+                if (state != GFS2_BLKST_UNLINKED && rbm->bi->bi_clone)
+                        buffer = rbm->bi->bi_clone + rbm->bi->bi_offset;
+                initial_offset = rbm->offset;
+                offset = gfs2_bitfit(buffer, rbm->bi->bi_len, rbm->offset, state);
+                if (offset == BFITNOENT)
+                        goto bitmap_full;
+                rbm->offset = offset;
+                if (ip == NULL)
+                        return 0;
+
+                initial_bi = rbm->bi;
+                ret = gfs2_reservation_check_and_update(rbm, ip, minext);
+                if (ret == 0)
+                        return 0;
+                if (ret > 0) {
+                        n += (rbm->bi - initial_bi);
+                        goto next_iter;
+                }
+                if (ret == -E2BIG) {
+                        index = 0;
+                        rbm->offset = 0;
+                        n += (rbm->bi - initial_bi);
+                        goto res_covered_end_of_rgrp;
+                }
+                return ret;
+
+bitmap_full:    /* Mark bitmap as full and fall through */
+                if ((state == GFS2_BLKST_FREE) && initial_offset == 0)
+                        set_bit(GBF_FULL, &rbm->bi->bi_flags);
+
+next_bitmap:    /* Find next bitmap in the rgrp */
+                rbm->offset = 0;
+                index = rbm->bi - rbm->rgd->rd_bits;
+                index++;
+                if (index == rbm->rgd->rd_length)
+                        index = 0;
+res_covered_end_of_rgrp:
+                rbm->bi = &rbm->rgd->rd_bits[index];
+                if ((index == 0) && nowrap)
+                        break;
+                n++;
+next_iter:
+                if (n >= iters)
+                        break;
+        }
+
+        return -ENOSPC;
 }
 
 /**
@@ -1489,34 +1616,33 @@ static int try_rgrp_fit(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip)
 
 static void try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked, u64 skip)
 {
-        u32 goal = 0, block;
-        u64 no_addr;
+        u64 block;
         struct gfs2_sbd *sdp = rgd->rd_sbd;
         struct gfs2_glock *gl;
         struct gfs2_inode *ip;
         int error;
         int found = 0;
-        struct gfs2_bitmap *bi;
+        struct gfs2_rbm rbm = { .rgd = rgd, .bi = rgd->rd_bits, .offset = 0 };
 
-        while (goal < rgd->rd_data) {
+        while (1) {
                 down_write(&sdp->sd_log_flush_lock);
-                block = rgblk_search(rgd, goal, GFS2_BLKST_UNLINKED, &bi);
+                error = gfs2_rbm_find(&rbm, GFS2_BLKST_UNLINKED, 0, NULL, true);
                 up_write(&sdp->sd_log_flush_lock);
-                if (block == BFITNOENT)
+                if (error == -ENOSPC)
+                        break;
+                if (WARN_ON_ONCE(error))
                         break;
 
-                block = gfs2_bi2rgd_blk(bi, block);
-                /* rgblk_search can return a block < goal, so we need to
-                   keep it marching forward. */
-                no_addr = block + rgd->rd_data0;
-                goal = max(block + 1, goal + 1);
-                if (*last_unlinked != NO_BLOCK && no_addr <= *last_unlinked)
+                block = gfs2_rbm_to_block(&rbm);
+                if (gfs2_rbm_from_block(&rbm, block + 1))
+                        break;
+                if (*last_unlinked != NO_BLOCK && block <= *last_unlinked)
                         continue;
-                if (no_addr == skip)
+                if (block == skip)
                         continue;
-                *last_unlinked = no_addr;
+                *last_unlinked = block;
 
-                error = gfs2_glock_get(sdp, no_addr, &gfs2_inode_glops, CREATE, &gl);
+                error = gfs2_glock_get(sdp, block, &gfs2_inode_glops, CREATE, &gl);
                 if (error)
                         continue;
 
@@ -1543,6 +1669,19 @@ static void try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked, u64 skip
         return;
 }
 
+static bool gfs2_select_rgrp(struct gfs2_rgrpd **pos, const struct gfs2_rgrpd *begin)
+{
+        struct gfs2_rgrpd *rgd = *pos;
+
+        rgd = gfs2_rgrpd_get_next(rgd);
+        if (rgd == NULL)
+                rgd = gfs2_rgrpd_get_next(NULL);
+        *pos = rgd;
+        if (rgd != begin) /* If we didn't wrap */
+                return true;
+        return false;
+}
+
 /**
  * gfs2_inplace_reserve - Reserve space in the filesystem
  * @ip: the inode to reserve space for
@@ -1562,103 +1701,96 @@ int gfs2_inplace_reserve(struct gfs2_inode *ip, u32 requested)
 
         if (sdp->sd_args.ar_rgrplvb)
                 flags |= GL_SKIP;
-        rs->rs_requested = requested;
-        if (gfs2_assert_warn(sdp, requested)) {
-                error = -EINVAL;
-                goto out;
-        }
+        if (gfs2_assert_warn(sdp, requested))
+                return -EINVAL;
         if (gfs2_rs_active(rs)) {
-                begin = rs->rs_rgd;
+                begin = rs->rs_rbm.rgd;
                 flags = 0; /* Yoda: Do or do not. There is no try */
         } else if (ip->i_rgd && rgrp_contains_block(ip->i_rgd, ip->i_goal)) {
-                rs->rs_rgd = begin = ip->i_rgd;
+                rs->rs_rbm.rgd = begin = ip->i_rgd;
         } else {
-                rs->rs_rgd = begin = gfs2_blk2rgrpd(sdp, ip->i_goal, 1);
+                rs->rs_rbm.rgd = begin = gfs2_blk2rgrpd(sdp, ip->i_goal, 1);
         }
-        if (rs->rs_rgd == NULL)
+        if (rs->rs_rbm.rgd == NULL)
                 return -EBADSLT;
 
         while (loops < 3) {
-                rg_locked = 0;
-
-                if (gfs2_glock_is_locked_by_me(rs->rs_rgd->rd_gl)) {
-                        rg_locked = 1;
-                        error = 0;
-                } else if (!loops && !gfs2_rs_active(rs) &&
-                           rs->rs_rgd->rd_rs_cnt > RGRP_RSRV_MAX_CONTENDERS) {
-                        /* If the rgrp already is maxed out for contenders,
-                           we can eliminate it as a "first pass" without even
-                           requesting the rgrp glock. */
-                        error = GLR_TRYFAILED;
-                } else {
-                        error = gfs2_glock_nq_init(rs->rs_rgd->rd_gl,
+                rg_locked = 1;
+
+                if (!gfs2_glock_is_locked_by_me(rs->rs_rbm.rgd->rd_gl)) {
+                        rg_locked = 0;
+                        error = gfs2_glock_nq_init(rs->rs_rbm.rgd->rd_gl,
                                                    LM_ST_EXCLUSIVE, flags,
                                                    &rs->rs_rgd_gh);
-                        if (!error && sdp->sd_args.ar_rgrplvb) {
-                                error = update_rgrp_lvb(rs->rs_rgd);
-                                if (error) {
+                        if (error == GLR_TRYFAILED)
+                                goto next_rgrp;
+                        if (unlikely(error))
+                                return error;
+                        if (sdp->sd_args.ar_rgrplvb) {
+                                error = update_rgrp_lvb(rs->rs_rbm.rgd);
+                                if (unlikely(error)) {
                                         gfs2_glock_dq_uninit(&rs->rs_rgd_gh);
                                         return error;
                                 }
                         }
                 }
-                switch (error) {
-                case 0:
-                        if (gfs2_rs_active(rs)) {
-                                if (unclaimed_blocks(rs->rs_rgd) +
-                                    rs->rs_free >= rs->rs_requested) {
-                                        ip->i_rgd = rs->rs_rgd;
-                                        return 0;
-                                }
-                                /* We have a multi-block reservation, but the
-                                   rgrp doesn't have enough free blocks to
-                                   satisfy the request. Free the reservation
-                                   and look for a suitable rgrp. */
-                                gfs2_rs_deltree(rs);
-                        }
-                        if (try_rgrp_fit(rs->rs_rgd, ip)) {
-                                if (sdp->sd_args.ar_rgrplvb)
-                                        gfs2_rgrp_bh_get(rs->rs_rgd);
-                                ip->i_rgd = rs->rs_rgd;
-                                return 0;
-                        }
-                        if (rs->rs_rgd->rd_flags & GFS2_RDF_CHECK) {
-                                if (sdp->sd_args.ar_rgrplvb)
-                                        gfs2_rgrp_bh_get(rs->rs_rgd);
-                                try_rgrp_unlink(rs->rs_rgd, &last_unlinked,
-                                                ip->i_no_addr);
-                        }
-                        if (!rg_locked)
-                                gfs2_glock_dq_uninit(&rs->rs_rgd_gh);
-                        /* fall through */
-                case GLR_TRYFAILED:
-                        rs->rs_rgd = gfs2_rgrpd_get_next(rs->rs_rgd);
-                        rs->rs_rgd = rs->rs_rgd ? : begin; /* if NULL, wrap */
-                        if (rs->rs_rgd != begin) /* If we didn't wrap */
-                                break;
 
-                        flags &= ~LM_FLAG_TRY;
-                        loops++;
-                        /* Check that fs hasn't grown if writing to rindex */
-                        if (ip == GFS2_I(sdp->sd_rindex) &&
-                            !sdp->sd_rindex_uptodate) {
-                                error = gfs2_ri_update(ip);
-                                if (error)
-                                        goto out;
-                        } else if (loops == 2)
-                                /* Flushing the log may release space */
-                                gfs2_log_flush(sdp, NULL);
-                        break;
-                default:
-                        goto out;
+                /* Skip unuseable resource groups */
+                if (rs->rs_rbm.rgd->rd_flags & (GFS2_RGF_NOALLOC | GFS2_RDF_ERROR))
+                        goto skip_rgrp;
+
+                if (sdp->sd_args.ar_rgrplvb)
+                        gfs2_rgrp_bh_get(rs->rs_rbm.rgd);
+
+                /* Get a reservation if we don't already have one */
+                if (!gfs2_rs_active(rs))
+                        rg_mblk_search(rs->rs_rbm.rgd, ip, requested);
+
+                /* Skip rgrps when we can't get a reservation on first pass */
+                if (!gfs2_rs_active(rs) && (loops < 1))
+                        goto check_rgrp;
+
+                /* If rgrp has enough free space, use it */
+                if (rs->rs_rbm.rgd->rd_free_clone >= requested) {
+                        ip->i_rgd = rs->rs_rbm.rgd;
+                        return 0;
+                }
+
+                /* Drop reservation, if we couldn't use reserved rgrp */
+                if (gfs2_rs_active(rs))
+                        gfs2_rs_deltree(ip, rs);
+check_rgrp:
+                /* Check for unlinked inodes which can be reclaimed */
+                if (rs->rs_rbm.rgd->rd_flags & GFS2_RDF_CHECK)
+                        try_rgrp_unlink(rs->rs_rbm.rgd, &last_unlinked,
+                                        ip->i_no_addr);
+skip_rgrp:
+                /* Unlock rgrp if required */
+                if (!rg_locked)
+                        gfs2_glock_dq_uninit(&rs->rs_rgd_gh);
+next_rgrp:
+                /* Find the next rgrp, and continue looking */
+                if (gfs2_select_rgrp(&rs->rs_rbm.rgd, begin))
+                        continue;
+
+                /* If we've scanned all the rgrps, but found no free blocks
+                 * then this checks for some less likely conditions before
+                 * trying again.
+                 */
+                flags &= ~LM_FLAG_TRY;
+                loops++;
+                /* Check that fs hasn't grown if writing to rindex */
+                if (ip == GFS2_I(sdp->sd_rindex) && !sdp->sd_rindex_uptodate) {
+                        error = gfs2_ri_update(ip);
+                        if (error)
+                                return error;
                 }
+                /* Flushing the log may release space */
+                if (loops == 2)
+                        gfs2_log_flush(sdp, NULL);
         }
-        error = -ENOSPC;
 
-out:
-        if (error)
-                rs->rs_requested = 0;
-        return error;
+        return -ENOSPC;
 }
 
 /**
@@ -1672,15 +1804,8 @@ void gfs2_inplace_release(struct gfs2_inode *ip)
 {
         struct gfs2_blkreserv *rs = ip->i_res;
 
-        if (!rs)
-                return;
-
-        if (!rs->rs_free)
-                gfs2_rs_deltree(rs);
-
         if (rs->rs_rgd_gh.gh_gl)
                 gfs2_glock_dq_uninit(&rs->rs_rgd_gh);
-        rs->rs_requested = 0;
 }
 
 /**
@@ -1693,173 +1818,47 @@ void gfs2_inplace_release(struct gfs2_inode *ip)
 
 static unsigned char gfs2_get_block_type(struct gfs2_rgrpd *rgd, u64 block)
 {
-        struct gfs2_bitmap *bi = NULL;
-        u32 length, rgrp_block, buf_block;
-        unsigned int buf;
-        unsigned char type;
-
-        length = rgd->rd_length;
-        rgrp_block = block - rgd->rd_data0;
-
-        for (buf = 0; buf < length; buf++) {
-                bi = rgd->rd_bits + buf;
-                if (rgrp_block < (bi->bi_start + bi->bi_len) * GFS2_NBBY)
-                        break;
-        }
+        struct gfs2_rbm rbm = { .rgd = rgd, };
+        int ret;
 
-        gfs2_assert(rgd->rd_sbd, buf < length);
-        buf_block = rgrp_block - bi->bi_start * GFS2_NBBY;
+        ret = gfs2_rbm_from_block(&rbm, block);
+        WARN_ON_ONCE(ret != 0);
 
-        type = gfs2_testbit(rgd, bi->bi_bh->b_data + bi->bi_offset,
-                           bi->bi_len, buf_block);
-
-        return type;
+        return gfs2_testbit(&rbm);
 }
 
-/**
- * rgblk_search - find a block in @state
- * @rgd: the resource group descriptor
- * @goal: the goal block within the RG (start here to search for avail block)
- * @state: GFS2_BLKST_XXX the before-allocation state to find
- * @rbi: address of the pointer to the bitmap containing the block found
- *
- * Walk rgrp's bitmap to find bits that represent a block in @state.
- *
- * This function never fails, because we wouldn't call it unless we
- * know (from reservation results, etc.) that a block is available.
- *
- * Scope of @goal is just within rgrp, not the whole filesystem.
- * Scope of @returned block is just within bitmap, not the whole filesystem.
- *
- * Returns: the block number found relative to the bitmap rbi
- */
-
-static u32 rgblk_search(struct gfs2_rgrpd *rgd, u32 goal, unsigned char state,
-                        struct gfs2_bitmap **rbi)
-{
-        struct gfs2_bitmap *bi = NULL;
-        const u32 length = rgd->rd_length;
-        u32 biblk = BFITNOENT;
-        unsigned int buf, x;
-        const u8 *buffer = NULL;
-
-        *rbi = NULL;
-        /* Find bitmap block that contains bits for goal block */
-        for (buf = 0; buf < length; buf++) {
-                bi = rgd->rd_bits + buf;
-                /* Convert scope of "goal" from rgrp-wide to within found bit block */
-                if (goal < (bi->bi_start + bi->bi_len) * GFS2_NBBY) {
-                        goal -= bi->bi_start * GFS2_NBBY;
-                        goto do_search;
-                }
-        }
-        buf = 0;
-        goal = 0;
-
-do_search:
-        /* Search (up to entire) bitmap in this rgrp for allocatable block.
-           "x <= length", instead of "x < length", because we typically start
-           the search in the middle of a bit block, but if we can't find an
-           allocatable block anywhere else, we want to be able wrap around and
-           search in the first part of our first-searched bit block.  */
-        for (x = 0; x <= length; x++) {
-                bi = rgd->rd_bits + buf;
-
-                if (test_bit(GBF_FULL, &bi->bi_flags) &&
-                    (state == GFS2_BLKST_FREE))
-                        goto skip;
-
-                /* The GFS2_BLKST_UNLINKED state doesn't apply to the clone
-                   bitmaps, so we must search the originals for that. */
-                buffer = bi->bi_bh->b_data + bi->bi_offset;
-                WARN_ON(!buffer_uptodate(bi->bi_bh));
-                if (state != GFS2_BLKST_UNLINKED && bi->bi_clone)
-                        buffer = bi->bi_clone + bi->bi_offset;
-
-                while (1) {
-                        struct gfs2_blkreserv *rs;
-                        u32 rgblk;
-
-                        biblk = gfs2_bitfit(buffer, bi->bi_len, goal, state);
-                        if (biblk == BFITNOENT)
-                                break;
-                        /* Check if this block is reserved() */
-                        rgblk = gfs2_bi2rgd_blk(bi, biblk);
-                        rs = rs_find(rgd, rgblk);
-                        if (rs == NULL)
-                                break;
-
-                        BUG_ON(rs->rs_bi != bi);
-                        biblk = BFITNOENT;
-                        /* This should jump to the first block after the
-                           reservation. */
-                        goal = rs->rs_biblk + rs->rs_free;
-                        if (goal >= bi->bi_len * GFS2_NBBY)
-                                break;
-                }
-                if (biblk != BFITNOENT)
-                        break;
-
-                if ((goal == 0) && (state == GFS2_BLKST_FREE))
-                        set_bit(GBF_FULL, &bi->bi_flags);
-
-                /* Try next bitmap block (wrap back to rgrp header if at end) */
-skip:
-                buf++;
-                buf %= length;
-                goal = 0;
-        }
-
-        if (biblk != BFITNOENT)
-                *rbi = bi;
-
-        return biblk;
-}
 
 /**
  * gfs2_alloc_extent - allocate an extent from a given bitmap
- * @rgd: the resource group descriptor
- * @bi: the bitmap within the rgrp
- * @blk: the block within the bitmap
+ * @rbm: the resource group information
  * @dinode: TRUE if the first block we allocate is for a dinode
- * @n: The extent length
+ * @n: The extent length (value/result)
  *
- * Add the found bitmap buffer to the transaction.
+ * Add the bitmap buffer to the transaction.
  * Set the found bits to @new_state to change block's allocation state.
- * Returns: starting block number of the extent (fs scope)
  */
-static u64 gfs2_alloc_extent(struct gfs2_rgrpd *rgd, struct gfs2_bitmap *bi,
-                             u32 blk, bool dinode, unsigned int *n)
+static void gfs2_alloc_extent(const struct gfs2_rbm *rbm, bool dinode,
+                             unsigned int *n)
 {
+        struct gfs2_rbm pos = { .rgd = rbm->rgd, };
         const unsigned int elen = *n;
-        u32 goal, rgblk;
-        const u8 *buffer = NULL;
-        struct gfs2_blkreserv *rs;
-
-        *n = 0;
-        buffer = bi->bi_bh->b_data + bi->bi_offset;
-        gfs2_trans_add_bh(rgd->rd_gl, bi->bi_bh, 1);
-        gfs2_setbit(rgd, bi->bi_clone, bi, blk,
-                    dinode ? GFS2_BLKST_DINODE : GFS2_BLKST_USED);
-        (*n)++;
-        goal = blk;
+        u64 block;
+        int ret;
+
+        *n = 1;
+        block = gfs2_rbm_to_block(rbm);
+        gfs2_trans_add_bh(rbm->rgd->rd_gl, rbm->bi->bi_bh, 1);
+        gfs2_setbit(rbm, true, dinode ? GFS2_BLKST_DINODE : GFS2_BLKST_USED);
+        block++;
         while (*n < elen) {
-                goal++;
-                if (goal >= (bi->bi_len * GFS2_NBBY))
-                        break;
-                rgblk = gfs2_bi2rgd_blk(bi, goal);
-                rs = rs_find(rgd, rgblk);
-                if (rs) /* Oops, we bumped into someone's reservation */
-                        break;
-                if (gfs2_testbit(rgd, buffer, bi->bi_len, goal) !=
-                    GFS2_BLKST_FREE)
+                ret = gfs2_rbm_from_block(&pos, block);
+                if (ret || gfs2_testbit(&pos) != GFS2_BLKST_FREE)
                         break;
-                gfs2_setbit(rgd, bi->bi_clone, bi, goal, GFS2_BLKST_USED);
+                gfs2_trans_add_bh(pos.rgd->rd_gl, pos.bi->bi_bh, 1);
+                gfs2_setbit(&pos, true, GFS2_BLKST_USED);
                 (*n)++;
+                block++;
         }
-        blk = gfs2_bi2rgd_blk(bi, blk);
-        rgd->rd_last_alloc = blk + *n - 1;
-        return rgd->rd_data0 + blk;
 }
 
 /**
@@ -1875,46 +1874,30 @@ static u64 gfs2_alloc_extent(struct gfs2_rgrpd *rgd, struct gfs2_bitmap *bi,
 static struct gfs2_rgrpd *rgblk_free(struct gfs2_sbd *sdp, u64 bstart,
                                      u32 blen, unsigned char new_state)
 {
-        struct gfs2_rgrpd *rgd;
-        struct gfs2_bitmap *bi = NULL;
-        u32 length, rgrp_blk, buf_blk;
-        unsigned int buf;
+        struct gfs2_rbm rbm;
 
-        rgd = gfs2_blk2rgrpd(sdp, bstart, 1);
-        if (!rgd) {
+        rbm.rgd = gfs2_blk2rgrpd(sdp, bstart, 1);
+        if (!rbm.rgd) {
                 if (gfs2_consist(sdp))
                         fs_err(sdp, "block = %llu\n", (unsigned long long)bstart);
                 return NULL;
         }
 
-        length = rgd->rd_length;
-
-        rgrp_blk = bstart - rgd->rd_data0;
-
         while (blen--) {
-                for (buf = 0; buf < length; buf++) {
-                        bi = rgd->rd_bits + buf;
-                        if (rgrp_blk < (bi->bi_start + bi->bi_len) * GFS2_NBBY)
-                                break;
-                }
-
-                gfs2_assert(rgd->rd_sbd, buf < length);
-
-                buf_blk = rgrp_blk - bi->bi_start * GFS2_NBBY;
-                rgrp_blk++;
-
-                if (!bi->bi_clone) {
-                        bi->bi_clone = kmalloc(bi->bi_bh->b_size,
-                                               GFP_NOFS | __GFP_NOFAIL);
-                        memcpy(bi->bi_clone + bi->bi_offset,
-                               bi->bi_bh->b_data + bi->bi_offset,
-                               bi->bi_len);
+                gfs2_rbm_from_block(&rbm, bstart);
+                bstart++;
+                if (!rbm.bi->bi_clone) {
+                        rbm.bi->bi_clone = kmalloc(rbm.bi->bi_bh->b_size,
+                                                   GFP_NOFS | __GFP_NOFAIL);
+                        memcpy(rbm.bi->bi_clone + rbm.bi->bi_offset,
+                               rbm.bi->bi_bh->b_data + rbm.bi->bi_offset,
+                               rbm.bi->bi_len);
                 }
-                gfs2_trans_add_bh(rgd->rd_gl, bi->bi_bh, 1);
-                gfs2_setbit(rgd, NULL, bi, buf_blk, new_state);
+                gfs2_trans_add_bh(rbm.rgd->rd_gl, rbm.bi->bi_bh, 1);
+                gfs2_setbit(&rbm, false, new_state);
         }
 
-        return rgd;
+        return rbm.rgd;
 }
 
 /**
@@ -1956,56 +1939,41 @@ static void gfs2_rgrp_error(struct gfs2_rgrpd *rgd)
 }
 
 /**
- * claim_reserved_blks - Claim previously reserved blocks
- * @ip: the inode that's claiming the reservation
- * @dinode: 1 if this block is a dinode block, otherwise data block
- * @nblocks: desired extent length
+ * gfs2_adjust_reservation - Adjust (or remove) a reservation after allocation
+ * @ip: The inode we have just allocated blocks for
+ * @rbm: The start of the allocated blocks
+ * @len: The extent length
  *
- * Lay claim to previously allocated block reservation blocks.
- * Returns: Starting block number of the blocks claimed.
- * Sets *nblocks to the actual extent length allocated.
+ * Adjusts a reservation after an allocation has taken place. If the
+ * reservation does not match the allocation, or if it is now empty
+ * then it is removed.
  */
-static u64 claim_reserved_blks(struct gfs2_inode *ip, bool dinode,
-                               unsigned int *nblocks)
+
+static void gfs2_adjust_reservation(struct gfs2_inode *ip,
+                                    const struct gfs2_rbm *rbm, unsigned len)
 {
         struct gfs2_blkreserv *rs = ip->i_res;
-        struct gfs2_rgrpd *rgd = rs->rs_rgd;
-        struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
-        struct gfs2_bitmap *bi;
-        u64 start_block = gfs2_rs_startblk(rs);
-        const unsigned int elen = *nblocks;
-
-        /*BUG_ON(!gfs2_glock_is_locked_by_me(ip->i_gl));*/
-        gfs2_assert_withdraw(sdp, rgd);
-        /*BUG_ON(!gfs2_glock_is_locked_by_me(rgd->rd_gl));*/
-        bi = rs->rs_bi;
-        gfs2_trans_add_bh(rgd->rd_gl, bi->bi_bh, 1);
-
-        for (*nblocks = 0; *nblocks < elen && rs->rs_free; (*nblocks)++) {
-                /* Make sure the bitmap hasn't changed */
-                gfs2_setbit(rgd, bi->bi_clone, bi, rs->rs_biblk,
-                            dinode ? GFS2_BLKST_DINODE : GFS2_BLKST_USED);
-                rs->rs_biblk++;
-                rs->rs_free--;
-
-                BUG_ON(!rgd->rd_reserved);
-                rgd->rd_reserved--;
-                dinode = false;
-                trace_gfs2_rs(ip, rs, TRACE_RS_CLAIM);
-        }
-
-        if (!rs->rs_free) {
-                struct gfs2_rgrpd *rgd = ip->i_res->rs_rgd;
+        struct gfs2_rgrpd *rgd = rbm->rgd;
+        unsigned rlen;
+        u64 block;
+        int ret;
 
-                gfs2_rs_deltree(rs);
-                /* -nblocks because we haven't returned to do the math yet.
-                   I'm doing the math backwards to prevent negative numbers,
-                   but think of it as:
-                   if (unclaimed_blocks(rgd) - *nblocks >= RGRP_RSRV_MINBLKS */
-                if (unclaimed_blocks(rgd) >= RGRP_RSRV_MINBLKS + *nblocks)
-                        rg_mblk_search(rgd, ip);
+        spin_lock(&rgd->rd_rsspin);
+        if (gfs2_rs_active(rs)) {
+                if (gfs2_rbm_eq(&rs->rs_rbm, rbm)) {
+                        block = gfs2_rbm_to_block(rbm);
+                        ret = gfs2_rbm_from_block(&rs->rs_rbm, block + len);
+                        rlen = min(rs->rs_free, len);
+                        rs->rs_free -= rlen;
+                        rgd->rd_reserved -= rlen;
+                        trace_gfs2_rs(rs, TRACE_RS_CLAIM);
+                        if (rs->rs_free && !ret)
+                                goto out;
+                }
+                __rs_deltree(ip, rs);
         }
-        return start_block;
+out:
+        spin_unlock(&rgd->rd_rsspin);
 }
 
 /**
@@ -2024,47 +1992,40 @@ int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *nblocks,
 {
         struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
         struct buffer_head *dibh;
-        struct gfs2_rgrpd *rgd;
+        struct gfs2_rbm rbm = { .rgd = ip->i_rgd, };
         unsigned int ndata;
-        u32 goal, blk; /* block, within the rgrp scope */
+        u64 goal;
         u64 block; /* block, within the file system scope */
         int error;
-        struct gfs2_bitmap *bi;
 
-        /* Only happens if there is a bug in gfs2, return something distinctive
-         * to ensure that it is noticed.
-         */
-        if (ip->i_res->rs_requested == 0)
-                return -ECANCELED;
-
-        /* Check if we have a multi-block reservation, and if so, claim the
-           next free block from it. */
-        if (gfs2_rs_active(ip->i_res)) {
-                BUG_ON(!ip->i_res->rs_free);
-                rgd = ip->i_res->rs_rgd;
-                block = claim_reserved_blks(ip, dinode, nblocks);
-        } else {
-                rgd = ip->i_rgd;
+        if (gfs2_rs_active(ip->i_res))
+                goal = gfs2_rbm_to_block(&ip->i_res->rs_rbm);
+        else if (!dinode && rgrp_contains_block(rbm.rgd, ip->i_goal))
+                goal = ip->i_goal;
+        else
+                goal = rbm.rgd->rd_last_alloc + rbm.rgd->rd_data0;
 
-                if (!dinode && rgrp_contains_block(rgd, ip->i_goal))
-                        goal = ip->i_goal - rgd->rd_data0;
-                else
-                        goal = rgd->rd_last_alloc;
-
-                blk = rgblk_search(rgd, goal, GFS2_BLKST_FREE, &bi);
-
-                /* Since all blocks are reserved in advance, this shouldn't
-                   happen */
-                if (blk == BFITNOENT) {
-                        printk(KERN_WARNING "BFITNOENT, nblocks=%u\n",
-                               *nblocks);
-                        printk(KERN_WARNING "FULL=%d\n",
-                               test_bit(GBF_FULL, &rgd->rd_bits->bi_flags));
-                        goto rgrp_error;
-                }
+        gfs2_rbm_from_block(&rbm, goal);
+        error = gfs2_rbm_find(&rbm, GFS2_BLKST_FREE, 0, ip, false);
 
-                block = gfs2_alloc_extent(rgd, bi, blk, dinode, nblocks);
+        if (error == -ENOSPC) {
+                gfs2_rbm_from_block(&rbm, goal);
+                error = gfs2_rbm_find(&rbm, GFS2_BLKST_FREE, 0, NULL, false);
+        }
+
+        /* Since all blocks are reserved in advance, this shouldn't happen */
+        if (error) {
+                fs_warn(sdp, "inum=%llu error=%d, nblocks=%u, full=%d\n",
+                        (unsigned long long)ip->i_no_addr, error, *nblocks,
+                        test_bit(GBF_FULL, &rbm.rgd->rd_bits->bi_flags));
+                goto rgrp_error;
         }
+
+        gfs2_alloc_extent(&rbm, dinode, nblocks);
+        block = gfs2_rbm_to_block(&rbm);
+        rbm.rgd->rd_last_alloc = block - rbm.rgd->rd_data0;
+        if (gfs2_rs_active(ip->i_res))
+                gfs2_adjust_reservation(ip, &rbm, *nblocks);
         ndata = *nblocks;
         if (dinode)
                 ndata--;
@@ -2081,22 +2042,22 @@ int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *nblocks,
                         brelse(dibh);
                 }
         }
-        if (rgd->rd_free < *nblocks) {
+        if (rbm.rgd->rd_free < *nblocks) {
                 printk(KERN_WARNING "nblocks=%u\n", *nblocks);
                 goto rgrp_error;
         }
 
-        rgd->rd_free -= *nblocks;
+        rbm.rgd->rd_free -= *nblocks;
         if (dinode) {
-                rgd->rd_dinodes++;
-                *generation = rgd->rd_igeneration++;
+                rbm.rgd->rd_dinodes++;
+                *generation = rbm.rgd->rd_igeneration++;
                 if (*generation == 0)
-                        *generation = rgd->rd_igeneration++;
+                        *generation = rbm.rgd->rd_igeneration++;
         }
 
-        gfs2_trans_add_bh(rgd->rd_gl, rgd->rd_bits[0].bi_bh, 1);
-        gfs2_rgrp_out(rgd, rgd->rd_bits[0].bi_bh->b_data);
-        gfs2_rgrp_ondisk2lvb(rgd->rd_rgl, rgd->rd_bits[0].bi_bh->b_data);
+        gfs2_trans_add_bh(rbm.rgd->rd_gl, rbm.rgd->rd_bits[0].bi_bh, 1);
+        gfs2_rgrp_out(rbm.rgd, rbm.rgd->rd_bits[0].bi_bh->b_data);
+        gfs2_rgrp_ondisk2lvb(rbm.rgd->rd_rgl, rbm.rgd->rd_bits[0].bi_bh->b_data);
 
         gfs2_statfs_change(sdp, 0, -(s64)*nblocks, dinode ? 1 : 0);
         if (dinode)
@@ -2110,14 +2071,14 @@ int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *nblocks,
                 gfs2_quota_change(ip, ndata, ip->i_inode.i_uid,
                                   ip->i_inode.i_gid);
 
-        rgd->rd_free_clone -= *nblocks;
-        trace_gfs2_block_alloc(ip, rgd, block, *nblocks,
+        rbm.rgd->rd_free_clone -= *nblocks;
+        trace_gfs2_block_alloc(ip, rbm.rgd, block, *nblocks,
                                dinode ? GFS2_BLKST_DINODE : GFS2_BLKST_USED);
         *bn = block;
         return 0;
 
 rgrp_error:
-        gfs2_rgrp_error(rgd);
+        gfs2_rgrp_error(rbm.rgd);
         return -EIO;
 }
 
diff --git a/fs/gfs2/rgrp.h b/fs/gfs2/rgrp.h
index ca6e26729b86..24077958dcf6 100644
--- a/fs/gfs2/rgrp.h
+++ b/fs/gfs2/rgrp.h
@@ -46,7 +46,7 @@ extern int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *n,
                              bool dinode, u64 *generation);
 
 extern int gfs2_rs_alloc(struct gfs2_inode *ip);
-extern void gfs2_rs_deltree(struct gfs2_blkreserv *rs);
+extern void gfs2_rs_deltree(struct gfs2_inode *ip, struct gfs2_blkreserv *rs);
 extern void gfs2_rs_delete(struct gfs2_inode *ip);
 extern void __gfs2_free_blocks(struct gfs2_inode *ip, u64 bstart, u32 blen, int meta);
 extern void gfs2_free_meta(struct gfs2_inode *ip, u64 bstart, u32 blen);
@@ -73,30 +73,10 @@ extern int gfs2_rgrp_send_discards(struct gfs2_sbd *sdp, u64 offset,
                                    const struct gfs2_bitmap *bi, unsigned minlen, u64 *ptrimmed);
 extern int gfs2_fitrim(struct file *filp, void __user *argp);
 
-/* This is how to tell if a multi-block reservation is "inplace" reserved: */
-static inline int gfs2_mb_reserved(struct gfs2_inode *ip)
+/* This is how to tell if a reservation is in the rgrp tree: */
+static inline bool gfs2_rs_active(struct gfs2_blkreserv *rs)
 {
-        if (ip->i_res && ip->i_res->rs_requested)
-                return 1;
-        return 0;
-}
-
-/* This is how to tell if a multi-block reservation is in the rgrp tree: */
-static inline int gfs2_rs_active(struct gfs2_blkreserv *rs)
-{
-        if (rs && rs->rs_bi)
-                return 1;
-        return 0;
-}
-
-static inline u32 gfs2_bi2rgd_blk(const struct gfs2_bitmap *bi, u32 blk)
-{
-        return (bi->bi_start * GFS2_NBBY) + blk;
-}
-
-static inline u64 gfs2_rs_startblk(const struct gfs2_blkreserv *rs)
-{
-        return gfs2_bi2rgd_blk(rs->rs_bi, rs->rs_biblk) + rs->rs_rgd->rd_data0;
+        return rs && !RB_EMPTY_NODE(&rs->rs_node);
 }
 
 #endif /* __RGRP_DOT_H__ */
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index fc3168f47a14..a8d90f2f576c 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1366,6 +1366,8 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
         val = sdp->sd_tune.gt_statfs_quantum;
         if (val != 30)
                 seq_printf(s, ",statfs_quantum=%d", val);
+        else if (sdp->sd_tune.gt_statfs_slow)
+                seq_puts(s, ",statfs_quantum=0");
         val = sdp->sd_tune.gt_quota_quantum;
         if (val != 60)
                 seq_printf(s, ",quota_quantum=%d", val);
@@ -1543,6 +1545,11 @@ static void gfs2_evict_inode(struct inode *inode)
 
 out_truncate:
         gfs2_log_flush(sdp, ip->i_gl);
+        if (test_bit(GLF_DIRTY, &ip->i_gl->gl_flags)) {
+                struct address_space *metamapping = gfs2_glock2aspace(ip->i_gl);
+                filemap_fdatawrite(metamapping);
+                filemap_fdatawait(metamapping);
+        }
         write_inode_now(inode, 1);
         gfs2_ail_flush(ip->i_gl, 0);
 
@@ -1557,7 +1564,7 @@ out_truncate:
 out_unlock:
         /* Error path for case 1 */
         if (gfs2_rs_active(ip->i_res))
-                gfs2_rs_deltree(ip->i_res);
+                gfs2_rs_deltree(ip, ip->i_res);
 
         if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags))
                 gfs2_glock_dq(&ip->i_iopen_gh);
diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h
index a25c252fe412..bbdc78af60ca 100644
--- a/fs/gfs2/trace_gfs2.h
+++ b/fs/gfs2/trace_gfs2.h
@@ -509,10 +509,9 @@ TRACE_EVENT(gfs2_block_alloc,
 /* Keep track of multi-block reservations as they are allocated/freed */
 TRACE_EVENT(gfs2_rs,
 
-        TP_PROTO(const struct gfs2_inode *ip, const struct gfs2_blkreserv *rs,
-                 u8 func),
+        TP_PROTO(const struct gfs2_blkreserv *rs, u8 func),
 
-        TP_ARGS(ip, rs, func),
+        TP_ARGS(rs, func),
 
         TP_STRUCT__entry(
                 __field(        dev_t,  dev                     )
@@ -526,18 +525,17 @@ TRACE_EVENT(gfs2_rs,
         ),
 
         TP_fast_assign(
-                __entry->dev            = rs->rs_rgd ? rs->rs_rgd->rd_sbd->sd_vfs->s_dev : 0;
-                __entry->rd_addr        = rs->rs_rgd ? rs->rs_rgd->rd_addr : 0;
-                __entry->rd_free_clone  = rs->rs_rgd ? rs->rs_rgd->rd_free_clone : 0;
-                __entry->rd_reserved    = rs->rs_rgd ? rs->rs_rgd->rd_reserved : 0;
-                __entry->inum           = ip ? ip->i_no_addr : 0;
-                __entry->start          = gfs2_rs_startblk(rs);
+                __entry->dev            = rs->rs_rbm.rgd->rd_sbd->sd_vfs->s_dev;
+                __entry->rd_addr        = rs->rs_rbm.rgd->rd_addr;
+                __entry->rd_free_clone  = rs->rs_rbm.rgd->rd_free_clone;
+                __entry->rd_reserved    = rs->rs_rbm.rgd->rd_reserved;
+                __entry->inum           = rs->rs_inum;
+                __entry->start          = gfs2_rbm_to_block(&rs->rs_rbm);
                 __entry->free           = rs->rs_free;
                 __entry->func           = func;
         ),
 
-        TP_printk("%u,%u bmap %llu resrv %llu rg:%llu rf:%lu rr:%lu %s "
-                  "f:%lu",
+        TP_printk("%u,%u bmap %llu resrv %llu rg:%llu rf:%lu rr:%lu %s f:%lu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long long)__entry->inum,
                   (unsigned long long)__entry->start,
diff --git a/fs/gfs2/trans.h b/fs/gfs2/trans.h
index 41f42cdccbb8..bf2ae9aeee7a 100644
--- a/fs/gfs2/trans.h
+++ b/fs/gfs2/trans.h
@@ -28,11 +28,10 @@ struct gfs2_glock;
 
 /* reserve either the number of blocks to be allocated plus the rg header
  * block, or all of the blocks in the rg, whichever is smaller */
-static inline unsigned int gfs2_rg_blocks(const struct gfs2_inode *ip)
+static inline unsigned int gfs2_rg_blocks(const struct gfs2_inode *ip, unsigned requested)
 {
-        const struct gfs2_blkreserv *rs = ip->i_res;
-        if (rs && rs->rs_requested < ip->i_rgd->rd_length)
-                return rs->rs_requested + 1;
+        if (requested < ip->i_rgd->rd_length)
+                return requested + 1;
         return ip->i_rgd->rd_length;
 }
 
diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c
index 27a0b4a901f5..db330e5518cd 100644
--- a/fs/gfs2/xattr.c
+++ b/fs/gfs2/xattr.c
@@ -448,17 +448,18 @@ ssize_t gfs2_listxattr(struct dentry *dentry, char *buffer, size_t size)
 }
 
 /**
- * ea_get_unstuffed - actually copies the unstuffed data into the
- *                    request buffer
+ * ea_iter_unstuffed - copies the unstuffed xattr data to/from the
+ *                     request buffer
  * @ip: The GFS2 inode
  * @ea: The extended attribute header structure
- * @data: The data to be copied
+ * @din: The data to be copied in
+ * @dout: The data to be copied out (one of din,dout will be NULL)
  *
  * Returns: errno
  */
 
-static int ea_get_unstuffed(struct gfs2_inode *ip, struct gfs2_ea_header *ea,
-                            char *data)
+static int gfs2_iter_unstuffed(struct gfs2_inode *ip, struct gfs2_ea_header *ea,
+                               const char *din, char *dout)
 {
         struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
         struct buffer_head **bh;
@@ -467,6 +468,8 @@ static int ea_get_unstuffed(struct gfs2_inode *ip, struct gfs2_ea_header *ea,
         __be64 *dataptrs = GFS2_EA2DATAPTRS(ea);
         unsigned int x;
         int error = 0;
+        unsigned char *pos;
+        unsigned cp_size;
 
         bh = kcalloc(nptrs, sizeof(struct buffer_head *), GFP_NOFS);
         if (!bh)
@@ -497,12 +500,21 @@ static int ea_get_unstuffed(struct gfs2_inode *ip, struct gfs2_ea_header *ea,
                         goto out;
                 }
 
-                memcpy(data, bh[x]->b_data + sizeof(struct gfs2_meta_header),
-                       (sdp->sd_jbsize > amount) ? amount : sdp->sd_jbsize);
+                pos = bh[x]->b_data + sizeof(struct gfs2_meta_header);
+                cp_size = (sdp->sd_jbsize > amount) ? amount : sdp->sd_jbsize;
 
-                amount -= sdp->sd_jbsize;
-                data += sdp->sd_jbsize;
+                if (dout) {
+                        memcpy(dout, pos, cp_size);
+                        dout += sdp->sd_jbsize;
+                }
+
+                if (din) {
+                        gfs2_trans_add_bh(ip->i_gl, bh[x], 1);
+                        memcpy(pos, din, cp_size);
+                        din += sdp->sd_jbsize;
+                }
 
+                amount -= sdp->sd_jbsize;
                 brelse(bh[x]);
         }
 
@@ -523,7 +535,7 @@ static int gfs2_ea_get_copy(struct gfs2_inode *ip, struct gfs2_ea_location *el,
                 memcpy(data, GFS2_EA2DATA(el->el_ea), len);
                 return len;
         }
-        ret = ea_get_unstuffed(ip, el->el_ea, data);
+        ret = gfs2_iter_unstuffed(ip, el->el_ea, NULL, data);
         if (ret < 0)
                 return ret;
         return len;
@@ -727,7 +739,7 @@ static int ea_alloc_skeleton(struct gfs2_inode *ip, struct gfs2_ea_request *er,
                 goto out_gunlock_q;
 
         error = gfs2_trans_begin(GFS2_SB(&ip->i_inode),
-                                 blks + gfs2_rg_blocks(ip) +
+                                 blks + gfs2_rg_blocks(ip, blks) +
                                  RES_DINODE + RES_STATFS + RES_QUOTA, 0);
         if (error)
                 goto out_ipres;
@@ -1220,69 +1232,23 @@ static int gfs2_xattr_set(struct dentry *dentry, const char *name,
                                 size, flags, type);
 }
 
+
 static int ea_acl_chmod_unstuffed(struct gfs2_inode *ip,
                                   struct gfs2_ea_header *ea, char *data)
 {
         struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
-        struct buffer_head **bh;
         unsigned int amount = GFS2_EA_DATA_LEN(ea);
         unsigned int nptrs = DIV_ROUND_UP(amount, sdp->sd_jbsize);
-        __be64 *dataptrs = GFS2_EA2DATAPTRS(ea);
-        unsigned int x;
-        int error;
-
-        bh = kcalloc(nptrs, sizeof(struct buffer_head *), GFP_NOFS);
-        if (!bh)
-                return -ENOMEM;
-
-        error = gfs2_trans_begin(sdp, nptrs + RES_DINODE, 0);
-        if (error)
-                goto out;
-
-        for (x = 0; x < nptrs; x++) {
-                error = gfs2_meta_read(ip->i_gl, be64_to_cpu(*dataptrs), 0,
-                                       bh + x);
-                if (error) {
-                        while (x--)
-                                brelse(bh[x]);
-                        goto fail;
-                }
-                dataptrs++;
-        }
-
-        for (x = 0; x < nptrs; x++) {
-                error = gfs2_meta_wait(sdp, bh[x]);
-                if (error) {
-                        for (; x < nptrs; x++)
-                                brelse(bh[x]);
-                        goto fail;
-                }
-                if (gfs2_metatype_check(sdp, bh[x], GFS2_METATYPE_ED)) {
-                        for (; x < nptrs; x++)
-                                brelse(bh[x]);
-                        error = -EIO;
-                        goto fail;
-                }
-
-                gfs2_trans_add_bh(ip->i_gl, bh[x], 1);
-
-                memcpy(bh[x]->b_data + sizeof(struct gfs2_meta_header), data,
-                       (sdp->sd_jbsize > amount) ? amount : sdp->sd_jbsize);
-
-                amount -= sdp->sd_jbsize;
-                data += sdp->sd_jbsize;
-
-                brelse(bh[x]);
-        }
+        int ret;
 
-out:
-        kfree(bh);
-        return error;
+        ret = gfs2_trans_begin(sdp, nptrs + RES_DINODE, 0);
+        if (ret)
+                return ret;
 
-fail:
+        ret = gfs2_iter_unstuffed(ip, ea, data, NULL);
         gfs2_trans_end(sdp);
-        kfree(bh);
-        return error;
+
+        return ret;
 }
 
 int gfs2_xattr_acl_chmod(struct gfs2_inode *ip, struct iattr *attr, char *data)
diff --git a/fs/libfs.c b/fs/libfs.c
index a74cb1725ac6..7cc37ca19cd8 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -874,7 +874,7 @@ struct dentry *generic_fh_to_dentry(struct super_block *sb, struct fid *fid,
 EXPORT_SYMBOL_GPL(generic_fh_to_dentry);
 
 /**
- * generic_fh_to_dentry - generic helper for the fh_to_parent export operation
+ * generic_fh_to_parent - generic helper for the fh_to_parent export operation
  * @sb:         filesystem to do the file handle conversion on
  * @fid:        file handle to convert
  * @fh_len:     length of the file handle in bytes
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index fb1a2bedbe97..8d80c990dffd 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -289,7 +289,6 @@ static void nlmsvc_free_block(struct kref *kref)
         dprintk("lockd: freeing block %p...\n", block);
 
         /* Remove block from file's list of blocks */
-        mutex_lock(&file->f_mutex);
         list_del_init(&block->b_flist);
         mutex_unlock(&file->f_mutex);
 
@@ -303,7 +302,7 @@ static void nlmsvc_free_block(struct kref *kref)
 static void nlmsvc_release_block(struct nlm_block *block)
 {
         if (block != NULL)
-                kref_put(&block->b_count, nlmsvc_free_block);
+                kref_put_mutex(&block->b_count, nlmsvc_free_block, &block->b_file->f_mutex);
 }
 
 /*
diff --git a/fs/namespace.c b/fs/namespace.c
index 4d31f73e2561..7bdf7907413f 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1886,8 +1886,14 @@ static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags)
                 return err;
 
         err = -EINVAL;
-        if (!(mnt_flags & MNT_SHRINKABLE) && !check_mnt(real_mount(path->mnt)))
-                goto unlock;
+        if (unlikely(!check_mnt(real_mount(path->mnt)))) {
+                /* that's acceptable only for automounts done in private ns */
+                if (!(mnt_flags & MNT_SHRINKABLE))
+                        goto unlock;
+                /* ... and for those we'd better have mountpoint still alive */
+                if (!real_mount(path->mnt)->mnt_ns)
+                        goto unlock;
+        }
 
         /* Refuse the same filesystem on the same mount point */
         err = -EBUSY;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 75d6d0a3d32e..6a7fcab7ecb3 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -287,10 +287,12 @@ nfs_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
         struct inode *inode = file->f_path.dentry->d_inode;
 
         ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
+        if (ret != 0)
+                goto out;
         mutex_lock(&inode->i_mutex);
         ret = nfs_file_fsync_commit(file, start, end, datasync);
         mutex_unlock(&inode->i_mutex);
-
+out:
         return ret;
 }
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index c6e895f0fbf3..9b47610338f5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -154,7 +154,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
         nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
         nfsi->attrtimeo_timestamp = jiffies;
 
-        memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
+        memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
         if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
         else
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index d6b3b5f2d779..69322096c325 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -643,7 +643,7 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                   u64 cookie, struct page **pages, unsigned int count, int plus)
 {
         struct inode            *dir = dentry->d_inode;
-        __be32                  *verf = NFS_COOKIEVERF(dir);
+        __be32                  *verf = NFS_I(dir)->cookieverf;
         struct nfs3_readdirargs arg = {
                 .fh             = NFS_FH(dir),
                 .cookie         = cookie,
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index acb65e7887f8..eb5eb8eef4d3 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -96,13 +96,15 @@ nfs4_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
         struct inode *inode = file->f_path.dentry->d_inode;
 
         ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
+        if (ret != 0)
+                goto out;
         mutex_lock(&inode->i_mutex);
         ret = nfs_file_fsync_commit(file, start, end, datasync);
         if (!ret && !datasync)
                 /* application has asked for meta-data sync */
                 ret = pnfs_layoutcommit_inode(inode, true);
         mutex_unlock(&inode->i_mutex);
-
+out:
         return ret;
 }
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 635274140b18..1e50326d00dd 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3215,11 +3215,11 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                         dentry->d_parent->d_name.name,
                         dentry->d_name.name,
                         (unsigned long long)cookie);
-        nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args);
+        nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
         res.pgbase = args.pgbase;
         status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
         if (status >= 0) {
-                memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE);
+                memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
                 status += args.pgbase;
         }
 
@@ -3653,11 +3653,11 @@ static inline int nfs4_server_supports_acls(struct nfs_server *server)
                 && (server->acl_bitmask & ACL4_SUPPORT_DENY_ACL);
 }
 
-/* Assuming that XATTR_SIZE_MAX is a multiple of PAGE_CACHE_SIZE, and that
- * it's OK to put sizeof(void) * (XATTR_SIZE_MAX/PAGE_CACHE_SIZE) bytes on
+/* Assuming that XATTR_SIZE_MAX is a multiple of PAGE_SIZE, and that
+ * it's OK to put sizeof(void) * (XATTR_SIZE_MAX/PAGE_SIZE) bytes on
  * the stack.
  */
-#define NFS4ACL_MAXPAGES (XATTR_SIZE_MAX >> PAGE_CACHE_SHIFT)
+#define NFS4ACL_MAXPAGES DIV_ROUND_UP(XATTR_SIZE_MAX, PAGE_SIZE)
 
 static int buf_to_pages_noslab(const void *buf, size_t buflen,
                 struct page **pages, unsigned int *pgbase)
@@ -3668,7 +3668,7 @@ static int buf_to_pages_noslab(const void *buf, size_t buflen,
         spages = pages;
 
         do {
-                len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
+                len = min_t(size_t, PAGE_SIZE, buflen);
                 newpage = alloc_page(GFP_KERNEL);
 
                 if (newpage == NULL)
@@ -3739,7 +3739,7 @@ static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size
         struct nfs4_cached_acl *acl;
         size_t buflen = sizeof(*acl) + acl_len;
 
-        if (pages && buflen <= PAGE_SIZE) {
+        if (buflen <= PAGE_SIZE) {
                 acl = kmalloc(buflen, GFP_KERNEL);
                 if (acl == NULL)
                         goto out;
@@ -3782,17 +3782,15 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
                 .rpc_argp = &args,
                 .rpc_resp = &res,
         };
-        int ret = -ENOMEM, npages, i;
-        size_t acl_len = 0;
+        unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
+        int ret = -ENOMEM, i;
 
-        npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
         /* As long as we're doing a round trip to the server anyway,
          * let's be prepared for a page of acl data. */
         if (npages == 0)
                 npages = 1;
-
-        /* Add an extra page to handle the bitmap returned */
-        npages++;
+        if (npages > ARRAY_SIZE(pages))
+                return -ERANGE;
 
         for (i = 0; i < npages; i++) {
                 pages[i] = alloc_page(GFP_KERNEL);
@@ -3808,11 +3806,6 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         args.acl_len = npages * PAGE_SIZE;
         args.acl_pgbase = 0;
 
-        /* Let decode_getfacl know not to fail if the ACL data is larger than
-         * the page we send as a guess */
-        if (buf == NULL)
-                res.acl_flags |= NFS4_ACL_LEN_REQUEST;
-
         dprintk("%s  buf %p buflen %zu npages %d args.acl_len %zu\n",
                 __func__, buf, buflen, npages, args.acl_len);
         ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode),
@@ -3820,20 +3813,19 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         if (ret)
                 goto out_free;
 
-        acl_len = res.acl_len;
-        if (acl_len > args.acl_len)
-                nfs4_write_cached_acl(inode, NULL, 0, acl_len);
-        else
-                nfs4_write_cached_acl(inode, pages, res.acl_data_offset,
-                                      acl_len);
-        if (buf) {
+        /* Handle the case where the passed-in buffer is too short */
+        if (res.acl_flags & NFS4_ACL_TRUNC) {
+                /* Did the user only issue a request for the acl length? */
+                if (buf == NULL)
+                        goto out_ok;
                 ret = -ERANGE;
-                if (acl_len > buflen)
-                        goto out_free;
-                _copy_from_pages(buf, pages, res.acl_data_offset,
-                                acl_len);
+                goto out_free;
         }
-        ret = acl_len;
+        nfs4_write_cached_acl(inode, pages, res.acl_data_offset, res.acl_len);
+        if (buf)
+                _copy_from_pages(buf, pages, res.acl_data_offset, res.acl_len);
+out_ok:
+        ret = res.acl_len;
 out_free:
         for (i = 0; i < npages; i++)
                 if (pages[i])
@@ -3891,10 +3883,13 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
                 .rpc_argp       = &arg,
                 .rpc_resp       = &res,
         };
+        unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
         int ret, i;
 
         if (!nfs4_server_supports_acls(server))
                 return -EOPNOTSUPP;
+        if (npages > ARRAY_SIZE(pages))
+                return -ERANGE;
         i = buf_to_pages_noslab(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
         if (i < 0)
                 return i;
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 1bfbd67c556d..8dba6bd48557 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -5072,18 +5072,14 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                  * are stored with the acl data to handle the problem of
                  * variable length bitmaps.*/
                 res->acl_data_offset = xdr_stream_pos(xdr) - pg_offset;
-
-                /* We ignore &savep and don't do consistency checks on
-                 * the attr length.  Let userspace figure it out.... */
                 res->acl_len = attrlen;
-                if (attrlen > (xdr->nwords << 2)) {
-                        if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
-                                /* getxattr interface called with a NULL buf */
-                                goto out;
-                        }
+
+                /* Check for receive buffer overflow */
+                if (res->acl_len > (xdr->nwords << 2) ||
+                    res->acl_len + res->acl_data_offset > xdr->buf->page_len) {
+                        res->acl_flags |= NFS4_ACL_TRUNC;
                         dprintk("NFS: acl reply: attrlen %u > page_len %u\n",
                                         attrlen, xdr->nwords << 2);
-                        return -EINVAL;
                 }
         } else
                 status = -EOPNOTSUPP;
@@ -6229,7 +6225,8 @@ static int nfs4_xdr_dec_open(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
         status = decode_open(xdr, res);
         if (status)
                 goto out;
-        if (decode_getfh(xdr, &res->fh) != 0)
+        status = decode_getfh(xdr, &res->fh);
+        if (status)
                 goto out;
         decode_getfattr(xdr, res->f_attr, res->server);
 out:
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 239aff7338eb..d2c7f5db0847 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1537,7 +1537,7 @@ static int nfs_parse_mount_options(char *raw,
 
         /*
          * verify that any proto=/mountproto= options match the address
-         * familiies in the addr=/mountaddr= options.
+         * families in the addr=/mountaddr= options.
          */
         if (protofamily != AF_UNSPEC &&
             protofamily != mnt->nfs_server.address.ss_family)
@@ -1867,6 +1867,7 @@ static int nfs23_validate_mount_data(void *options,
 
                 memcpy(sap, &data->addr, sizeof(data->addr));
                 args->nfs_server.addrlen = sizeof(data->addr);
+                args->nfs_server.port = ntohs(data->addr.sin_port);
                 if (!nfs_verify_server_address(sap))
                         goto out_no_address;
 
@@ -2564,6 +2565,7 @@ static int nfs4_validate_mount_data(void *options,
                         return -EFAULT;
                 if (!nfs_verify_server_address(sap))
                         goto out_no_address;
+                args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port);
 
                 if (data->auth_flavourlen) {
                         if (data->auth_flavourlen > 1)
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index dfafeb2b05a0..eb7cc91b7258 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
 
         err = ERR_PTR(-ENOMEM);
         inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
-        if (h)
-                sysctl_head_finish(h);
-
         if (!inode)
                 goto out;
 
@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
         d_add(dentry, inode);
 
 out:
+        if (h)
+                sysctl_head_finish(h);
         sysctl_head_finish(head);
         return err;
 }
diff --git a/fs/stat.c b/fs/stat.c
index b6ff11825fc8..40780229a032 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -58,7 +58,7 @@ EXPORT_SYMBOL(vfs_getattr);
 int vfs_fstat(unsigned int fd, struct kstat *stat)
 {
         int fput_needed;
-        struct file *f = fget_light(fd, &fput_needed);
+        struct file *f = fget_raw_light(fd, &fput_needed);
         int error = -EBADF;
 
         if (f) {
diff --git a/fs/udf/file.c b/fs/udf/file.c
index 7f3f7ba3df6e..d1c6093fd3d3 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -39,20 +39,24 @@
 #include "udf_i.h"
 #include "udf_sb.h"
 
-static int udf_adinicb_readpage(struct file *file, struct page *page)
+static void __udf_adinicb_readpage(struct page *page)
 {
         struct inode *inode = page->mapping->host;
         char *kaddr;
         struct udf_inode_info *iinfo = UDF_I(inode);
 
-        BUG_ON(!PageLocked(page));
-
         kaddr = kmap(page);
-        memset(kaddr, 0, PAGE_CACHE_SIZE);
         memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, inode->i_size);
+        memset(kaddr + inode->i_size, 0, PAGE_CACHE_SIZE - inode->i_size);
         flush_dcache_page(page);
         SetPageUptodate(page);
         kunmap(page);
+}
+
+static int udf_adinicb_readpage(struct file *file, struct page *page)
+{
+        BUG_ON(!PageLocked(page));
+        __udf_adinicb_readpage(page);
         unlock_page(page);
 
         return 0;
@@ -77,6 +81,25 @@ static int udf_adinicb_writepage(struct page *page,
         return 0;
 }
 
+static int udf_adinicb_write_begin(struct file *file,
+                        struct address_space *mapping, loff_t pos,
+                        unsigned len, unsigned flags, struct page **pagep,
+                        void **fsdata)
+{
+        struct page *page;
+
+        if (WARN_ON_ONCE(pos >= PAGE_CACHE_SIZE))
+                return -EIO;
+        page = grab_cache_page_write_begin(mapping, 0, flags);
+        if (!page)
+                return -ENOMEM;
+        *pagep = page;
+
+        if (!PageUptodate(page) && len != PAGE_CACHE_SIZE)
+                __udf_adinicb_readpage(page);
+        return 0;
+}
+
 static int udf_adinicb_write_end(struct file *file,
                         struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned copied,
@@ -98,8 +121,8 @@ static int udf_adinicb_write_end(struct file *file,
 const struct address_space_operations udf_adinicb_aops = {
         .readpage       = udf_adinicb_readpage,
         .writepage      = udf_adinicb_writepage,
-        .write_begin = simple_write_begin,
-        .write_end = udf_adinicb_write_end,
+        .write_begin    = udf_adinicb_write_begin,
+        .write_end      = udf_adinicb_write_end,
 };
 
 static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index d7a9dd735e1e..933b7930b863 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -96,6 +96,7 @@ xfs_buf_lru_add(
                 atomic_inc(&bp->b_hold);
                 list_add_tail(&bp->b_lru, &btp->bt_lru);
                 btp->bt_lru_nr++;
+                bp->b_lru_flags &= ~_XBF_LRU_DISPOSE;
         }
         spin_unlock(&btp->bt_lru_lock);
 }
@@ -154,7 +155,8 @@ xfs_buf_stale(
                 struct xfs_buftarg *btp = bp->b_target;
 
                 spin_lock(&btp->bt_lru_lock);
-                if (!list_empty(&bp->b_lru)) {
+                if (!list_empty(&bp->b_lru) &&
+                    !(bp->b_lru_flags & _XBF_LRU_DISPOSE)) {
                         list_del_init(&bp->b_lru);
                         btp->bt_lru_nr--;
                         atomic_dec(&bp->b_hold);
@@ -1501,6 +1503,7 @@ xfs_buftarg_shrink(
                  */
                 list_move(&bp->b_lru, &dispose);
                 btp->bt_lru_nr--;
+                bp->b_lru_flags |= _XBF_LRU_DISPOSE;
         }
         spin_unlock(&btp->bt_lru_lock);
 
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index d03b73b9604e..7c0b6a0a1557 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -38,27 +38,28 @@ typedef enum {
         XBRW_ZERO = 3,                  /* Zero target memory */
 } xfs_buf_rw_t;
 
-#define XBF_READ        (1 << 0) /* buffer intended for reading from device */
-#define XBF_WRITE       (1 << 1) /* buffer intended for writing to device */
-#define XBF_READ_AHEAD  (1 << 2) /* asynchronous read-ahead */
-#define XBF_ASYNC       (1 << 4) /* initiator will not wait for completion */
-#define XBF_DONE        (1 << 5) /* all pages in the buffer uptodate */
-#define XBF_STALE       (1 << 6) /* buffer has been staled, do not find it */
+#define XBF_READ         (1 << 0) /* buffer intended for reading from device */
+#define XBF_WRITE        (1 << 1) /* buffer intended for writing to device */
+#define XBF_READ_AHEAD   (1 << 2) /* asynchronous read-ahead */
+#define XBF_ASYNC        (1 << 4) /* initiator will not wait for completion */
+#define XBF_DONE         (1 << 5) /* all pages in the buffer uptodate */
+#define XBF_STALE        (1 << 6) /* buffer has been staled, do not find it */
 
 /* I/O hints for the BIO layer */
-#define XBF_SYNCIO      (1 << 10)/* treat this buffer as synchronous I/O */
-#define XBF_FUA         (1 << 11)/* force cache write through mode */
-#define XBF_FLUSH       (1 << 12)/* flush the disk cache before a write */
+#define XBF_SYNCIO       (1 << 10)/* treat this buffer as synchronous I/O */
+#define XBF_FUA          (1 << 11)/* force cache write through mode */
+#define XBF_FLUSH        (1 << 12)/* flush the disk cache before a write */
 
 /* flags used only as arguments to access routines */
-#define XBF_TRYLOCK     (1 << 16)/* lock requested, but do not wait */
-#define XBF_UNMAPPED    (1 << 17)/* do not map the buffer */
+#define XBF_TRYLOCK      (1 << 16)/* lock requested, but do not wait */
+#define XBF_UNMAPPED     (1 << 17)/* do not map the buffer */
 
 /* flags used only internally */
-#define _XBF_PAGES      (1 << 20)/* backed by refcounted pages */
-#define _XBF_KMEM       (1 << 21)/* backed by heap memory */
-#define _XBF_DELWRI_Q   (1 << 22)/* buffer on a delwri queue */
-#define _XBF_COMPOUND   (1 << 23)/* compound buffer */
+#define _XBF_PAGES       (1 << 20)/* backed by refcounted pages */
+#define _XBF_KMEM        (1 << 21)/* backed by heap memory */
+#define _XBF_DELWRI_Q    (1 << 22)/* buffer on a delwri queue */
+#define _XBF_COMPOUND    (1 << 23)/* compound buffer */
+#define _XBF_LRU_DISPOSE (1 << 24)/* buffer being discarded */
 
 typedef unsigned int xfs_buf_flags_t;
 
@@ -72,12 +73,13 @@ typedef unsigned int xfs_buf_flags_t;
         { XBF_SYNCIO,           "SYNCIO" }, \
         { XBF_FUA,              "FUA" }, \
         { XBF_FLUSH,            "FLUSH" }, \
-        { XBF_TRYLOCK,          "TRYLOCK" },    /* should never be set */\
+        { XBF_TRYLOCK,          "TRYLOCK" },    /* should never be set */\
         { XBF_UNMAPPED,         "UNMAPPED" },   /* ditto */\
         { _XBF_PAGES,           "PAGES" }, \
         { _XBF_KMEM,            "KMEM" }, \
         { _XBF_DELWRI_Q,        "DELWRI_Q" }, \
-        { _XBF_COMPOUND,        "COMPOUND" }
+        { _XBF_COMPOUND,        "COMPOUND" }, \
+        { _XBF_LRU_DISPOSE,     "LRU_DISPOSE" }
 
 typedef struct xfs_buftarg {
         dev_t                   bt_dev;
@@ -124,7 +126,12 @@ typedef struct xfs_buf {
         xfs_buf_flags_t         b_flags;        /* status flags */
         struct semaphore        b_sema;         /* semaphore for lockables */
 
+        /*
+         * concurrent access to b_lru and b_lru_flags are protected by
+         * bt_lru_lock and not by b_sema
+         */
         struct list_head        b_lru;          /* lru list */
+        xfs_buf_flags_t         b_lru_flags;    /* internal lru status flags */
         wait_queue_head_t       b_waiters;      /* unpin waiters */
         struct list_head        b_list;
         struct xfs_perag        *b_pag;         /* contains rbtree root */
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index bdaf4cb9f4a2..19e2380fb867 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -919,6 +919,7 @@ xfs_fs_put_super(
         struct xfs_mount        *mp = XFS_M(sb);
 
         xfs_filestream_unmount(mp);
+        cancel_delayed_work_sync(&mp->m_sync_work);
         xfs_unmountfs(mp);
         xfs_syncd_stop(mp);
         xfs_freesb(mp);
diff --git a/include/asm-generic/unistd.h b/include/asm-generic/unistd.h
index 991ef01cd77e..3748ec92dcbc 100644
--- a/include/asm-generic/unistd.h
+++ b/include/asm-generic/unistd.h
@@ -691,9 +691,11 @@ __SC_COMP(__NR_process_vm_readv, sys_process_vm_readv, \
 #define __NR_process_vm_writev 271
 __SC_COMP(__NR_process_vm_writev, sys_process_vm_writev, \
           compat_sys_process_vm_writev)
+#define __NR_kcmp 272
+__SYSCALL(__NR_kcmp, sys_kcmp)
 
 #undef __NR_syscalls
-#define __NR_syscalls 272
+#define __NR_syscalls 273
 
 /*
  * All syscalls below here should go away really,
diff --git a/include/drm/drm_fourcc.h b/include/drm/drm_fourcc.h
index bdf0152cbbe9..f4621184a9b4 100644
--- a/include/drm/drm_fourcc.h
+++ b/include/drm/drm_fourcc.h
@@ -107,8 +107,7 @@
 #define DRM_FORMAT_NV16         fourcc_code('N', 'V', '1', '6') /* 2x1 subsampled Cr:Cb plane */
 #define DRM_FORMAT_NV61         fourcc_code('N', 'V', '6', '1') /* 2x1 subsampled Cb:Cr plane */
 
-/* 2 non contiguous plane YCbCr */
-#define DRM_FORMAT_NV12M        fourcc_code('N', 'M', '1', '2') /* 2x2 subsampled Cr:Cb plane */
+/* special NV12 tiled format */
 #define DRM_FORMAT_NV12MT       fourcc_code('T', 'M', '1', '2') /* 2x2 subsampled Cr:Cb plane 64x32 macroblocks */
 
 /*
@@ -131,7 +130,4 @@
 #define DRM_FORMAT_YUV444       fourcc_code('Y', 'U', '2', '4') /* non-subsampled Cb (1) and Cr (2) planes */
 #define DRM_FORMAT_YVU444       fourcc_code('Y', 'V', '2', '4') /* non-subsampled Cr (1) and Cb (2) planes */
 
-/* 3 non contiguous plane YCbCr */
-#define DRM_FORMAT_YUV420M      fourcc_code('Y', 'M', '1', '2') /* 2x2 subsampled Cb (1) and Cr (2) planes */
-
 #endif /* DRM_FOURCC_H */
diff --git a/include/linux/atmel-ssc.h b/include/linux/atmel-ssc.h
index 06023393fba9..4eb31752e2b7 100644
--- a/include/linux/atmel-ssc.h
+++ b/include/linux/atmel-ssc.h
@@ -3,6 +3,7 @@
 
 #include <linux/platform_device.h>
 #include <linux/list.h>
+#include <linux/io.h>
 
 struct ssc_device {
         struct list_head        list;
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 2f4079175afb..934bc34d5f99 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -49,6 +49,13 @@
 #endif
 #endif
 
+#if __GNUC_MINOR__ >= 6
+/*
+ * Tell the optimizer that something else uses this function or variable.
+ */
+#define __visible __attribute__((externally_visible))
+#endif
+
 #if __GNUC_MINOR__ > 0
 #define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
 #endif
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 923d093c9cea..f430e4162f41 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -278,6 +278,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 # define __section(S) __attribute__ ((__section__(#S)))
 #endif
 
+#ifndef __visible
+#define __visible
+#endif
+
 /* Are two types/vars the same type (ignoring qualifiers)? */
 #ifndef __same_type
 # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index caa34e50537e..59200795482e 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -206,6 +206,8 @@ struct dentry_operations {
 #define DCACHE_MANAGED_DENTRY \
         (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
 
+#define DCACHE_DENTRY_KILLED    0x100000
+
 extern seqlock_t rename_lock;
 
 static inline int dname_external(struct dentry *dentry)
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 42970de1b40c..7e1f37db7582 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -414,7 +414,7 @@ struct hid_field {
         __u16 dpad;                     /* dpad input code */
 };
 
-#define HID_MAX_FIELDS 128
+#define HID_MAX_FIELDS 256
 
 struct hid_report {
         struct list_head list;
@@ -626,6 +626,7 @@ struct hid_usage_id {
  * @report_fixup: called before report descriptor parsing (NULL means nop)
  * @input_mapping: invoked on input registering before mapping an usage
  * @input_mapped: invoked on input registering after mapping an usage
+ * @input_configured: invoked just before the device is registered
  * @feature_mapping: invoked on feature registering
  * @suspend: invoked on suspend (NULL means nop)
  * @resume: invoked on resume if device was not reset (NULL means nop)
@@ -670,6 +671,8 @@ struct hid_driver {
         int (*input_mapped)(struct hid_device *hdev,
                         struct hid_input *hidinput, struct hid_field *field,
                         struct hid_usage *usage, unsigned long **bit, int *max);
+        void (*input_configured)(struct hid_device *hdev,
+                                 struct hid_input *hidinput);
         void (*feature_mapping)(struct hid_device *hdev,
                         struct hid_field *field,
                         struct hid_usage *usage);
diff --git a/include/linux/i2c-pnx.h b/include/linux/i2c-pnx.h
index 1bc74afe7a35..49ed17fdf055 100644
--- a/include/linux/i2c-pnx.h
+++ b/include/linux/i2c-pnx.h
@@ -22,6 +22,7 @@ struct i2c_pnx_mif {
         struct timer_list       timer;          /* Timeout */
         u8 *                    buf;            /* Data buffer */
         int                     len;            /* Length of data buffer */
+        int                     order;          /* RX Bytes to order via TX */
 };
 
 struct i2c_pnx_algo_data {
diff --git a/include/linux/input.h b/include/linux/input.h
index 725dcd0f63a4..ba4874302939 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -1169,6 +1169,18 @@ struct ff_effect {
 #include <linux/mod_devicetable.h>
 
 /**
+ * struct input_value - input value representation
+ * @type: type of value (EV_KEY, EV_ABS, etc)
+ * @code: the value code
+ * @value: the value
+ */
+struct input_value {
+        __u16 type;
+        __u16 code;
+        __s32 value;
+};
+
+/**
  * struct input_dev - represents an input device
  * @name: name of the device
  * @phys: physical path to the device in the system hierarchy
@@ -1203,11 +1215,7 @@ struct ff_effect {
  *      software autorepeat
  * @timer: timer for software autorepeat
  * @rep: current values for autorepeat parameters (delay, rate)
- * @mt: pointer to array of struct input_mt_slot holding current values
- *      of tracked contacts
- * @mtsize: number of MT slots the device uses
- * @slot: MT slot currently being transmitted
- * @trkid: stores MT tracking ID for the current contact
+ * @mt: pointer to multitouch state
  * @absinfo: array of &struct input_absinfo elements holding information
  *      about absolute axes (current value, min, max, flat, fuzz,
  *      resolution)
@@ -1244,7 +1252,6 @@ struct ff_effect {
  *      last user closes the device
  * @going_away: marks devices that are in a middle of unregistering and
  *      causes input_open_device*() fail with -ENODEV.
- * @sync: set to %true when there were no new events since last EV_SYN
  * @dev: driver model's view of this device
  * @h_list: list of input handles associated with the device. When
  *      accessing the list dev->mutex must be held
@@ -1287,10 +1294,7 @@ struct input_dev {
 
         int rep[REP_CNT];
 
-        struct input_mt_slot *mt;
-        int mtsize;
-        int slot;
-        int trkid;
+        struct input_mt *mt;
 
         struct input_absinfo *absinfo;
 
@@ -1312,12 +1316,14 @@ struct input_dev {
         unsigned int users;
         bool going_away;
 
-        bool sync;
-
         struct device dev;
 
         struct list_head        h_list;
         struct list_head        node;
+
+        unsigned int num_vals;
+        unsigned int max_vals;
+        struct input_value *vals;
 };
 #define to_input_dev(d) container_of(d, struct input_dev, dev)
 
@@ -1378,6 +1384,9 @@ struct input_handle;
  * @event: event handler. This method is being called by input core with
  *      interrupts disabled and dev->event_lock spinlock held and so
  *      it may not sleep
+ * @events: event sequence handler. This method is being called by
+ *      input core with interrupts disabled and dev->event_lock
+ *      spinlock held and so it may not sleep
  * @filter: similar to @event; separates normal event handlers from
  *      "filters".
  * @match: called after comparing device's id with handler's id_table
@@ -1414,6 +1423,8 @@ struct input_handler {
         void *private;
 
         void (*event)(struct input_handle *handle, unsigned int type, unsigned int code, int value);
+        void (*events)(struct input_handle *handle,
+                       const struct input_value *vals, unsigned int count);
         bool (*filter)(struct input_handle *handle, unsigned int type, unsigned int code, int value);
         bool (*match)(struct input_handler *handler, struct input_dev *dev);
         int (*connect)(struct input_handler *handler, struct input_dev *dev, const struct input_device_id *id);
diff --git a/include/linux/input/mt.h b/include/linux/input/mt.h
index f86737586e19..cc5cca774bab 100644
--- a/include/linux/input/mt.h
+++ b/include/linux/input/mt.h
@@ -15,12 +15,41 @@
 
 #define TRKID_MAX       0xffff
 
+#define INPUT_MT_POINTER        0x0001  /* pointer device, e.g. trackpad */
+#define INPUT_MT_DIRECT         0x0002  /* direct device, e.g. touchscreen */
+#define INPUT_MT_DROP_UNUSED    0x0004  /* drop contacts not seen in frame */
+#define INPUT_MT_TRACK          0x0008  /* use in-kernel tracking */
+
 /**
  * struct input_mt_slot - represents the state of an input MT slot
  * @abs: holds current values of ABS_MT axes for this slot
+ * @frame: last frame at which input_mt_report_slot_state() was called
+ * @key: optional driver designation of this slot
  */
 struct input_mt_slot {
         int abs[ABS_MT_LAST - ABS_MT_FIRST + 1];
+        unsigned int frame;
+        unsigned int key;
+};
+
+/**
+ * struct input_mt - state of tracked contacts
+ * @trkid: stores MT tracking ID for the next contact
+ * @num_slots: number of MT slots the device uses
+ * @slot: MT slot currently being transmitted
+ * @flags: input_mt operation flags
+ * @frame: increases every time input_mt_sync_frame() is called
+ * @red: reduced cost matrix for in-kernel tracking
+ * @slots: array of slots holding current values of tracked contacts
+ */
+struct input_mt {
+        int trkid;
+        int num_slots;
+        int slot;
+        unsigned int flags;
+        unsigned int frame;
+        int *red;
+        struct input_mt_slot slots[];
 };
 
 static inline void input_mt_set_value(struct input_mt_slot *slot,
@@ -35,12 +64,18 @@ static inline int input_mt_get_value(const struct input_mt_slot *slot,
         return slot->abs[code - ABS_MT_FIRST];
 }
 
-int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots);
+static inline bool input_mt_is_active(const struct input_mt_slot *slot)
+{
+        return input_mt_get_value(slot, ABS_MT_TRACKING_ID) >= 0;
+}
+
+int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots,
+                        unsigned int flags);
 void input_mt_destroy_slots(struct input_dev *dev);
 
-static inline int input_mt_new_trkid(struct input_dev *dev)
+static inline int input_mt_new_trkid(struct input_mt *mt)
 {
-        return dev->trkid++ & TRKID_MAX;
+        return mt->trkid++ & TRKID_MAX;
 }
 
 static inline void input_mt_slot(struct input_dev *dev, int slot)
@@ -64,4 +99,20 @@ void input_mt_report_slot_state(struct input_dev *dev,
 void input_mt_report_finger_count(struct input_dev *dev, int count);
 void input_mt_report_pointer_emulation(struct input_dev *dev, bool use_count);
 
+void input_mt_sync_frame(struct input_dev *dev);
+
+/**
+ * struct input_mt_pos - contact position
+ * @x: horizontal coordinate
+ * @y: vertical coordinate
+ */
+struct input_mt_pos {
+        s16 x, y;
+};
+
+int input_mt_assign_slots(struct input_dev *dev, int *slots,
+                          const struct input_mt_pos *pos, int num_pos);
+
+int input_mt_get_slot_by_key(struct input_dev *dev, int key);
+
 #endif
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index c5f856a040b9..5e4e6170f43a 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -430,6 +430,8 @@ enum
         NR_SOFTIRQS
 };
 
+#define SOFTIRQ_STOP_IDLE_MASK (~(1 << RCU_SOFTIRQ))
+
 /* map softirq index to softirq name. update 'softirq_to_name' in
  * kernel/softirq.c when adding a new softirq.
  */
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 7e83370e6fd2..f3b99e1c1042 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -256,72 +256,78 @@ static inline void iommu_set_fault_handler(struct iommu_domain *domain,
 {
 }
 
-int iommu_attach_group(struct iommu_domain *domain, struct iommu_group *group)
+static inline int iommu_attach_group(struct iommu_domain *domain,
+                                     struct iommu_group *group)
 {
         return -ENODEV;
 }
 
-void iommu_detach_group(struct iommu_domain *domain, struct iommu_group *group)
+static inline void iommu_detach_group(struct iommu_domain *domain,
+                                      struct iommu_group *group)
 {
 }
 
-struct iommu_group *iommu_group_alloc(void)
+static inline struct iommu_group *iommu_group_alloc(void)
 {
         return ERR_PTR(-ENODEV);
 }
 
-void *iommu_group_get_iommudata(struct iommu_group *group)
+static inline void *iommu_group_get_iommudata(struct iommu_group *group)
 {
         return NULL;
 }
 
-void iommu_group_set_iommudata(struct iommu_group *group, void *iommu_data,
-                               void (*release)(void *iommu_data))
+static inline void iommu_group_set_iommudata(struct iommu_group *group,
+                                             void *iommu_data,
+                                             void (*release)(void *iommu_data))
 {
 }
 
-int iommu_group_set_name(struct iommu_group *group, const char *name)
+static inline int iommu_group_set_name(struct iommu_group *group,
+                                       const char *name)
 {
         return -ENODEV;
 }
 
-int iommu_group_add_device(struct iommu_group *group, struct device *dev)
+static inline int iommu_group_add_device(struct iommu_group *group,
+                                         struct device *dev)
 {
         return -ENODEV;
 }
 
-void iommu_group_remove_device(struct device *dev)
+static inline void iommu_group_remove_device(struct device *dev)
 {
 }
 
-int iommu_group_for_each_dev(struct iommu_group *group, void *data,
-                             int (*fn)(struct device *, void *))
+static inline int iommu_group_for_each_dev(struct iommu_group *group,
+                                           void *data,
+                                           int (*fn)(struct device *, void *))
 {
         return -ENODEV;
 }
 
-struct iommu_group *iommu_group_get(struct device *dev)
+static inline struct iommu_group *iommu_group_get(struct device *dev)
 {
         return NULL;
 }
 
-void iommu_group_put(struct iommu_group *group)
+static inline void iommu_group_put(struct iommu_group *group)
 {
 }
 
-int iommu_group_register_notifier(struct iommu_group *group,
-                                  struct notifier_block *nb)
+static inline int iommu_group_register_notifier(struct iommu_group *group,
+                                                struct notifier_block *nb)
 {
         return -ENODEV;
 }
 
-int iommu_group_unregister_notifier(struct iommu_group *group,
-                                    struct notifier_block *nb)
+static inline int iommu_group_unregister_notifier(struct iommu_group *group,
+                                                  struct notifier_block *nb)
 {
         return 0;
 }
 
-int iommu_group_id(struct iommu_group *group)
+static inline int iommu_group_id(struct iommu_group *group)
 {
         return -ENODEV;
 }
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 9a323d12de1c..0ba014c55056 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -10,12 +10,10 @@
 
 struct irq_affinity_notify;
 struct proc_dir_entry;
-struct timer_rand_state;
 struct module;
 /**
  * struct irq_desc - interrupt descriptor
  * @irq_data:           per irq and chip data passed down to chip functions
- * @timer_rand_state:   pointer to timer rand state struct
  * @kstat_irqs:         irq stats per cpu
  * @handle_irq:         highlevel irq-events handler
  * @preflow_handler:    handler called before the flow handler (currently used by sparc)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 594b419b7d20..2451f1f7a1d9 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -91,7 +91,7 @@
 {                                                       \
         typeof(x) __x = x;                              \
         typeof(divisor) __d = divisor;                  \
-        (((typeof(x))-1) >= 0 || (__x) >= 0) ?          \
+        (((typeof(x))-1) > 0 || (__x) > 0) ?            \
                 (((__x) + ((__d) / 2)) / (__d)) :       \
                 (((__x) - ((__d) / 2)) / (__d));        \
 }                                                       \
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index fc615a97e2d3..1e57449395b1 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -224,7 +224,7 @@ static inline int kobject_uevent_env(struct kobject *kobj,
 
 static inline __printf(2, 3)
 int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...)
-{ return 0; }
+{ return -ENOMEM; }
 
 static inline int kobject_action_type(const char *buf, size_t count,
                                       enum kobject_action *type)
diff --git a/include/linux/kthread.h b/include/linux/kthread.h
index 22ccf9dee177..8d816646f766 100644
--- a/include/linux/kthread.h
+++ b/include/linux/kthread.h
@@ -14,6 +14,11 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
         kthread_create_on_node(threadfn, data, -1, namefmt, ##arg)
 
 
+struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
+                                          void *data,
+                                          unsigned int cpu,
+                                          const char *namefmt);
+
 /**
  * kthread_run - create and wake a thread.
  * @threadfn: the function to run until signal_pending(current).
@@ -34,9 +39,13 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
 
 void kthread_bind(struct task_struct *k, unsigned int cpu);
 int kthread_stop(struct task_struct *k);
-int kthread_should_stop(void);
+bool kthread_should_stop(void);
+bool kthread_should_park(void);
 bool kthread_freezable_should_stop(bool *was_frozen);
 void *kthread_data(struct task_struct *k);
+int kthread_park(struct task_struct *k);
+void kthread_unpark(struct task_struct *k);
+void kthread_parkme(void);
 
 int kthreadd(void *unused);
 extern struct task_struct *kthreadd_task;
diff --git a/include/linux/mISDNhw.h b/include/linux/mISDNhw.h
index d0752eca9b44..9d96d5d4dfed 100644
--- a/include/linux/mISDNhw.h
+++ b/include/linux/mISDNhw.h
@@ -183,7 +183,7 @@ extern int	mISDN_initbchannel(struct bchannel *, unsigned short,
                                    unsigned short);
 extern int      mISDN_freedchannel(struct dchannel *);
 extern void     mISDN_clear_bchannel(struct bchannel *);
-extern int      mISDN_freebchannel(struct bchannel *);
+extern void     mISDN_freebchannel(struct bchannel *);
 extern int      mISDN_ctrl_bchannel(struct bchannel *, struct mISDN_ctrl_req *);
 extern void     queue_ch_frame(struct mISDNchannel *, u_int,
                         int, struct sk_buff *);
diff --git a/include/linux/memory.h b/include/linux/memory.h
index 1ac7f6e405f9..ff9a9f8e0ed9 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -19,7 +19,7 @@
 #include <linux/compiler.h>
 #include <linux/mutex.h>
 
-#define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)
+#define MIN_MEMORY_BLOCK_SIZE     (1UL << SECTION_SIZE_BITS)
 
 struct memory_block {
         unsigned long start_section_nr;
diff --git a/include/linux/mfd/core.h b/include/linux/mfd/core.h
index 3a8435a8058f..cebe97ee98b8 100644
--- a/include/linux/mfd/core.h
+++ b/include/linux/mfd/core.h
@@ -16,6 +16,8 @@
 
 #include <linux/platform_device.h>
 
+struct irq_domain;
+
 /*
  * This struct describes the MFD part ("cell").
  * After registration the copy of this structure will become the platform data
@@ -98,7 +100,7 @@ static inline const struct mfd_cell *mfd_get_cell(struct platform_device *pdev)
 extern int mfd_add_devices(struct device *parent, int id,
                            struct mfd_cell *cells, int n_devs,
                            struct resource *mem_base,
-                           int irq_base);
+                           int irq_base, struct irq_domain *irq_domain);
 
 extern void mfd_remove_devices(struct device *parent);
 
diff --git a/include/linux/mfd/max77686.h b/include/linux/mfd/max77686.h
index 3d7ae4d7fd36..46c0f320ed76 100644
--- a/include/linux/mfd/max77686.h
+++ b/include/linux/mfd/max77686.h
@@ -74,6 +74,7 @@ enum max77686_regulators {
 struct max77686_regulator_data {
         int id;
         struct regulator_init_data *initdata;
+        struct device_node *of_node;
 };
 
 enum max77686_opmode {
diff --git a/include/linux/mfd/max8998.h b/include/linux/mfd/max8998.h
index f4f0dfa4698a..6823548d0c0a 100644
--- a/include/linux/mfd/max8998.h
+++ b/include/linux/mfd/max8998.h
@@ -67,7 +67,7 @@ struct max8998_regulator_data {
 /**
  * struct max8998_board - packages regulator init data
  * @regulators: array of defined regulators
- * @num_regulators: number of regultors used
+ * @num_regulators: number of regulators used
  * @irq_base: base IRQ number for max8998, required for IRQs
  * @ono: power onoff IRQ number for max8998
  * @buck_voltage_lock: Do NOT change the values of the following six
diff --git a/include/linux/mfd/tps65217.h b/include/linux/mfd/tps65217.h
index 12c06870829a..7cd83d826ed8 100644
--- a/include/linux/mfd/tps65217.h
+++ b/include/linux/mfd/tps65217.h
@@ -22,6 +22,9 @@
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
 
+/* TPS chip id list */
+#define TPS65217                        0xF0
+
 /* I2C ID for TPS65217 part */
 #define TPS65217_I2C_ID                 0x24
 
@@ -248,13 +251,11 @@ struct tps_info {
 struct tps65217 {
         struct device *dev;
         struct tps65217_board *pdata;
+        unsigned int id;
         struct regulator_desc desc[TPS65217_NUM_REGULATOR];
         struct regulator_dev *rdev[TPS65217_NUM_REGULATOR];
         struct tps_info *info[TPS65217_NUM_REGULATOR];
         struct regmap *regmap;
-
-        /* Client devices */
-        struct platform_device *regulator_pdev[TPS65217_NUM_REGULATOR];
 };
 
 static inline struct tps65217 *dev_to_tps65217(struct device *dev)
@@ -262,6 +263,11 @@ static inline struct tps65217 *dev_to_tps65217(struct device *dev)
         return dev_get_drvdata(dev);
 }
 
+static inline int tps65217_chip_id(struct tps65217 *tps65217)
+{
+        return tps65217->id;
+}
+
 int tps65217_reg_read(struct tps65217 *tps, unsigned int reg,
                                         unsigned int *val);
 int tps65217_reg_write(struct tps65217 *tps, unsigned int reg,
diff --git a/include/linux/mfd/tps6586x.h b/include/linux/mfd/tps6586x.h
index f350fd0ba1df..94514710a03f 100644
--- a/include/linux/mfd/tps6586x.h
+++ b/include/linux/mfd/tps6586x.h
@@ -14,6 +14,7 @@
 #define TPS6586X_SLEW_RATE_MASK         0x07
 
 enum {
+        TPS6586X_ID_SYS,
         TPS6586X_ID_SM_0,
         TPS6586X_ID_SM_1,
         TPS6586X_ID_SM_2,
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index 61f0905bdc48..de201203bc7c 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -1,3 +1,15 @@
+/*
+ * include/linux/micrel_phy.h
+ *
+ * Micrel PHY IDs
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+
 #ifndef _MICREL_PHY_H
 #define _MICREL_PHY_H
 
@@ -5,10 +17,11 @@
 
 #define PHY_ID_KSZ9021          0x00221610
 #define PHY_ID_KS8737           0x00221720
-#define PHY_ID_KS8041           0x00221510
-#define PHY_ID_KS8051           0x00221550
+#define PHY_ID_KSZ8021          0x00221555
+#define PHY_ID_KSZ8041          0x00221510
+#define PHY_ID_KSZ8051          0x00221550
 /* both for ks8001 Rev. A/B, and for ks8721 Rev 3. */
-#define PHY_ID_KS8001           0x0022161A
+#define PHY_ID_KSZ8001          0x0022161A
 
 /* struct phy_device dev_flags definitions */
 #define MICREL_PHY_50MHZ_CLK    0x00000001
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index bd6c9fcdf2dd..6e1b0f973a03 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -796,6 +796,19 @@ enum mlx4_net_trans_rule_id {
         MLX4_NET_TRANS_RULE_NUM, /* should be last */
 };
 
+extern const u16 __sw_id_hw[];
+
+static inline int map_hw_to_sw_id(u16 header_id)
+{
+
+        int i;
+        for (i = 0; i < MLX4_NET_TRANS_RULE_NUM; i++) {
+                if (header_id == __sw_id_hw[i])
+                        return i;
+        }
+        return -EINVAL;
+}
+
 enum mlx4_net_trans_promisc_mode {
         MLX4_FS_PROMISC_NONE = 0,
         MLX4_FS_PROMISC_UPLINK,
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 1f8fc7f9bcd8..4b03f56e280e 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -265,11 +265,6 @@ static inline const struct nfs_rpc_ops *NFS_PROTO(const struct inode *inode)
         return NFS_SERVER(inode)->nfs_client->rpc_ops;
 }
 
-static inline __be32 *NFS_COOKIEVERF(const struct inode *inode)
-{
-        return NFS_I(inode)->cookieverf;
-}
-
 static inline unsigned NFS_MINATTRTIMEO(const struct inode *inode)
 {
         struct nfs_server *nfss = NFS_SERVER(inode);
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index ac7c8ae254f2..be9cf3c7e79e 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -652,7 +652,7 @@ struct nfs_getaclargs {
 };
 
 /* getxattr ACL interface flags */
-#define NFS4_ACL_LEN_REQUEST    0x0001  /* zero length getxattr buffer */
+#define NFS4_ACL_TRUNC          0x0001  /* ACL was truncated */
 struct nfs_getaclres {
         size_t                          acl_len;
         size_t                          acl_data_offset;
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index 9490a00529f4..c25cccaa555a 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -35,8 +35,10 @@ struct nvme_bar {
         __u64                   acq;    /* Admin CQ Base Address */
 };
 
+#define NVME_CAP_MQES(cap)      ((cap) & 0xffff)
 #define NVME_CAP_TIMEOUT(cap)   (((cap) >> 24) & 0xff)
 #define NVME_CAP_STRIDE(cap)    (((cap) >> 32) & 0xf)
+#define NVME_CAP_MPSMIN(cap)    (((cap) >> 48) & 0xf)
 
 enum {
         NVME_CC_ENABLE          = 1 << 0,
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 28f9cee3fbc3..599afc4bb67e 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -304,6 +304,8 @@ struct perf_event_attr {
         __u32   __reserved_2;
 };
 
+#define perf_flags(attr)        (*(&(attr)->read_format + 1))
+
 /*
  * Ioctls that can be done on a perf event fd:
  */
@@ -969,7 +971,7 @@ struct perf_event {
         struct hw_perf_event            hw;
 
         struct perf_event_context       *ctx;
-        struct file                     *filp;
+        atomic_long_t                   refcount;
 
         /*
          * These accumulate total time (in nanoseconds) that children
@@ -1346,6 +1348,7 @@ extern int perf_swevent_get_recursion_context(void);
 extern void perf_swevent_put_recursion_context(int rctx);
 extern void perf_event_enable(struct perf_event *event);
 extern void perf_event_disable(struct perf_event *event);
+extern int __perf_event_disable(void *info);
 extern void perf_event_task_tick(void);
 #else
 static inline void
@@ -1384,6 +1387,7 @@ static inline int  perf_swevent_get_recursion_context(void)		{ return -1; }
 static inline void perf_swevent_put_recursion_context(int rctx)         { }
 static inline void perf_event_enable(struct perf_event *event)          { }
 static inline void perf_event_disable(struct perf_event *event)         { }
+static inline int __perf_event_disable(void *info)                      { return -1; }
 static inline void perf_event_task_tick(void)                           { }
 #endif
 
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 115ead2b5155..7c968e4f929e 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -191,6 +191,21 @@ extern void rcu_idle_enter(void);
 extern void rcu_idle_exit(void);
 extern void rcu_irq_enter(void);
 extern void rcu_irq_exit(void);
+
+#ifdef CONFIG_RCU_USER_QS
+extern void rcu_user_enter(void);
+extern void rcu_user_exit(void);
+extern void rcu_user_enter_after_irq(void);
+extern void rcu_user_exit_after_irq(void);
+extern void rcu_user_hooks_switch(struct task_struct *prev,
+                                  struct task_struct *next);
+#else
+static inline void rcu_user_enter(void) { }
+static inline void rcu_user_exit(void) { }
+static inline void rcu_user_enter_after_irq(void) { }
+static inline void rcu_user_exit_after_irq(void) { }
+#endif /* CONFIG_RCU_USER_QS */
+
 extern void exit_rcu(void);
 
 /**
@@ -210,14 +225,12 @@ extern void exit_rcu(void);
  * to nest RCU_NONIDLE() wrappers, but the nesting level is currently
  * quite limited.  If deeper nesting is required, it will be necessary
  * to adjust DYNTICK_TASK_NESTING_VALUE accordingly.
- *
- * This macro may be used from process-level code only.
  */
 #define RCU_NONIDLE(a) \
         do { \
-                rcu_idle_exit(); \
+                rcu_irq_enter(); \
                 do { a; } while (0); \
-                rcu_idle_enter(); \
+                rcu_irq_exit(); \
         } while (0)
 
 /*
diff --git a/include/linux/regmap.h b/include/linux/regmap.h
index 7f7e00df3adf..e3bcc3f4dcb8 100644
--- a/include/linux/regmap.h
+++ b/include/linux/regmap.h
@@ -285,6 +285,7 @@ struct regmap_irq {
  * @ack_base:    Base ack address.  If zero then the chip is clear on read.
  * @wake_base:   Base address for wake enables.  If zero unsupported.
  * @irq_reg_stride:  Stride to use for chips where registers are not contiguous.
+ * @runtime_pm:  Hold a runtime PM lock on the device when accessing it.
  *
  * @num_regs:    Number of registers in each control bank.
  * @irqs:        Descriptors for individual IRQs.  Interrupt numbers are
@@ -299,6 +300,8 @@ struct regmap_irq_chip {
         unsigned int ack_base;
         unsigned int wake_base;
         unsigned int irq_reg_stride;
+        unsigned int mask_invert;
+        bool runtime_pm;
 
         int num_regs;
 
diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
index da339fd8c755..c43cd3556b1f 100644
--- a/include/linux/regulator/consumer.h
+++ b/include/linux/regulator/consumer.h
@@ -177,6 +177,8 @@ int regulator_set_mode(struct regulator *regulator, unsigned int mode);
 unsigned int regulator_get_mode(struct regulator *regulator);
 int regulator_set_optimum_mode(struct regulator *regulator, int load_uA);
 
+int regulator_allow_bypass(struct regulator *regulator, bool allow);
+
 /* regulator notifier block */
 int regulator_register_notifier(struct regulator *regulator,
                               struct notifier_block *nb);
@@ -328,6 +330,12 @@ static inline int regulator_set_optimum_mode(struct regulator *regulator,
         return REGULATOR_MODE_NORMAL;
 }
 
+static inline int regulator_allow_bypass(struct regulator *regulator,
+                                         bool allow)
+{
+        return 0;
+}
+
 static inline int regulator_register_notifier(struct regulator *regulator,
                               struct notifier_block *nb)
 {
@@ -352,4 +360,11 @@ static inline void regulator_set_drvdata(struct regulator *regulator,
 
 #endif
 
+static inline int regulator_set_voltage_tol(struct regulator *regulator,
+                                            int new_uV, int tol_uV)
+{
+        return regulator_set_voltage(regulator,
+                                     new_uV - tol_uV, new_uV + tol_uV);
+}
+
 #endif
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index bac4c871f3bd..7932a3bf21bd 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -32,6 +32,8 @@ enum regulator_status {
         REGULATOR_STATUS_NORMAL,
         REGULATOR_STATUS_IDLE,
         REGULATOR_STATUS_STANDBY,
+        /* The regulator is enabled but not regulating */
+        REGULATOR_STATUS_BYPASS,
         /* in case that any other status doesn't apply */
         REGULATOR_STATUS_UNDEFINED,
 };
@@ -58,6 +60,7 @@ enum regulator_status {
  *      regulator_desc.n_voltages.  Voltages may be reported in any order.
  *
  * @set_current_limit: Configure a limit for a current-limited regulator.
+ *                     The driver should select the current closest to max_uA.
  * @get_current_limit: Get the configured limit for a current-limited regulator.
  *
  * @set_mode: Set the configured operating mode for the regulator.
@@ -67,6 +70,9 @@ enum regulator_status {
  * @get_optimum_mode: Get the most efficient operating mode for the regulator
  *                    when running with the specified parameters.
  *
+ * @set_bypass: Set the regulator in bypass mode.
+ * @get_bypass: Get the regulator bypass mode state.
+ *
  * @enable_time: Time taken for the regulator voltage output voltage to
  *               stabilise after being enabled, in microseconds.
  * @set_ramp_delay: Set the ramp delay for the regulator. The driver should
@@ -133,6 +139,10 @@ struct regulator_ops {
         unsigned int (*get_optimum_mode) (struct regulator_dev *, int input_uV,
                                           int output_uV, int load_uA);
 
+        /* control and report on bypass mode */
+        int (*set_bypass)(struct regulator_dev *dev, bool enable);
+        int (*get_bypass)(struct regulator_dev *dev, bool *enable);
+
         /* the operations below are for configuration of regulator state when
          * its parent PMIC enters a global STANDBY/HIBERNATE state */
 
@@ -205,6 +215,8 @@ struct regulator_desc {
         unsigned int vsel_mask;
         unsigned int enable_reg;
         unsigned int enable_mask;
+        unsigned int bypass_reg;
+        unsigned int bypass_mask;
 
         unsigned int enable_time;
 };
@@ -221,7 +233,8 @@ struct regulator_desc {
  * @driver_data: private regulator data
  * @of_node: OpenFirmware node to parse for device tree bindings (may be
  *           NULL).
- * @regmap: regmap to use for core regmap helpers
+ * @regmap: regmap to use for core regmap helpers if dev_get_regulator() is
+ *          insufficient.
  * @ena_gpio: GPIO controlling regulator enable.
  * @ena_gpio_invert: Sense for GPIO enable control.
  * @ena_gpio_flags: Flags to use when calling gpio_request_one()
@@ -253,6 +266,7 @@ struct regulator_dev {
         int exclusive;
         u32 use_count;
         u32 open_count;
+        u32 bypass_count;
 
         /* lists we belong to */
         struct list_head list; /* list of all regulators */
@@ -310,6 +324,8 @@ int regulator_disable_regmap(struct regulator_dev *rdev);
 int regulator_set_voltage_time_sel(struct regulator_dev *rdev,
                                    unsigned int old_selector,
                                    unsigned int new_selector);
+int regulator_set_bypass_regmap(struct regulator_dev *rdev, bool enable);
+int regulator_get_bypass_regmap(struct regulator_dev *rdev, bool *enable);
 
 void *regulator_get_init_drvdata(struct regulator_init_data *reg_init_data);
 
diff --git a/include/linux/regulator/fan53555.h b/include/linux/regulator/fan53555.h
new file mode 100644
index 000000000000..5c45c85d52ca
--- /dev/null
+++ b/include/linux/regulator/fan53555.h
@@ -0,0 +1,60 @@
+/*
+ * fan53555.h - Fairchild Regulator FAN53555 Driver
+ *
+ * Copyright (C) 2012 Marvell Technology Ltd.
+ * Yunfan Zhang <yfzhang@marvell.com>
+ *
+ * This package is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#ifndef __FAN53555_H__
+
+/* VSEL ID */
+enum {
+        FAN53555_VSEL_ID_0 = 0,
+        FAN53555_VSEL_ID_1,
+};
+
+/* Transition slew rate limiting from a low to high voltage.
+ * -----------------------
+ *   Bin |Slew Rate(mV/uS)
+ * ------|----------------
+ *   000 |    64.00
+ * ------|----------------
+ *   001 |    32.00
+ * ------|----------------
+ *   010 |    16.00
+ * ------|----------------
+ *   011 |     8.00
+ * ------|----------------
+ *   100 |     4.00
+ * ------|----------------
+ *   101 |     2.00
+ * ------|----------------
+ *   110 |     1.00
+ * ------|----------------
+ *   111 |     0.50
+ * -----------------------
+ */
+enum {
+        FAN53555_SLEW_RATE_64MV = 0,
+        FAN53555_SLEW_RATE_32MV,
+        FAN53555_SLEW_RATE_16MV,
+        FAN53555_SLEW_RATE_8MV,
+        FAN53555_SLEW_RATE_4MV,
+        FAN53555_SLEW_RATE_2MV,
+        FAN53555_SLEW_RATE_1MV,
+        FAN53555_SLEW_RATE_0_5MV,
+};
+
+struct fan53555_platform_data {
+        struct regulator_init_data *regulator;
+        unsigned int slew_rate;
+        /* Sleep VSEL ID */
+        unsigned int sleep_vsel_id;
+};
+
+#endif /* __FAN53555_H__ */
diff --git a/include/linux/regulator/machine.h b/include/linux/regulator/machine.h
index 40dd0a394cfa..36adbc82de6a 100644
--- a/include/linux/regulator/machine.h
+++ b/include/linux/regulator/machine.h
@@ -32,6 +32,7 @@ struct regulator;
  *           board/machine.
  * STATUS:   Regulator can be enabled and disabled.
  * DRMS:     Dynamic Regulator Mode Switching is enabled for this regulator.
+ * BYPASS:   Regulator can be put into bypass mode
  */
 
 #define REGULATOR_CHANGE_VOLTAGE        0x1
@@ -39,6 +40,7 @@ struct regulator;
 #define REGULATOR_CHANGE_MODE           0x4
 #define REGULATOR_CHANGE_STATUS         0x8
 #define REGULATOR_CHANGE_DRMS           0x10
+#define REGULATOR_CHANGE_BYPASS         0x20
 
 /**
  * struct regulator_state - regulator state during low power system states
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 255661d48834..83035269e597 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -957,7 +957,6 @@ struct sched_domain {
         unsigned int smt_gain;
         int flags;                      /* See SD_* */
         int level;
-        int idle_buddy;                 /* cpu assigned to select_idle_sibling() */
 
         /* Runtime fields. */
         unsigned long last_balance;     /* init to jiffies. units in jiffies */
@@ -1889,6 +1888,14 @@ static inline void rcu_copy_process(struct task_struct *p)
 
 #endif
 
+static inline void rcu_switch(struct task_struct *prev,
+                              struct task_struct *next)
+{
+#ifdef CONFIG_RCU_USER_QS
+        rcu_user_hooks_switch(prev, next);
+#endif
+}
+
 static inline void tsk_restore_flags(struct task_struct *task,
                                 unsigned long orig_flags, unsigned long flags)
 {
diff --git a/include/linux/security.h b/include/linux/security.h
index 3dea6a9d568f..d143b8e01954 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -118,6 +118,7 @@ void reset_security_ops(void);
 extern unsigned long mmap_min_addr;
 extern unsigned long dac_mmap_min_addr;
 #else
+#define mmap_min_addr           0UL
 #define dac_mmap_min_addr       0UL
 #endif
 
diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
new file mode 100644
index 000000000000..e0106d8581d3
--- /dev/null
+++ b/include/linux/smpboot.h
@@ -0,0 +1,43 @@
+#ifndef _LINUX_SMPBOOT_H
+#define _LINUX_SMPBOOT_H
+
+#include <linux/types.h>
+
+struct task_struct;
+/* Cookie handed to the thread_fn*/
+struct smpboot_thread_data;
+
+/**
+ * struct smp_hotplug_thread - CPU hotplug related thread descriptor
+ * @store:              Pointer to per cpu storage for the task pointers
+ * @list:               List head for core management
+ * @thread_should_run:  Check whether the thread should run or not. Called with
+ *                      preemption disabled.
+ * @thread_fn:          The associated thread function
+ * @setup:              Optional setup function, called when the thread gets
+ *                      operational the first time
+ * @cleanup:            Optional cleanup function, called when the thread
+ *                      should stop (module exit)
+ * @park:               Optional park function, called when the thread is
+ *                      parked (cpu offline)
+ * @unpark:             Optional unpark function, called when the thread is
+ *                      unparked (cpu online)
+ * @thread_comm:        The base name of the thread
+ */
+struct smp_hotplug_thread {
+        struct task_struct __percpu     **store;
+        struct list_head                list;
+        int                             (*thread_should_run)(unsigned int cpu);
+        void                            (*thread_fn)(unsigned int cpu);
+        void                            (*setup)(unsigned int cpu);
+        void                            (*cleanup)(unsigned int cpu, bool online);
+        void                            (*park)(unsigned int cpu);
+        void                            (*unpark)(unsigned int cpu);
+        const char                      *thread_comm;
+};
+
+int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread);
+void smpboot_unregister_percpu_thread(struct smp_hotplug_thread *plug_thread);
+int smpboot_thread_schedule(void);
+
+#endif
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index cff40aa7db62..bf8c49ff7530 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -114,6 +114,7 @@ struct rpc_xprt_ops {
         void            (*set_buffer_size)(struct rpc_xprt *xprt, size_t sndsize, size_t rcvsize);
         int             (*reserve_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
         void            (*release_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
+        void            (*alloc_slot)(struct rpc_xprt *xprt, struct rpc_task *task);
         void            (*rpcbind)(struct rpc_task *task);
         void            (*set_port)(struct rpc_xprt *xprt, unsigned short port);
         void            (*connect)(struct rpc_task *task);
@@ -281,6 +282,8 @@ void			xprt_connect(struct rpc_task *task);
 void                    xprt_reserve(struct rpc_task *task);
 int                     xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
 int                     xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
+void                    xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
+void                    xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
 int                     xprt_prepare_transmit(struct rpc_task *task);
 void                    xprt_transmit(struct rpc_task *task);
 void                    xprt_end_transmit(struct rpc_task *task);
diff --git a/include/linux/task_work.h b/include/linux/task_work.h
index fb46b03b1852..ca5a1cf27dae 100644
--- a/include/linux/task_work.h
+++ b/include/linux/task_work.h
@@ -18,8 +18,7 @@ void task_work_run(void);
 
 static inline void exit_task_work(struct task_struct *task)
 {
-        if (unlikely(task->task_works))
-                task_work_run();
+        task_work_run();
 }
 
 #endif  /* _LINUX_TASK_WORK_H */
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 22e61fdf75a2..28e493b5b94c 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -84,6 +84,8 @@ struct xfrm_replay_state {
         __u32   bitmap;
 };
 
+#define XFRMA_REPLAY_ESN_MAX    4096
+
 struct xfrm_replay_state_esn {
         unsigned int    bmp_len;
         __u32           oseq;
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index ca356a734920..8b27927b2a55 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -136,7 +136,7 @@ struct smp_chan {
 };
 
 /* SMP Commands */
-int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
 int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
 int smp_user_confirm_reply(struct hci_conn *conn, u16 mgmt_op, __le32 passkey);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 0fedbd8d747a..9fc7114159e8 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -111,9 +111,8 @@ struct rt6_info {
         struct inet6_dev                *rt6i_idev;
         unsigned long                   _rt6i_peer;
 
-#ifdef CONFIG_XFRM
-        u32                             rt6i_flow_cache_genid;
-#endif
+        u32                             rt6i_genid;
+
         /* more non-fragment space at head required */
         unsigned short                  rt6i_nfheader_len;
 
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index ae1cd6c9ba52..fd87963a0ea5 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -102,6 +102,7 @@ struct net {
 #endif
         struct netns_ipvs       *ipvs;
         struct sock             *diag_nlsk;
+        atomic_t                rt_genid;
 };
 
 
@@ -300,5 +301,14 @@ static inline void unregister_net_sysctl_table(struct ctl_table_header *header)
 }
 #endif
 
+static inline int rt_genid(struct net *net)
+{
+        return atomic_read(&net->rt_genid);
+}
+
+static inline void rt_genid_bump(struct net *net)
+{
+        atomic_inc(&net->rt_genid);
+}
 
 #endif /* __NET_NET_NAMESPACE_H */
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 1474dd65c66f..eb24dbccd81e 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -65,7 +65,6 @@ struct netns_ipv4 {
         unsigned int sysctl_ping_group_range[2];
         long sysctl_tcp_mem[3];
 
-        atomic_t rt_genid;
         atomic_t dev_addr_genid;
 
 #ifdef CONFIG_IP_MROUTE
diff --git a/include/net/route.h b/include/net/route.h
index 776a27f1ab78..da22243d2760 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -108,7 +108,7 @@ extern struct ip_rt_acct __percpu *ip_rt_acct;
 
 struct in_device;
 extern int              ip_rt_init(void);
-extern void             rt_cache_flush(struct net *net, int how);
+extern void             rt_cache_flush(struct net *net);
 extern void             rt_flush_dev(struct net_device *dev);
 extern struct rtable *__ip_route_output_key(struct net *, struct flowi4 *flp);
 extern struct rtable *ip_route_output_flow(struct net *, struct flowi4 *flp,
diff --git a/include/net/sock.h b/include/net/sock.h
index 72132aef53fc..adb7da20b5a1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1332,7 +1332,7 @@ static inline bool sk_wmem_schedule(struct sock *sk, int size)
 }
 
 static inline bool
-sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, unsigned int size)
+sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size)
 {
         if (!sk_has_account(sk))
                 return true;
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 976a81abe1a2..639dd1316d37 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -273,6 +273,9 @@ struct xfrm_replay {
         int     (*check)(struct xfrm_state *x,
                          struct sk_buff *skb,
                          __be32 net_seq);
+        int     (*recheck)(struct xfrm_state *x,
+                           struct sk_buff *skb,
+                           __be32 net_seq);
         void    (*notify)(struct xfrm_state *x, int event);
         int     (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
 };
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index f1405d335a96..941c84bf1065 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -23,7 +23,9 @@ struct se_subsystem_api {
         struct se_device *(*create_virtdevice)(struct se_hba *,
                                 struct se_subsystem_dev *, void *);
         void (*free_device)(void *);
-        int (*transport_complete)(struct se_cmd *cmd, struct scatterlist *);
+        void (*transport_complete)(struct se_cmd *cmd,
+                                   struct scatterlist *,
+                                   unsigned char *);
 
         int (*parse_cdb)(struct se_cmd *cmd);
         ssize_t (*check_configfs_dev_params)(struct se_hba *,
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 015cea01ae39..5be89373ceac 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -121,6 +121,7 @@
 
 #define SE_INQUIRY_BUF                          512
 #define SE_MODE_PAGE_BUF                        512
+#define SE_SENSE_BUF                            96
 
 /* struct se_hba->hba_flags */
 enum hba_flags_table {
diff --git a/include/trace/define_trace.h b/include/trace/define_trace.h
index b0b4eb24d592..1905ca8dd399 100644
--- a/include/trace/define_trace.h
+++ b/include/trace/define_trace.h
@@ -1,5 +1,5 @@
 /*
- * Trace files that want to automate creationg of all tracepoints defined
+ * Trace files that want to automate creation of all tracepoints defined
  * in their file should include this file. The following are macros that the
  * trace file may define:
  *
diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
index 5f889f16b0c8..08fa27244da7 100644
--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,
 
         TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
                 __entry->page,
-                page_to_pfn(__entry->page),
+                __entry->page ? page_to_pfn(__entry->page) : 0,
                 __entry->order,
                 __entry->migratetype,
                 show_gfp_flags(__entry->gfp_flags))
@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,
 
         TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
                 __entry->page,
-                page_to_pfn(__entry->page),
+                __entry->page ? page_to_pfn(__entry->page) : 0,
                 __entry->order,
                 __entry->migratetype,
                 __entry->order == 0)
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index 11e27c3af3cb..f19fff8650e9 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -187,6 +187,7 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                     struct gnttab_map_grant_ref *kmap_ops,
                     struct page **pages, unsigned int count);
 int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
-                      struct page **pages, unsigned int count, bool clear_pte);
+                      struct gnttab_map_grant_ref *kunmap_ops,
+                      struct page **pages, unsigned int count);
 
 #endif /* __ASM_GNTTAB_H__ */
diff --git a/init/Kconfig b/init/Kconfig
index af6c7f8ba019..c26b8a1d2b57 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -441,6 +441,24 @@ config PREEMPT_RCU
           This option enables preemptible-RCU code that is common between
           the TREE_PREEMPT_RCU and TINY_PREEMPT_RCU implementations.
 
+config RCU_USER_QS
+        bool "Consider userspace as in RCU extended quiescent state"
+        depends on HAVE_RCU_USER_QS && SMP
+        help
+          This option sets hooks on kernel / userspace boundaries and
+          puts RCU in extended quiescent state when the CPU runs in
+          userspace. It means that when a CPU runs in userspace, it is
+          excluded from the global RCU state machine and thus doesn't
+          to keep the timer tick on for RCU.
+
+config RCU_USER_QS_FORCE
+        bool "Force userspace extended QS by default"
+        depends on RCU_USER_QS
+        help
+          Set the hooks in user/kernel boundaries by default in order to
+          test this feature that treats userspace as an extended quiescent
+          state until we have a real user like a full adaptive nohz option.
+
 config RCU_FANOUT
         int "Tree-based hierarchical RCU fanout value"
         range 2 64 if 64BIT
diff --git a/kernel/Kconfig.locks b/kernel/Kconfig.locks
index 2251882daf53..44511d100eaa 100644
--- a/kernel/Kconfig.locks
+++ b/kernel/Kconfig.locks
@@ -87,6 +87,9 @@ config ARCH_INLINE_WRITE_UNLOCK_IRQ
 config ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
         bool
 
+config UNINLINE_SPIN_UNLOCK
+        bool
+
 #
 # lock_* functions are inlined when:
 #   - DEBUG_SPINLOCK=n and GENERIC_LOCKBREAK=n and ARCH_INLINE_*LOCK=y
@@ -103,100 +106,120 @@ config ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
 #   - DEBUG_SPINLOCK=n and ARCH_INLINE_*LOCK=y
 #
 
+if !DEBUG_SPINLOCK
+
 config INLINE_SPIN_TRYLOCK
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_SPIN_TRYLOCK
+        def_bool y
+        depends on ARCH_INLINE_SPIN_TRYLOCK
 
 config INLINE_SPIN_TRYLOCK_BH
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_SPIN_TRYLOCK_BH
+        def_bool y
+        depends on ARCH_INLINE_SPIN_TRYLOCK_BH
 
 config INLINE_SPIN_LOCK
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && ARCH_INLINE_SPIN_LOCK
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_SPIN_LOCK
 
 config INLINE_SPIN_LOCK_BH
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_SPIN_LOCK_BH
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_SPIN_LOCK_BH
 
 config INLINE_SPIN_LOCK_IRQ
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_SPIN_LOCK_IRQ
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_SPIN_LOCK_IRQ
 
 config INLINE_SPIN_LOCK_IRQSAVE
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_SPIN_LOCK_IRQSAVE
-
-config UNINLINE_SPIN_UNLOCK
-        bool
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_SPIN_LOCK_IRQSAVE
 
 config INLINE_SPIN_UNLOCK_BH
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_SPIN_UNLOCK_BH
+        def_bool y
+        depends on ARCH_INLINE_SPIN_UNLOCK_BH
 
 config INLINE_SPIN_UNLOCK_IRQ
-        def_bool !DEBUG_SPINLOCK && (!PREEMPT || ARCH_INLINE_SPIN_UNLOCK_BH)
+        def_bool y
+        depends on !PREEMPT || ARCH_INLINE_SPIN_UNLOCK_BH
 
 config INLINE_SPIN_UNLOCK_IRQRESTORE
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE
+        def_bool y
+        depends on ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE
 
 
 config INLINE_READ_TRYLOCK
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_READ_TRYLOCK
+        def_bool y
+        depends on ARCH_INLINE_READ_TRYLOCK
 
 config INLINE_READ_LOCK
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && ARCH_INLINE_READ_LOCK
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_READ_LOCK
 
 config INLINE_READ_LOCK_BH
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_READ_LOCK_BH
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_READ_LOCK_BH
 
 config INLINE_READ_LOCK_IRQ
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_READ_LOCK_IRQ
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_READ_LOCK_IRQ
 
 config INLINE_READ_LOCK_IRQSAVE
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_READ_LOCK_IRQSAVE
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_READ_LOCK_IRQSAVE
 
 config INLINE_READ_UNLOCK
-        def_bool !DEBUG_SPINLOCK && (!PREEMPT || ARCH_INLINE_READ_UNLOCK)
+        def_bool y
+        depends on !PREEMPT || ARCH_INLINE_READ_UNLOCK
 
 config INLINE_READ_UNLOCK_BH
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_READ_UNLOCK_BH
+        def_bool y
+        depends on ARCH_INLINE_READ_UNLOCK_BH
 
 config INLINE_READ_UNLOCK_IRQ
-        def_bool !DEBUG_SPINLOCK && (!PREEMPT || ARCH_INLINE_READ_UNLOCK_BH)
+        def_bool y
+        depends on !PREEMPT || ARCH_INLINE_READ_UNLOCK_BH
 
 config INLINE_READ_UNLOCK_IRQRESTORE
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_READ_UNLOCK_IRQRESTORE
+        def_bool y
+        depends on ARCH_INLINE_READ_UNLOCK_IRQRESTORE
 
 
 config INLINE_WRITE_TRYLOCK
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_WRITE_TRYLOCK
+        def_bool y
+        depends on ARCH_INLINE_WRITE_TRYLOCK
 
 config INLINE_WRITE_LOCK
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && ARCH_INLINE_WRITE_LOCK
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_WRITE_LOCK
 
 config INLINE_WRITE_LOCK_BH
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_WRITE_LOCK_BH
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_WRITE_LOCK_BH
 
 config INLINE_WRITE_LOCK_IRQ
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_WRITE_LOCK_IRQ
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_WRITE_LOCK_IRQ
 
 config INLINE_WRITE_LOCK_IRQSAVE
-        def_bool !DEBUG_SPINLOCK && !GENERIC_LOCKBREAK && \
-                 ARCH_INLINE_WRITE_LOCK_IRQSAVE
+        def_bool y
+        depends on !GENERIC_LOCKBREAK && ARCH_INLINE_WRITE_LOCK_IRQSAVE
 
 config INLINE_WRITE_UNLOCK
-        def_bool !DEBUG_SPINLOCK && (!PREEMPT || ARCH_INLINE_WRITE_UNLOCK)
+        def_bool y
+        depends on !PREEMPT || ARCH_INLINE_WRITE_UNLOCK
 
 config INLINE_WRITE_UNLOCK_BH
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_WRITE_UNLOCK_BH
+        def_bool y
+        depends on ARCH_INLINE_WRITE_UNLOCK_BH
 
 config INLINE_WRITE_UNLOCK_IRQ
-        def_bool !DEBUG_SPINLOCK && (!PREEMPT || ARCH_INLINE_WRITE_UNLOCK_BH)
+        def_bool y
+        depends on !PREEMPT || ARCH_INLINE_WRITE_UNLOCK_BH
 
 config INLINE_WRITE_UNLOCK_IRQRESTORE
-        def_bool !DEBUG_SPINLOCK && ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
+        def_bool y
+        depends on ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
+
+endif
 
 config MUTEX_SPIN_ON_OWNER
-        def_bool SMP && !DEBUG_MUTEXES
+        def_bool y
+        depends on SMP && !DEBUG_MUTEXES
diff --git a/kernel/Makefile b/kernel/Makefile
index 29d993be7dba..5404911eaee9 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -10,7 +10,7 @@ obj-y     = fork.o exec_domain.o panic.o printk.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o cred.o \
-            async.o range.o groups.o lglock.o
+            async.o range.o groups.o lglock.o smpboot.o
 
 ifdef CONFIG_FUNCTION_TRACER
 # Do not trace debug files and internal ftrace files
@@ -46,7 +46,6 @@ obj-$(CONFIG_DEBUG_RT_MUTEXES) += rtmutex-debug.o
 obj-$(CONFIG_RT_MUTEX_TESTER) += rtmutex-tester.o
 obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o
 obj-$(CONFIG_SMP) += smp.o
-obj-$(CONFIG_SMP) += smpboot.o
 ifneq ($(CONFIG_SMP),y)
 obj-y += up.o
 endif
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 14d32588cccd..e615dfbcf794 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -280,12 +280,13 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
                                 __func__, cpu);
                 goto out_release;
         }
+        smpboot_park_threads(cpu);
 
         err = __stop_machine(take_cpu_down, &tcd_param, cpumask_of(cpu));
         if (err) {
                 /* CPU didn't die: tell everyone.  Can't complain. */
+                smpboot_unpark_threads(cpu);
                 cpu_notify_nofail(CPU_DOWN_FAILED | mod, hcpu);
-
                 goto out_release;
         }
         BUG_ON(cpu_online(cpu));
@@ -354,6 +355,10 @@ static int __cpuinit _cpu_up(unsigned int cpu, int tasks_frozen)
                 goto out;
         }
 
+        ret = smpboot_create_threads(cpu);
+        if (ret)
+                goto out;
+
         ret = __cpu_notify(CPU_UP_PREPARE | mod, hcpu, -1, &nr_calls);
         if (ret) {
                 nr_calls--;
@@ -368,6 +373,9 @@ static int __cpuinit _cpu_up(unsigned int cpu, int tasks_frozen)
                 goto out_notify;
         BUG_ON(!cpu_online(cpu));
 
+        /* Wake the per cpu threads */
+        smpboot_unpark_threads(cpu);
+
         /* Now call notifier in preparation. */
         cpu_notify(CPU_ONLINE | mod, hcpu);
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 2ba890450d15..7b9df353ba1b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1254,7 +1254,7 @@ retry:
 /*
  * Cross CPU call to disable a performance event
  */
-static int __perf_event_disable(void *info)
+int __perf_event_disable(void *info)
 {
         struct perf_event *event = info;
         struct perf_event_context *ctx = event->ctx;
@@ -2936,12 +2936,12 @@ EXPORT_SYMBOL_GPL(perf_event_release_kernel);
 /*
  * Called when the last reference to the file is gone.
  */
-static int perf_release(struct inode *inode, struct file *file)
+static void put_event(struct perf_event *event)
 {
-        struct perf_event *event = file->private_data;
         struct task_struct *owner;
 
-        file->private_data = NULL;
+        if (!atomic_long_dec_and_test(&event->refcount))
+                return;
 
         rcu_read_lock();
         owner = ACCESS_ONCE(event->owner);
@@ -2976,7 +2976,13 @@ static int perf_release(struct inode *inode, struct file *file)
                 put_task_struct(owner);
         }
 
-        return perf_event_release_kernel(event);
+        perf_event_release_kernel(event);
+}
+
+static int perf_release(struct inode *inode, struct file *file)
+{
+        put_event(file->private_data);
+        return 0;
 }
 
 u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
@@ -3228,7 +3234,7 @@ unlock:
 
 static const struct file_operations perf_fops;
 
-static struct perf_event *perf_fget_light(int fd, int *fput_needed)
+static struct file *perf_fget_light(int fd, int *fput_needed)
 {
         struct file *file;
 
@@ -3242,7 +3248,7 @@ static struct perf_event *perf_fget_light(int fd, int *fput_needed)
                 return ERR_PTR(-EBADF);
         }
 
-        return file->private_data;
+        return file;
 }
 
 static int perf_event_set_output(struct perf_event *event,
@@ -3274,19 +3280,21 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
         case PERF_EVENT_IOC_SET_OUTPUT:
         {
+                struct file *output_file = NULL;
                 struct perf_event *output_event = NULL;
                 int fput_needed = 0;
                 int ret;
 
                 if (arg != -1) {
-                        output_event = perf_fget_light(arg, &fput_needed);
-                        if (IS_ERR(output_event))
-                                return PTR_ERR(output_event);
+                        output_file = perf_fget_light(arg, &fput_needed);
+                        if (IS_ERR(output_file))
+                                return PTR_ERR(output_file);
+                        output_event = output_file->private_data;
                 }
 
                 ret = perf_event_set_output(event, output_event);
                 if (output_event)
-                        fput_light(output_event->filp, fput_needed);
+                        fput_light(output_file, fput_needed);
 
                 return ret;
         }
@@ -6142,6 +6150,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 
         mutex_init(&event->mmap_mutex);
 
+        atomic_long_set(&event->refcount, 1);
         event->cpu              = cpu;
         event->attr             = *attr;
         event->group_leader     = group_leader;
@@ -6474,12 +6483,12 @@ SYSCALL_DEFINE5(perf_event_open,
                 return event_fd;
 
         if (group_fd != -1) {
-                group_leader = perf_fget_light(group_fd, &fput_needed);
-                if (IS_ERR(group_leader)) {
-                        err = PTR_ERR(group_leader);
+                group_file = perf_fget_light(group_fd, &fput_needed);
+                if (IS_ERR(group_file)) {
+                        err = PTR_ERR(group_file);
                         goto err_fd;
                 }
-                group_file = group_leader->filp;
+                group_leader = group_file->private_data;
                 if (flags & PERF_FLAG_FD_OUTPUT)
                         output_event = group_leader;
                 if (flags & PERF_FLAG_FD_NO_GROUP)
@@ -6616,7 +6625,6 @@ SYSCALL_DEFINE5(perf_event_open,
                 put_ctx(gctx);
         }
 
-        event->filp = event_file;
         WARN_ON_ONCE(ctx->parent_ctx);
         mutex_lock(&ctx->mutex);
 
@@ -6710,7 +6718,6 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
                 goto err_free;
         }
 
-        event->filp = NULL;
         WARN_ON_ONCE(ctx->parent_ctx);
         mutex_lock(&ctx->mutex);
         perf_install_in_context(ctx, event, cpu);
@@ -6792,7 +6799,7 @@ static void sync_child_event(struct perf_event *child_event,
          * Release the parent event, if this was the last
          * reference to it.
          */
-        fput(parent_event->filp);
+        put_event(parent_event);
 }
 
 static void
@@ -6868,9 +6875,8 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
          *
          *   __perf_event_exit_task()
          *     sync_child_event()
-         *       fput(parent_event->filp)
-         *         perf_release()
-         *           mutex_lock(&ctx->mutex)
+         *       put_event()
+         *         mutex_lock(&ctx->mutex)
          *
          * But since its the parent context it won't be the same instance.
          */
@@ -6938,7 +6944,7 @@ static void perf_free_event(struct perf_event *event,
         list_del_init(&event->child_list);
         mutex_unlock(&parent->child_mutex);
 
-        fput(parent->filp);
+        put_event(parent);
 
         perf_group_detach(event);
         list_del_event(event, ctx);
@@ -7018,6 +7024,12 @@ inherit_event(struct perf_event *parent_event,
                                            NULL, NULL);
         if (IS_ERR(child_event))
                 return child_event;
+
+        if (!atomic_long_inc_not_zero(&parent_event->refcount)) {
+                free_event(child_event);
+                return NULL;
+        }
+
         get_ctx(child_ctx);
 
         /*
@@ -7059,14 +7071,6 @@ inherit_event(struct perf_event *parent_event,
         raw_spin_unlock_irqrestore(&child_ctx->lock, flags);
 
         /*
-         * Get a reference to the parent filp - we will fput it
-         * when the child event exits. This is safe to do because
-         * we are in the parent and we know that the filp still
-         * exists and has a nonzero count:
-         */
-        atomic_long_inc(&parent_event->filp->f_count);
-
-        /*
          * Link this into the parent event's child list
          */
         WARN_ON_ONCE(parent_event->ctx->parent_ctx);
diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index bb38c4d3ee12..9a7b487c6fe2 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -453,7 +453,16 @@ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *att
         int old_type = bp->attr.bp_type;
         int err = 0;
 
-        perf_event_disable(bp);
+        /*
+         * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it
+         * will not be possible to raise IPIs that invoke __perf_event_disable.
+         * So call the function directly after making sure we are targeting the
+         * current task.
+         */
+        if (irqs_disabled() && bp->ctx && bp->ctx->task == current)
+                __perf_event_disable(bp);
+        else
+                perf_event_disable(bp);
 
         bp->attr.bp_addr = attr->bp_addr;
         bp->attr.bp_type = attr->bp_type;
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index eebd6d5cfb44..57d86d07221e 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -671,6 +671,7 @@ irq_set_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
         irq_set_chip(irq, chip);
         __irq_set_handler(irq, handle, 0, name);
 }
+EXPORT_SYMBOL_GPL(irq_set_chip_and_handler_name);
 
 void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 {
diff --git a/kernel/irq/dummychip.c b/kernel/irq/dummychip.c
index b5fcd96c7102..988dc58e8847 100644
--- a/kernel/irq/dummychip.c
+++ b/kernel/irq/dummychip.c
@@ -6,6 +6,7 @@
  */
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/export.h>
 
 #include "internals.h"
 
@@ -57,3 +58,4 @@ struct irq_chip dummy_irq_chip = {
         .irq_mask       = noop,
         .irq_unmask     = noop,
 };
+EXPORT_SYMBOL_GPL(dummy_irq_chip);
diff --git a/kernel/kthread.c b/kernel/kthread.c
index b579af57ea10..146a6fa96825 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -37,11 +37,20 @@ struct kthread_create_info
 };
 
 struct kthread {
-        int should_stop;
+        unsigned long flags;
+        unsigned int cpu;
         void *data;
+        struct completion parked;
         struct completion exited;
 };
 
+enum KTHREAD_BITS {
+        KTHREAD_IS_PER_CPU = 0,
+        KTHREAD_SHOULD_STOP,
+        KTHREAD_SHOULD_PARK,
+        KTHREAD_IS_PARKED,
+};
+
 #define to_kthread(tsk) \
         container_of((tsk)->vfork_done, struct kthread, exited)
 
@@ -52,13 +61,29 @@ struct kthread {
  * and this will return true.  You should then return, and your return
  * value will be passed through to kthread_stop().
  */
-int kthread_should_stop(void)
+bool kthread_should_stop(void)
 {
-        return to_kthread(current)->should_stop;
+        return test_bit(KTHREAD_SHOULD_STOP, &to_kthread(current)->flags);
 }
 EXPORT_SYMBOL(kthread_should_stop);
 
 /**
+ * kthread_should_park - should this kthread park now?
+ *
+ * When someone calls kthread_park() on your kthread, it will be woken
+ * and this will return true.  You should then do the necessary
+ * cleanup and call kthread_parkme()
+ *
+ * Similar to kthread_should_stop(), but this keeps the thread alive
+ * and in a park position. kthread_unpark() "restarts" the thread and
+ * calls the thread function again.
+ */
+bool kthread_should_park(void)
+{
+        return test_bit(KTHREAD_SHOULD_PARK, &to_kthread(current)->flags);
+}
+
+/**
  * kthread_freezable_should_stop - should this freezable kthread return now?
  * @was_frozen: optional out parameter, indicates whether %current was frozen
  *
@@ -96,6 +121,24 @@ void *kthread_data(struct task_struct *task)
         return to_kthread(task)->data;
 }
 
+static void __kthread_parkme(struct kthread *self)
+{
+        __set_current_state(TASK_INTERRUPTIBLE);
+        while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
+                if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
+                        complete(&self->parked);
+                schedule();
+                __set_current_state(TASK_INTERRUPTIBLE);
+        }
+        clear_bit(KTHREAD_IS_PARKED, &self->flags);
+        __set_current_state(TASK_RUNNING);
+}
+
+void kthread_parkme(void)
+{
+        __kthread_parkme(to_kthread(current));
+}
+
 static int kthread(void *_create)
 {
         /* Copy data: it's on kthread's stack */
@@ -105,9 +148,10 @@ static int kthread(void *_create)
         struct kthread self;
         int ret;
 
-        self.should_stop = 0;
+        self.flags = 0;
         self.data = data;
         init_completion(&self.exited);
+        init_completion(&self.parked);
         current->vfork_done = &self.exited;
 
         /* OK, tell user we're spawned, wait for stop or wakeup */
@@ -117,9 +161,11 @@ static int kthread(void *_create)
         schedule();
 
         ret = -EINTR;
-        if (!self.should_stop)
-                ret = threadfn(data);
 
+        if (!test_bit(KTHREAD_SHOULD_STOP, &self.flags)) {
+                __kthread_parkme(&self);
+                ret = threadfn(data);
+        }
         /* we can't just return, we must preserve "self" on stack */
         do_exit(ret);
 }
@@ -172,8 +218,7 @@ static void create_kthread(struct kthread_create_info *create)
  * Returns a task_struct or ERR_PTR(-ENOMEM).
  */
 struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
-                                           void *data,
-                                           int node,
+                                           void *data, int node,
                                            const char namefmt[],
                                            ...)
 {
@@ -210,6 +255,13 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
 }
 EXPORT_SYMBOL(kthread_create_on_node);
 
+static void __kthread_bind(struct task_struct *p, unsigned int cpu)
+{
+        /* It's safe because the task is inactive. */
+        do_set_cpus_allowed(p, cpumask_of(cpu));
+        p->flags |= PF_THREAD_BOUND;
+}
+
 /**
  * kthread_bind - bind a just-created kthread to a cpu.
  * @p: thread created by kthread_create().
@@ -226,14 +278,112 @@ void kthread_bind(struct task_struct *p, unsigned int cpu)
                 WARN_ON(1);
                 return;
         }
-
-        /* It's safe because the task is inactive. */
-        do_set_cpus_allowed(p, cpumask_of(cpu));
-        p->flags |= PF_THREAD_BOUND;
+        __kthread_bind(p, cpu);
 }
 EXPORT_SYMBOL(kthread_bind);
 
 /**
+ * kthread_create_on_cpu - Create a cpu bound kthread
+ * @threadfn: the function to run until signal_pending(current).
+ * @data: data ptr for @threadfn.
+ * @cpu: The cpu on which the thread should be bound,
+ * @namefmt: printf-style name for the thread. Format is restricted
+ *           to "name.*%u". Code fills in cpu number.
+ *
+ * Description: This helper function creates and names a kernel thread
+ * The thread will be woken and put into park mode.
+ */
+struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
+                                          void *data, unsigned int cpu,
+                                          const char *namefmt)
+{
+        struct task_struct *p;
+
+        p = kthread_create_on_node(threadfn, data, cpu_to_node(cpu), namefmt,
+                                   cpu);
+        if (IS_ERR(p))
+                return p;
+        set_bit(KTHREAD_IS_PER_CPU, &to_kthread(p)->flags);
+        to_kthread(p)->cpu = cpu;
+        /* Park the thread to get it out of TASK_UNINTERRUPTIBLE state */
+        kthread_park(p);
+        return p;
+}
+
+static struct kthread *task_get_live_kthread(struct task_struct *k)
+{
+        struct kthread *kthread;
+
+        get_task_struct(k);
+        kthread = to_kthread(k);
+        /* It might have exited */
+        barrier();
+        if (k->vfork_done != NULL)
+                return kthread;
+        return NULL;
+}
+
+/**
+ * kthread_unpark - unpark a thread created by kthread_create().
+ * @k:          thread created by kthread_create().
+ *
+ * Sets kthread_should_park() for @k to return false, wakes it, and
+ * waits for it to return. If the thread is marked percpu then its
+ * bound to the cpu again.
+ */
+void kthread_unpark(struct task_struct *k)
+{
+        struct kthread *kthread = task_get_live_kthread(k);
+
+        if (kthread) {
+                clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+                /*
+                 * We clear the IS_PARKED bit here as we don't wait
+                 * until the task has left the park code. So if we'd
+                 * park before that happens we'd see the IS_PARKED bit
+                 * which might be about to be cleared.
+                 */
+                if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
+                        if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
+                                __kthread_bind(k, kthread->cpu);
+                        wake_up_process(k);
+                }
+        }
+        put_task_struct(k);
+}
+
+/**
+ * kthread_park - park a thread created by kthread_create().
+ * @k: thread created by kthread_create().
+ *
+ * Sets kthread_should_park() for @k to return true, wakes it, and
+ * waits for it to return. This can also be called after kthread_create()
+ * instead of calling wake_up_process(): the thread will park without
+ * calling threadfn().
+ *
+ * Returns 0 if the thread is parked, -ENOSYS if the thread exited.
+ * If called by the kthread itself just the park bit is set.
+ */
+int kthread_park(struct task_struct *k)
+{
+        struct kthread *kthread = task_get_live_kthread(k);
+        int ret = -ENOSYS;
+
+        if (kthread) {
+                if (!test_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
+                        set_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+                        if (k != current) {
+                                wake_up_process(k);
+                                wait_for_completion(&kthread->parked);
+                        }
+                }
+                ret = 0;
+        }
+        put_task_struct(k);
+        return ret;
+}
+
+/**
  * kthread_stop - stop a thread created by kthread_create().
  * @k: thread created by kthread_create().
  *
@@ -250,16 +400,13 @@ EXPORT_SYMBOL(kthread_bind);
  */
 int kthread_stop(struct task_struct *k)
 {
-        struct kthread *kthread;
+        struct kthread *kthread = task_get_live_kthread(k);
         int ret;
 
         trace_sched_kthread_stop(k);
-        get_task_struct(k);
-
-        kthread = to_kthread(k);
-        barrier(); /* it might have exited */
-        if (k->vfork_done != NULL) {
-                kthread->should_stop = 1;
+        if (kthread) {
+                set_bit(KTHREAD_SHOULD_STOP, &kthread->flags);
+                clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
                 wake_up_process(k);
                 wait_for_completion(&kthread->exited);
         }
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index ea9ee4518c35..7981e5b2350d 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -2998,6 +2998,42 @@ EXPORT_SYMBOL_GPL(lockdep_init_map);
 
 struct lock_class_key __lockdep_no_validate__;
 
+static int
+print_lock_nested_lock_not_held(struct task_struct *curr,
+                                struct held_lock *hlock,
+                                unsigned long ip)
+{
+        if (!debug_locks_off())
+                return 0;
+        if (debug_locks_silent)
+                return 0;
+
+        printk("\n");
+        printk("==================================\n");
+        printk("[ BUG: Nested lock was not taken ]\n");
+        print_kernel_ident();
+        printk("----------------------------------\n");
+
+        printk("%s/%d is trying to lock:\n", curr->comm, task_pid_nr(curr));
+        print_lock(hlock);
+
+        printk("\nbut this task is not holding:\n");
+        printk("%s\n", hlock->nest_lock->name);
+
+        printk("\nstack backtrace:\n");
+        dump_stack();
+
+        printk("\nother info that might help us debug this:\n");
+        lockdep_print_held_locks(curr);
+
+        printk("\nstack backtrace:\n");
+        dump_stack();
+
+        return 0;
+}
+
+static int __lock_is_held(struct lockdep_map *lock);
+
 /*
  * This gets called for every mutex_lock*()/spin_lock*() operation.
  * We maintain the dependency maps and validate the locking attempt:
@@ -3139,6 +3175,9 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         }
         chain_key = iterate_chain_key(chain_key, id);
 
+        if (nest_lock && !__lock_is_held(nest_lock))
+                return print_lock_nested_lock_not_held(curr, hlock, ip);
+
         if (!validate_chain(curr, lock, hlock, chain_head, chain_key))
                 return 0;
 
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index b3c7fd554250..6144bab8fd8e 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -232,15 +232,19 @@ static int pid_ns_ctl_handler(struct ctl_table *table, int write,
          */
 
         tmp.data = &current->nsproxy->pid_ns->last_pid;
-        return proc_dointvec(&tmp, write, buffer, lenp, ppos);
+        return proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 }
 
+extern int pid_max;
+static int zero = 0;
 static struct ctl_table pid_ns_ctl_table[] = {
         {
                 .procname = "ns_last_pid",
                 .maxlen = sizeof(int),
                 .mode = 0666, /* permissions are checked in the handler */
                 .proc_handler = pid_ns_ctl_handler,
+                .extra1 = &zero,
+                .extra2 = &pid_max,
         },
         { }
 };
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 4e6a61b15e86..29ca1c6da594 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -45,6 +45,7 @@
 #include <linux/mutex.h>
 #include <linux/export.h>
 #include <linux/hardirq.h>
+#include <linux/delay.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/rcu.h>
@@ -81,6 +82,9 @@ void __rcu_read_unlock(void)
         } else {
                 barrier();  /* critical section before exit code. */
                 t->rcu_read_lock_nesting = INT_MIN;
+#ifdef CONFIG_PROVE_RCU_DELAY
+                udelay(10); /* Make preemption more probable. */
+#endif /* #ifdef CONFIG_PROVE_RCU_DELAY */
                 barrier();  /* assign before ->rcu_read_unlock_special load */
                 if (unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
                         rcu_read_unlock_special(t);
diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c
index 547b1fe5b052..e4c6a598d6f7 100644
--- a/kernel/rcutiny.c
+++ b/kernel/rcutiny.c
@@ -56,25 +56,28 @@ static void __call_rcu(struct rcu_head *head,
 static long long rcu_dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
 
 /* Common code for rcu_idle_enter() and rcu_irq_exit(), see kernel/rcutree.c. */
-static void rcu_idle_enter_common(long long oldval)
+static void rcu_idle_enter_common(long long newval)
 {
-        if (rcu_dynticks_nesting) {
+        if (newval) {
                 RCU_TRACE(trace_rcu_dyntick("--=",
-                                            oldval, rcu_dynticks_nesting));
+                                            rcu_dynticks_nesting, newval));
+                rcu_dynticks_nesting = newval;
                 return;
         }
-        RCU_TRACE(trace_rcu_dyntick("Start", oldval, rcu_dynticks_nesting));
+        RCU_TRACE(trace_rcu_dyntick("Start", rcu_dynticks_nesting, newval));
         if (!is_idle_task(current)) {
                 struct task_struct *idle = idle_task(smp_processor_id());
 
                 RCU_TRACE(trace_rcu_dyntick("Error on entry: not idle task",
-                                            oldval, rcu_dynticks_nesting));
+                                            rcu_dynticks_nesting, newval));
                 ftrace_dump(DUMP_ALL);
                 WARN_ONCE(1, "Current pid: %d comm: %s / Idle pid: %d comm: %s",
                           current->pid, current->comm,
                           idle->pid, idle->comm); /* must be idle task! */
         }
         rcu_sched_qs(0); /* implies rcu_bh_qsctr_inc(0) */
+        barrier();
+        rcu_dynticks_nesting = newval;
 }
 
 /*
@@ -84,17 +87,16 @@ static void rcu_idle_enter_common(long long oldval)
 void rcu_idle_enter(void)
 {
         unsigned long flags;
-        long long oldval;
+        long long newval;
 
         local_irq_save(flags);
-        oldval = rcu_dynticks_nesting;
         WARN_ON_ONCE((rcu_dynticks_nesting & DYNTICK_TASK_NEST_MASK) == 0);
         if ((rcu_dynticks_nesting & DYNTICK_TASK_NEST_MASK) ==
             DYNTICK_TASK_NEST_VALUE)
-                rcu_dynticks_nesting = 0;
+                newval = 0;
         else
-                rcu_dynticks_nesting  -= DYNTICK_TASK_NEST_VALUE;
-        rcu_idle_enter_common(oldval);
+                newval = rcu_dynticks_nesting - DYNTICK_TASK_NEST_VALUE;
+        rcu_idle_enter_common(newval);
         local_irq_restore(flags);
 }
 EXPORT_SYMBOL_GPL(rcu_idle_enter);
@@ -105,15 +107,15 @@ EXPORT_SYMBOL_GPL(rcu_idle_enter);
 void rcu_irq_exit(void)
 {
         unsigned long flags;
-        long long oldval;
+        long long newval;
 
         local_irq_save(flags);
-        oldval = rcu_dynticks_nesting;
-        rcu_dynticks_nesting--;
-        WARN_ON_ONCE(rcu_dynticks_nesting < 0);
-        rcu_idle_enter_common(oldval);
+        newval = rcu_dynticks_nesting - 1;
+        WARN_ON_ONCE(newval < 0);
+        rcu_idle_enter_common(newval);
         local_irq_restore(flags);
 }
+EXPORT_SYMBOL_GPL(rcu_irq_exit);
 
 /* Common code for rcu_idle_exit() and rcu_irq_enter(), see kernel/rcutree.c. */
 static void rcu_idle_exit_common(long long oldval)
@@ -171,6 +173,7 @@ void rcu_irq_enter(void)
         rcu_idle_exit_common(oldval);
         local_irq_restore(flags);
 }
+EXPORT_SYMBOL_GPL(rcu_irq_enter);
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 
diff --git a/kernel/rcutiny_plugin.h b/kernel/rcutiny_plugin.h
index 918fd1e8509c..3d0190282204 100644
--- a/kernel/rcutiny_plugin.h
+++ b/kernel/rcutiny_plugin.h
@@ -278,7 +278,7 @@ static int rcu_boost(void)
             rcu_preempt_ctrlblk.exp_tasks == NULL)
                 return 0;  /* Nothing to boost. */
 
-        raw_local_irq_save(flags);
+        local_irq_save(flags);
 
         /*
          * Recheck with irqs disabled: all tasks in need of boosting
@@ -287,7 +287,7 @@ static int rcu_boost(void)
          */
         if (rcu_preempt_ctrlblk.boost_tasks == NULL &&
             rcu_preempt_ctrlblk.exp_tasks == NULL) {
-                raw_local_irq_restore(flags);
+                local_irq_restore(flags);
                 return 0;
         }
 
@@ -317,7 +317,7 @@ static int rcu_boost(void)
         t = container_of(tb, struct task_struct, rcu_node_entry);
         rt_mutex_init_proxy_locked(&mtx, t);
         t->rcu_boost_mutex = &mtx;
-        raw_local_irq_restore(flags);
+        local_irq_restore(flags);
         rt_mutex_lock(&mtx);
         rt_mutex_unlock(&mtx);  /* Keep lockdep happy. */
 
@@ -991,9 +991,9 @@ static void rcu_trace_sub_qlen(struct rcu_ctrlblk *rcp, int n)
 {
         unsigned long flags;
 
-        raw_local_irq_save(flags);
+        local_irq_save(flags);
         rcp->qlen -= n;
-        raw_local_irq_restore(flags);
+        local_irq_restore(flags);
 }
 
 /*
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 25b15033c61f..aaa7b9f3532a 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -53,10 +53,11 @@ MODULE_AUTHOR("Paul E. McKenney <paulmck@us.ibm.com> and Josh Triplett <josh@fre
 
 static int nreaders = -1;       /* # reader threads, defaults to 2*ncpus */
 static int nfakewriters = 4;    /* # fake writer threads */
-static int stat_interval;       /* Interval between stats, in seconds. */
-                                /*  Defaults to "only at end of test". */
+static int stat_interval = 60;  /* Interval between stats, in seconds. */
+                                /*  Zero means "only at end of test". */
 static bool verbose;            /* Print more debug info. */
-static bool test_no_idle_hz;    /* Test RCU's support for tickless idle CPUs. */
+static bool test_no_idle_hz = true;
+                                /* Test RCU support for tickless idle CPUs. */
 static int shuffle_interval = 3; /* Interval between shuffles (in sec)*/
 static int stutter = 5;         /* Start/stop testing interval (in sec) */
 static int irqreader = 1;       /* RCU readers from irq (timers). */
@@ -119,11 +120,11 @@ MODULE_PARM_DESC(torture_type, "Type of RCU to torture (rcu, rcu_bh, srcu)");
 
 #define TORTURE_FLAG "-torture:"
 #define PRINTK_STRING(s) \
-        do { printk(KERN_ALERT "%s" TORTURE_FLAG s "\n", torture_type); } while (0)
+        do { pr_alert("%s" TORTURE_FLAG s "\n", torture_type); } while (0)
 #define VERBOSE_PRINTK_STRING(s) \
-        do { if (verbose) printk(KERN_ALERT "%s" TORTURE_FLAG s "\n", torture_type); } while (0)
+        do { if (verbose) pr_alert("%s" TORTURE_FLAG s "\n", torture_type); } while (0)
 #define VERBOSE_PRINTK_ERRSTRING(s) \
-        do { if (verbose) printk(KERN_ALERT "%s" TORTURE_FLAG "!!! " s "\n", torture_type); } while (0)
+        do { if (verbose) pr_alert("%s" TORTURE_FLAG "!!! " s "\n", torture_type); } while (0)
 
 static char printk_buf[4096];
 
@@ -176,8 +177,14 @@ static long n_rcu_torture_boosts;
 static long n_rcu_torture_timers;
 static long n_offline_attempts;
 static long n_offline_successes;
+static unsigned long sum_offline;
+static int min_offline = -1;
+static int max_offline;
 static long n_online_attempts;
 static long n_online_successes;
+static unsigned long sum_online;
+static int min_online = -1;
+static int max_online;
 static long n_barrier_attempts;
 static long n_barrier_successes;
 static struct list_head rcu_torture_removed;
@@ -235,7 +242,7 @@ rcutorture_shutdown_notify(struct notifier_block *unused1,
         if (fullstop == FULLSTOP_DONTSTOP)
                 fullstop = FULLSTOP_SHUTDOWN;
         else
-                printk(KERN_WARNING /* but going down anyway, so... */
+                pr_warn(/* but going down anyway, so... */
                        "Concurrent 'rmmod rcutorture' and shutdown illegal!\n");
         mutex_unlock(&fullstop_mutex);
         return NOTIFY_DONE;
@@ -248,7 +255,7 @@ rcutorture_shutdown_notify(struct notifier_block *unused1,
 static void rcutorture_shutdown_absorb(char *title)
 {
         if (ACCESS_ONCE(fullstop) == FULLSTOP_SHUTDOWN) {
-                printk(KERN_NOTICE
+                pr_notice(
                        "rcutorture thread %s parking due to system shutdown\n",
                        title);
                 schedule_timeout_uninterruptible(MAX_SCHEDULE_TIMEOUT);
@@ -1214,11 +1221,13 @@ rcu_torture_printk(char *page)
                        n_rcu_torture_boost_failure,
                        n_rcu_torture_boosts,
                        n_rcu_torture_timers);
-        cnt += sprintf(&page[cnt], "onoff: %ld/%ld:%ld/%ld ",
-                       n_online_successes,
-                       n_online_attempts,
-                       n_offline_successes,
-                       n_offline_attempts);
+        cnt += sprintf(&page[cnt],
+                       "onoff: %ld/%ld:%ld/%ld %d,%d:%d,%d %lu:%lu (HZ=%d) ",
+                       n_online_successes, n_online_attempts,
+                       n_offline_successes, n_offline_attempts,
+                       min_online, max_online,
+                       min_offline, max_offline,
+                       sum_online, sum_offline, HZ);
         cnt += sprintf(&page[cnt], "barrier: %ld/%ld:%ld",
                        n_barrier_successes,
                        n_barrier_attempts,
@@ -1267,7 +1276,7 @@ rcu_torture_stats_print(void)
         int cnt;
 
         cnt = rcu_torture_printk(printk_buf);
-        printk(KERN_ALERT "%s", printk_buf);
+        pr_alert("%s", printk_buf);
 }
 
 /*
@@ -1380,20 +1389,20 @@ rcu_torture_stutter(void *arg)
 static inline void
 rcu_torture_print_module_parms(struct rcu_torture_ops *cur_ops, char *tag)
 {
-        printk(KERN_ALERT "%s" TORTURE_FLAG
-                "--- %s: nreaders=%d nfakewriters=%d "
-                "stat_interval=%d verbose=%d test_no_idle_hz=%d "
-                "shuffle_interval=%d stutter=%d irqreader=%d "
-                "fqs_duration=%d fqs_holdoff=%d fqs_stutter=%d "
-                "test_boost=%d/%d test_boost_interval=%d "
-                "test_boost_duration=%d shutdown_secs=%d "
-                "onoff_interval=%d onoff_holdoff=%d\n",
-                torture_type, tag, nrealreaders, nfakewriters,
-                stat_interval, verbose, test_no_idle_hz, shuffle_interval,
-                stutter, irqreader, fqs_duration, fqs_holdoff, fqs_stutter,
-                test_boost, cur_ops->can_boost,
-                test_boost_interval, test_boost_duration, shutdown_secs,
-                onoff_interval, onoff_holdoff);
+        pr_alert("%s" TORTURE_FLAG
+                 "--- %s: nreaders=%d nfakewriters=%d "
+                 "stat_interval=%d verbose=%d test_no_idle_hz=%d "
+                 "shuffle_interval=%d stutter=%d irqreader=%d "
+                 "fqs_duration=%d fqs_holdoff=%d fqs_stutter=%d "
+                 "test_boost=%d/%d test_boost_interval=%d "
+                 "test_boost_duration=%d shutdown_secs=%d "
+                 "onoff_interval=%d onoff_holdoff=%d\n",
+                 torture_type, tag, nrealreaders, nfakewriters,
+                 stat_interval, verbose, test_no_idle_hz, shuffle_interval,
+                 stutter, irqreader, fqs_duration, fqs_holdoff, fqs_stutter,
+                 test_boost, cur_ops->can_boost,
+                 test_boost_interval, test_boost_duration, shutdown_secs,
+                 onoff_interval, onoff_holdoff);
 }
 
 static struct notifier_block rcutorture_shutdown_nb = {
@@ -1460,9 +1469,9 @@ rcu_torture_shutdown(void *arg)
                !kthread_should_stop()) {
                 delta = shutdown_time - jiffies_snap;
                 if (verbose)
-                        printk(KERN_ALERT "%s" TORTURE_FLAG
-                               "rcu_torture_shutdown task: %lu jiffies remaining\n",
-                               torture_type, delta);
+                        pr_alert("%s" TORTURE_FLAG
+                                 "rcu_torture_shutdown task: %lu jiffies remaining\n",
+                                 torture_type, delta);
                 schedule_timeout_interruptible(delta);
                 jiffies_snap = ACCESS_ONCE(jiffies);
         }
@@ -1490,8 +1499,10 @@ static int __cpuinit
 rcu_torture_onoff(void *arg)
 {
         int cpu;
+        unsigned long delta;
         int maxcpu = -1;
         DEFINE_RCU_RANDOM(rand);
+        unsigned long starttime;
 
         VERBOSE_PRINTK_STRING("rcu_torture_onoff task started");
         for_each_online_cpu(cpu)
@@ -1506,29 +1517,51 @@ rcu_torture_onoff(void *arg)
                 cpu = (rcu_random(&rand) >> 4) % (maxcpu + 1);
                 if (cpu_online(cpu) && cpu_is_hotpluggable(cpu)) {
                         if (verbose)
-                                printk(KERN_ALERT "%s" TORTURE_FLAG
-                                       "rcu_torture_onoff task: offlining %d\n",
-                                       torture_type, cpu);
+                                pr_alert("%s" TORTURE_FLAG
+                                         "rcu_torture_onoff task: offlining %d\n",
+                                         torture_type, cpu);
+                        starttime = jiffies;
                         n_offline_attempts++;
                         if (cpu_down(cpu) == 0) {
                                 if (verbose)
-                                        printk(KERN_ALERT "%s" TORTURE_FLAG
-                                               "rcu_torture_onoff task: offlined %d\n",
-                                               torture_type, cpu);
+                                        pr_alert("%s" TORTURE_FLAG
+                                                 "rcu_torture_onoff task: offlined %d\n",
+                                                 torture_type, cpu);
                                 n_offline_successes++;
+                                delta = jiffies - starttime;
+                                sum_offline += delta;
+                                if (min_offline < 0) {
+                                        min_offline = delta;
+                                        max_offline = delta;
+                                }
+                                if (min_offline > delta)
+                                        min_offline = delta;
+                                if (max_offline < delta)
+                                        max_offline = delta;
                         }
                 } else if (cpu_is_hotpluggable(cpu)) {
                         if (verbose)
-                                printk(KERN_ALERT "%s" TORTURE_FLAG
-                                       "rcu_torture_onoff task: onlining %d\n",
-                                       torture_type, cpu);
+                                pr_alert("%s" TORTURE_FLAG
+                                         "rcu_torture_onoff task: onlining %d\n",
+                                         torture_type, cpu);
+                        starttime = jiffies;
                         n_online_attempts++;
                         if (cpu_up(cpu) == 0) {
                                 if (verbose)
-                                        printk(KERN_ALERT "%s" TORTURE_FLAG
-                                               "rcu_torture_onoff task: onlined %d\n",
-                                               torture_type, cpu);
+                                        pr_alert("%s" TORTURE_FLAG
+                                                 "rcu_torture_onoff task: onlined %d\n",
+                                                 torture_type, cpu);
                                 n_online_successes++;
+                                delta = jiffies - starttime;
+                                sum_online += delta;
+                                if (min_online < 0) {
+                                        min_online = delta;
+                                        max_online = delta;
+                                }
+                                if (min_online > delta)
+                                        min_online = delta;
+                                if (max_online < delta)
+                                        max_online = delta;
                         }
                 }
                 schedule_timeout_interruptible(onoff_interval * HZ);
@@ -1593,14 +1626,14 @@ static int __cpuinit rcu_torture_stall(void *args)
         if (!kthread_should_stop()) {
                 stop_at = get_seconds() + stall_cpu;
                 /* RCU CPU stall is expected behavior in following code. */
-                printk(KERN_ALERT "rcu_torture_stall start.\n");
+                pr_alert("rcu_torture_stall start.\n");
                 rcu_read_lock();
                 preempt_disable();
                 while (ULONG_CMP_LT(get_seconds(), stop_at))
                         continue;  /* Induce RCU CPU stall warning. */
                 preempt_enable();
                 rcu_read_unlock();
-                printk(KERN_ALERT "rcu_torture_stall end.\n");
+                pr_alert("rcu_torture_stall end.\n");
         }
         rcutorture_shutdown_absorb("rcu_torture_stall");
         while (!kthread_should_stop())
@@ -1716,12 +1749,12 @@ static int rcu_torture_barrier_init(void)
         if (n_barrier_cbs == 0)
                 return 0;
         if (cur_ops->call == NULL || cur_ops->cb_barrier == NULL) {
-                printk(KERN_ALERT "%s" TORTURE_FLAG
-                       " Call or barrier ops missing for %s,\n",
-                       torture_type, cur_ops->name);
-                printk(KERN_ALERT "%s" TORTURE_FLAG
-                       " RCU barrier testing omitted from run.\n",
-                       torture_type);
+                pr_alert("%s" TORTURE_FLAG
+                         " Call or barrier ops missing for %s,\n",
+                         torture_type, cur_ops->name);
+                pr_alert("%s" TORTURE_FLAG
+                         " RCU barrier testing omitted from run.\n",
+                         torture_type);
                 return 0;
         }
         atomic_set(&barrier_cbs_count, 0);
@@ -1814,7 +1847,7 @@ rcu_torture_cleanup(void)
         mutex_lock(&fullstop_mutex);
         rcutorture_record_test_transition();
         if (fullstop == FULLSTOP_SHUTDOWN) {
-                printk(KERN_WARNING /* but going down anyway, so... */
+                pr_warn(/* but going down anyway, so... */
                        "Concurrent 'rmmod rcutorture' and shutdown illegal!\n");
                 mutex_unlock(&fullstop_mutex);
                 schedule_timeout_uninterruptible(10);
@@ -1938,17 +1971,17 @@ rcu_torture_init(void)
                         break;
         }
         if (i == ARRAY_SIZE(torture_ops)) {
-                printk(KERN_ALERT "rcu-torture: invalid torture type: \"%s\"\n",
-                       torture_type);
-                printk(KERN_ALERT "rcu-torture types:");
+                pr_alert("rcu-torture: invalid torture type: \"%s\"\n",
+                         torture_type);
+                pr_alert("rcu-torture types:");
                 for (i = 0; i < ARRAY_SIZE(torture_ops); i++)
-                        printk(KERN_ALERT " %s", torture_ops[i]->name);
-                printk(KERN_ALERT "\n");
+                        pr_alert(" %s", torture_ops[i]->name);
+                pr_alert("\n");
                 mutex_unlock(&fullstop_mutex);
                 return -EINVAL;
         }
         if (cur_ops->fqs == NULL && fqs_duration != 0) {
-                printk(KERN_ALERT "rcu-torture: ->fqs NULL and non-zero fqs_duration, fqs disabled.\n");
+                pr_alert("rcu-torture: ->fqs NULL and non-zero fqs_duration, fqs disabled.\n");
                 fqs_duration = 0;
         }
         if (cur_ops->init)
@@ -1996,14 +2029,15 @@ rcu_torture_init(void)
         /* Start up the kthreads. */
 
         VERBOSE_PRINTK_STRING("Creating rcu_torture_writer task");
-        writer_task = kthread_run(rcu_torture_writer, NULL,
-                                  "rcu_torture_writer");
+        writer_task = kthread_create(rcu_torture_writer, NULL,
+                                     "rcu_torture_writer");
         if (IS_ERR(writer_task)) {
                 firsterr = PTR_ERR(writer_task);
                 VERBOSE_PRINTK_ERRSTRING("Failed to create writer");
                 writer_task = NULL;
                 goto unwind;
         }
+        wake_up_process(writer_task);
         fakewriter_tasks = kzalloc(nfakewriters * sizeof(fakewriter_tasks[0]),
                                    GFP_KERNEL);
         if (fakewriter_tasks == NULL) {
@@ -2118,14 +2152,15 @@ rcu_torture_init(void)
         }
         if (shutdown_secs > 0) {
                 shutdown_time = jiffies + shutdown_secs * HZ;
-                shutdown_task = kthread_run(rcu_torture_shutdown, NULL,
-                                            "rcu_torture_shutdown");
+                shutdown_task = kthread_create(rcu_torture_shutdown, NULL,
+                                               "rcu_torture_shutdown");
                 if (IS_ERR(shutdown_task)) {
                         firsterr = PTR_ERR(shutdown_task);
                         VERBOSE_PRINTK_ERRSTRING("Failed to create shutdown");
                         shutdown_task = NULL;
                         goto unwind;
                 }
+                wake_up_process(shutdown_task);
         }
         i = rcu_torture_onoff_init();
         if (i != 0) {
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index f280e542e3e9..4fb2376ddf06 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -52,6 +52,7 @@
 #include <linux/prefetch.h>
 #include <linux/delay.h>
 #include <linux/stop_machine.h>
+#include <linux/random.h>
 
 #include "rcutree.h"
 #include <trace/events/rcu.h>
@@ -61,6 +62,7 @@
 /* Data structures. */
 
 static struct lock_class_key rcu_node_class[RCU_NUM_LVLS];
+static struct lock_class_key rcu_fqs_class[RCU_NUM_LVLS];
 
 #define RCU_STATE_INITIALIZER(sname, cr) { \
         .level = { &sname##_state.node[0] }, \
@@ -72,7 +74,6 @@ static struct lock_class_key rcu_node_class[RCU_NUM_LVLS];
         .orphan_nxttail = &sname##_state.orphan_nxtlist, \
         .orphan_donetail = &sname##_state.orphan_donelist, \
         .barrier_mutex = __MUTEX_INITIALIZER(sname##_state.barrier_mutex), \
-        .fqslock = __RAW_SPIN_LOCK_UNLOCKED(&sname##_state.fqslock), \
         .name = #sname, \
 }
 
@@ -88,7 +89,7 @@ LIST_HEAD(rcu_struct_flavors);
 
 /* Increase (but not decrease) the CONFIG_RCU_FANOUT_LEAF at boot time. */
 static int rcu_fanout_leaf = CONFIG_RCU_FANOUT_LEAF;
-module_param(rcu_fanout_leaf, int, 0);
+module_param(rcu_fanout_leaf, int, 0444);
 int rcu_num_lvls __read_mostly = RCU_NUM_LVLS;
 static int num_rcu_lvl[] = {  /* Number of rcu_nodes at specified level. */
         NUM_RCU_LVL_0,
@@ -133,13 +134,12 @@ static int rcu_scheduler_fully_active __read_mostly;
  */
 static DEFINE_PER_CPU(struct task_struct *, rcu_cpu_kthread_task);
 DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_status);
-DEFINE_PER_CPU(int, rcu_cpu_kthread_cpu);
 DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_loops);
 DEFINE_PER_CPU(char, rcu_cpu_has_work);
 
 #endif /* #ifdef CONFIG_RCU_BOOST */
 
-static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu);
+static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu);
 static void invoke_rcu_core(void);
 static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp);
 
@@ -175,8 +175,6 @@ void rcu_sched_qs(int cpu)
 {
         struct rcu_data *rdp = &per_cpu(rcu_sched_data, cpu);
 
-        rdp->passed_quiesce_gpnum = rdp->gpnum;
-        barrier();
         if (rdp->passed_quiesce == 0)
                 trace_rcu_grace_period("rcu_sched", rdp->gpnum, "cpuqs");
         rdp->passed_quiesce = 1;
@@ -186,8 +184,6 @@ void rcu_bh_qs(int cpu)
 {
         struct rcu_data *rdp = &per_cpu(rcu_bh_data, cpu);
 
-        rdp->passed_quiesce_gpnum = rdp->gpnum;
-        barrier();
         if (rdp->passed_quiesce == 0)
                 trace_rcu_grace_period("rcu_bh", rdp->gpnum, "cpuqs");
         rdp->passed_quiesce = 1;
@@ -210,15 +206,18 @@ EXPORT_SYMBOL_GPL(rcu_note_context_switch);
 DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = {
         .dynticks_nesting = DYNTICK_TASK_EXIT_IDLE,
         .dynticks = ATOMIC_INIT(1),
+#if defined(CONFIG_RCU_USER_QS) && !defined(CONFIG_RCU_USER_QS_FORCE)
+        .ignore_user_qs = true,
+#endif
 };
 
 static int blimit = 10;         /* Maximum callbacks per rcu_do_batch. */
 static int qhimark = 10000;     /* If this many pending, ignore blimit. */
 static int qlowmark = 100;      /* Once only this many pending, use blimit. */
 
-module_param(blimit, int, 0);
-module_param(qhimark, int, 0);
-module_param(qlowmark, int, 0);
+module_param(blimit, int, 0444);
+module_param(qhimark, int, 0444);
+module_param(qlowmark, int, 0444);
 
 int rcu_cpu_stall_suppress __read_mostly; /* 1 = suppress stall warnings. */
 int rcu_cpu_stall_timeout __read_mostly = CONFIG_RCU_CPU_STALL_TIMEOUT;
@@ -226,7 +225,14 @@ int rcu_cpu_stall_timeout __read_mostly = CONFIG_RCU_CPU_STALL_TIMEOUT;
 module_param(rcu_cpu_stall_suppress, int, 0644);
 module_param(rcu_cpu_stall_timeout, int, 0644);
 
-static void force_quiescent_state(struct rcu_state *rsp, int relaxed);
+static ulong jiffies_till_first_fqs = RCU_JIFFIES_TILL_FORCE_QS;
+static ulong jiffies_till_next_fqs = RCU_JIFFIES_TILL_FORCE_QS;
+
+module_param(jiffies_till_first_fqs, ulong, 0644);
+module_param(jiffies_till_next_fqs, ulong, 0644);
+
+static void force_qs_rnp(struct rcu_state *rsp, int (*f)(struct rcu_data *));
+static void force_quiescent_state(struct rcu_state *rsp);
 static int rcu_pending(int cpu);
 
 /*
@@ -252,7 +258,7 @@ EXPORT_SYMBOL_GPL(rcu_batches_completed_bh);
  */
 void rcu_bh_force_quiescent_state(void)
 {
-        force_quiescent_state(&rcu_bh_state, 0);
+        force_quiescent_state(&rcu_bh_state);
 }
 EXPORT_SYMBOL_GPL(rcu_bh_force_quiescent_state);
 
@@ -286,7 +292,7 @@ EXPORT_SYMBOL_GPL(rcutorture_record_progress);
  */
 void rcu_sched_force_quiescent_state(void)
 {
-        force_quiescent_state(&rcu_sched_state, 0);
+        force_quiescent_state(&rcu_sched_state);
 }
 EXPORT_SYMBOL_GPL(rcu_sched_force_quiescent_state);
 
@@ -305,7 +311,9 @@ cpu_has_callbacks_ready_to_invoke(struct rcu_data *rdp)
 static int
 cpu_needs_another_gp(struct rcu_state *rsp, struct rcu_data *rdp)
 {
-        return *rdp->nxttail[RCU_DONE_TAIL] && !rcu_gp_in_progress(rsp);
+        return *rdp->nxttail[RCU_DONE_TAIL +
+                             ACCESS_ONCE(rsp->completed) != rdp->completed] &&
+               !rcu_gp_in_progress(rsp);
 }
 
 /*
@@ -317,45 +325,17 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp)
 }
 
 /*
- * If the specified CPU is offline, tell the caller that it is in
- * a quiescent state.  Otherwise, whack it with a reschedule IPI.
- * Grace periods can end up waiting on an offline CPU when that
- * CPU is in the process of coming online -- it will be added to the
- * rcu_node bitmasks before it actually makes it online.  The same thing
- * can happen while a CPU is in the process of coming online.  Because this
- * race is quite rare, we check for it after detecting that the grace
- * period has been delayed rather than checking each and every CPU
- * each and every time we start a new grace period.
- */
-static int rcu_implicit_offline_qs(struct rcu_data *rdp)
-{
-        /*
-         * If the CPU is offline for more than a jiffy, it is in a quiescent
-         * state.  We can trust its state not to change because interrupts
-         * are disabled.  The reason for the jiffy's worth of slack is to
-         * handle CPUs initializing on the way up and finding their way
-         * to the idle loop on the way down.
-         */
-        if (cpu_is_offline(rdp->cpu) &&
-            ULONG_CMP_LT(rdp->rsp->gp_start + 2, jiffies)) {
-                trace_rcu_fqs(rdp->rsp->name, rdp->gpnum, rdp->cpu, "ofl");
-                rdp->offline_fqs++;
-                return 1;
-        }
-        return 0;
-}
-
-/*
- * rcu_idle_enter_common - inform RCU that current CPU is moving towards idle
+ * rcu_eqs_enter_common - current CPU is moving towards extended quiescent state
  *
  * If the new value of the ->dynticks_nesting counter now is zero,
  * we really have entered idle, and must do the appropriate accounting.
  * The caller must have disabled interrupts.
  */
-static void rcu_idle_enter_common(struct rcu_dynticks *rdtp, long long oldval)
+static void rcu_eqs_enter_common(struct rcu_dynticks *rdtp, long long oldval,
+                                bool user)
 {
         trace_rcu_dyntick("Start", oldval, 0);
-        if (!is_idle_task(current)) {
+        if (!user && !is_idle_task(current)) {
                 struct task_struct *idle = idle_task(smp_processor_id());
 
                 trace_rcu_dyntick("Error on entry: not idle task", oldval, 0);
@@ -372,7 +352,7 @@ static void rcu_idle_enter_common(struct rcu_dynticks *rdtp, long long oldval)
         WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
 
         /*
-         * The idle task is not permitted to enter the idle loop while
+         * It is illegal to enter an extended quiescent state while
          * in an RCU read-side critical section.
          */
         rcu_lockdep_assert(!lock_is_held(&rcu_lock_map),
@@ -383,6 +363,25 @@ static void rcu_idle_enter_common(struct rcu_dynticks *rdtp, long long oldval)
                            "Illegal idle entry in RCU-sched read-side critical section.");
 }
 
+/*
+ * Enter an RCU extended quiescent state, which can be either the
+ * idle loop or adaptive-tickless usermode execution.
+ */
+static void rcu_eqs_enter(bool user)
+{
+        long long oldval;
+        struct rcu_dynticks *rdtp;
+
+        rdtp = &__get_cpu_var(rcu_dynticks);
+        oldval = rdtp->dynticks_nesting;
+        WARN_ON_ONCE((oldval & DYNTICK_TASK_NEST_MASK) == 0);
+        if ((oldval & DYNTICK_TASK_NEST_MASK) == DYNTICK_TASK_NEST_VALUE)
+                rdtp->dynticks_nesting = 0;
+        else
+                rdtp->dynticks_nesting -= DYNTICK_TASK_NEST_VALUE;
+        rcu_eqs_enter_common(rdtp, oldval, user);
+}
+
 /**
  * rcu_idle_enter - inform RCU that current CPU is entering idle
  *
@@ -398,21 +397,70 @@ static void rcu_idle_enter_common(struct rcu_dynticks *rdtp, long long oldval)
 void rcu_idle_enter(void)
 {
         unsigned long flags;
-        long long oldval;
+
+        local_irq_save(flags);
+        rcu_eqs_enter(false);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL_GPL(rcu_idle_enter);
+
+#ifdef CONFIG_RCU_USER_QS
+/**
+ * rcu_user_enter - inform RCU that we are resuming userspace.
+ *
+ * Enter RCU idle mode right before resuming userspace.  No use of RCU
+ * is permitted between this call and rcu_user_exit(). This way the
+ * CPU doesn't need to maintain the tick for RCU maintenance purposes
+ * when the CPU runs in userspace.
+ */
+void rcu_user_enter(void)
+{
+        unsigned long flags;
         struct rcu_dynticks *rdtp;
 
+        /*
+         * Some contexts may involve an exception occuring in an irq,
+         * leading to that nesting:
+         * rcu_irq_enter() rcu_user_exit() rcu_user_exit() rcu_irq_exit()
+         * This would mess up the dyntick_nesting count though. And rcu_irq_*()
+         * helpers are enough to protect RCU uses inside the exception. So
+         * just return immediately if we detect we are in an IRQ.
+         */
+        if (in_interrupt())
+                return;
+
+        WARN_ON_ONCE(!current->mm);
+
         local_irq_save(flags);
         rdtp = &__get_cpu_var(rcu_dynticks);
-        oldval = rdtp->dynticks_nesting;
-        WARN_ON_ONCE((oldval & DYNTICK_TASK_NEST_MASK) == 0);
-        if ((oldval & DYNTICK_TASK_NEST_MASK) == DYNTICK_TASK_NEST_VALUE)
-                rdtp->dynticks_nesting = 0;
-        else
-                rdtp->dynticks_nesting -= DYNTICK_TASK_NEST_VALUE;
-        rcu_idle_enter_common(rdtp, oldval);
+        if (!rdtp->ignore_user_qs && !rdtp->in_user) {
+                rdtp->in_user = true;
+                rcu_eqs_enter(true);
+        }
         local_irq_restore(flags);
 }
-EXPORT_SYMBOL_GPL(rcu_idle_enter);
+
+/**
+ * rcu_user_enter_after_irq - inform RCU that we are going to resume userspace
+ * after the current irq returns.
+ *
+ * This is similar to rcu_user_enter() but in the context of a non-nesting
+ * irq. After this call, RCU enters into idle mode when the interrupt
+ * returns.
+ */
+void rcu_user_enter_after_irq(void)
+{
+        unsigned long flags;
+        struct rcu_dynticks *rdtp;
+
+        local_irq_save(flags);
+        rdtp = &__get_cpu_var(rcu_dynticks);
+        /* Ensure this irq is interrupting a non-idle RCU state.  */
+        WARN_ON_ONCE(!(rdtp->dynticks_nesting & DYNTICK_TASK_MASK));
+        rdtp->dynticks_nesting = 1;
+        local_irq_restore(flags);
+}
+#endif /* CONFIG_RCU_USER_QS */
 
 /**
  * rcu_irq_exit - inform RCU that current CPU is exiting irq towards idle
@@ -444,18 +492,19 @@ void rcu_irq_exit(void)
         if (rdtp->dynticks_nesting)
                 trace_rcu_dyntick("--=", oldval, rdtp->dynticks_nesting);
         else
-                rcu_idle_enter_common(rdtp, oldval);
+                rcu_eqs_enter_common(rdtp, oldval, true);
         local_irq_restore(flags);
 }
 
 /*
- * rcu_idle_exit_common - inform RCU that current CPU is moving away from idle
+ * rcu_eqs_exit_common - current CPU moving away from extended quiescent state
  *
  * If the new value of the ->dynticks_nesting counter was previously zero,
  * we really have exited idle, and must do the appropriate accounting.
  * The caller must have disabled interrupts.
  */
-static void rcu_idle_exit_common(struct rcu_dynticks *rdtp, long long oldval)
+static void rcu_eqs_exit_common(struct rcu_dynticks *rdtp, long long oldval,
+                               int user)
 {
         smp_mb__before_atomic_inc();  /* Force ordering w/previous sojourn. */
         atomic_inc(&rdtp->dynticks);
@@ -464,7 +513,7 @@ static void rcu_idle_exit_common(struct rcu_dynticks *rdtp, long long oldval)
         WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
         rcu_cleanup_after_idle(smp_processor_id());
         trace_rcu_dyntick("End", oldval, rdtp->dynticks_nesting);
-        if (!is_idle_task(current)) {
+        if (!user && !is_idle_task(current)) {
                 struct task_struct *idle = idle_task(smp_processor_id());
 
                 trace_rcu_dyntick("Error on exit: not idle task",
@@ -476,6 +525,25 @@ static void rcu_idle_exit_common(struct rcu_dynticks *rdtp, long long oldval)
         }
 }
 
+/*
+ * Exit an RCU extended quiescent state, which can be either the
+ * idle loop or adaptive-tickless usermode execution.
+ */
+static void rcu_eqs_exit(bool user)
+{
+        struct rcu_dynticks *rdtp;
+        long long oldval;
+
+        rdtp = &__get_cpu_var(rcu_dynticks);
+        oldval = rdtp->dynticks_nesting;
+        WARN_ON_ONCE(oldval < 0);
+        if (oldval & DYNTICK_TASK_NEST_MASK)
+                rdtp->dynticks_nesting += DYNTICK_TASK_NEST_VALUE;
+        else
+                rdtp->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
+        rcu_eqs_exit_common(rdtp, oldval, user);
+}
+
 /**
  * rcu_idle_exit - inform RCU that current CPU is leaving idle
  *
@@ -490,21 +558,67 @@ static void rcu_idle_exit_common(struct rcu_dynticks *rdtp, long long oldval)
 void rcu_idle_exit(void)
 {
         unsigned long flags;
+
+        local_irq_save(flags);
+        rcu_eqs_exit(false);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL_GPL(rcu_idle_exit);
+
+#ifdef CONFIG_RCU_USER_QS
+/**
+ * rcu_user_exit - inform RCU that we are exiting userspace.
+ *
+ * Exit RCU idle mode while entering the kernel because it can
+ * run a RCU read side critical section anytime.
+ */
+void rcu_user_exit(void)
+{
+        unsigned long flags;
         struct rcu_dynticks *rdtp;
-        long long oldval;
+
+        /*
+         * Some contexts may involve an exception occuring in an irq,
+         * leading to that nesting:
+         * rcu_irq_enter() rcu_user_exit() rcu_user_exit() rcu_irq_exit()
+         * This would mess up the dyntick_nesting count though. And rcu_irq_*()
+         * helpers are enough to protect RCU uses inside the exception. So
+         * just return immediately if we detect we are in an IRQ.
+         */
+        if (in_interrupt())
+                return;
 
         local_irq_save(flags);
         rdtp = &__get_cpu_var(rcu_dynticks);
-        oldval = rdtp->dynticks_nesting;
-        WARN_ON_ONCE(oldval < 0);
-        if (oldval & DYNTICK_TASK_NEST_MASK)
-                rdtp->dynticks_nesting += DYNTICK_TASK_NEST_VALUE;
-        else
-                rdtp->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
-        rcu_idle_exit_common(rdtp, oldval);
+        if (rdtp->in_user) {
+                rdtp->in_user = false;
+                rcu_eqs_exit(true);
+        }
         local_irq_restore(flags);
 }
-EXPORT_SYMBOL_GPL(rcu_idle_exit);
+
+/**
+ * rcu_user_exit_after_irq - inform RCU that we won't resume to userspace
+ * idle mode after the current non-nesting irq returns.
+ *
+ * This is similar to rcu_user_exit() but in the context of an irq.
+ * This is called when the irq has interrupted a userspace RCU idle mode
+ * context. When the current non-nesting interrupt returns after this call,
+ * the CPU won't restore the RCU idle mode.
+ */
+void rcu_user_exit_after_irq(void)
+{
+        unsigned long flags;
+        struct rcu_dynticks *rdtp;
+
+        local_irq_save(flags);
+        rdtp = &__get_cpu_var(rcu_dynticks);
+        /* Ensure we are interrupting an RCU idle mode. */
+        WARN_ON_ONCE(rdtp->dynticks_nesting & DYNTICK_TASK_NEST_MASK);
+        rdtp->dynticks_nesting += DYNTICK_TASK_EXIT_IDLE;
+        local_irq_restore(flags);
+}
+#endif /* CONFIG_RCU_USER_QS */
 
 /**
  * rcu_irq_enter - inform RCU that current CPU is entering irq away from idle
@@ -539,7 +653,7 @@ void rcu_irq_enter(void)
         if (oldval)
                 trace_rcu_dyntick("++=", oldval, rdtp->dynticks_nesting);
         else
-                rcu_idle_exit_common(rdtp, oldval);
+                rcu_eqs_exit_common(rdtp, oldval, true);
         local_irq_restore(flags);
 }
 
@@ -603,6 +717,21 @@ int rcu_is_cpu_idle(void)
 }
 EXPORT_SYMBOL(rcu_is_cpu_idle);
 
+#ifdef CONFIG_RCU_USER_QS
+void rcu_user_hooks_switch(struct task_struct *prev,
+                           struct task_struct *next)
+{
+        struct rcu_dynticks *rdtp;
+
+        /* Interrupts are disabled in context switch */
+        rdtp = &__get_cpu_var(rcu_dynticks);
+        if (!rdtp->ignore_user_qs) {
+                clear_tsk_thread_flag(prev, TIF_NOHZ);
+                set_tsk_thread_flag(next, TIF_NOHZ);
+        }
+}
+#endif /* #ifdef CONFIG_RCU_USER_QS */
+
 #if defined(CONFIG_PROVE_RCU) && defined(CONFIG_HOTPLUG_CPU)
 
 /*
@@ -673,7 +802,7 @@ static int dyntick_save_progress_counter(struct rcu_data *rdp)
  * Return true if the specified CPU has passed through a quiescent
  * state by virtue of being in or having passed through an dynticks
  * idle state since the last call to dyntick_save_progress_counter()
- * for this same CPU.
+ * for this same CPU, or by virtue of having been offline.
  */
 static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
 {
@@ -697,8 +826,26 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
                 return 1;
         }
 
-        /* Go check for the CPU being offline. */
-        return rcu_implicit_offline_qs(rdp);
+        /*
+         * Check for the CPU being offline, but only if the grace period
+         * is old enough.  We don't need to worry about the CPU changing
+         * state: If we see it offline even once, it has been through a
+         * quiescent state.
+         *
+         * The reason for insisting that the grace period be at least
+         * one jiffy old is that CPUs that are not quite online and that
+         * have just gone offline can still execute RCU read-side critical
+         * sections.
+         */
+        if (ULONG_CMP_GE(rdp->rsp->gp_start + 2, jiffies))
+                return 0;  /* Grace period is not old enough. */
+        barrier();
+        if (cpu_is_offline(rdp->cpu)) {
+                trace_rcu_fqs(rdp->rsp->name, rdp->gpnum, rdp->cpu, "ofl");
+                rdp->offline_fqs++;
+                return 1;
+        }
+        return 0;
 }
 
 static int jiffies_till_stall_check(void)
@@ -755,14 +902,15 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
         rcu_for_each_leaf_node(rsp, rnp) {
                 raw_spin_lock_irqsave(&rnp->lock, flags);
                 ndetected += rcu_print_task_stall(rnp);
+                if (rnp->qsmask != 0) {
+                        for (cpu = 0; cpu <= rnp->grphi - rnp->grplo; cpu++)
+                                if (rnp->qsmask & (1UL << cpu)) {
+                                        print_cpu_stall_info(rsp,
+                                                             rnp->grplo + cpu);
+                                        ndetected++;
+                                }
+                }
                 raw_spin_unlock_irqrestore(&rnp->lock, flags);
-                if (rnp->qsmask == 0)
-                        continue;
-                for (cpu = 0; cpu <= rnp->grphi - rnp->grplo; cpu++)
-                        if (rnp->qsmask & (1UL << cpu)) {
-                                print_cpu_stall_info(rsp, rnp->grplo + cpu);
-                                ndetected++;
-                        }
         }
 
         /*
@@ -782,11 +930,11 @@ static void print_other_cpu_stall(struct rcu_state *rsp)
         else if (!trigger_all_cpu_backtrace())
                 dump_stack();
 
-        /* If so configured, complain about tasks blocking the grace period. */
+        /* Complain about tasks blocking the grace period. */
 
         rcu_print_detail_task_stall(rsp);
 
-        force_quiescent_state(rsp, 0);  /* Kick them all. */
+        force_quiescent_state(rsp);  /* Kick them all. */
 }
 
 static void print_cpu_stall(struct rcu_state *rsp)
@@ -827,7 +975,8 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
         j = ACCESS_ONCE(jiffies);
         js = ACCESS_ONCE(rsp->jiffies_stall);
         rnp = rdp->mynode;
-        if ((ACCESS_ONCE(rnp->qsmask) & rdp->grpmask) && ULONG_CMP_GE(j, js)) {
+        if (rcu_gp_in_progress(rsp) &&
+            (ACCESS_ONCE(rnp->qsmask) & rdp->grpmask) && ULONG_CMP_GE(j, js)) {
 
                 /* We haven't checked in, so go dump stack. */
                 print_cpu_stall(rsp);
@@ -889,12 +1038,8 @@ static void __note_new_gpnum(struct rcu_state *rsp, struct rcu_node *rnp, struct
                  */
                 rdp->gpnum = rnp->gpnum;
                 trace_rcu_grace_period(rsp->name, rdp->gpnum, "cpustart");
-                if (rnp->qsmask & rdp->grpmask) {
-                        rdp->qs_pending = 1;
-                        rdp->passed_quiesce = 0;
-                } else {
-                        rdp->qs_pending = 0;
-                }
+                rdp->passed_quiesce = 0;
+                rdp->qs_pending = !!(rnp->qsmask & rdp->grpmask);
                 zero_cpu_stall_ticks(rdp);
         }
 }
@@ -974,10 +1119,13 @@ __rcu_process_gp_end(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_dat
                  * our behalf. Catch up with this state to avoid noting
                  * spurious new grace periods.  If another grace period
                  * has started, then rnp->gpnum will have advanced, so
-                 * we will detect this later on.
+                 * we will detect this later on.  Of course, any quiescent
+                 * states we found for the old GP are now invalid.
                  */
-                if (ULONG_CMP_LT(rdp->gpnum, rdp->completed))
+                if (ULONG_CMP_LT(rdp->gpnum, rdp->completed)) {
                         rdp->gpnum = rdp->completed;
+                        rdp->passed_quiesce = 0;
+                }
 
                 /*
                  * If RCU does not need a quiescent state from this CPU,
@@ -1021,97 +1169,56 @@ rcu_start_gp_per_cpu(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_dat
         /* Prior grace period ended, so advance callbacks for current CPU. */
         __rcu_process_gp_end(rsp, rnp, rdp);
 
-        /*
-         * Because this CPU just now started the new grace period, we know
-         * that all of its callbacks will be covered by this upcoming grace
-         * period, even the ones that were registered arbitrarily recently.
-         * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL.
-         *
-         * Other CPUs cannot be sure exactly when the grace period started.
-         * Therefore, their recently registered callbacks must pass through
-         * an additional RCU_NEXT_READY stage, so that they will be handled
-         * by the next RCU grace period.
-         */
-        rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
-        rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
-
         /* Set state so that this CPU will detect the next quiescent state. */
         __note_new_gpnum(rsp, rnp, rdp);
 }
 
 /*
- * Start a new RCU grace period if warranted, re-initializing the hierarchy
- * in preparation for detecting the next grace period.  The caller must hold
- * the root node's ->lock, which is released before return.  Hard irqs must
- * be disabled.
- *
- * Note that it is legal for a dying CPU (which is marked as offline) to
- * invoke this function.  This can happen when the dying CPU reports its
- * quiescent state.
+ * Initialize a new grace period.
  */
-static void
-rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
-        __releases(rcu_get_root(rsp)->lock)
+static int rcu_gp_init(struct rcu_state *rsp)
 {
-        struct rcu_data *rdp = this_cpu_ptr(rsp->rda);
+        struct rcu_data *rdp;
         struct rcu_node *rnp = rcu_get_root(rsp);
 
-        if (!rcu_scheduler_fully_active ||
-            !cpu_needs_another_gp(rsp, rdp)) {
-                /*
-                 * Either the scheduler hasn't yet spawned the first
-                 * non-idle task or this CPU does not need another
-                 * grace period.  Either way, don't start a new grace
-                 * period.
-                 */
-                raw_spin_unlock_irqrestore(&rnp->lock, flags);
-                return;
-        }
+        raw_spin_lock_irq(&rnp->lock);
+        rsp->gp_flags = 0; /* Clear all flags: New grace period. */
 
-        if (rsp->fqs_active) {
-                /*
-                 * This CPU needs a grace period, but force_quiescent_state()
-                 * is running.  Tell it to start one on this CPU's behalf.
-                 */
-                rsp->fqs_need_gp = 1;
-                raw_spin_unlock_irqrestore(&rnp->lock, flags);
-                return;
+        if (rcu_gp_in_progress(rsp)) {
+                /* Grace period already in progress, don't start another.  */
+                raw_spin_unlock_irq(&rnp->lock);
+                return 0;
         }
 
         /* Advance to a new grace period and initialize state. */
         rsp->gpnum++;
         trace_rcu_grace_period(rsp->name, rsp->gpnum, "start");
-        WARN_ON_ONCE(rsp->fqs_state == RCU_GP_INIT);
-        rsp->fqs_state = RCU_GP_INIT; /* Hold off force_quiescent_state. */
-        rsp->jiffies_force_qs = jiffies + RCU_JIFFIES_TILL_FORCE_QS;
         record_gp_stall_check_time(rsp);
-        raw_spin_unlock(&rnp->lock);  /* leave irqs disabled. */
+        raw_spin_unlock_irq(&rnp->lock);
 
         /* Exclude any concurrent CPU-hotplug operations. */
-        raw_spin_lock(&rsp->onofflock);  /* irqs already disabled. */
+        get_online_cpus();
 
         /*
          * Set the quiescent-state-needed bits in all the rcu_node
-         * structures for all currently online CPUs in breadth-first
-         * order, starting from the root rcu_node structure.  This
-         * operation relies on the layout of the hierarchy within the
-         * rsp->node[] array.  Note that other CPUs will access only
-         * the leaves of the hierarchy, which still indicate that no
+         * structures for all currently online CPUs in breadth-first order,
+         * starting from the root rcu_node structure, relying on the layout
+         * of the tree within the rsp->node[] array.  Note that other CPUs
+         * will access only the leaves of the hierarchy, thus seeing that no
          * grace period is in progress, at least until the corresponding
          * leaf node has been initialized.  In addition, we have excluded
          * CPU-hotplug operations.
          *
-         * Note that the grace period cannot complete until we finish
-         * the initialization process, as there will be at least one
-         * qsmask bit set in the root node until that time, namely the
-         * one corresponding to this CPU, due to the fact that we have
-         * irqs disabled.
+         * The grace period cannot complete until the initialization
+         * process finishes, because this kthread handles both.
          */
         rcu_for_each_node_breadth_first(rsp, rnp) {
-                raw_spin_lock(&rnp->lock);      /* irqs already disabled. */
+                raw_spin_lock_irq(&rnp->lock);
+                rdp = this_cpu_ptr(rsp->rda);
                 rcu_preempt_check_blocked_tasks(rnp);
                 rnp->qsmask = rnp->qsmaskinit;
                 rnp->gpnum = rsp->gpnum;
+                WARN_ON_ONCE(rnp->completed != rsp->completed);
                 rnp->completed = rsp->completed;
                 if (rnp == rdp->mynode)
                         rcu_start_gp_per_cpu(rsp, rnp, rdp);
@@ -1119,37 +1226,54 @@ rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
                 trace_rcu_grace_period_init(rsp->name, rnp->gpnum,
                                             rnp->level, rnp->grplo,
                                             rnp->grphi, rnp->qsmask);
-                raw_spin_unlock(&rnp->lock);    /* irqs remain disabled. */
+                raw_spin_unlock_irq(&rnp->lock);
+#ifdef CONFIG_PROVE_RCU_DELAY
+                if ((random32() % (rcu_num_nodes * 8)) == 0)
+                        schedule_timeout_uninterruptible(2);
+#endif /* #ifdef CONFIG_PROVE_RCU_DELAY */
+                cond_resched();
         }
 
-        rnp = rcu_get_root(rsp);
-        raw_spin_lock(&rnp->lock);              /* irqs already disabled. */
-        rsp->fqs_state = RCU_SIGNAL_INIT; /* force_quiescent_state now OK. */
-        raw_spin_unlock(&rnp->lock);            /* irqs remain disabled. */
-        raw_spin_unlock_irqrestore(&rsp->onofflock, flags);
+        put_online_cpus();
+        return 1;
 }
 
 /*
- * Report a full set of quiescent states to the specified rcu_state
- * data structure.  This involves cleaning up after the prior grace
- * period and letting rcu_start_gp() start up the next grace period
- * if one is needed.  Note that the caller must hold rnp->lock, as
- * required by rcu_start_gp(), which will release it.
+ * Do one round of quiescent-state forcing.
  */
-static void rcu_report_qs_rsp(struct rcu_state *rsp, unsigned long flags)
-        __releases(rcu_get_root(rsp)->lock)
+int rcu_gp_fqs(struct rcu_state *rsp, int fqs_state_in)
 {
-        unsigned long gp_duration;
+        int fqs_state = fqs_state_in;
         struct rcu_node *rnp = rcu_get_root(rsp);
-        struct rcu_data *rdp = this_cpu_ptr(rsp->rda);
 
-        WARN_ON_ONCE(!rcu_gp_in_progress(rsp));
+        rsp->n_force_qs++;
+        if (fqs_state == RCU_SAVE_DYNTICK) {
+                /* Collect dyntick-idle snapshots. */
+                force_qs_rnp(rsp, dyntick_save_progress_counter);
+                fqs_state = RCU_FORCE_QS;
+        } else {
+                /* Handle dyntick-idle and offline CPUs. */
+                force_qs_rnp(rsp, rcu_implicit_dynticks_qs);
+        }
+        /* Clear flag to prevent immediate re-entry. */
+        if (ACCESS_ONCE(rsp->gp_flags) & RCU_GP_FLAG_FQS) {
+                raw_spin_lock_irq(&rnp->lock);
+                rsp->gp_flags &= ~RCU_GP_FLAG_FQS;
+                raw_spin_unlock_irq(&rnp->lock);
+        }
+        return fqs_state;
+}
 
-        /*
-         * Ensure that all grace-period and pre-grace-period activity
-         * is seen before the assignment to rsp->completed.
-         */
-        smp_mb(); /* See above block comment. */
+/*
+ * Clean up after the old grace period.
+ */
+static void rcu_gp_cleanup(struct rcu_state *rsp)
+{
+        unsigned long gp_duration;
+        struct rcu_data *rdp;
+        struct rcu_node *rnp = rcu_get_root(rsp);
+
+        raw_spin_lock_irq(&rnp->lock);
         gp_duration = jiffies - rsp->gp_start;
         if (gp_duration > rsp->gp_max)
                 rsp->gp_max = gp_duration;
@@ -1161,35 +1285,149 @@ static void rcu_report_qs_rsp(struct rcu_state *rsp, unsigned long flags)
          * they can do to advance the grace period.  It is therefore
          * safe for us to drop the lock in order to mark the grace
          * period as completed in all of the rcu_node structures.
-         *
-         * But if this CPU needs another grace period, it will take
-         * care of this while initializing the next grace period.
-         * We use RCU_WAIT_TAIL instead of the usual RCU_DONE_TAIL
-         * because the callbacks have not yet been advanced: Those
-         * callbacks are waiting on the grace period that just now
-         * completed.
          */
-        if (*rdp->nxttail[RCU_WAIT_TAIL] == NULL) {
-                raw_spin_unlock(&rnp->lock);     /* irqs remain disabled. */
+        raw_spin_unlock_irq(&rnp->lock);
 
-                /*
-                 * Propagate new ->completed value to rcu_node structures
-                 * so that other CPUs don't have to wait until the start
-                 * of the next grace period to process their callbacks.
-                 */
-                rcu_for_each_node_breadth_first(rsp, rnp) {
-                        raw_spin_lock(&rnp->lock); /* irqs already disabled. */
-                        rnp->completed = rsp->gpnum;
-                        raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
-                }
-                rnp = rcu_get_root(rsp);
-                raw_spin_lock(&rnp->lock); /* irqs already disabled. */
+        /*
+         * Propagate new ->completed value to rcu_node structures so
+         * that other CPUs don't have to wait until the start of the next
+         * grace period to process their callbacks.  This also avoids
+         * some nasty RCU grace-period initialization races by forcing
+         * the end of the current grace period to be completely recorded in
+         * all of the rcu_node structures before the beginning of the next
+         * grace period is recorded in any of the rcu_node structures.
+         */
+        rcu_for_each_node_breadth_first(rsp, rnp) {
+                raw_spin_lock_irq(&rnp->lock);
+                rnp->completed = rsp->gpnum;
+                raw_spin_unlock_irq(&rnp->lock);
+                cond_resched();
         }
+        rnp = rcu_get_root(rsp);
+        raw_spin_lock_irq(&rnp->lock);
 
-        rsp->completed = rsp->gpnum;  /* Declare the grace period complete. */
+        rsp->completed = rsp->gpnum; /* Declare grace period done. */
         trace_rcu_grace_period(rsp->name, rsp->completed, "end");
         rsp->fqs_state = RCU_GP_IDLE;
-        rcu_start_gp(rsp, flags);  /* releases root node's rnp->lock. */
+        rdp = this_cpu_ptr(rsp->rda);
+        if (cpu_needs_another_gp(rsp, rdp))
+                rsp->gp_flags = 1;
+        raw_spin_unlock_irq(&rnp->lock);
+}
+
+/*
+ * Body of kthread that handles grace periods.
+ */
+static int __noreturn rcu_gp_kthread(void *arg)
+{
+        int fqs_state;
+        unsigned long j;
+        int ret;
+        struct rcu_state *rsp = arg;
+        struct rcu_node *rnp = rcu_get_root(rsp);
+
+        for (;;) {
+
+                /* Handle grace-period start. */
+                for (;;) {
+                        wait_event_interruptible(rsp->gp_wq,
+                                                 rsp->gp_flags &
+                                                 RCU_GP_FLAG_INIT);
+                        if ((rsp->gp_flags & RCU_GP_FLAG_INIT) &&
+                            rcu_gp_init(rsp))
+                                break;
+                        cond_resched();
+                        flush_signals(current);
+                }
+
+                /* Handle quiescent-state forcing. */
+                fqs_state = RCU_SAVE_DYNTICK;
+                j = jiffies_till_first_fqs;
+                if (j > HZ) {
+                        j = HZ;
+                        jiffies_till_first_fqs = HZ;
+                }
+                for (;;) {
+                        rsp->jiffies_force_qs = jiffies + j;
+                        ret = wait_event_interruptible_timeout(rsp->gp_wq,
+                                        (rsp->gp_flags & RCU_GP_FLAG_FQS) ||
+                                        (!ACCESS_ONCE(rnp->qsmask) &&
+                                         !rcu_preempt_blocked_readers_cgp(rnp)),
+                                        j);
+                        /* If grace period done, leave loop. */
+                        if (!ACCESS_ONCE(rnp->qsmask) &&
+                            !rcu_preempt_blocked_readers_cgp(rnp))
+                                break;
+                        /* If time for quiescent-state forcing, do it. */
+                        if (ret == 0 || (rsp->gp_flags & RCU_GP_FLAG_FQS)) {
+                                fqs_state = rcu_gp_fqs(rsp, fqs_state);
+                                cond_resched();
+                        } else {
+                                /* Deal with stray signal. */
+                                cond_resched();
+                                flush_signals(current);
+                        }
+                        j = jiffies_till_next_fqs;
+                        if (j > HZ) {
+                                j = HZ;
+                                jiffies_till_next_fqs = HZ;
+                        } else if (j < 1) {
+                                j = 1;
+                                jiffies_till_next_fqs = 1;
+                        }
+                }
+
+                /* Handle grace-period end. */
+                rcu_gp_cleanup(rsp);
+        }
+}
+
+/*
+ * Start a new RCU grace period if warranted, re-initializing the hierarchy
+ * in preparation for detecting the next grace period.  The caller must hold
+ * the root node's ->lock, which is released before return.  Hard irqs must
+ * be disabled.
+ *
+ * Note that it is legal for a dying CPU (which is marked as offline) to
+ * invoke this function.  This can happen when the dying CPU reports its
+ * quiescent state.
+ */
+static void
+rcu_start_gp(struct rcu_state *rsp, unsigned long flags)
+        __releases(rcu_get_root(rsp)->lock)
+{
+        struct rcu_data *rdp = this_cpu_ptr(rsp->rda);
+        struct rcu_node *rnp = rcu_get_root(rsp);
+
+        if (!rsp->gp_kthread ||
+            !cpu_needs_another_gp(rsp, rdp)) {
+                /*
+                 * Either we have not yet spawned the grace-period
+                 * task or this CPU does not need another grace period.
+                 * Either way, don't start a new grace period.
+                 */
+                raw_spin_unlock_irqrestore(&rnp->lock, flags);
+                return;
+        }
+
+        rsp->gp_flags = RCU_GP_FLAG_INIT;
+        raw_spin_unlock_irqrestore(&rnp->lock, flags);
+        wake_up(&rsp->gp_wq);
+}
+
+/*
+ * Report a full set of quiescent states to the specified rcu_state
+ * data structure.  This involves cleaning up after the prior grace
+ * period and letting rcu_start_gp() start up the next grace period
+ * if one is needed.  Note that the caller must hold rnp->lock, as
+ * required by rcu_start_gp(), which will release it.
+ */
+static void rcu_report_qs_rsp(struct rcu_state *rsp, unsigned long flags)
+        __releases(rcu_get_root(rsp)->lock)
+{
+        WARN_ON_ONCE(!rcu_gp_in_progress(rsp));
+        raw_spin_unlock_irqrestore(&rcu_get_root(rsp)->lock, flags);
+        wake_up(&rsp->gp_wq);  /* Memory barrier implied by wake_up() path. */
 }
 
 /*
@@ -1258,7 +1496,7 @@ rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
  * based on quiescent states detected in an earlier grace period!
  */
 static void
-rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp, long lastgp)
+rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp)
 {
         unsigned long flags;
         unsigned long mask;
@@ -1266,7 +1504,8 @@ rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp, long las
 
         rnp = rdp->mynode;
         raw_spin_lock_irqsave(&rnp->lock, flags);
-        if (lastgp != rnp->gpnum || rnp->completed == rnp->gpnum) {
+        if (rdp->passed_quiesce == 0 || rdp->gpnum != rnp->gpnum ||
+            rnp->completed == rnp->gpnum) {
 
                 /*
                  * The grace period in which this quiescent state was
@@ -1325,7 +1564,7 @@ rcu_check_quiescent_state(struct rcu_state *rsp, struct rcu_data *rdp)
          * Tell RCU we are done (but rcu_report_qs_rdp() will be the
          * judge of that).
          */
-        rcu_report_qs_rdp(rdp->cpu, rsp, rdp, rdp->passed_quiesce_gpnum);
+        rcu_report_qs_rdp(rdp->cpu, rsp, rdp);
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -1390,17 +1629,6 @@ static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
         int i;
         struct rcu_data *rdp = __this_cpu_ptr(rsp->rda);
 
-        /*
-         * If there is an rcu_barrier() operation in progress, then
-         * only the task doing that operation is permitted to adopt
-         * callbacks.  To do otherwise breaks rcu_barrier() and friends
-         * by causing them to fail to wait for the callbacks in the
-         * orphanage.
-         */
-        if (rsp->rcu_barrier_in_progress &&
-            rsp->rcu_barrier_in_progress != current)
-                return;
-
         /* Do the accounting first. */
         rdp->qlen_lazy += rsp->qlen_lazy;
         rdp->qlen += rsp->qlen;
@@ -1455,9 +1683,8 @@ static void rcu_cleanup_dying_cpu(struct rcu_state *rsp)
  * The CPU has been completely removed, and some other CPU is reporting
  * this fact from process context.  Do the remainder of the cleanup,
  * including orphaning the outgoing CPU's RCU callbacks, and also
- * adopting them, if there is no _rcu_barrier() instance running.
- * There can only be one CPU hotplug operation at a time, so no other
- * CPU can be attempting to update rcu_cpu_kthread_task.
+ * adopting them.  There can only be one CPU hotplug operation at a time,
+ * so no other CPU can be attempting to update rcu_cpu_kthread_task.
  */
 static void rcu_cleanup_dead_cpu(int cpu, struct rcu_state *rsp)
 {
@@ -1468,8 +1695,7 @@ static void rcu_cleanup_dead_cpu(int cpu, struct rcu_state *rsp)
         struct rcu_node *rnp = rdp->mynode;  /* Outgoing CPU's rdp & rnp. */
 
         /* Adjust any no-longer-needed kthreads. */
-        rcu_stop_cpu_kthread(cpu);
-        rcu_node_kthread_setaffinity(rnp, -1);
+        rcu_boost_kthread_setaffinity(rnp, -1);
 
         /* Remove the dead CPU from the bitmasks in the rcu_node hierarchy. */
 
@@ -1515,14 +1741,13 @@ static void rcu_cleanup_dead_cpu(int cpu, struct rcu_state *rsp)
         WARN_ONCE(rdp->qlen != 0 || rdp->nxtlist != NULL,
                   "rcu_cleanup_dead_cpu: Callbacks on offline CPU %d: qlen=%lu, nxtlist=%p\n",
                   cpu, rdp->qlen, rdp->nxtlist);
+        init_callback_list(rdp);
+        /* Disallow further callbacks on this CPU. */
+        rdp->nxttail[RCU_NEXT_TAIL] = NULL;
 }
 
 #else /* #ifdef CONFIG_HOTPLUG_CPU */
 
-static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
-{
-}
-
 static void rcu_cleanup_dying_cpu(struct rcu_state *rsp)
 {
 }
@@ -1687,6 +1912,7 @@ static void force_qs_rnp(struct rcu_state *rsp, int (*f)(struct rcu_data *))
         struct rcu_node *rnp;
 
         rcu_for_each_leaf_node(rsp, rnp) {
+                cond_resched();
                 mask = 0;
                 raw_spin_lock_irqsave(&rnp->lock, flags);
                 if (!rcu_gp_in_progress(rsp)) {
@@ -1723,72 +1949,39 @@ static void force_qs_rnp(struct rcu_state *rsp, int (*f)(struct rcu_data *))
  * Force quiescent states on reluctant CPUs, and also detect which
  * CPUs are in dyntick-idle mode.
  */
-static void force_quiescent_state(struct rcu_state *rsp, int relaxed)
+static void force_quiescent_state(struct rcu_state *rsp)
 {
         unsigned long flags;
-        struct rcu_node *rnp = rcu_get_root(rsp);
-
-        trace_rcu_utilization("Start fqs");
-        if (!rcu_gp_in_progress(rsp)) {
-                trace_rcu_utilization("End fqs");
-                return;  /* No grace period in progress, nothing to force. */
-        }
-        if (!raw_spin_trylock_irqsave(&rsp->fqslock, flags)) {
-                rsp->n_force_qs_lh++; /* Inexact, can lose counts.  Tough! */
-                trace_rcu_utilization("End fqs");
-                return; /* Someone else is already on the job. */
-        }
-        if (relaxed && ULONG_CMP_GE(rsp->jiffies_force_qs, jiffies))
-                goto unlock_fqs_ret; /* no emergency and done recently. */
-        rsp->n_force_qs++;
-        raw_spin_lock(&rnp->lock);  /* irqs already disabled */
-        rsp->jiffies_force_qs = jiffies + RCU_JIFFIES_TILL_FORCE_QS;
-        if(!rcu_gp_in_progress(rsp)) {
-                rsp->n_force_qs_ngp++;
-                raw_spin_unlock(&rnp->lock);  /* irqs remain disabled */
-                goto unlock_fqs_ret;  /* no GP in progress, time updated. */
-        }
-        rsp->fqs_active = 1;
-        switch (rsp->fqs_state) {
-        case RCU_GP_IDLE:
-        case RCU_GP_INIT:
-
-                break; /* grace period idle or initializing, ignore. */
-
-        case RCU_SAVE_DYNTICK:
-
-                raw_spin_unlock(&rnp->lock);  /* irqs remain disabled */
-
-                /* Record dyntick-idle state. */
-                force_qs_rnp(rsp, dyntick_save_progress_counter);
-                raw_spin_lock(&rnp->lock);  /* irqs already disabled */
-                if (rcu_gp_in_progress(rsp))
-                        rsp->fqs_state = RCU_FORCE_QS;
-                break;
-
-        case RCU_FORCE_QS:
-
-                /* Check dyntick-idle state, send IPI to laggarts. */
-                raw_spin_unlock(&rnp->lock);  /* irqs remain disabled */
-                force_qs_rnp(rsp, rcu_implicit_dynticks_qs);
-
-                /* Leave state in case more forcing is required. */
-
-                raw_spin_lock(&rnp->lock);  /* irqs already disabled */
-                break;
+        bool ret;
+        struct rcu_node *rnp;
+        struct rcu_node *rnp_old = NULL;
+
+        /* Funnel through hierarchy to reduce memory contention. */
+        rnp = per_cpu_ptr(rsp->rda, raw_smp_processor_id())->mynode;
+        for (; rnp != NULL; rnp = rnp->parent) {
+                ret = (ACCESS_ONCE(rsp->gp_flags) & RCU_GP_FLAG_FQS) ||
+                      !raw_spin_trylock(&rnp->fqslock);
+                if (rnp_old != NULL)
+                        raw_spin_unlock(&rnp_old->fqslock);
+                if (ret) {
+                        rsp->n_force_qs_lh++;
+                        return;
+                }
+                rnp_old = rnp;
         }
-        rsp->fqs_active = 0;
-        if (rsp->fqs_need_gp) {
-                raw_spin_unlock(&rsp->fqslock); /* irqs remain disabled */
-                rsp->fqs_need_gp = 0;
-                rcu_start_gp(rsp, flags); /* releases rnp->lock */
-                trace_rcu_utilization("End fqs");
-                return;
+        /* rnp_old == rcu_get_root(rsp), rnp == NULL. */
+
+        /* Reached the root of the rcu_node tree, acquire lock. */
+        raw_spin_lock_irqsave(&rnp_old->lock, flags);
+        raw_spin_unlock(&rnp_old->fqslock);
+        if (ACCESS_ONCE(rsp->gp_flags) & RCU_GP_FLAG_FQS) {
+                rsp->n_force_qs_lh++;
+                raw_spin_unlock_irqrestore(&rnp_old->lock, flags);
+                return;  /* Someone beat us to it. */
         }
-        raw_spin_unlock(&rnp->lock);  /* irqs remain disabled */
-unlock_fqs_ret:
-        raw_spin_unlock_irqrestore(&rsp->fqslock, flags);
-        trace_rcu_utilization("End fqs");
+        rsp->gp_flags |= RCU_GP_FLAG_FQS;
+        raw_spin_unlock_irqrestore(&rnp_old->lock, flags);
+        wake_up(&rsp->gp_wq);  /* Memory barrier implied by wake_up() path. */
 }
 
 /*
@@ -1805,13 +1998,6 @@ __rcu_process_callbacks(struct rcu_state *rsp)
         WARN_ON_ONCE(rdp->beenonline == 0);
 
         /*
-         * If an RCU GP has gone long enough, go check for dyntick
-         * idle CPUs and, if needed, send resched IPIs.
-         */
-        if (ULONG_CMP_LT(ACCESS_ONCE(rsp->jiffies_force_qs), jiffies))
-                force_quiescent_state(rsp, 1);
-
-        /*
          * Advance callbacks in response to end of earlier grace
          * period that some other CPU ended.
          */
@@ -1838,6 +2024,8 @@ static void rcu_process_callbacks(struct softirq_action *unused)
 {
         struct rcu_state *rsp;
 
+        if (cpu_is_offline(smp_processor_id()))
+                return;
         trace_rcu_utilization("Start RCU core");
         for_each_rcu_flavor(rsp)
                 __rcu_process_callbacks(rsp);
@@ -1909,12 +2097,11 @@ static void __call_rcu_core(struct rcu_state *rsp, struct rcu_data *rdp,
                         rdp->blimit = LONG_MAX;
                         if (rsp->n_force_qs == rdp->n_force_qs_snap &&
                             *rdp->nxttail[RCU_DONE_TAIL] != head)
-                                force_quiescent_state(rsp, 0);
+                                force_quiescent_state(rsp);
                         rdp->n_force_qs_snap = rsp->n_force_qs;
                         rdp->qlen_last_fqs_check = rdp->qlen;
                 }
-        } else if (ULONG_CMP_LT(ACCESS_ONCE(rsp->jiffies_force_qs), jiffies))
-                force_quiescent_state(rsp, 1);
+        }
 }
 
 static void
@@ -1929,8 +2116,6 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
         head->func = func;
         head->next = NULL;
 
-        smp_mb(); /* Ensure RCU update seen before callback registry. */
-
         /*
          * Opportunistically note grace-period endings and beginnings.
          * Note that we might see a beginning right after we see an
@@ -1941,6 +2126,12 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
         rdp = this_cpu_ptr(rsp->rda);
 
         /* Add the callback to our list. */
+        if (unlikely(rdp->nxttail[RCU_NEXT_TAIL] == NULL)) {
+                /* _call_rcu() is illegal on offline CPU; leak the callback. */
+                WARN_ON_ONCE(1);
+                local_irq_restore(flags);
+                return;
+        }
         ACCESS_ONCE(rdp->qlen)++;
         if (lazy)
                 rdp->qlen_lazy++;
@@ -2195,17 +2386,7 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
         /* Is the RCU core waiting for a quiescent state from this CPU? */
         if (rcu_scheduler_fully_active &&
             rdp->qs_pending && !rdp->passed_quiesce) {
-
-                /*
-                 * If force_quiescent_state() coming soon and this CPU
-                 * needs a quiescent state, and this is either RCU-sched
-                 * or RCU-bh, force a local reschedule.
-                 */
                 rdp->n_rp_qs_pending++;
-                if (!rdp->preemptible &&
-                    ULONG_CMP_LT(ACCESS_ONCE(rsp->jiffies_force_qs) - 1,
-                                 jiffies))
-                        set_need_resched();
         } else if (rdp->qs_pending && rdp->passed_quiesce) {
                 rdp->n_rp_report_qs++;
                 return 1;
@@ -2235,13 +2416,6 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
                 return 1;
         }
 
-        /* Has an RCU GP gone long enough to send resched IPIs &c? */
-        if (rcu_gp_in_progress(rsp) &&
-            ULONG_CMP_LT(ACCESS_ONCE(rsp->jiffies_force_qs), jiffies)) {
-                rdp->n_rp_need_fqs++;
-                return 1;
-        }
-
         /* nothing to do */
         rdp->n_rp_need_nothing++;
         return 0;
@@ -2326,13 +2500,10 @@ static void rcu_barrier_func(void *type)
 static void _rcu_barrier(struct rcu_state *rsp)
 {
         int cpu;
-        unsigned long flags;
         struct rcu_data *rdp;
-        struct rcu_data rd;
         unsigned long snap = ACCESS_ONCE(rsp->n_barrier_done);
         unsigned long snap_done;
 
-        init_rcu_head_on_stack(&rd.barrier_head);
         _rcu_barrier_trace(rsp, "Begin", -1, snap);
 
         /* Take mutex to serialize concurrent rcu_barrier() requests. */
@@ -2372,70 +2543,30 @@ static void _rcu_barrier(struct rcu_state *rsp)
         /*
          * Initialize the count to one rather than to zero in order to
          * avoid a too-soon return to zero in case of a short grace period
-         * (or preemption of this task).  Also flag this task as doing
-         * an rcu_barrier().  This will prevent anyone else from adopting
-         * orphaned callbacks, which could cause otherwise failure if a
-         * CPU went offline and quickly came back online.  To see this,
-         * consider the following sequence of events:
-         *
-         * 1.   We cause CPU 0 to post an rcu_barrier_callback() callback.
-         * 2.   CPU 1 goes offline, orphaning its callbacks.
-         * 3.   CPU 0 adopts CPU 1's orphaned callbacks.
-         * 4.   CPU 1 comes back online.
-         * 5.   We cause CPU 1 to post an rcu_barrier_callback() callback.
-         * 6.   Both rcu_barrier_callback() callbacks are invoked, awakening
-         *      us -- but before CPU 1's orphaned callbacks are invoked!!!
+         * (or preemption of this task).  Exclude CPU-hotplug operations
+         * to ensure that no offline CPU has callbacks queued.
          */
         init_completion(&rsp->barrier_completion);
         atomic_set(&rsp->barrier_cpu_count, 1);
-        raw_spin_lock_irqsave(&rsp->onofflock, flags);
-        rsp->rcu_barrier_in_progress = current;
-        raw_spin_unlock_irqrestore(&rsp->onofflock, flags);
+        get_online_cpus();
 
         /*
-         * Force every CPU with callbacks to register a new callback
-         * that will tell us when all the preceding callbacks have
-         * been invoked.  If an offline CPU has callbacks, wait for
-         * it to either come back online or to finish orphaning those
-         * callbacks.
+         * Force each CPU with callbacks to register a new callback.
+         * When that callback is invoked, we will know that all of the
+         * corresponding CPU's preceding callbacks have been invoked.
          */
-        for_each_possible_cpu(cpu) {
-                preempt_disable();
+        for_each_online_cpu(cpu) {
                 rdp = per_cpu_ptr(rsp->rda, cpu);
-                if (cpu_is_offline(cpu)) {
-                        _rcu_barrier_trace(rsp, "Offline", cpu,
-                                           rsp->n_barrier_done);
-                        preempt_enable();
-                        while (cpu_is_offline(cpu) && ACCESS_ONCE(rdp->qlen))
-                                schedule_timeout_interruptible(1);
-                } else if (ACCESS_ONCE(rdp->qlen)) {
+                if (ACCESS_ONCE(rdp->qlen)) {
                         _rcu_barrier_trace(rsp, "OnlineQ", cpu,
                                            rsp->n_barrier_done);
                         smp_call_function_single(cpu, rcu_barrier_func, rsp, 1);
-                        preempt_enable();
                 } else {
                         _rcu_barrier_trace(rsp, "OnlineNQ", cpu,
                                            rsp->n_barrier_done);
-                        preempt_enable();
                 }
         }
-
-        /*
-         * Now that all online CPUs have rcu_barrier_callback() callbacks
-         * posted, we can adopt all of the orphaned callbacks and place
-         * an rcu_barrier_callback() callback after them.  When that is done,
-         * we are guaranteed to have an rcu_barrier_callback() callback
-         * following every callback that could possibly have been
-         * registered before _rcu_barrier() was called.
-         */
-        raw_spin_lock_irqsave(&rsp->onofflock, flags);
-        rcu_adopt_orphan_cbs(rsp);
-        rsp->rcu_barrier_in_progress = NULL;
-        raw_spin_unlock_irqrestore(&rsp->onofflock, flags);
-        atomic_inc(&rsp->barrier_cpu_count);
-        smp_mb__after_atomic_inc(); /* Ensure atomic_inc() before callback. */
-        rd.rsp = rsp;
-        rsp->call(&rd.barrier_head, rcu_barrier_callback);
+        put_online_cpus();
 
         /*
          * Now that we have an rcu_barrier_callback() callback on each
@@ -2456,8 +2587,6 @@ static void _rcu_barrier(struct rcu_state *rsp)
 
         /* Other rcu_barrier() invocations can now safely proceed. */
         mutex_unlock(&rsp->barrier_mutex);
-
-        destroy_rcu_head_on_stack(&rd.barrier_head);
 }
 
 /**
@@ -2497,6 +2626,9 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp)
         rdp->dynticks = &per_cpu(rcu_dynticks, cpu);
         WARN_ON_ONCE(rdp->dynticks->dynticks_nesting != DYNTICK_TASK_EXIT_IDLE);
         WARN_ON_ONCE(atomic_read(&rdp->dynticks->dynticks) != 1);
+#ifdef CONFIG_RCU_USER_QS
+        WARN_ON_ONCE(rdp->dynticks->in_user);
+#endif
         rdp->cpu = cpu;
         rdp->rsp = rsp;
         raw_spin_unlock_irqrestore(&rnp->lock, flags);
@@ -2523,6 +2655,7 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible)
         rdp->qlen_last_fqs_check = 0;
         rdp->n_force_qs_snap = rsp->n_force_qs;
         rdp->blimit = blimit;
+        init_callback_list(rdp);  /* Re-enable callbacks on this CPU. */
         rdp->dynticks->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
         atomic_set(&rdp->dynticks->dynticks,
                    (atomic_read(&rdp->dynticks->dynticks) & ~0x1) + 1);
@@ -2555,7 +2688,6 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible)
                         rdp->completed = rnp->completed;
                         rdp->passed_quiesce = 0;
                         rdp->qs_pending = 0;
-                        rdp->passed_quiesce_gpnum = rnp->gpnum - 1;
                         trace_rcu_grace_period(rsp->name, rdp->gpnum, "cpuonl");
                 }
                 raw_spin_unlock(&rnp->lock); /* irqs already disabled. */
@@ -2594,12 +2726,10 @@ static int __cpuinit rcu_cpu_notify(struct notifier_block *self,
                 break;
         case CPU_ONLINE:
         case CPU_DOWN_FAILED:
-                rcu_node_kthread_setaffinity(rnp, -1);
-                rcu_cpu_kthread_setrt(cpu, 1);
+                rcu_boost_kthread_setaffinity(rnp, -1);
                 break;
         case CPU_DOWN_PREPARE:
-                rcu_node_kthread_setaffinity(rnp, cpu);
-                rcu_cpu_kthread_setrt(cpu, 0);
+                rcu_boost_kthread_setaffinity(rnp, cpu);
                 break;
         case CPU_DYING:
         case CPU_DYING_FROZEN:
@@ -2627,6 +2757,28 @@ static int __cpuinit rcu_cpu_notify(struct notifier_block *self,
 }
 
 /*
+ * Spawn the kthread that handles this RCU flavor's grace periods.
+ */
+static int __init rcu_spawn_gp_kthread(void)
+{
+        unsigned long flags;
+        struct rcu_node *rnp;
+        struct rcu_state *rsp;
+        struct task_struct *t;
+
+        for_each_rcu_flavor(rsp) {
+                t = kthread_run(rcu_gp_kthread, rsp, rsp->name);
+                BUG_ON(IS_ERR(t));
+                rnp = rcu_get_root(rsp);
+                raw_spin_lock_irqsave(&rnp->lock, flags);
+                rsp->gp_kthread = t;
+                raw_spin_unlock_irqrestore(&rnp->lock, flags);
+        }
+        return 0;
+}
+early_initcall(rcu_spawn_gp_kthread);
+
+/*
  * This function is invoked towards the end of the scheduler's initialization
  * process.  Before this is called, the idle task might contain
  * RCU read-side critical sections (during which time, this idle
@@ -2661,7 +2813,7 @@ static void __init rcu_init_levelspread(struct rcu_state *rsp)
         int cprv;
         int i;
 
-        cprv = NR_CPUS;
+        cprv = nr_cpu_ids;
         for (i = rcu_num_lvls - 1; i >= 0; i--) {
                 ccur = rsp->levelcnt[i];
                 rsp->levelspread[i] = (cprv + ccur - 1) / ccur;
@@ -2676,10 +2828,14 @@ static void __init rcu_init_levelspread(struct rcu_state *rsp)
 static void __init rcu_init_one(struct rcu_state *rsp,
                 struct rcu_data __percpu *rda)
 {
-        static char *buf[] = { "rcu_node_level_0",
-                               "rcu_node_level_1",
-                               "rcu_node_level_2",
-                               "rcu_node_level_3" };  /* Match MAX_RCU_LVLS */
+        static char *buf[] = { "rcu_node_0",
+                               "rcu_node_1",
+                               "rcu_node_2",
+                               "rcu_node_3" };  /* Match MAX_RCU_LVLS */
+        static char *fqs[] = { "rcu_node_fqs_0",
+                               "rcu_node_fqs_1",
+                               "rcu_node_fqs_2",
+                               "rcu_node_fqs_3" };  /* Match MAX_RCU_LVLS */
         int cpustride = 1;
         int i;
         int j;
@@ -2704,7 +2860,11 @@ static void __init rcu_init_one(struct rcu_state *rsp,
                         raw_spin_lock_init(&rnp->lock);
                         lockdep_set_class_and_name(&rnp->lock,
                                                    &rcu_node_class[i], buf[i]);
-                        rnp->gpnum = 0;
+                        raw_spin_lock_init(&rnp->fqslock);
+                        lockdep_set_class_and_name(&rnp->fqslock,
+                                                   &rcu_fqs_class[i], fqs[i]);
+                        rnp->gpnum = rsp->gpnum;
+                        rnp->completed = rsp->completed;
                         rnp->qsmask = 0;
                         rnp->qsmaskinit = 0;
                         rnp->grplo = j * cpustride;
@@ -2727,6 +2887,7 @@ static void __init rcu_init_one(struct rcu_state *rsp,
         }
 
         rsp->rda = rda;
+        init_waitqueue_head(&rsp->gp_wq);
         rnp = rsp->level[rcu_num_lvls - 1];
         for_each_possible_cpu(i) {
                 while (i > rnp->grphi)
@@ -2750,7 +2911,8 @@ static void __init rcu_init_geometry(void)
         int rcu_capacity[MAX_RCU_LVLS + 1];
 
         /* If the compile-time values are accurate, just leave. */
-        if (rcu_fanout_leaf == CONFIG_RCU_FANOUT_LEAF)
+        if (rcu_fanout_leaf == CONFIG_RCU_FANOUT_LEAF &&
+            nr_cpu_ids == NR_CPUS)
                 return;
 
         /*
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 4d29169f2124..5faf05d68326 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -102,6 +102,10 @@ struct rcu_dynticks {
                                     /* idle-period nonlazy_posted snapshot. */
         int tick_nohz_enabled_snap; /* Previously seen value from sysfs. */
 #endif /* #ifdef CONFIG_RCU_FAST_NO_HZ */
+#ifdef CONFIG_RCU_USER_QS
+        bool ignore_user_qs;        /* Treat userspace as extended QS or not */
+        bool in_user;               /* Is the CPU in userland from RCU POV? */
+#endif
 };
 
 /* RCU's kthread states for tracing. */
@@ -196,12 +200,7 @@ struct rcu_node {
                                 /* Refused to boost: not sure why, though. */
                                 /*  This can happen due to race conditions. */
 #endif /* #ifdef CONFIG_RCU_BOOST */
-        struct task_struct *node_kthread_task;
-                                /* kthread that takes care of this rcu_node */
-                                /*  structure, for example, awakening the */
-                                /*  per-CPU kthreads as needed. */
-        unsigned int node_kthread_status;
-                                /* State of node_kthread_task for tracing. */
+        raw_spinlock_t fqslock ____cacheline_internodealigned_in_smp;
 } ____cacheline_internodealigned_in_smp;
 
 /*
@@ -245,8 +244,6 @@ struct rcu_data {
                                         /*  in order to detect GP end. */
         unsigned long   gpnum;          /* Highest gp number that this CPU */
                                         /*  is aware of having started. */
-        unsigned long   passed_quiesce_gpnum;
-                                        /* gpnum at time of quiescent state. */
         bool            passed_quiesce; /* User-mode/idle loop etc. */
         bool            qs_pending;     /* Core waits for quiesc state. */
         bool            beenonline;     /* CPU online at least once. */
@@ -312,11 +309,13 @@ struct rcu_data {
         unsigned long n_rp_cpu_needs_gp;
         unsigned long n_rp_gp_completed;
         unsigned long n_rp_gp_started;
-        unsigned long n_rp_need_fqs;
         unsigned long n_rp_need_nothing;
 
-        /* 6) _rcu_barrier() callback. */
+        /* 6) _rcu_barrier() and OOM callbacks. */
         struct rcu_head barrier_head;
+#ifdef CONFIG_RCU_FAST_NO_HZ
+        struct rcu_head oom_head;
+#endif /* #ifdef CONFIG_RCU_FAST_NO_HZ */
 
         int cpu;
         struct rcu_state *rsp;
@@ -375,20 +374,17 @@ struct rcu_state {
 
         u8      fqs_state ____cacheline_internodealigned_in_smp;
                                                 /* Force QS state. */
-        u8      fqs_active;                     /* force_quiescent_state() */
-                                                /*  is running. */
-        u8      fqs_need_gp;                    /* A CPU was prevented from */
-                                                /*  starting a new grace */
-                                                /*  period because */
-                                                /*  force_quiescent_state() */
-                                                /*  was running. */
         u8      boost;                          /* Subject to priority boost. */
         unsigned long gpnum;                    /* Current gp number. */
         unsigned long completed;                /* # of last completed gp. */
+        struct task_struct *gp_kthread;         /* Task for grace periods. */
+        wait_queue_head_t gp_wq;                /* Where GP task waits. */
+        int gp_flags;                           /* Commands for GP task. */
 
         /* End of fields guarded by root rcu_node's lock. */
 
-        raw_spinlock_t onofflock;               /* exclude on/offline and */
+        raw_spinlock_t onofflock ____cacheline_internodealigned_in_smp;
+                                                /* exclude on/offline and */
                                                 /*  starting new GP. */
         struct rcu_head *orphan_nxtlist;        /* Orphaned callbacks that */
                                                 /*  need a grace period. */
@@ -398,16 +394,11 @@ struct rcu_state {
         struct rcu_head **orphan_donetail;      /* Tail of above. */
         long qlen_lazy;                         /* Number of lazy callbacks. */
         long qlen;                              /* Total number of callbacks. */
-        struct task_struct *rcu_barrier_in_progress;
-                                                /* Task doing rcu_barrier(), */
-                                                /*  or NULL if no barrier. */
         struct mutex barrier_mutex;             /* Guards barrier fields. */
         atomic_t barrier_cpu_count;             /* # CPUs waiting on. */
         struct completion barrier_completion;   /* Wake at barrier end. */
         unsigned long n_barrier_done;           /* ++ at start and end of */
                                                 /*  _rcu_barrier(). */
-        raw_spinlock_t fqslock;                 /* Only one task forcing */
-                                                /*  quiescent states. */
         unsigned long jiffies_force_qs;         /* Time at which to invoke */
                                                 /*  force_quiescent_state(). */
         unsigned long n_force_qs;               /* Number of calls to */
@@ -426,6 +417,10 @@ struct rcu_state {
         struct list_head flavors;               /* List of RCU flavors. */
 };
 
+/* Values for rcu_state structure's gp_flags field. */
+#define RCU_GP_FLAG_INIT 0x1    /* Need grace-period initialization. */
+#define RCU_GP_FLAG_FQS  0x2    /* Need grace-period quiescent-state forcing. */
+
 extern struct list_head rcu_struct_flavors;
 #define for_each_rcu_flavor(rsp) \
         list_for_each_entry((rsp), &rcu_struct_flavors, flavors)
@@ -468,7 +463,6 @@ static int rcu_preempt_blocked_readers_cgp(struct rcu_node *rnp);
 #ifdef CONFIG_HOTPLUG_CPU
 static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp,
                                       unsigned long flags);
-static void rcu_stop_cpu_kthread(int cpu);
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
 static void rcu_print_detail_task_stall(struct rcu_state *rsp);
 static int rcu_print_task_stall(struct rcu_node *rnp);
@@ -491,15 +485,9 @@ static void invoke_rcu_callbacks_kthread(void);
 static bool rcu_is_callbacks_kthread(void);
 #ifdef CONFIG_RCU_BOOST
 static void rcu_preempt_do_callbacks(void);
-static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp,
-                                          cpumask_var_t cm);
 static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
-                                                 struct rcu_node *rnp,
-                                                 int rnp_index);
-static void invoke_rcu_node_kthread(struct rcu_node *rnp);
-static void rcu_yield(void (*f)(unsigned long), unsigned long arg);
+                                                 struct rcu_node *rnp);
 #endif /* #ifdef CONFIG_RCU_BOOST */
-static void rcu_cpu_kthread_setrt(int cpu, int to_rt);
 static void __cpuinit rcu_prepare_kthreads(int cpu);
 static void rcu_prepare_for_idle_init(int cpu);
 static void rcu_cleanup_after_idle(int cpu);
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 7f3244c0df01..f92115488187 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -25,6 +25,8 @@
  */
 
 #include <linux/delay.h>
+#include <linux/oom.h>
+#include <linux/smpboot.h>
 
 #define RCU_KTHREAD_PRIO 1
 
@@ -118,7 +120,7 @@ EXPORT_SYMBOL_GPL(rcu_batches_completed);
  */
 void rcu_force_quiescent_state(void)
 {
-        force_quiescent_state(&rcu_preempt_state, 0);
+        force_quiescent_state(&rcu_preempt_state);
 }
 EXPORT_SYMBOL_GPL(rcu_force_quiescent_state);
 
@@ -136,8 +138,6 @@ static void rcu_preempt_qs(int cpu)
 {
         struct rcu_data *rdp = &per_cpu(rcu_preempt_data, cpu);
 
-        rdp->passed_quiesce_gpnum = rdp->gpnum;
-        barrier();
         if (rdp->passed_quiesce == 0)
                 trace_rcu_grace_period("rcu_preempt", rdp->gpnum, "cpuqs");
         rdp->passed_quiesce = 1;
@@ -422,9 +422,11 @@ static void rcu_print_detail_task_stall_rnp(struct rcu_node *rnp)
         unsigned long flags;
         struct task_struct *t;
 
-        if (!rcu_preempt_blocked_readers_cgp(rnp))
-                return;
         raw_spin_lock_irqsave(&rnp->lock, flags);
+        if (!rcu_preempt_blocked_readers_cgp(rnp)) {
+                raw_spin_unlock_irqrestore(&rnp->lock, flags);
+                return;
+        }
         t = list_entry(rnp->gp_tasks,
                        struct task_struct, rcu_node_entry);
         list_for_each_entry_continue(t, &rnp->blkd_tasks, rcu_node_entry)
@@ -584,17 +586,23 @@ static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
                 raw_spin_unlock(&rnp_root->lock); /* irqs still disabled */
         }
 
+        rnp->gp_tasks = NULL;
+        rnp->exp_tasks = NULL;
 #ifdef CONFIG_RCU_BOOST
-        /* In case root is being boosted and leaf is not. */
+        rnp->boost_tasks = NULL;
+        /*
+         * In case root is being boosted and leaf was not.  Make sure
+         * that we boost the tasks blocking the current grace period
+         * in this case.
+         */
         raw_spin_lock(&rnp_root->lock); /* irqs already disabled */
         if (rnp_root->boost_tasks != NULL &&
-            rnp_root->boost_tasks != rnp_root->gp_tasks)
+            rnp_root->boost_tasks != rnp_root->gp_tasks &&
+            rnp_root->boost_tasks != rnp_root->exp_tasks)
                 rnp_root->boost_tasks = rnp_root->gp_tasks;
         raw_spin_unlock(&rnp_root->lock); /* irqs still disabled */
 #endif /* #ifdef CONFIG_RCU_BOOST */
 
-        rnp->gp_tasks = NULL;
-        rnp->exp_tasks = NULL;
         return retval;
 }
 
@@ -676,7 +684,7 @@ void synchronize_rcu(void)
 EXPORT_SYMBOL_GPL(synchronize_rcu);
 
 static DECLARE_WAIT_QUEUE_HEAD(sync_rcu_preempt_exp_wq);
-static long sync_rcu_preempt_exp_count;
+static unsigned long sync_rcu_preempt_exp_count;
 static DEFINE_MUTEX(sync_rcu_preempt_exp_mutex);
 
 /*
@@ -791,7 +799,7 @@ void synchronize_rcu_expedited(void)
         unsigned long flags;
         struct rcu_node *rnp;
         struct rcu_state *rsp = &rcu_preempt_state;
-        long snap;
+        unsigned long snap;
         int trycount = 0;
 
         smp_mb(); /* Caller's modifications seen first by other CPUs. */
@@ -799,33 +807,47 @@ void synchronize_rcu_expedited(void)
         smp_mb(); /* Above access cannot bleed into critical section. */
 
         /*
+         * Block CPU-hotplug operations.  This means that any CPU-hotplug
+         * operation that finds an rcu_node structure with tasks in the
+         * process of being boosted will know that all tasks blocking
+         * this expedited grace period will already be in the process of
+         * being boosted.  This simplifies the process of moving tasks
+         * from leaf to root rcu_node structures.
+         */
+        get_online_cpus();
+
+        /*
          * Acquire lock, falling back to synchronize_rcu() if too many
          * lock-acquisition failures.  Of course, if someone does the
          * expedited grace period for us, just leave.
          */
         while (!mutex_trylock(&sync_rcu_preempt_exp_mutex)) {
+                if (ULONG_CMP_LT(snap,
+                    ACCESS_ONCE(sync_rcu_preempt_exp_count))) {
+                        put_online_cpus();
+                        goto mb_ret; /* Others did our work for us. */
+                }
                 if (trycount++ < 10) {
                         udelay(trycount * num_online_cpus());
                 } else {
+                        put_online_cpus();
                         synchronize_rcu();
                         return;
                 }
-                if ((ACCESS_ONCE(sync_rcu_preempt_exp_count) - snap) > 0)
-                        goto mb_ret; /* Others did our work for us. */
         }
-        if ((ACCESS_ONCE(sync_rcu_preempt_exp_count) - snap) > 0)
+        if (ULONG_CMP_LT(snap, ACCESS_ONCE(sync_rcu_preempt_exp_count))) {
+                put_online_cpus();
                 goto unlock_mb_ret; /* Others did our work for us. */
+        }
 
         /* force all RCU readers onto ->blkd_tasks lists. */
         synchronize_sched_expedited();
 
-        raw_spin_lock_irqsave(&rsp->onofflock, flags);
-
         /* Initialize ->expmask for all non-leaf rcu_node structures. */
         rcu_for_each_nonleaf_node_breadth_first(rsp, rnp) {
-                raw_spin_lock(&rnp->lock); /* irqs already disabled. */
+                raw_spin_lock_irqsave(&rnp->lock, flags);
                 rnp->expmask = rnp->qsmaskinit;
-                raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
+                raw_spin_unlock_irqrestore(&rnp->lock, flags);
         }
 
         /* Snapshot current state of ->blkd_tasks lists. */
@@ -834,7 +856,7 @@ void synchronize_rcu_expedited(void)
         if (NUM_RCU_NODES > 1)
                 sync_rcu_preempt_exp_init(rsp, rcu_get_root(rsp));
 
-        raw_spin_unlock_irqrestore(&rsp->onofflock, flags);
+        put_online_cpus();
 
         /* Wait for snapshotted ->blkd_tasks lists to drain. */
         rnp = rcu_get_root(rsp);
@@ -1069,6 +1091,16 @@ static void rcu_initiate_boost_trace(struct rcu_node *rnp)
 
 #endif /* #else #ifdef CONFIG_RCU_TRACE */
 
+static void rcu_wake_cond(struct task_struct *t, int status)
+{
+        /*
+         * If the thread is yielding, only wake it when this
+         * is invoked from idle
+         */
+        if (status != RCU_KTHREAD_YIELDING || is_idle_task(current))
+                wake_up_process(t);
+}
+
 /*
  * Carry out RCU priority boosting on the task indicated by ->exp_tasks
  * or ->boost_tasks, advancing the pointer to the next task in the
@@ -1141,17 +1173,6 @@ static int rcu_boost(struct rcu_node *rnp)
 }
 
 /*
- * Timer handler to initiate waking up of boost kthreads that
- * have yielded the CPU due to excessive numbers of tasks to
- * boost.  We wake up the per-rcu_node kthread, which in turn
- * will wake up the booster kthread.
- */
-static void rcu_boost_kthread_timer(unsigned long arg)
-{
-        invoke_rcu_node_kthread((struct rcu_node *)arg);
-}
-
-/*
  * Priority-boosting kthread.  One per leaf rcu_node and one for the
  * root rcu_node.
  */
@@ -1174,8 +1195,9 @@ static int rcu_boost_kthread(void *arg)
                 else
                         spincnt = 0;
                 if (spincnt > 10) {
+                        rnp->boost_kthread_status = RCU_KTHREAD_YIELDING;
                         trace_rcu_utilization("End boost kthread@rcu_yield");
-                        rcu_yield(rcu_boost_kthread_timer, (unsigned long)rnp);
+                        schedule_timeout_interruptible(2);
                         trace_rcu_utilization("Start boost kthread@rcu_yield");
                         spincnt = 0;
                 }
@@ -1191,9 +1213,9 @@ static int rcu_boost_kthread(void *arg)
  * kthread to start boosting them.  If there is an expedited grace
  * period in progress, it is always time to boost.
  *
- * The caller must hold rnp->lock, which this function releases,
- * but irqs remain disabled.  The ->boost_kthread_task is immortal,
- * so we don't need to worry about it going away.
+ * The caller must hold rnp->lock, which this function releases.
+ * The ->boost_kthread_task is immortal, so we don't need to worry
+ * about it going away.
  */
 static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
 {
@@ -1213,8 +1235,8 @@ static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
                         rnp->boost_tasks = rnp->gp_tasks;
                 raw_spin_unlock_irqrestore(&rnp->lock, flags);
                 t = rnp->boost_kthread_task;
-                if (t != NULL)
-                        wake_up_process(t);
+                if (t)
+                        rcu_wake_cond(t, rnp->boost_kthread_status);
         } else {
                 rcu_initiate_boost_trace(rnp);
                 raw_spin_unlock_irqrestore(&rnp->lock, flags);
@@ -1231,8 +1253,10 @@ static void invoke_rcu_callbacks_kthread(void)
         local_irq_save(flags);
         __this_cpu_write(rcu_cpu_has_work, 1);
         if (__this_cpu_read(rcu_cpu_kthread_task) != NULL &&
-            current != __this_cpu_read(rcu_cpu_kthread_task))
-                wake_up_process(__this_cpu_read(rcu_cpu_kthread_task));
+            current != __this_cpu_read(rcu_cpu_kthread_task)) {
+                rcu_wake_cond(__this_cpu_read(rcu_cpu_kthread_task),
+                              __this_cpu_read(rcu_cpu_kthread_status));
+        }
         local_irq_restore(flags);
 }
 
@@ -1245,21 +1269,6 @@ static bool rcu_is_callbacks_kthread(void)
         return __get_cpu_var(rcu_cpu_kthread_task) == current;
 }
 
-/*
- * Set the affinity of the boost kthread.  The CPU-hotplug locks are
- * held, so no one should be messing with the existence of the boost
- * kthread.
- */
-static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp,
-                                          cpumask_var_t cm)
-{
-        struct task_struct *t;
-
-        t = rnp->boost_kthread_task;
-        if (t != NULL)
-                set_cpus_allowed_ptr(rnp->boost_kthread_task, cm);
-}
-
 #define RCU_BOOST_DELAY_JIFFIES DIV_ROUND_UP(CONFIG_RCU_BOOST_DELAY * HZ, 1000)
 
 /*
@@ -1276,15 +1285,19 @@ static void rcu_preempt_boost_start_gp(struct rcu_node *rnp)
  * Returns zero if all is well, a negated errno otherwise.
  */
 static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
-                                                 struct rcu_node *rnp,
-                                                 int rnp_index)
+                                                 struct rcu_node *rnp)
 {
+        int rnp_index = rnp - &rsp->node[0];
         unsigned long flags;
         struct sched_param sp;
         struct task_struct *t;
 
         if (&rcu_preempt_state != rsp)
                 return 0;
+
+        if (!rcu_scheduler_fully_active || rnp->qsmaskinit == 0)
+                return 0;
+
         rsp->boost = 1;
         if (rnp->boost_kthread_task != NULL)
                 return 0;
@@ -1301,25 +1314,6 @@ static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
         return 0;
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
-
-/*
- * Stop the RCU's per-CPU kthread when its CPU goes offline,.
- */
-static void rcu_stop_cpu_kthread(int cpu)
-{
-        struct task_struct *t;
-
-        /* Stop the CPU's kthread. */
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t != NULL) {
-                per_cpu(rcu_cpu_kthread_task, cpu) = NULL;
-                kthread_stop(t);
-        }
-}
-
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
-
 static void rcu_kthread_do_work(void)
 {
         rcu_do_batch(&rcu_sched_state, &__get_cpu_var(rcu_sched_data));
@@ -1327,112 +1321,22 @@ static void rcu_kthread_do_work(void)
         rcu_preempt_do_callbacks();
 }
 
-/*
- * Wake up the specified per-rcu_node-structure kthread.
- * Because the per-rcu_node kthreads are immortal, we don't need
- * to do anything to keep them alive.
- */
-static void invoke_rcu_node_kthread(struct rcu_node *rnp)
-{
-        struct task_struct *t;
-
-        t = rnp->node_kthread_task;
-        if (t != NULL)
-                wake_up_process(t);
-}
-
-/*
- * Set the specified CPU's kthread to run RT or not, as specified by
- * the to_rt argument.  The CPU-hotplug locks are held, so the task
- * is not going away.
- */
-static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
+static void rcu_cpu_kthread_setup(unsigned int cpu)
 {
-        int policy;
         struct sched_param sp;
-        struct task_struct *t;
 
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t == NULL)
-                return;
-        if (to_rt) {
-                policy = SCHED_FIFO;
-                sp.sched_priority = RCU_KTHREAD_PRIO;
-        } else {
-                policy = SCHED_NORMAL;
-                sp.sched_priority = 0;
-        }
-        sched_setscheduler_nocheck(t, policy, &sp);
+        sp.sched_priority = RCU_KTHREAD_PRIO;
+        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
 }
 
-/*
- * Timer handler to initiate the waking up of per-CPU kthreads that
- * have yielded the CPU due to excess numbers of RCU callbacks.
- * We wake up the per-rcu_node kthread, which in turn will wake up
- * the booster kthread.
- */
-static void rcu_cpu_kthread_timer(unsigned long arg)
+static void rcu_cpu_kthread_park(unsigned int cpu)
 {
-        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, arg);
-        struct rcu_node *rnp = rdp->mynode;
-
-        atomic_or(rdp->grpmask, &rnp->wakemask);
-        invoke_rcu_node_kthread(rnp);
+        per_cpu(rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
 }
 
-/*
- * Drop to non-real-time priority and yield, but only after posting a
- * timer that will cause us to regain our real-time priority if we
- * remain preempted.  Either way, we restore our real-time priority
- * before returning.
- */
-static void rcu_yield(void (*f)(unsigned long), unsigned long arg)
+static int rcu_cpu_kthread_should_run(unsigned int cpu)
 {
-        struct sched_param sp;
-        struct timer_list yield_timer;
-        int prio = current->rt_priority;
-
-        setup_timer_on_stack(&yield_timer, f, arg);
-        mod_timer(&yield_timer, jiffies + 2);
-        sp.sched_priority = 0;
-        sched_setscheduler_nocheck(current, SCHED_NORMAL, &sp);
-        set_user_nice(current, 19);
-        schedule();
-        set_user_nice(current, 0);
-        sp.sched_priority = prio;
-        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
-        del_timer(&yield_timer);
-}
-
-/*
- * Handle cases where the rcu_cpu_kthread() ends up on the wrong CPU.
- * This can happen while the corresponding CPU is either coming online
- * or going offline.  We cannot wait until the CPU is fully online
- * before starting the kthread, because the various notifier functions
- * can wait for RCU grace periods.  So we park rcu_cpu_kthread() until
- * the corresponding CPU is online.
- *
- * Return 1 if the kthread needs to stop, 0 otherwise.
- *
- * Caller must disable bh.  This function can momentarily enable it.
- */
-static int rcu_cpu_kthread_should_stop(int cpu)
-{
-        while (cpu_is_offline(cpu) ||
-               !cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)) ||
-               smp_processor_id() != cpu) {
-                if (kthread_should_stop())
-                        return 1;
-                per_cpu(rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
-                per_cpu(rcu_cpu_kthread_cpu, cpu) = raw_smp_processor_id();
-                local_bh_enable();
-                schedule_timeout_uninterruptible(1);
-                if (!cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)))
-                        set_cpus_allowed_ptr(current, cpumask_of(cpu));
-                local_bh_disable();
-        }
-        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
-        return 0;
+        return __get_cpu_var(rcu_cpu_has_work);
 }
 
 /*
@@ -1440,138 +1344,35 @@ static int rcu_cpu_kthread_should_stop(int cpu)
  * RCU softirq used in flavors and configurations of RCU that do not
  * support RCU priority boosting.
  */
-static int rcu_cpu_kthread(void *arg)
+static void rcu_cpu_kthread(unsigned int cpu)
 {
-        int cpu = (int)(long)arg;
-        unsigned long flags;
-        int spincnt = 0;
-        unsigned int *statusp = &per_cpu(rcu_cpu_kthread_status, cpu);
-        char work;
-        char *workp = &per_cpu(rcu_cpu_has_work, cpu);
+        unsigned int *statusp = &__get_cpu_var(rcu_cpu_kthread_status);
+        char work, *workp = &__get_cpu_var(rcu_cpu_has_work);
+        int spincnt;
 
-        trace_rcu_utilization("Start CPU kthread@init");
-        for (;;) {
-                *statusp = RCU_KTHREAD_WAITING;
-                trace_rcu_utilization("End CPU kthread@rcu_wait");
-                rcu_wait(*workp != 0 || kthread_should_stop());
+        for (spincnt = 0; spincnt < 10; spincnt++) {
                 trace_rcu_utilization("Start CPU kthread@rcu_wait");
                 local_bh_disable();
-                if (rcu_cpu_kthread_should_stop(cpu)) {
-                        local_bh_enable();
-                        break;
-                }
                 *statusp = RCU_KTHREAD_RUNNING;
-                per_cpu(rcu_cpu_kthread_loops, cpu)++;
-                local_irq_save(flags);
+                this_cpu_inc(rcu_cpu_kthread_loops);
+                local_irq_disable();
                 work = *workp;
                 *workp = 0;
-                local_irq_restore(flags);
+                local_irq_enable();
                 if (work)
                         rcu_kthread_do_work();
                 local_bh_enable();
-                if (*workp != 0)
-                        spincnt++;
-                else
-                        spincnt = 0;
-                if (spincnt > 10) {
-                        *statusp = RCU_KTHREAD_YIELDING;
-                        trace_rcu_utilization("End CPU kthread@rcu_yield");
-                        rcu_yield(rcu_cpu_kthread_timer, (unsigned long)cpu);
-                        trace_rcu_utilization("Start CPU kthread@rcu_yield");
-                        spincnt = 0;
-                }
-        }
-        *statusp = RCU_KTHREAD_STOPPED;
-        trace_rcu_utilization("End CPU kthread@term");
-        return 0;
-}
-
-/*
- * Spawn a per-CPU kthread, setting up affinity and priority.
- * Because the CPU hotplug lock is held, no other CPU will be attempting
- * to manipulate rcu_cpu_kthread_task.  There might be another CPU
- * attempting to access it during boot, but the locking in kthread_bind()
- * will enforce sufficient ordering.
- *
- * Please note that we cannot simply refuse to wake up the per-CPU
- * kthread because kthreads are created in TASK_UNINTERRUPTIBLE state,
- * which can result in softlockup complaints if the task ends up being
- * idle for more than a couple of minutes.
- *
- * However, please note also that we cannot bind the per-CPU kthread to its
- * CPU until that CPU is fully online.  We also cannot wait until the
- * CPU is fully online before we create its per-CPU kthread, as this would
- * deadlock the system when CPU notifiers tried waiting for grace
- * periods.  So we bind the per-CPU kthread to its CPU only if the CPU
- * is online.  If its CPU is not yet fully online, then the code in
- * rcu_cpu_kthread() will wait until it is fully online, and then do
- * the binding.
- */
-static int __cpuinit rcu_spawn_one_cpu_kthread(int cpu)
-{
-        struct sched_param sp;
-        struct task_struct *t;
-
-        if (!rcu_scheduler_fully_active ||
-            per_cpu(rcu_cpu_kthread_task, cpu) != NULL)
-                return 0;
-        t = kthread_create_on_node(rcu_cpu_kthread,
-                                   (void *)(long)cpu,
-                                   cpu_to_node(cpu),
-                                   "rcuc/%d", cpu);
-        if (IS_ERR(t))
-                return PTR_ERR(t);
-        if (cpu_online(cpu))
-                kthread_bind(t, cpu);
-        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
-        WARN_ON_ONCE(per_cpu(rcu_cpu_kthread_task, cpu) != NULL);
-        sp.sched_priority = RCU_KTHREAD_PRIO;
-        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-        per_cpu(rcu_cpu_kthread_task, cpu) = t;
-        wake_up_process(t); /* Get to TASK_INTERRUPTIBLE quickly. */
-        return 0;
-}
-
-/*
- * Per-rcu_node kthread, which is in charge of waking up the per-CPU
- * kthreads when needed.  We ignore requests to wake up kthreads
- * for offline CPUs, which is OK because force_quiescent_state()
- * takes care of this case.
- */
-static int rcu_node_kthread(void *arg)
-{
-        int cpu;
-        unsigned long flags;
-        unsigned long mask;
-        struct rcu_node *rnp = (struct rcu_node *)arg;
-        struct sched_param sp;
-        struct task_struct *t;
-
-        for (;;) {
-                rnp->node_kthread_status = RCU_KTHREAD_WAITING;
-                rcu_wait(atomic_read(&rnp->wakemask) != 0);
-                rnp->node_kthread_status = RCU_KTHREAD_RUNNING;
-                raw_spin_lock_irqsave(&rnp->lock, flags);
-                mask = atomic_xchg(&rnp->wakemask, 0);
-                rcu_initiate_boost(rnp, flags); /* releases rnp->lock. */
-                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1) {
-                        if ((mask & 0x1) == 0)
-                                continue;
-                        preempt_disable();
-                        t = per_cpu(rcu_cpu_kthread_task, cpu);
-                        if (!cpu_online(cpu) || t == NULL) {
-                                preempt_enable();
-                                continue;
-                        }
-                        per_cpu(rcu_cpu_has_work, cpu) = 1;
-                        sp.sched_priority = RCU_KTHREAD_PRIO;
-                        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-                        preempt_enable();
+                if (*workp == 0) {
+                        trace_rcu_utilization("End CPU kthread@rcu_wait");
+                        *statusp = RCU_KTHREAD_WAITING;
+                        return;
                 }
         }
-        /* NOTREACHED */
-        rnp->node_kthread_status = RCU_KTHREAD_STOPPED;
-        return 0;
+        *statusp = RCU_KTHREAD_YIELDING;
+        trace_rcu_utilization("Start CPU kthread@rcu_yield");
+        schedule_timeout_interruptible(2);
+        trace_rcu_utilization("End CPU kthread@rcu_yield");
+        *statusp = RCU_KTHREAD_WAITING;
 }
 
 /*
@@ -1583,17 +1384,17 @@ static int rcu_node_kthread(void *arg)
  * no outgoing CPU.  If there are no CPUs left in the affinity set,
  * this function allows the kthread to execute on any CPU.
  */
-static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
+static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
 {
+        struct task_struct *t = rnp->boost_kthread_task;
+        unsigned long mask = rnp->qsmaskinit;
         cpumask_var_t cm;
         int cpu;
-        unsigned long mask = rnp->qsmaskinit;
 
-        if (rnp->node_kthread_task == NULL)
+        if (!t)
                 return;
-        if (!alloc_cpumask_var(&cm, GFP_KERNEL))
+        if (!zalloc_cpumask_var(&cm, GFP_KERNEL))
                 return;
-        cpumask_clear(cm);
         for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1)
                 if ((mask & 0x1) && cpu != outgoingcpu)
                         cpumask_set_cpu(cpu, cm);
@@ -1603,62 +1404,36 @@ static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
                         cpumask_clear_cpu(cpu, cm);
                 WARN_ON_ONCE(cpumask_weight(cm) == 0);
         }
-        set_cpus_allowed_ptr(rnp->node_kthread_task, cm);
-        rcu_boost_kthread_setaffinity(rnp, cm);
+        set_cpus_allowed_ptr(t, cm);
         free_cpumask_var(cm);
 }
 
-/*
- * Spawn a per-rcu_node kthread, setting priority and affinity.
- * Called during boot before online/offline can happen, or, if
- * during runtime, with the main CPU-hotplug locks held.  So only
- * one of these can be executing at a time.
- */
-static int __cpuinit rcu_spawn_one_node_kthread(struct rcu_state *rsp,
-                                                struct rcu_node *rnp)
-{
-        unsigned long flags;
-        int rnp_index = rnp - &rsp->node[0];
-        struct sched_param sp;
-        struct task_struct *t;
-
-        if (!rcu_scheduler_fully_active ||
-            rnp->qsmaskinit == 0)
-                return 0;
-        if (rnp->node_kthread_task == NULL) {
-                t = kthread_create(rcu_node_kthread, (void *)rnp,
-                                   "rcun/%d", rnp_index);
-                if (IS_ERR(t))
-                        return PTR_ERR(t);
-                raw_spin_lock_irqsave(&rnp->lock, flags);
-                rnp->node_kthread_task = t;
-                raw_spin_unlock_irqrestore(&rnp->lock, flags);
-                sp.sched_priority = 99;
-                sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-                wake_up_process(t); /* get to TASK_INTERRUPTIBLE quickly. */
-        }
-        return rcu_spawn_one_boost_kthread(rsp, rnp, rnp_index);
-}
+static struct smp_hotplug_thread rcu_cpu_thread_spec = {
+        .store                  = &rcu_cpu_kthread_task,
+        .thread_should_run      = rcu_cpu_kthread_should_run,
+        .thread_fn              = rcu_cpu_kthread,
+        .thread_comm            = "rcuc/%u",
+        .setup                  = rcu_cpu_kthread_setup,
+        .park                   = rcu_cpu_kthread_park,
+};
 
 /*
  * Spawn all kthreads -- called as soon as the scheduler is running.
  */
 static int __init rcu_spawn_kthreads(void)
 {
-        int cpu;
         struct rcu_node *rnp;
+        int cpu;
 
         rcu_scheduler_fully_active = 1;
-        for_each_possible_cpu(cpu) {
+        for_each_possible_cpu(cpu)
                 per_cpu(rcu_cpu_has_work, cpu) = 0;
-                if (cpu_online(cpu))
-                        (void)rcu_spawn_one_cpu_kthread(cpu);
-        }
+        BUG_ON(smpboot_register_percpu_thread(&rcu_cpu_thread_spec));
         rnp = rcu_get_root(rcu_state);
-        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+        (void)rcu_spawn_one_boost_kthread(rcu_state, rnp);
         if (NUM_RCU_NODES > 1) {
                 rcu_for_each_leaf_node(rcu_state, rnp)
-                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+                        (void)rcu_spawn_one_boost_kthread(rcu_state, rnp);
         }
         return 0;
 }
@@ -1670,11 +1445,8 @@ static void __cpuinit rcu_prepare_kthreads(int cpu)
         struct rcu_node *rnp = rdp->mynode;
 
         /* Fire up the incoming CPU's kthread and leaf rcu_node kthread. */
-        if (rcu_scheduler_fully_active) {
-                (void)rcu_spawn_one_cpu_kthread(cpu);
-                if (rnp->node_kthread_task == NULL)
-                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
-        }
+        if (rcu_scheduler_fully_active)
+                (void)rcu_spawn_one_boost_kthread(rcu_state, rnp);
 }
 
 #else /* #ifdef CONFIG_RCU_BOOST */
@@ -1698,19 +1470,7 @@ static void rcu_preempt_boost_start_gp(struct rcu_node *rnp)
 {
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
-
-static void rcu_stop_cpu_kthread(int cpu)
-{
-}
-
-#endif /* #ifdef CONFIG_HOTPLUG_CPU */
-
-static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
-{
-}
-
-static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
+static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
 {
 }
 
@@ -1997,6 +1757,26 @@ static void rcu_prepare_for_idle(int cpu)
         if (!tne)
                 return;
 
+        /* Adaptive-tick mode, where usermode execution is idle to RCU. */
+        if (!is_idle_task(current)) {
+                rdtp->dyntick_holdoff = jiffies - 1;
+                if (rcu_cpu_has_nonlazy_callbacks(cpu)) {
+                        trace_rcu_prep_idle("User dyntick with callbacks");
+                        rdtp->idle_gp_timer_expires =
+                                round_up(jiffies + RCU_IDLE_GP_DELAY,
+                                         RCU_IDLE_GP_DELAY);
+                } else if (rcu_cpu_has_callbacks(cpu)) {
+                        rdtp->idle_gp_timer_expires =
+                                round_jiffies(jiffies + RCU_IDLE_LAZY_GP_DELAY);
+                        trace_rcu_prep_idle("User dyntick with lazy callbacks");
+                } else {
+                        return;
+                }
+                tp = &rdtp->idle_gp_timer;
+                mod_timer_pinned(tp, rdtp->idle_gp_timer_expires);
+                return;
+        }
+
         /*
          * If this is an idle re-entry, for example, due to use of
          * RCU_NONIDLE() or the new idle-loop tracing API within the idle
@@ -2075,16 +1855,16 @@ static void rcu_prepare_for_idle(int cpu)
 #ifdef CONFIG_TREE_PREEMPT_RCU
         if (per_cpu(rcu_preempt_data, cpu).nxtlist) {
                 rcu_preempt_qs(cpu);
-                force_quiescent_state(&rcu_preempt_state, 0);
+                force_quiescent_state(&rcu_preempt_state);
         }
 #endif /* #ifdef CONFIG_TREE_PREEMPT_RCU */
         if (per_cpu(rcu_sched_data, cpu).nxtlist) {
                 rcu_sched_qs(cpu);
-                force_quiescent_state(&rcu_sched_state, 0);
+                force_quiescent_state(&rcu_sched_state);
         }
         if (per_cpu(rcu_bh_data, cpu).nxtlist) {
                 rcu_bh_qs(cpu);
-                force_quiescent_state(&rcu_bh_state, 0);
+                force_quiescent_state(&rcu_bh_state);
         }
 
         /*
@@ -2112,6 +1892,88 @@ static void rcu_idle_count_callbacks_posted(void)
         __this_cpu_add(rcu_dynticks.nonlazy_posted, 1);
 }
 
+/*
+ * Data for flushing lazy RCU callbacks at OOM time.
+ */
+static atomic_t oom_callback_count;
+static DECLARE_WAIT_QUEUE_HEAD(oom_callback_wq);
+
+/*
+ * RCU OOM callback -- decrement the outstanding count and deliver the
+ * wake-up if we are the last one.
+ */
+static void rcu_oom_callback(struct rcu_head *rhp)
+{
+        if (atomic_dec_and_test(&oom_callback_count))
+                wake_up(&oom_callback_wq);
+}
+
+/*
+ * Post an rcu_oom_notify callback on the current CPU if it has at
+ * least one lazy callback.  This will unnecessarily post callbacks
+ * to CPUs that already have a non-lazy callback at the end of their
+ * callback list, but this is an infrequent operation, so accept some
+ * extra overhead to keep things simple.
+ */
+static void rcu_oom_notify_cpu(void *unused)
+{
+        struct rcu_state *rsp;
+        struct rcu_data *rdp;
+
+        for_each_rcu_flavor(rsp) {
+                rdp = __this_cpu_ptr(rsp->rda);
+                if (rdp->qlen_lazy != 0) {
+                        atomic_inc(&oom_callback_count);
+                        rsp->call(&rdp->oom_head, rcu_oom_callback);
+                }
+        }
+}
+
+/*
+ * If low on memory, ensure that each CPU has a non-lazy callback.
+ * This will wake up CPUs that have only lazy callbacks, in turn
+ * ensuring that they free up the corresponding memory in a timely manner.
+ * Because an uncertain amount of memory will be freed in some uncertain
+ * timeframe, we do not claim to have freed anything.
+ */
+static int rcu_oom_notify(struct notifier_block *self,
+                          unsigned long notused, void *nfreed)
+{
+        int cpu;
+
+        /* Wait for callbacks from earlier instance to complete. */
+        wait_event(oom_callback_wq, atomic_read(&oom_callback_count) == 0);
+
+        /*
+         * Prevent premature wakeup: ensure that all increments happen
+         * before there is a chance of the counter reaching zero.
+         */
+        atomic_set(&oom_callback_count, 1);
+
+        get_online_cpus();
+        for_each_online_cpu(cpu) {
+                smp_call_function_single(cpu, rcu_oom_notify_cpu, NULL, 1);
+                cond_resched();
+        }
+        put_online_cpus();
+
+        /* Unconditionally decrement: no need to wake ourselves up. */
+        atomic_dec(&oom_callback_count);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block rcu_oom_nb = {
+        .notifier_call = rcu_oom_notify
+};
+
+static int __init rcu_register_oom_notifier(void)
+{
+        register_oom_notifier(&rcu_oom_nb);
+        return 0;
+}
+early_initcall(rcu_register_oom_notifier);
+
 #endif /* #else #if !defined(CONFIG_RCU_FAST_NO_HZ) */
 
 #ifdef CONFIG_RCU_CPU_STALL_INFO
@@ -2122,11 +1984,15 @@ static void print_cpu_stall_fast_no_hz(char *cp, int cpu)
 {
         struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
         struct timer_list *tltp = &rdtp->idle_gp_timer;
+        char c;
 
-        sprintf(cp, "drain=%d %c timer=%lu",
-                rdtp->dyntick_drain,
-                rdtp->dyntick_holdoff == jiffies ? 'H' : '.',
-                timer_pending(tltp) ? tltp->expires - jiffies : -1);
+        c = rdtp->dyntick_holdoff == jiffies ? 'H' : '.';
+        if (timer_pending(tltp))
+                sprintf(cp, "drain=%d %c timer=%lu",
+                        rdtp->dyntick_drain, c, tltp->expires - jiffies);
+        else
+                sprintf(cp, "drain=%d %c timer not pending",
+                        rdtp->dyntick_drain, c);
 }
 
 #else /* #ifdef CONFIG_RCU_FAST_NO_HZ */
@@ -2194,11 +2060,10 @@ static void zero_cpu_stall_ticks(struct rcu_data *rdp)
 /* Increment ->ticks_this_gp for all flavors of RCU. */
 static void increment_cpu_stall_ticks(void)
 {
-        __get_cpu_var(rcu_sched_data).ticks_this_gp++;
-        __get_cpu_var(rcu_bh_data).ticks_this_gp++;
-#ifdef CONFIG_TREE_PREEMPT_RCU
-        __get_cpu_var(rcu_preempt_data).ticks_this_gp++;
-#endif /* #ifdef CONFIG_TREE_PREEMPT_RCU */
+        struct rcu_state *rsp;
+
+        for_each_rcu_flavor(rsp)
+                __this_cpu_ptr(rsp->rda)->ticks_this_gp++;
 }
 
 #else /* #ifdef CONFIG_RCU_CPU_STALL_INFO */
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index abffb486e94e..693513bc50e6 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -51,8 +51,8 @@ static int show_rcubarrier(struct seq_file *m, void *unused)
         struct rcu_state *rsp;
 
         for_each_rcu_flavor(rsp)
-                seq_printf(m, "%s: %c bcc: %d nbd: %lu\n",
-                           rsp->name, rsp->rcu_barrier_in_progress ? 'B' : '.',
+                seq_printf(m, "%s: bcc: %d nbd: %lu\n",
+                           rsp->name,
                            atomic_read(&rsp->barrier_cpu_count),
                            rsp->n_barrier_done);
         return 0;
@@ -86,12 +86,11 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
 {
         if (!rdp->beenonline)
                 return;
-        seq_printf(m, "%3d%cc=%lu g=%lu pq=%d pgp=%lu qp=%d",
+        seq_printf(m, "%3d%cc=%lu g=%lu pq=%d qp=%d",
                    rdp->cpu,
                    cpu_is_offline(rdp->cpu) ? '!' : ' ',
                    rdp->completed, rdp->gpnum,
-                   rdp->passed_quiesce, rdp->passed_quiesce_gpnum,
-                   rdp->qs_pending);
+                   rdp->passed_quiesce, rdp->qs_pending);
         seq_printf(m, " dt=%d/%llx/%d df=%lu",
                    atomic_read(&rdp->dynticks->dynticks),
                    rdp->dynticks->dynticks_nesting,
@@ -108,11 +107,10 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
                         rdp->nxttail[RCU_WAIT_TAIL]],
                    ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]]);
 #ifdef CONFIG_RCU_BOOST
-        seq_printf(m, " kt=%d/%c/%d ktl=%x",
+        seq_printf(m, " kt=%d/%c ktl=%x",
                    per_cpu(rcu_cpu_has_work, rdp->cpu),
                    convert_kthread_status(per_cpu(rcu_cpu_kthread_status,
                                           rdp->cpu)),
-                   per_cpu(rcu_cpu_kthread_cpu, rdp->cpu),
                    per_cpu(rcu_cpu_kthread_loops, rdp->cpu) & 0xffff);
 #endif /* #ifdef CONFIG_RCU_BOOST */
         seq_printf(m, " b=%ld", rdp->blimit);
@@ -150,12 +148,11 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
 {
         if (!rdp->beenonline)
                 return;
-        seq_printf(m, "%d,%s,%lu,%lu,%d,%lu,%d",
+        seq_printf(m, "%d,%s,%lu,%lu,%d,%d",
                    rdp->cpu,
                    cpu_is_offline(rdp->cpu) ? "\"N\"" : "\"Y\"",
                    rdp->completed, rdp->gpnum,
-                   rdp->passed_quiesce, rdp->passed_quiesce_gpnum,
-                   rdp->qs_pending);
+                   rdp->passed_quiesce, rdp->qs_pending);
         seq_printf(m, ",%d,%llx,%d,%lu",
                    atomic_read(&rdp->dynticks->dynticks),
                    rdp->dynticks->dynticks_nesting,
@@ -186,7 +183,7 @@ static int show_rcudata_csv(struct seq_file *m, void *unused)
         int cpu;
         struct rcu_state *rsp;
 
-        seq_puts(m, "\"CPU\",\"Online?\",\"c\",\"g\",\"pq\",\"pgp\",\"pq\",");
+        seq_puts(m, "\"CPU\",\"Online?\",\"c\",\"g\",\"pq\",\"pq\",");
         seq_puts(m, "\"dt\",\"dt nesting\",\"dt NMI nesting\",\"df\",");
         seq_puts(m, "\"of\",\"qll\",\"ql\",\"qs\"");
 #ifdef CONFIG_RCU_BOOST
@@ -386,10 +383,9 @@ static void print_one_rcu_pending(struct seq_file *m, struct rcu_data *rdp)
                    rdp->n_rp_report_qs,
                    rdp->n_rp_cb_ready,
                    rdp->n_rp_cpu_needs_gp);
-        seq_printf(m, "gpc=%ld gps=%ld nf=%ld nn=%ld\n",
+        seq_printf(m, "gpc=%ld gps=%ld nn=%ld\n",
                    rdp->n_rp_gp_completed,
                    rdp->n_rp_gp_started,
-                   rdp->n_rp_need_fqs,
                    rdp->n_rp_need_nothing);
 }
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index fbf1fd098dc6..3c4dec0594d6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2081,6 +2081,7 @@ context_switch(struct rq *rq, struct task_struct *prev,
 #endif
 
         /* Here we just switch the register state and the stack. */
+        rcu_switch(prev, next);
         switch_to(prev, next, prev);
 
         barrier();
@@ -3468,6 +3469,21 @@ asmlinkage void __sched schedule(void)
 }
 EXPORT_SYMBOL(schedule);
 
+#ifdef CONFIG_RCU_USER_QS
+asmlinkage void __sched schedule_user(void)
+{
+        /*
+         * If we come here after a random call to set_need_resched(),
+         * or we have been woken up remotely but the IPI has not yet arrived,
+         * we haven't yet exited the RCU idle mode. Do it here manually until
+         * we find a better solution.
+         */
+        rcu_user_exit();
+        schedule();
+        rcu_user_enter();
+}
+#endif
+
 /**
  * schedule_preempt_disabled - called with preemption disabled
  *
@@ -3569,6 +3585,7 @@ asmlinkage void __sched preempt_schedule_irq(void)
         /* Catch callers which need to be fixed */
         BUG_ON(ti->preempt_count || !irqs_disabled());
 
+        rcu_user_exit();
         do {
                 add_preempt_count(PREEMPT_ACTIVE);
                 local_irq_enable();
@@ -5304,27 +5321,17 @@ void idle_task_exit(void)
 }
 
 /*
- * While a dead CPU has no uninterruptible tasks queued at this point,
- * it might still have a nonzero ->nr_uninterruptible counter, because
- * for performance reasons the counter is not stricly tracking tasks to
- * their home CPUs. So we just add the counter to another CPU's counter,
- * to keep the global sum constant after CPU-down:
- */
-static void migrate_nr_uninterruptible(struct rq *rq_src)
-{
-        struct rq *rq_dest = cpu_rq(cpumask_any(cpu_active_mask));
-
-        rq_dest->nr_uninterruptible += rq_src->nr_uninterruptible;
-        rq_src->nr_uninterruptible = 0;
-}
-
-/*
- * remove the tasks which were accounted by rq from calc_load_tasks.
+ * Since this CPU is going 'away' for a while, fold any nr_active delta
+ * we might have. Assumes we're called after migrate_tasks() so that the
+ * nr_active count is stable.
+ *
+ * Also see the comment "Global load-average calculations".
  */
-static void calc_global_load_remove(struct rq *rq)
+static void calc_load_migrate(struct rq *rq)
 {
-        atomic_long_sub(rq->calc_load_active, &calc_load_tasks);
-        rq->calc_load_active = 0;
+        long delta = calc_load_fold_active(rq);
+        if (delta)
+                atomic_long_add(delta, &calc_load_tasks);
 }
 
 /*
@@ -5352,9 +5359,6 @@ static void migrate_tasks(unsigned int dead_cpu)
          */
         rq->stop = NULL;
 
-        /* Ensure any throttled groups are reachable by pick_next_task */
-        unthrottle_offline_cfs_rqs(rq);
-
         for ( ; ; ) {
                 /*
                  * There's this thread running, bail when that's the only
@@ -5617,9 +5621,10 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 migrate_tasks(cpu);
                 BUG_ON(rq->nr_running != 1); /* the migration thread */
                 raw_spin_unlock_irqrestore(&rq->lock, flags);
+                break;
 
-                migrate_nr_uninterruptible(rq);
-                calc_global_load_remove(rq);
+        case CPU_DEAD:
+                calc_load_migrate(rq);
                 break;
 #endif
         }
@@ -6028,11 +6033,6 @@ static void destroy_sched_domains(struct sched_domain *sd, int cpu)
  * SD_SHARE_PKG_RESOURCE set (Last Level Cache Domain) for this
  * allows us to avoid some pointer chasing select_idle_sibling().
  *
- * Iterate domains and sched_groups downward, assigning CPUs to be
- * select_idle_sibling() hw buddy.  Cross-wiring hw makes bouncing
- * due to random perturbation self canceling, ie sw buddies pull
- * their counterpart to their CPU's hw counterpart.
- *
  * Also keep a unique ID per domain (we use the first cpu number in
  * the cpumask of the domain), this allows us to quickly tell if
  * two cpus are in the same cache domain, see cpus_share_cache().
@@ -6046,40 +6046,8 @@ static void update_top_cache_domain(int cpu)
         int id = cpu;
 
         sd = highest_flag_domain(cpu, SD_SHARE_PKG_RESOURCES);
-        if (sd) {
-                struct sched_domain *tmp = sd;
-                struct sched_group *sg, *prev;
-                bool right;
-
-                /*
-                 * Traverse to first CPU in group, and count hops
-                 * to cpu from there, switching direction on each
-                 * hop, never ever pointing the last CPU rightward.
-                 */
-                do {
-                        id = cpumask_first(sched_domain_span(tmp));
-                        prev = sg = tmp->groups;
-                        right = 1;
-
-                        while (cpumask_first(sched_group_cpus(sg)) != id)
-                                sg = sg->next;
-
-                        while (!cpumask_test_cpu(cpu, sched_group_cpus(sg))) {
-                                prev = sg;
-                                sg = sg->next;
-                                right = !right;
-                        }
-
-                        /* A CPU went down, never point back to domain start. */
-                        if (right && cpumask_first(sched_group_cpus(sg->next)) == id)
-                                right = false;
-
-                        sg = right ? sg->next : prev;
-                        tmp->idle_buddy = cpumask_first(sched_group_cpus(sg));
-                } while ((tmp = tmp->child));
-
+        if (sd)
                 id = cpumask_first(sched_domain_span(sd));
-        }
 
         rcu_assign_pointer(per_cpu(sd_llc, cpu), sd);
         per_cpu(sd_llc_id, cpu) = id;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index c219bf8d704c..96e2b18b6283 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2052,7 +2052,7 @@ static void destroy_cfs_bandwidth(struct cfs_bandwidth *cfs_b)
         hrtimer_cancel(&cfs_b->slack_timer);
 }
 
-void unthrottle_offline_cfs_rqs(struct rq *rq)
+static void unthrottle_offline_cfs_rqs(struct rq *rq)
 {
         struct cfs_rq *cfs_rq;
 
@@ -2106,7 +2106,7 @@ static inline struct cfs_bandwidth *tg_cfs_bandwidth(struct task_group *tg)
         return NULL;
 }
 static inline void destroy_cfs_bandwidth(struct cfs_bandwidth *cfs_b) {}
-void unthrottle_offline_cfs_rqs(struct rq *rq) {}
+static inline void unthrottle_offline_cfs_rqs(struct rq *rq) {}
 
 #endif /* CONFIG_CFS_BANDWIDTH */
 
@@ -2637,6 +2637,8 @@ static int select_idle_sibling(struct task_struct *p, int target)
         int cpu = smp_processor_id();
         int prev_cpu = task_cpu(p);
         struct sched_domain *sd;
+        struct sched_group *sg;
+        int i;
 
         /*
          * If the task is going to be woken-up on this cpu and if it is
@@ -2653,17 +2655,29 @@ static int select_idle_sibling(struct task_struct *p, int target)
                 return prev_cpu;
 
         /*
-         * Otherwise, check assigned siblings to find an elegible idle cpu.
+         * Otherwise, iterate the domains and find an elegible idle cpu.
          */
         sd = rcu_dereference(per_cpu(sd_llc, target));
-
         for_each_lower_domain(sd) {
-                if (!cpumask_test_cpu(sd->idle_buddy, tsk_cpus_allowed(p)))
-                        continue;
-                if (idle_cpu(sd->idle_buddy))
-                        return sd->idle_buddy;
-        }
+                sg = sd->groups;
+                do {
+                        if (!cpumask_intersects(sched_group_cpus(sg),
+                                                tsk_cpus_allowed(p)))
+                                goto next;
 
+                        for_each_cpu(i, sched_group_cpus(sg)) {
+                                if (!idle_cpu(i))
+                                        goto next;
+                        }
+
+                        target = cpumask_first_and(sched_group_cpus(sg),
+                                        tsk_cpus_allowed(p));
+                        goto done;
+next:
+                        sg = sg->next;
+                } while (sg != sd->groups);
+        }
+done:
         return target;
 }
 
@@ -3658,7 +3672,6 @@ fix_small_capacity(struct sched_domain *sd, struct sched_group *group)
  * @group: sched_group whose statistics are to be updated.
  * @load_idx: Load index of sched_domain of this_cpu for load calc.
  * @local_group: Does group contain this_cpu.
- * @cpus: Set of cpus considered for load balancing.
  * @balance: Should we balance.
  * @sgs: variable to hold the statistics for this group.
  */
@@ -3805,7 +3818,6 @@ static bool update_sd_pick_busiest(struct lb_env *env,
 /**
  * update_sd_lb_stats - Update sched_domain's statistics for load balancing.
  * @env: The load balancing environment.
- * @cpus: Set of cpus considered for load balancing.
  * @balance: Should we balance.
  * @sds: variable to hold the statistics for this sched_domain.
  */
@@ -4956,6 +4968,9 @@ static void rq_online_fair(struct rq *rq)
 static void rq_offline_fair(struct rq *rq)
 {
         update_sysctl();
+
+        /* Ensure any throttled groups are reachable by pick_next_task */
+        unthrottle_offline_cfs_rqs(rq);
 }
 
 #endif /* CONFIG_SMP */
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 944cb68420e9..e0b7ba9c040f 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -691,6 +691,7 @@ balanced:
                  * runtime - in which case borrowing doesn't make sense.
                  */
                 rt_rq->rt_runtime = RUNTIME_INF;
+                rt_rq->rt_throttled = 0;
                 raw_spin_unlock(&rt_rq->rt_runtime_lock);
                 raw_spin_unlock(&rt_b->rt_runtime_lock);
         }
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index f6714d009e77..0848fa36c383 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1144,7 +1144,6 @@ extern void print_rt_stats(struct seq_file *m, int cpu);
 
 extern void init_cfs_rq(struct cfs_rq *cfs_rq);
 extern void init_rt_rq(struct rt_rq *rt_rq, struct rq *rq);
-extern void unthrottle_offline_cfs_rqs(struct rq *rq);
 
 extern void account_cfs_bandwidth_used(int enabled, int was_enabled);
 
diff --git a/kernel/signal.c b/kernel/signal.c
index be4f856d52f8..2c681f11b7d2 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1971,13 +1971,8 @@ static void ptrace_do_notify(int signr, int exit_code, int why)
 void ptrace_notify(int exit_code)
 {
         BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
-        if (unlikely(current->task_works)) {
-                if (test_and_clear_ti_thread_flag(current_thread_info(),
-                                                   TIF_NOTIFY_RESUME)) {
-                        smp_mb__after_clear_bit();
-                        task_work_run();
-                }
-        }
+        if (unlikely(current->task_works))
+                task_work_run();
 
         spin_lock_irq(&current->sighand->siglock);
         ptrace_do_notify(SIGTRAP, exit_code, CLD_TRAPPED);
@@ -2198,13 +2193,8 @@ int get_signal_to_deliver(siginfo_t *info, struct k_sigaction *return_ka,
         struct signal_struct *signal = current->signal;
         int signr;
 
-        if (unlikely(current->task_works)) {
-                if (test_and_clear_ti_thread_flag(current_thread_info(),
-                                                   TIF_NOTIFY_RESUME)) {
-                        smp_mb__after_clear_bit();
-                        task_work_run();
-                }
-        }
+        if (unlikely(current->task_works))
+                task_work_run();
 
         if (unlikely(uprobe_deny_signal()))
                 return 0;
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index 98f60c5caa1b..d6c5fc054242 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -1,14 +1,22 @@
 /*
  * Common SMP CPU bringup/teardown functions
  */
+#include <linux/cpu.h>
 #include <linux/err.h>
 #include <linux/smp.h>
 #include <linux/init.h>
+#include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/export.h>
 #include <linux/percpu.h>
+#include <linux/kthread.h>
+#include <linux/smpboot.h>
 
 #include "smpboot.h"
 
+#ifdef CONFIG_SMP
+
 #ifdef CONFIG_GENERIC_SMP_IDLE_THREAD
 /*
  * For the hotplug case we keep the task structs around and reuse
@@ -65,3 +73,228 @@ void __init idle_threads_init(void)
         }
 }
 #endif
+
+#endif /* #ifdef CONFIG_SMP */
+
+static LIST_HEAD(hotplug_threads);
+static DEFINE_MUTEX(smpboot_threads_lock);
+
+struct smpboot_thread_data {
+        unsigned int                    cpu;
+        unsigned int                    status;
+        struct smp_hotplug_thread       *ht;
+};
+
+enum {
+        HP_THREAD_NONE = 0,
+        HP_THREAD_ACTIVE,
+        HP_THREAD_PARKED,
+};
+
+/**
+ * smpboot_thread_fn - percpu hotplug thread loop function
+ * @data:       thread data pointer
+ *
+ * Checks for thread stop and park conditions. Calls the necessary
+ * setup, cleanup, park and unpark functions for the registered
+ * thread.
+ *
+ * Returns 1 when the thread should exit, 0 otherwise.
+ */
+static int smpboot_thread_fn(void *data)
+{
+        struct smpboot_thread_data *td = data;
+        struct smp_hotplug_thread *ht = td->ht;
+
+        while (1) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                preempt_disable();
+                if (kthread_should_stop()) {
+                        set_current_state(TASK_RUNNING);
+                        preempt_enable();
+                        if (ht->cleanup)
+                                ht->cleanup(td->cpu, cpu_online(td->cpu));
+                        kfree(td);
+                        return 0;
+                }
+
+                if (kthread_should_park()) {
+                        __set_current_state(TASK_RUNNING);
+                        preempt_enable();
+                        if (ht->park && td->status == HP_THREAD_ACTIVE) {
+                                BUG_ON(td->cpu != smp_processor_id());
+                                ht->park(td->cpu);
+                                td->status = HP_THREAD_PARKED;
+                        }
+                        kthread_parkme();
+                        /* We might have been woken for stop */
+                        continue;
+                }
+
+                BUG_ON(td->cpu != smp_processor_id());
+
+                /* Check for state change setup */
+                switch (td->status) {
+                case HP_THREAD_NONE:
+                        preempt_enable();
+                        if (ht->setup)
+                                ht->setup(td->cpu);
+                        td->status = HP_THREAD_ACTIVE;
+                        preempt_disable();
+                        break;
+                case HP_THREAD_PARKED:
+                        preempt_enable();
+                        if (ht->unpark)
+                                ht->unpark(td->cpu);
+                        td->status = HP_THREAD_ACTIVE;
+                        preempt_disable();
+                        break;
+                }
+
+                if (!ht->thread_should_run(td->cpu)) {
+                        preempt_enable();
+                        schedule();
+                } else {
+                        set_current_state(TASK_RUNNING);
+                        preempt_enable();
+                        ht->thread_fn(td->cpu);
+                }
+        }
+}
+
+static int
+__smpboot_create_thread(struct smp_hotplug_thread *ht, unsigned int cpu)
+{
+        struct task_struct *tsk = *per_cpu_ptr(ht->store, cpu);
+        struct smpboot_thread_data *td;
+
+        if (tsk)
+                return 0;
+
+        td = kzalloc_node(sizeof(*td), GFP_KERNEL, cpu_to_node(cpu));
+        if (!td)
+                return -ENOMEM;
+        td->cpu = cpu;
+        td->ht = ht;
+
+        tsk = kthread_create_on_cpu(smpboot_thread_fn, td, cpu,
+                                    ht->thread_comm);
+        if (IS_ERR(tsk)) {
+                kfree(td);
+                return PTR_ERR(tsk);
+        }
+
+        get_task_struct(tsk);
+        *per_cpu_ptr(ht->store, cpu) = tsk;
+        return 0;
+}
+
+int smpboot_create_threads(unsigned int cpu)
+{
+        struct smp_hotplug_thread *cur;
+        int ret = 0;
+
+        mutex_lock(&smpboot_threads_lock);
+        list_for_each_entry(cur, &hotplug_threads, list) {
+                ret = __smpboot_create_thread(cur, cpu);
+                if (ret)
+                        break;
+        }
+        mutex_unlock(&smpboot_threads_lock);
+        return ret;
+}
+
+static void smpboot_unpark_thread(struct smp_hotplug_thread *ht, unsigned int cpu)
+{
+        struct task_struct *tsk = *per_cpu_ptr(ht->store, cpu);
+
+        kthread_unpark(tsk);
+}
+
+void smpboot_unpark_threads(unsigned int cpu)
+{
+        struct smp_hotplug_thread *cur;
+
+        mutex_lock(&smpboot_threads_lock);
+        list_for_each_entry(cur, &hotplug_threads, list)
+                smpboot_unpark_thread(cur, cpu);
+        mutex_unlock(&smpboot_threads_lock);
+}
+
+static void smpboot_park_thread(struct smp_hotplug_thread *ht, unsigned int cpu)
+{
+        struct task_struct *tsk = *per_cpu_ptr(ht->store, cpu);
+
+        if (tsk)
+                kthread_park(tsk);
+}
+
+void smpboot_park_threads(unsigned int cpu)
+{
+        struct smp_hotplug_thread *cur;
+
+        mutex_lock(&smpboot_threads_lock);
+        list_for_each_entry_reverse(cur, &hotplug_threads, list)
+                smpboot_park_thread(cur, cpu);
+        mutex_unlock(&smpboot_threads_lock);
+}
+
+static void smpboot_destroy_threads(struct smp_hotplug_thread *ht)
+{
+        unsigned int cpu;
+
+        /* We need to destroy also the parked threads of offline cpus */
+        for_each_possible_cpu(cpu) {
+                struct task_struct *tsk = *per_cpu_ptr(ht->store, cpu);
+
+                if (tsk) {
+                        kthread_stop(tsk);
+                        put_task_struct(tsk);
+                        *per_cpu_ptr(ht->store, cpu) = NULL;
+                }
+        }
+}
+
+/**
+ * smpboot_register_percpu_thread - Register a per_cpu thread related to hotplug
+ * @plug_thread:        Hotplug thread descriptor
+ *
+ * Creates and starts the threads on all online cpus.
+ */
+int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
+{
+        unsigned int cpu;
+        int ret = 0;
+
+        mutex_lock(&smpboot_threads_lock);
+        for_each_online_cpu(cpu) {
+                ret = __smpboot_create_thread(plug_thread, cpu);
+                if (ret) {
+                        smpboot_destroy_threads(plug_thread);
+                        goto out;
+                }
+                smpboot_unpark_thread(plug_thread, cpu);
+        }
+        list_add(&plug_thread->list, &hotplug_threads);
+out:
+        mutex_unlock(&smpboot_threads_lock);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread);
+
+/**
+ * smpboot_unregister_percpu_thread - Unregister a per_cpu thread related to hotplug
+ * @plug_thread:        Hotplug thread descriptor
+ *
+ * Stops all threads on all possible cpus.
+ */
+void smpboot_unregister_percpu_thread(struct smp_hotplug_thread *plug_thread)
+{
+        get_online_cpus();
+        mutex_lock(&smpboot_threads_lock);
+        list_del(&plug_thread->list);
+        smpboot_destroy_threads(plug_thread);
+        mutex_unlock(&smpboot_threads_lock);
+        put_online_cpus();
+}
+EXPORT_SYMBOL_GPL(smpboot_unregister_percpu_thread);
diff --git a/kernel/smpboot.h b/kernel/smpboot.h
index 6ef9433e1c70..72415a0eb955 100644
--- a/kernel/smpboot.h
+++ b/kernel/smpboot.h
@@ -13,4 +13,8 @@ static inline void idle_thread_set_boot_cpu(void) { }
 static inline void idle_threads_init(void) { }
 #endif
 
+int smpboot_create_threads(unsigned int cpu);
+void smpboot_park_threads(unsigned int cpu);
+void smpboot_unpark_threads(unsigned int cpu);
+
 #endif
diff --git a/kernel/softirq.c b/kernel/softirq.c
index b73e681df09e..5c6a5bd8462f 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -23,6 +23,7 @@
 #include <linux/rcupdate.h>
 #include <linux/ftrace.h>
 #include <linux/smp.h>
+#include <linux/smpboot.h>
 #include <linux/tick.h>
 
 #define CREATE_TRACE_POINTS
@@ -742,49 +743,22 @@ void __init softirq_init(void)
         open_softirq(HI_SOFTIRQ, tasklet_hi_action);
 }
 
-static int run_ksoftirqd(void * __bind_cpu)
+static int ksoftirqd_should_run(unsigned int cpu)
 {
-        set_current_state(TASK_INTERRUPTIBLE);
-
-        while (!kthread_should_stop()) {
-                preempt_disable();
-                if (!local_softirq_pending()) {
-                        schedule_preempt_disabled();
-                }
-
-                __set_current_state(TASK_RUNNING);
-
-                while (local_softirq_pending()) {
-                        /* Preempt disable stops cpu going offline.
-                           If already offline, we'll be on wrong CPU:
-                           don't process */
-                        if (cpu_is_offline((long)__bind_cpu))
-                                goto wait_to_die;
-                        local_irq_disable();
-                        if (local_softirq_pending())
-                                __do_softirq();
-                        local_irq_enable();
-                        sched_preempt_enable_no_resched();
-                        cond_resched();
-                        preempt_disable();
-                        rcu_note_context_switch((long)__bind_cpu);
-                }
-                preempt_enable();
-                set_current_state(TASK_INTERRUPTIBLE);
-        }
-        __set_current_state(TASK_RUNNING);
-        return 0;
+        return local_softirq_pending();
+}
 
-wait_to_die:
-        preempt_enable();
-        /* Wait for kthread_stop */
-        set_current_state(TASK_INTERRUPTIBLE);
-        while (!kthread_should_stop()) {
-                schedule();
-                set_current_state(TASK_INTERRUPTIBLE);
+static void run_ksoftirqd(unsigned int cpu)
+{
+        local_irq_disable();
+        if (local_softirq_pending()) {
+                __do_softirq();
+                rcu_note_context_switch(cpu);
+                local_irq_enable();
+                cond_resched();
+                return;
         }
-        __set_current_state(TASK_RUNNING);
-        return 0;
+        local_irq_enable();
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -850,50 +824,14 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
                                   unsigned long action,
                                   void *hcpu)
 {
-        int hotcpu = (unsigned long)hcpu;
-        struct task_struct *p;
-
         switch (action) {
-        case CPU_UP_PREPARE:
-        case CPU_UP_PREPARE_FROZEN:
-                p = kthread_create_on_node(run_ksoftirqd,
-                                           hcpu,
-                                           cpu_to_node(hotcpu),
-                                           "ksoftirqd/%d", hotcpu);
-                if (IS_ERR(p)) {
-                        printk("ksoftirqd for %i failed\n", hotcpu);
-                        return notifier_from_errno(PTR_ERR(p));
-                }
-                kthread_bind(p, hotcpu);
-                per_cpu(ksoftirqd, hotcpu) = p;
-                break;
-        case CPU_ONLINE:
-        case CPU_ONLINE_FROZEN:
-                wake_up_process(per_cpu(ksoftirqd, hotcpu));
-                break;
 #ifdef CONFIG_HOTPLUG_CPU
-        case CPU_UP_CANCELED:
-        case CPU_UP_CANCELED_FROZEN:
-                if (!per_cpu(ksoftirqd, hotcpu))
-                        break;
-                /* Unbind so it can run.  Fall thru. */
-                kthread_bind(per_cpu(ksoftirqd, hotcpu),
-                             cpumask_any(cpu_online_mask));
         case CPU_DEAD:
-        case CPU_DEAD_FROZEN: {
-                static const struct sched_param param = {
-                        .sched_priority = MAX_RT_PRIO-1
-                };
-
-                p = per_cpu(ksoftirqd, hotcpu);
-                per_cpu(ksoftirqd, hotcpu) = NULL;
-                sched_setscheduler_nocheck(p, SCHED_FIFO, &param);
-                kthread_stop(p);
-                takeover_tasklets(hotcpu);
+        case CPU_DEAD_FROZEN:
+                takeover_tasklets((unsigned long)hcpu);
                 break;
-        }
 #endif /* CONFIG_HOTPLUG_CPU */
-        }
+        }
         return NOTIFY_OK;
 }
 
@@ -901,14 +839,19 @@ static struct notifier_block __cpuinitdata cpu_nfb = {
         .notifier_call = cpu_callback
 };
 
+static struct smp_hotplug_thread softirq_threads = {
+        .store                  = &ksoftirqd,
+        .thread_should_run      = ksoftirqd_should_run,
+        .thread_fn              = run_ksoftirqd,
+        .thread_comm            = "ksoftirqd/%u",
+};
+
 static __init int spawn_ksoftirqd(void)
 {
-        void *cpu = (void *)(long)smp_processor_id();
-        int err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
-
-        BUG_ON(err != NOTIFY_OK);
-        cpu_callback(&cpu_nfb, CPU_ONLINE, cpu);
         register_cpu_notifier(&cpu_nfb);
+
+        BUG_ON(smpboot_register_percpu_thread(&softirq_threads));
+
         return 0;
 }
 early_initcall(spawn_ksoftirqd);
diff --git a/kernel/task_work.c b/kernel/task_work.c
index d320d44903bd..65bd3c92d6f3 100644
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -2,26 +2,20 @@
 #include <linux/task_work.h>
 #include <linux/tracehook.h>
 
+static struct callback_head work_exited; /* all we need is ->next == NULL */
+
 int
-task_work_add(struct task_struct *task, struct callback_head *twork, bool notify)
+task_work_add(struct task_struct *task, struct callback_head *work, bool notify)
 {
-        struct callback_head *last, *first;
-        unsigned long flags;
+        struct callback_head *head;
 
-        /*
-         * Not inserting the new work if the task has already passed
-         * exit_task_work() is the responisbility of callers.
-         */
-        raw_spin_lock_irqsave(&task->pi_lock, flags);
-        last = task->task_works;
-        first = last ? last->next : twork;
-        twork->next = first;
-        if (last)
-                last->next = twork;
-        task->task_works = twork;
-        raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+        do {
+                head = ACCESS_ONCE(task->task_works);
+                if (unlikely(head == &work_exited))
+                        return -ESRCH;
+                work->next = head;
+        } while (cmpxchg(&task->task_works, head, work) != head);
 
-        /* test_and_set_bit() implies mb(), see tracehook_notify_resume(). */
         if (notify)
                 set_notify_resume(task);
         return 0;
@@ -30,52 +24,69 @@ task_work_add(struct task_struct *task, struct callback_head *twork, bool notify
 struct callback_head *
 task_work_cancel(struct task_struct *task, task_work_func_t func)
 {
+        struct callback_head **pprev = &task->task_works;
+        struct callback_head *work = NULL;
         unsigned long flags;
-        struct callback_head *last, *res = NULL;
-
+        /*
+         * If cmpxchg() fails we continue without updating pprev.
+         * Either we raced with task_work_add() which added the
+         * new entry before this work, we will find it again. Or
+         * we raced with task_work_run(), *pprev == NULL/exited.
+         */
         raw_spin_lock_irqsave(&task->pi_lock, flags);
-        last = task->task_works;
-        if (last) {
-                struct callback_head *q = last, *p = q->next;
-                while (1) {
-                        if (p->func == func) {
-                                q->next = p->next;
-                                if (p == last)
-                                        task->task_works = q == p ? NULL : q;
-                                res = p;
-                                break;
-                        }
-                        if (p == last)
-                                break;
-                        q = p;
-                        p = q->next;
-                }
+        while ((work = ACCESS_ONCE(*pprev))) {
+                read_barrier_depends();
+                if (work->func != func)
+                        pprev = &work->next;
+                else if (cmpxchg(pprev, work, work->next) == work)
+                        break;
         }
         raw_spin_unlock_irqrestore(&task->pi_lock, flags);
-        return res;
+
+        return work;
 }
 
 void task_work_run(void)
 {
         struct task_struct *task = current;
-        struct callback_head *p, *q;
+        struct callback_head *work, *head, *next;
+
+        for (;;) {
+                /*
+                 * work->func() can do task_work_add(), do not set
+                 * work_exited unless the list is empty.
+                 */
+                do {
+                        work = ACCESS_ONCE(task->task_works);
+                        head = !work && (task->flags & PF_EXITING) ?
+                                &work_exited : NULL;
+                } while (cmpxchg(&task->task_works, work, head) != work);
 
-        while (1) {
-                raw_spin_lock_irq(&task->pi_lock);
-                p = task->task_works;
-                task->task_works = NULL;
-                raw_spin_unlock_irq(&task->pi_lock);
+                if (!work)
+                        break;
+                /*
+                 * Synchronize with task_work_cancel(). It can't remove
+                 * the first entry == work, cmpxchg(task_works) should
+                 * fail, but it can play with *work and other entries.
+                 */
+                raw_spin_unlock_wait(&task->pi_lock);
+                smp_mb();
 
-                if (unlikely(!p))
-                        return;
+                /* Reverse the list to run the works in fifo order */
+                head = NULL;
+                do {
+                        next = work->next;
+                        work->next = head;
+                        head = work;
+                        work = next;
+                } while (work);
 
-                q = p->next; /* head */
-                p->next = NULL; /* cut it */
-                while (q) {
-                        p = q->next;
-                        q->func(q);
-                        q = p;
+                work = head;
+                do {
+                        next = work->next;
+                        work->func(work);
+                        work = next;
                         cond_resched();
-                }
+                } while (work);
         }
 }
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 024540f97f74..cf5f6b262673 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -436,7 +436,8 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts)
         if (unlikely(local_softirq_pending() && cpu_online(cpu))) {
                 static int ratelimit;
 
-                if (ratelimit < 10) {
+                if (ratelimit < 10 &&
+                    (local_softirq_pending() & SOFTIRQ_STOP_IDLE_MASK)) {
                         printk(KERN_ERR "NOHZ: local_softirq_pending %02x\n",
                                (unsigned int) local_softirq_pending());
                         ratelimit++;
@@ -573,6 +574,7 @@ static void tick_nohz_restart_sched_tick(struct tick_sched *ts, ktime_t now)
         tick_do_update_jiffies64(now);
         update_cpu_load_nohz();
 
+        calc_load_exit_idle();
         touch_softlockup_watchdog();
         /*
          * Cancel the scheduled timer and restore the tick
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 34e5eac81424..d3b91e75cecd 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -303,10 +303,11 @@ void getnstimeofday(struct timespec *ts)
                 seq = read_seqbegin(&tk->lock);
 
                 ts->tv_sec = tk->xtime_sec;
-                ts->tv_nsec = timekeeping_get_ns(tk);
+                nsecs = timekeeping_get_ns(tk);
 
         } while (read_seqretry(&tk->lock, seq));
 
+        ts->tv_nsec = 0;
         timespec_add_ns(ts, nsecs);
 }
 EXPORT_SYMBOL(getnstimeofday);
@@ -345,6 +346,7 @@ void ktime_get_ts(struct timespec *ts)
 {
         struct timekeeper *tk = &timekeeper;
         struct timespec tomono;
+        s64 nsec;
         unsigned int seq;
 
         WARN_ON(timekeeping_suspended);
@@ -352,13 +354,14 @@ void ktime_get_ts(struct timespec *ts)
         do {
                 seq = read_seqbegin(&tk->lock);
                 ts->tv_sec = tk->xtime_sec;
-                ts->tv_nsec = timekeeping_get_ns(tk);
+                nsec = timekeeping_get_ns(tk);
                 tomono = tk->wall_to_monotonic;
 
         } while (read_seqretry(&tk->lock, seq));
 
-        set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec,
-                                ts->tv_nsec + tomono.tv_nsec);
+        ts->tv_sec += tomono.tv_sec;
+        ts->tv_nsec = 0;
+        timespec_add_ns(ts, nsec + tomono.tv_nsec);
 }
 EXPORT_SYMBOL_GPL(ktime_get_ts);
 
@@ -1244,6 +1247,7 @@ void get_monotonic_boottime(struct timespec *ts)
 {
         struct timekeeper *tk = &timekeeper;
         struct timespec tomono, sleep;
+        s64 nsec;
         unsigned int seq;
 
         WARN_ON(timekeeping_suspended);
@@ -1251,14 +1255,15 @@ void get_monotonic_boottime(struct timespec *ts)
         do {
                 seq = read_seqbegin(&tk->lock);
                 ts->tv_sec = tk->xtime_sec;
-                ts->tv_nsec = timekeeping_get_ns(tk);
+                nsec = timekeeping_get_ns(tk);
                 tomono = tk->wall_to_monotonic;
                 sleep = tk->total_sleep_time;
 
         } while (read_seqretry(&tk->lock, seq));
 
-        set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec + sleep.tv_sec,
-                        ts->tv_nsec + tomono.tv_nsec + sleep.tv_nsec);
+        ts->tv_sec += tomono.tv_sec + sleep.tv_sec;
+        ts->tv_nsec = 0;
+        timespec_add_ns(ts, nsec + tomono.tv_nsec + sleep.tv_nsec);
 }
 EXPORT_SYMBOL_GPL(get_monotonic_boottime);
 
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 4b1dfba70f7c..9d4c8d5a1f53 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -22,6 +22,7 @@
 #include <linux/notifier.h>
 #include <linux/module.h>
 #include <linux/sysctl.h>
+#include <linux/smpboot.h>
 
 #include <asm/irq_regs.h>
 #include <linux/kvm_para.h>
@@ -29,16 +30,18 @@
 
 int watchdog_enabled = 1;
 int __read_mostly watchdog_thresh = 10;
+static int __read_mostly watchdog_disabled;
 
 static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
 static DEFINE_PER_CPU(struct task_struct *, softlockup_watchdog);
 static DEFINE_PER_CPU(struct hrtimer, watchdog_hrtimer);
 static DEFINE_PER_CPU(bool, softlockup_touch_sync);
 static DEFINE_PER_CPU(bool, soft_watchdog_warn);
+static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts);
+static DEFINE_PER_CPU(unsigned long, soft_lockup_hrtimer_cnt);
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 static DEFINE_PER_CPU(bool, hard_watchdog_warn);
 static DEFINE_PER_CPU(bool, watchdog_nmi_touch);
-static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts);
 static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
 #endif
@@ -248,13 +251,15 @@ static void watchdog_overflow_callback(struct perf_event *event,
         __this_cpu_write(hard_watchdog_warn, false);
         return;
 }
+#endif /* CONFIG_HARDLOCKUP_DETECTOR */
+
 static void watchdog_interrupt_count(void)
 {
         __this_cpu_inc(hrtimer_interrupts);
 }
-#else
-static inline void watchdog_interrupt_count(void) { return; }
-#endif /* CONFIG_HARDLOCKUP_DETECTOR */
+
+static int watchdog_nmi_enable(unsigned int cpu);
+static void watchdog_nmi_disable(unsigned int cpu);
 
 /* watchdog kicker functions */
 static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
@@ -327,49 +332,68 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         return HRTIMER_RESTART;
 }
 
+static void watchdog_set_prio(unsigned int policy, unsigned int prio)
+{
+        struct sched_param param = { .sched_priority = prio };
 
-/*
- * The watchdog thread - touches the timestamp.
- */
-static int watchdog(void *unused)
+        sched_setscheduler(current, policy, &param);
+}
+
+static void watchdog_enable(unsigned int cpu)
 {
-        struct sched_param param = { .sched_priority = 0 };
         struct hrtimer *hrtimer = &__raw_get_cpu_var(watchdog_hrtimer);
 
-        /* initialize timestamp */
-        __touch_watchdog();
+        if (!watchdog_enabled) {
+                kthread_park(current);
+                return;
+        }
+
+        /* Enable the perf event */
+        watchdog_nmi_enable(cpu);
 
         /* kick off the timer for the hardlockup detector */
+        hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        hrtimer->function = watchdog_timer_fn;
+
         /* done here because hrtimer_start can only pin to smp_processor_id() */
         hrtimer_start(hrtimer, ns_to_ktime(get_sample_period()),
                       HRTIMER_MODE_REL_PINNED);
 
-        set_current_state(TASK_INTERRUPTIBLE);
-        /*
-         * Run briefly (kicked by the hrtimer callback function) once every
-         * get_sample_period() seconds (4 seconds by default) to reset the
-         * softlockup timestamp. If this gets delayed for more than
-         * 2*watchdog_thresh seconds then the debug-printout triggers in
-         * watchdog_timer_fn().
-         */
-        while (!kthread_should_stop()) {
-                __touch_watchdog();
-                schedule();
+        /* initialize timestamp */
+        watchdog_set_prio(SCHED_FIFO, MAX_RT_PRIO - 1);
+        __touch_watchdog();
+}
 
-                if (kthread_should_stop())
-                        break;
+static void watchdog_disable(unsigned int cpu)
+{
+        struct hrtimer *hrtimer = &__raw_get_cpu_var(watchdog_hrtimer);
 
-                set_current_state(TASK_INTERRUPTIBLE);
-        }
-        /*
-         * Drop the policy/priority elevation during thread exit to avoid a
-         * scheduling latency spike.
-         */
-        __set_current_state(TASK_RUNNING);
-        sched_setscheduler(current, SCHED_NORMAL, &param);
-        return 0;
+        watchdog_set_prio(SCHED_NORMAL, 0);
+        hrtimer_cancel(hrtimer);
+        /* disable the perf event */
+        watchdog_nmi_disable(cpu);
 }
 
+static int watchdog_should_run(unsigned int cpu)
+{
+        return __this_cpu_read(hrtimer_interrupts) !=
+                __this_cpu_read(soft_lockup_hrtimer_cnt);
+}
+
+/*
+ * The watchdog thread function - touches the timestamp.
+ *
+ * It only runs once every get_sample_period() seconds (4 seconds by
+ * default) to reset the softlockup timestamp. If this gets delayed
+ * for more than 2*watchdog_thresh seconds then the debug-printout
+ * triggers in watchdog_timer_fn().
+ */
+static void watchdog(unsigned int cpu)
+{
+        __this_cpu_write(soft_lockup_hrtimer_cnt,
+                         __this_cpu_read(hrtimer_interrupts));
+        __touch_watchdog();
+}
 
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
 /*
@@ -379,7 +403,7 @@ static int watchdog(void *unused)
  */
 static unsigned long cpu0_err;
 
-static int watchdog_nmi_enable(int cpu)
+static int watchdog_nmi_enable(unsigned int cpu)
 {
         struct perf_event_attr *wd_attr;
         struct perf_event *event = per_cpu(watchdog_ev, cpu);
@@ -433,7 +457,7 @@ out:
         return 0;
 }
 
-static void watchdog_nmi_disable(int cpu)
+static void watchdog_nmi_disable(unsigned int cpu)
 {
         struct perf_event *event = per_cpu(watchdog_ev, cpu);
 
@@ -447,107 +471,35 @@ static void watchdog_nmi_disable(int cpu)
         return;
 }
 #else
-static int watchdog_nmi_enable(int cpu) { return 0; }
-static void watchdog_nmi_disable(int cpu) { return; }
+static int watchdog_nmi_enable(unsigned int cpu) { return 0; }
+static void watchdog_nmi_disable(unsigned int cpu) { return; }
 #endif /* CONFIG_HARDLOCKUP_DETECTOR */
 
 /* prepare/enable/disable routines */
-static void watchdog_prepare_cpu(int cpu)
-{
-        struct hrtimer *hrtimer = &per_cpu(watchdog_hrtimer, cpu);
-
-        WARN_ON(per_cpu(softlockup_watchdog, cpu));
-        hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        hrtimer->function = watchdog_timer_fn;
-}
-
-static int watchdog_enable(int cpu)
-{
-        struct task_struct *p = per_cpu(softlockup_watchdog, cpu);
-        int err = 0;
-
-        /* enable the perf event */
-        err = watchdog_nmi_enable(cpu);
-
-        /* Regardless of err above, fall through and start softlockup */
-
-        /* create the watchdog thread */
-        if (!p) {
-                struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
-                p = kthread_create_on_node(watchdog, NULL, cpu_to_node(cpu), "watchdog/%d", cpu);
-                if (IS_ERR(p)) {
-                        pr_err("softlockup watchdog for %i failed\n", cpu);
-                        if (!err) {
-                                /* if hardlockup hasn't already set this */
-                                err = PTR_ERR(p);
-                                /* and disable the perf event */
-                                watchdog_nmi_disable(cpu);
-                        }
-                        goto out;
-                }
-                sched_setscheduler(p, SCHED_FIFO, &param);
-                kthread_bind(p, cpu);
-                per_cpu(watchdog_touch_ts, cpu) = 0;
-                per_cpu(softlockup_watchdog, cpu) = p;
-                wake_up_process(p);
-        }
-
-out:
-        return err;
-}
-
-static void watchdog_disable(int cpu)
-{
-        struct task_struct *p = per_cpu(softlockup_watchdog, cpu);
-        struct hrtimer *hrtimer = &per_cpu(watchdog_hrtimer, cpu);
-
-        /*
-         * cancel the timer first to stop incrementing the stats
-         * and waking up the kthread
-         */
-        hrtimer_cancel(hrtimer);
-
-        /* disable the perf event */
-        watchdog_nmi_disable(cpu);
-
-        /* stop the watchdog thread */
-        if (p) {
-                per_cpu(softlockup_watchdog, cpu) = NULL;
-                kthread_stop(p);
-        }
-}
-
 /* sysctl functions */
 #ifdef CONFIG_SYSCTL
 static void watchdog_enable_all_cpus(void)
 {
-        int cpu;
-
-        watchdog_enabled = 0;
-
-        for_each_online_cpu(cpu)
-                if (!watchdog_enable(cpu))
-                        /* if any cpu succeeds, watchdog is considered
-                           enabled for the system */
-                        watchdog_enabled = 1;
-
-        if (!watchdog_enabled)
-                pr_err("failed to be enabled on some cpus\n");
+        unsigned int cpu;
 
+        if (watchdog_disabled) {
+                watchdog_disabled = 0;
+                for_each_online_cpu(cpu)
+                        kthread_unpark(per_cpu(softlockup_watchdog, cpu));
+        }
 }
 
 static void watchdog_disable_all_cpus(void)
 {
-        int cpu;
-
-        for_each_online_cpu(cpu)
-                watchdog_disable(cpu);
+        unsigned int cpu;
 
-        /* if all watchdogs are disabled, then they are disabled for the system */
-        watchdog_enabled = 0;
+        if (!watchdog_disabled) {
+                watchdog_disabled = 1;
+                for_each_online_cpu(cpu)
+                        kthread_park(per_cpu(softlockup_watchdog, cpu));
+        }
 }
 
-
 /*
  * proc handler for /proc/sys/kernel/nmi_watchdog,watchdog_thresh
  */
@@ -557,73 +509,36 @@ int proc_dowatchdog(struct ctl_table *table, int write,
 {
         int ret;
 
+        if (watchdog_disabled < 0)
+                return -ENODEV;
+
         ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
         if (ret || !write)
-                goto out;
+                return ret;
 
         if (watchdog_enabled && watchdog_thresh)
                 watchdog_enable_all_cpus();
         else
                 watchdog_disable_all_cpus();
 
-out:
         return ret;
 }
 #endif /* CONFIG_SYSCTL */
 
-
-/*
- * Create/destroy watchdog threads as CPUs come and go:
- */
-static int __cpuinit
-cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
-{
-        int hotcpu = (unsigned long)hcpu;
-
-        switch (action) {
-        case CPU_UP_PREPARE:
-        case CPU_UP_PREPARE_FROZEN:
-                watchdog_prepare_cpu(hotcpu);
-                break;
-        case CPU_ONLINE:
-        case CPU_ONLINE_FROZEN:
-                if (watchdog_enabled)
-                        watchdog_enable(hotcpu);
-                break;
-#ifdef CONFIG_HOTPLUG_CPU
-        case CPU_UP_CANCELED:
-        case CPU_UP_CANCELED_FROZEN:
-                watchdog_disable(hotcpu);
-                break;
-        case CPU_DEAD:
-        case CPU_DEAD_FROZEN:
-                watchdog_disable(hotcpu);
-                break;
-#endif /* CONFIG_HOTPLUG_CPU */
-        }
-
-        /*
-         * hardlockup and softlockup are not important enough
-         * to block cpu bring up.  Just always succeed and
-         * rely on printk output to flag problems.
-         */
-        return NOTIFY_OK;
-}
-
-static struct notifier_block __cpuinitdata cpu_nfb = {
-        .notifier_call = cpu_callback
+static struct smp_hotplug_thread watchdog_threads = {
+        .store                  = &softlockup_watchdog,
+        .thread_should_run      = watchdog_should_run,
+        .thread_fn              = watchdog,
+        .thread_comm            = "watchdog/%u",
+        .setup                  = watchdog_enable,
+        .park                   = watchdog_disable,
+        .unpark                 = watchdog_enable,
 };
 
 void __init lockup_detector_init(void)
 {
-        void *cpu = (void *)(long)smp_processor_id();
-        int err;
-
-        err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
-        WARN_ON(notifier_to_errno(err));
-
-        cpu_callback(&cpu_nfb, CPU_ONLINE, cpu);
-        register_cpu_notifier(&cpu_nfb);
-
-        return;
+        if (smpboot_register_percpu_thread(&watchdog_threads)) {
+                pr_err("Failed to create watchdog threads, disabled\n");
+                watchdog_disabled = -ENODEV;
+        }
 }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 692d97628a10..3c5a79e2134c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -66,6 +66,7 @@ enum {
 
         /* pool flags */
         POOL_MANAGE_WORKERS     = 1 << 0,       /* need to manage workers */
+        POOL_MANAGING_WORKERS   = 1 << 1,       /* managing workers */
 
         /* worker flags */
         WORKER_STARTED          = 1 << 0,       /* started */
@@ -652,7 +653,7 @@ static bool need_to_manage_workers(struct worker_pool *pool)
 /* Do we have too many workers and should some go away? */
 static bool too_many_workers(struct worker_pool *pool)
 {
-        bool managing = mutex_is_locked(&pool->manager_mutex);
+        bool managing = pool->flags & POOL_MANAGING_WORKERS;
         int nr_idle = pool->nr_idle + managing; /* manager is considered idle */
         int nr_busy = pool->nr_workers - nr_idle;
 
@@ -1326,6 +1327,15 @@ static void idle_worker_rebind(struct worker *worker)
 
         /* we did our part, wait for rebind_workers() to finish up */
         wait_event(gcwq->rebind_hold, !(worker->flags & WORKER_REBIND));
+
+        /*
+         * rebind_workers() shouldn't finish until all workers passed the
+         * above WORKER_REBIND wait.  Tell it when done.
+         */
+        spin_lock_irq(&worker->pool->gcwq->lock);
+        if (!--worker->idle_rebind->cnt)
+                complete(&worker->idle_rebind->done);
+        spin_unlock_irq(&worker->pool->gcwq->lock);
 }
 
 /*
@@ -1339,8 +1349,16 @@ static void busy_worker_rebind_fn(struct work_struct *work)
         struct worker *worker = container_of(work, struct worker, rebind_work);
         struct global_cwq *gcwq = worker->pool->gcwq;
 
-        if (worker_maybe_bind_and_lock(worker))
-                worker_clr_flags(worker, WORKER_REBIND);
+        worker_maybe_bind_and_lock(worker);
+
+        /*
+         * %WORKER_REBIND must be cleared even if the above binding failed;
+         * otherwise, we may confuse the next CPU_UP cycle or oops / get
+         * stuck by calling idle_worker_rebind() prematurely.  If CPU went
+         * down again inbetween, %WORKER_UNBOUND would be set, so clearing
+         * %WORKER_REBIND is always safe.
+         */
+        worker_clr_flags(worker, WORKER_REBIND);
 
         spin_unlock_irq(&gcwq->lock);
 }
@@ -1396,12 +1414,15 @@ retry:
         /* set REBIND and kick idle ones, we'll wait for these later */
         for_each_worker_pool(pool, gcwq) {
                 list_for_each_entry(worker, &pool->idle_list, entry) {
+                        unsigned long worker_flags = worker->flags;
+
                         if (worker->flags & WORKER_REBIND)
                                 continue;
 
-                        /* morph UNBOUND to REBIND */
-                        worker->flags &= ~WORKER_UNBOUND;
-                        worker->flags |= WORKER_REBIND;
+                        /* morph UNBOUND to REBIND atomically */
+                        worker_flags &= ~WORKER_UNBOUND;
+                        worker_flags |= WORKER_REBIND;
+                        ACCESS_ONCE(worker->flags) = worker_flags;
 
                         idle_rebind.cnt++;
                         worker->idle_rebind = &idle_rebind;
@@ -1419,25 +1440,15 @@ retry:
                 goto retry;
         }
 
-        /*
-         * All idle workers are rebound and waiting for %WORKER_REBIND to
-         * be cleared inside idle_worker_rebind().  Clear and release.
-         * Clearing %WORKER_REBIND from this foreign context is safe
-         * because these workers are still guaranteed to be idle.
-         */
-        for_each_worker_pool(pool, gcwq)
-                list_for_each_entry(worker, &pool->idle_list, entry)
-                        worker->flags &= ~WORKER_REBIND;
-
-        wake_up_all(&gcwq->rebind_hold);
-
-        /* rebind busy workers */
+        /* all idle workers are rebound, rebind busy workers */
         for_each_busy_worker(worker, i, pos, gcwq) {
                 struct work_struct *rebind_work = &worker->rebind_work;
+                unsigned long worker_flags = worker->flags;
 
-                /* morph UNBOUND to REBIND */
-                worker->flags &= ~WORKER_UNBOUND;
-                worker->flags |= WORKER_REBIND;
+                /* morph UNBOUND to REBIND atomically */
+                worker_flags &= ~WORKER_UNBOUND;
+                worker_flags |= WORKER_REBIND;
+                ACCESS_ONCE(worker->flags) = worker_flags;
 
                 if (test_and_set_bit(WORK_STRUCT_PENDING_BIT,
                                      work_data_bits(rebind_work)))
@@ -1449,6 +1460,34 @@ retry:
                             worker->scheduled.next,
                             work_color_to_flags(WORK_NO_COLOR));
         }
+
+        /*
+         * All idle workers are rebound and waiting for %WORKER_REBIND to
+         * be cleared inside idle_worker_rebind().  Clear and release.
+         * Clearing %WORKER_REBIND from this foreign context is safe
+         * because these workers are still guaranteed to be idle.
+         *
+         * We need to make sure all idle workers passed WORKER_REBIND wait
+         * in idle_worker_rebind() before returning; otherwise, workers can
+         * get stuck at the wait if hotplug cycle repeats.
+         */
+        idle_rebind.cnt = 1;
+        INIT_COMPLETION(idle_rebind.done);
+
+        for_each_worker_pool(pool, gcwq) {
+                list_for_each_entry(worker, &pool->idle_list, entry) {
+                        worker->flags &= ~WORKER_REBIND;
+                        idle_rebind.cnt++;
+                }
+        }
+
+        wake_up_all(&gcwq->rebind_hold);
+
+        if (--idle_rebind.cnt) {
+                spin_unlock_irq(&gcwq->lock);
+                wait_for_completion(&idle_rebind.done);
+                spin_lock_irq(&gcwq->lock);
+        }
 }
 
 static struct worker *alloc_worker(void)
@@ -1794,9 +1833,45 @@ static bool manage_workers(struct worker *worker)
         struct worker_pool *pool = worker->pool;
         bool ret = false;
 
-        if (!mutex_trylock(&pool->manager_mutex))
+        if (pool->flags & POOL_MANAGING_WORKERS)
                 return ret;
 
+        pool->flags |= POOL_MANAGING_WORKERS;
+
+        /*
+         * To simplify both worker management and CPU hotplug, hold off
+         * management while hotplug is in progress.  CPU hotplug path can't
+         * grab %POOL_MANAGING_WORKERS to achieve this because that can
+         * lead to idle worker depletion (all become busy thinking someone
+         * else is managing) which in turn can result in deadlock under
+         * extreme circumstances.  Use @pool->manager_mutex to synchronize
+         * manager against CPU hotplug.
+         *
+         * manager_mutex would always be free unless CPU hotplug is in
+         * progress.  trylock first without dropping @gcwq->lock.
+         */
+        if (unlikely(!mutex_trylock(&pool->manager_mutex))) {
+                spin_unlock_irq(&pool->gcwq->lock);
+                mutex_lock(&pool->manager_mutex);
+                /*
+                 * CPU hotplug could have happened while we were waiting
+                 * for manager_mutex.  Hotplug itself can't handle us
+                 * because manager isn't either on idle or busy list, and
+                 * @gcwq's state and ours could have deviated.
+                 *
+                 * As hotplug is now excluded via manager_mutex, we can
+                 * simply try to bind.  It will succeed or fail depending
+                 * on @gcwq's current state.  Try it and adjust
+                 * %WORKER_UNBOUND accordingly.
+                 */
+                if (worker_maybe_bind_and_lock(worker))
+                        worker->flags &= ~WORKER_UNBOUND;
+                else
+                        worker->flags |= WORKER_UNBOUND;
+
+                ret = true;
+        }
+
         pool->flags &= ~POOL_MANAGE_WORKERS;
 
         /*
@@ -1806,6 +1881,7 @@ static bool manage_workers(struct worker *worker)
         ret |= maybe_destroy_workers(pool);
         ret |= maybe_create_worker(pool);
 
+        pool->flags &= ~POOL_MANAGING_WORKERS;
         mutex_unlock(&pool->manager_mutex);
         return ret;
 }
@@ -3500,18 +3576,17 @@ static int __devinit workqueue_cpu_down_callback(struct notifier_block *nfb,
 #ifdef CONFIG_SMP
 
 struct work_for_cpu {
-        struct completion completion;
+        struct work_struct work;
         long (*fn)(void *);
         void *arg;
         long ret;
 };
 
-static int do_work_for_cpu(void *_wfc)
+static void work_for_cpu_fn(struct work_struct *work)
 {
-        struct work_for_cpu *wfc = _wfc;
+        struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
+
         wfc->ret = wfc->fn(wfc->arg);
-        complete(&wfc->completion);
-        return 0;
 }
 
 /**
@@ -3526,19 +3601,11 @@ static int do_work_for_cpu(void *_wfc)
  */
 long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg)
 {
-        struct task_struct *sub_thread;
-        struct work_for_cpu wfc = {
-                .completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion),
-                .fn = fn,
-                .arg = arg,
-        };
+        struct work_for_cpu wfc = { .fn = fn, .arg = arg };
 
-        sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu");
-        if (IS_ERR(sub_thread))
-                return PTR_ERR(sub_thread);
-        kthread_bind(sub_thread, cpu);
-        wake_up_process(sub_thread);
-        wait_for_completion(&wfc.completion);
+        INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
+        schedule_work_on(cpu, &wfc.work);
+        flush_work(&wfc.work);
         return wfc.ret;
 }
 EXPORT_SYMBOL_GPL(work_on_cpu);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 2403a63b5da5..dacbbe4d7a80 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -629,6 +629,20 @@ config PROVE_RCU_REPEATEDLY
 
          Say N if you are unsure.
 
+config PROVE_RCU_DELAY
+        bool "RCU debugging: preemptible RCU race provocation"
+        depends on DEBUG_KERNEL && PREEMPT_RCU
+        default n
+        help
+         There is a class of races that involve an unlikely preemption
+         of __rcu_read_unlock() just after ->rcu_read_lock_nesting has
+         been set to INT_MIN.  This feature inserts a delay at that
+         point to increase the probability of these races.
+
+         Say Y to increase probability of preemption of __rcu_read_unlock().
+
+         Say N if you are unsure.
+
 config SPARSE_RCU_POINTER
         bool "RCU debugging: sparse-based checks for pointer usage"
         default n
diff --git a/lib/digsig.c b/lib/digsig.c
index 286d558033e2..8c0e62975c88 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -163,9 +163,11 @@ static int digsig_verify_rsa(struct key *key,
         memcpy(out1 + head, p, l);
 
         err = pkcs_1_v1_5_decode_emsa(out1, len, mblen, out2, &len);
+        if (err)
+                goto err;
 
-        if (!err && len == hlen)
-                err = memcmp(out2, h, hlen);
+        if (len != hlen || memcmp(out2, h, hlen))
+                err = -EINVAL;
 
 err:
         mpi_free(in);
diff --git a/lib/flex_proportions.c b/lib/flex_proportions.c
index c785554f9523..ebf3bac460b0 100644
--- a/lib/flex_proportions.c
+++ b/lib/flex_proportions.c
@@ -62,7 +62,7 @@ void fprop_global_destroy(struct fprop_global *p)
  */
 bool fprop_new_period(struct fprop_global *p, int periods)
 {
-        u64 events;
+        s64 events;
         unsigned long flags;
 
         local_irq_save(flags);
diff --git a/mm/bootmem.c b/mm/bootmem.c
index bcb63ac48cc5..f468185b3b28 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -419,7 +419,7 @@ int __init reserve_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
 }
 
 /**
- * reserve_bootmem - mark a page range as usable
+ * reserve_bootmem - mark a page range as reserved
  * @addr: starting address of the range
  * @size: size of the range in bytes
  * @flags: reservation flags (see linux/bootmem.h)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 57c4b9309015..141dbb695097 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1811,7 +1811,6 @@ static void __collapse_huge_page_copy(pte_t *pte, struct page *page,
                         src_page = pte_page(pteval);
                         copy_user_highpage(page, src_page, address, vma);
                         VM_BUG_ON(page_mapcount(src_page) != 1);
-                        VM_BUG_ON(page_count(src_page) != 2);
                         release_pte_page(src_page);
                         /*
                          * ptl mostly unnecessary, but preempt has to
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 45eb6217bf38..0de83b4541e9 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1483,13 +1483,11 @@ static void *kmemleak_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct kmemleak_object *prev_obj = v;
         struct kmemleak_object *next_obj = NULL;
-        struct list_head *n = &prev_obj->object_list;
+        struct kmemleak_object *obj = prev_obj;
 
         ++(*pos);
 
-        list_for_each_continue_rcu(n, &object_list) {
-                struct kmemleak_object *obj =
-                        list_entry(n, struct kmemleak_object, object_list);
+        list_for_each_entry_continue_rcu(obj, &object_list, object_list) {
                 if (get_object(obj)) {
                         next_obj = obj;
                         break;
diff --git a/mm/memblock.c b/mm/memblock.c
index 4d9393c7edc9..82aa349d2f7a 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -246,7 +246,7 @@ static int __init_memblock memblock_double_array(struct memblock_type *type,
                                 min(new_area_start, memblock.current_limit),
                                 new_alloc_size, PAGE_SIZE);
 
-                new_array = addr ? __va(addr) : 0;
+                new_array = addr ? __va(addr) : NULL;
         }
         if (!addr) {
                 pr_err("memblock: Failed to double %s array from %ld to %ld entries !\n",
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 3ad25f9d1fc1..6a5b90d0cfd7 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -126,9 +126,6 @@ static void register_page_bootmem_info_section(unsigned long start_pfn)
         struct mem_section *ms;
         struct page *page, *memmap;
 
-        if (!pfn_valid(start_pfn))
-                return;
-
         section_nr = pfn_to_section_nr(start_pfn);
         ms = __nr_to_section(section_nr);
 
@@ -187,9 +184,16 @@ void register_page_bootmem_info_node(struct pglist_data *pgdat)
         end_pfn = pfn + pgdat->node_spanned_pages;
 
         /* register_section info */
-        for (; pfn < end_pfn; pfn += PAGES_PER_SECTION)
-                register_page_bootmem_info_section(pfn);
-
+        for (; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
+                /*
+                 * Some platforms can assign the same pfn to multiple nodes - on
+                 * node0 as well as nodeN.  To avoid registering a pfn against
+                 * multiple nodes we check that this pfn does not already
+                 * reside in some other node.
+                 */
+                if (pfn_valid(pfn) && (pfn_to_nid(pfn) == node))
+                        register_page_bootmem_info_section(pfn);
+        }
 }
 #endif /* !CONFIG_SPARSEMEM_VMEMMAP */
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c66fb875104a..c13ea7538891 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -584,7 +584,7 @@ static inline void __free_one_page(struct page *page,
                 combined_idx = buddy_idx & page_idx;
                 higher_page = page + (combined_idx - page_idx);
                 buddy_idx = __find_buddy_index(combined_idx, order + 1);
-                higher_buddy = page + (buddy_idx - combined_idx);
+                higher_buddy = higher_page + (buddy_idx - combined_idx);
                 if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
                         list_add_tail(&page->lru,
                                 &zone->free_area[order].free_list[migratetype]);
diff --git a/mm/slab.c b/mm/slab.c
index 811af03a14ef..c6854759bcf1 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -983,7 +983,7 @@ static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
                 }
 
                 /* The caller cannot use PFMEMALLOC objects, find another one */
-                for (i = 1; i < ac->avail; i++) {
+                for (i = 0; i < ac->avail; i++) {
                         /* If a !PFMEMALLOC object is found, swap them */
                         if (!is_obj_pfmemalloc(ac->entry[i])) {
                                 objp = ac->entry[i];
@@ -1000,7 +1000,7 @@ static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
                 l3 = cachep->nodelists[numa_mem_id()];
                 if (!list_empty(&l3->slabs_free) && force_refill) {
                         struct slab *slabp = virt_to_slab(objp);
-                        ClearPageSlabPfmemalloc(virt_to_page(slabp->s_mem));
+                        ClearPageSlabPfmemalloc(virt_to_head_page(slabp->s_mem));
                         clear_obj_pfmemalloc(&objp);
                         recheck_pfmemalloc_active(cachep, ac);
                         return objp;
@@ -1032,7 +1032,7 @@ static void *__ac_put_obj(struct kmem_cache *cachep, struct array_cache *ac,
 {
         if (unlikely(pfmemalloc_active)) {
                 /* Some pfmemalloc slabs exist, check if this is one */
-                struct page *page = virt_to_page(objp);
+                struct page *page = virt_to_head_page(objp);
                 if (PageSlabPfmemalloc(page))
                         set_obj_pfmemalloc(&objp);
         }
diff --git a/mm/slub.c b/mm/slub.c
index 8f78e2577031..2fdd96f9e998 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1524,12 +1524,13 @@ static inline void *acquire_slab(struct kmem_cache *s,
 }
 
 static int put_cpu_partial(struct kmem_cache *s, struct page *page, int drain);
+static inline bool pfmemalloc_match(struct page *page, gfp_t gfpflags);
 
 /*
  * Try to allocate a partial slab from a specific node.
  */
-static void *get_partial_node(struct kmem_cache *s,
-                struct kmem_cache_node *n, struct kmem_cache_cpu *c)
+static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
+                                struct kmem_cache_cpu *c, gfp_t flags)
 {
         struct page *page, *page2;
         void *object = NULL;
@@ -1545,9 +1546,13 @@ static void *get_partial_node(struct kmem_cache *s,
 
         spin_lock(&n->list_lock);
         list_for_each_entry_safe(page, page2, &n->partial, lru) {
-                void *t = acquire_slab(s, n, page, object == NULL);
+                void *t;
                 int available;
 
+                if (!pfmemalloc_match(page, flags))
+                        continue;
+
+                t = acquire_slab(s, n, page, object == NULL);
                 if (!t)
                         break;
 
@@ -1614,7 +1619,7 @@ static void *get_any_partial(struct kmem_cache *s, gfp_t flags,
 
                         if (n && cpuset_zone_allowed_hardwall(zone, flags) &&
                                         n->nr_partial > s->min_partial) {
-                                object = get_partial_node(s, n, c);
+                                object = get_partial_node(s, n, c, flags);
                                 if (object) {
                                         /*
                                          * Return the object even if
@@ -1643,7 +1648,7 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
         void *object;
         int searchnode = (node == NUMA_NO_NODE) ? numa_node_id() : node;
 
-        object = get_partial_node(s, get_node(s, searchnode), c);
+        object = get_partial_node(s, get_node(s, searchnode), c, flags);
         if (object || node != NUMA_NO_NODE)
                 return object;
 
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8d01243d9560..99b434b674c0 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3102,6 +3102,7 @@ int kswapd_run(int nid)
                 /* failure at boot is fatal */
                 BUG_ON(system_state == SYSTEM_BOOTING);
                 printk("Failed to start kswapd on node %d\n",nid);
+                pgdat->kswapd = NULL;
                 ret = -1;
         }
         return ret;
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index c718fd3664b6..4de77ea5fa37 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -105,7 +105,7 @@ static const struct file_operations vlandev_fops = {
 };
 
 /*
- * Proc filesystem derectory entries.
+ * Proc filesystem directory entries.
  */
 
 /* Strings */
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index e877af8bdd1e..469daabd90c7 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -642,7 +642,8 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *router = NULL;
         struct batadv_orig_node *orig_node_tmp;
         struct hlist_node *node;
-        uint8_t bcast_own_sum_orig, bcast_own_sum_neigh;
+        int if_num;
+        uint8_t sum_orig, sum_neigh;
         uint8_t *neigh_addr;
 
         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -727,17 +728,17 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         if (router && (neigh_node->tq_avg == router->tq_avg)) {
                 orig_node_tmp = router->orig_node;
                 spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);
-                bcast_own_sum_orig =
-                        orig_node_tmp->bcast_own_sum[if_incoming->if_num];
+                if_num = router->if_incoming->if_num;
+                sum_orig = orig_node_tmp->bcast_own_sum[if_num];
                 spin_unlock_bh(&orig_node_tmp->ogm_cnt_lock);
 
                 orig_node_tmp = neigh_node->orig_node;
                 spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);
-                bcast_own_sum_neigh =
-                        orig_node_tmp->bcast_own_sum[if_incoming->if_num];
+                if_num = neigh_node->if_incoming->if_num;
+                sum_neigh = orig_node_tmp->bcast_own_sum[if_num];
                 spin_unlock_bh(&orig_node_tmp->ogm_cnt_lock);
 
-                if (bcast_own_sum_orig >= bcast_own_sum_neigh)
+                if (sum_orig >= sum_neigh)
                         goto update_tt;
         }
 
diff --git a/net/batman-adv/bitarray.h b/net/batman-adv/bitarray.h
index a081ce1c0514..cebaae7e148b 100644
--- a/net/batman-adv/bitarray.h
+++ b/net/batman-adv/bitarray.h
@@ -20,8 +20,8 @@
 #ifndef _NET_BATMAN_ADV_BITARRAY_H_
 #define _NET_BATMAN_ADV_BITARRAY_H_
 
-/* returns true if the corresponding bit in the given seq_bits indicates true
- * and curr_seqno is within range of last_seqno
+/* Returns 1 if the corresponding bit in the given seq_bits indicates true
+ * and curr_seqno is within range of last_seqno. Otherwise returns 0.
  */
 static inline int batadv_test_bit(const unsigned long *seq_bits,
                                   uint32_t last_seqno, uint32_t curr_seqno)
@@ -32,7 +32,7 @@ static inline int batadv_test_bit(const unsigned long *seq_bits,
         if (diff < 0 || diff >= BATADV_TQ_LOCAL_WINDOW_SIZE)
                 return 0;
         else
-                return  test_bit(diff, seq_bits);
+                return test_bit(diff, seq_bits) != 0;
 }
 
 /* turn corresponding bit on, so we can remember that we got the packet */
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 109ea2aae96c..21c53577c8d6 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -100,18 +100,21 @@ static int batadv_interface_set_mac_addr(struct net_device *dev, void *p)
 {
         struct batadv_priv *bat_priv = netdev_priv(dev);
         struct sockaddr *addr = p;
+        uint8_t old_addr[ETH_ALEN];
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
+        memcpy(old_addr, dev->dev_addr, ETH_ALEN);
+        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+
         /* only modify transtable if it has been initialized before */
         if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_ACTIVE) {
-                batadv_tt_local_remove(bat_priv, dev->dev_addr,
+                batadv_tt_local_remove(bat_priv, old_addr,
                                        "mac address changed", false);
                 batadv_tt_local_add(dev, addr->sa_data, BATADV_NULL_IFINDEX);
         }
 
-        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
         dev->addr_assign_type &= ~NET_ADDR_RANDOM;
         return 0;
 }
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 5e5f5b410e0b..1eaacf10d19d 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -58,7 +58,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         switch (cmd) {
         case BNEPCONNADD:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
 
                 if (copy_from_user(&ca, argp, sizeof(ca)))
                         return -EFAULT;
@@ -84,7 +84,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
 
         case BNEPCONNDEL:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
 
                 if (copy_from_user(&cd, argp, sizeof(cd)))
                         return -EFAULT;
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 311668d14571..32dc83dcb6b2 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -72,7 +72,7 @@ static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         switch (cmd) {
         case CMTPCONNADD:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
 
                 if (copy_from_user(&ca, argp, sizeof(ca)))
                         return -EFAULT;
@@ -97,7 +97,7 @@ static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
 
         case CMTPCONNDEL:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
 
                 if (copy_from_user(&cd, argp, sizeof(cd)))
                         return -EFAULT;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5ad7da217474..3c094e78dde9 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -29,6 +29,7 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/a2mp.h>
+#include <net/bluetooth/smp.h>
 
 static void hci_le_connect(struct hci_conn *conn)
 {
@@ -619,6 +620,9 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("hcon %p", conn);
 
+        if (conn->type == LE_LINK)
+                return smp_conn_security(conn, sec_level);
+
         /* For sdp we don't need the link key. */
         if (sec_level == BT_SECURITY_SDP)
                 return 1;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d4de5db18d5a..0b997c8f9655 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -734,6 +734,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         cancel_work_sync(&hdev->le_scan);
 
+        cancel_delayed_work(&hdev->power_off);
+
         hci_req_cancel(hdev, ENODEV);
         hci_req_lock(hdev);
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 19fdac78e555..d5ace1eda3ed 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -490,7 +490,7 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
         switch (cmd) {
         case HCISETRAW:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
 
                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
                         return -EPERM;
@@ -510,12 +510,12 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
 
         case HCIBLOCKADDR:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                 return hci_sock_blacklist_add(hdev, (void __user *) arg);
 
         case HCIUNBLOCKADDR:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                 return hci_sock_blacklist_del(hdev, (void __user *) arg);
 
         default:
@@ -546,22 +546,22 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
 
         case HCIDEVUP:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                 return hci_dev_open(arg);
 
         case HCIDEVDOWN:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                 return hci_dev_close(arg);
 
         case HCIDEVRESET:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                 return hci_dev_reset(arg);
 
         case HCIDEVRESTAT:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                 return hci_dev_reset_stat(arg);
 
         case HCISETSCAN:
@@ -573,7 +573,7 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
         case HCISETACLMTU:
         case HCISETSCOMTU:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                 return hci_dev_cmd(cmd, argp);
 
         case HCIINQUIRY:
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 18b3f6892a36..b24fb3bd8625 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -56,7 +56,7 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         switch (cmd) {
         case HIDPCONNADD:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
 
                 if (copy_from_user(&ca, argp, sizeof(ca)))
                         return -EFAULT;
@@ -91,7 +91,7 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
 
         case HIDPCONNDEL:
                 if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
 
                 if (copy_from_user(&cd, argp, sizeof(cd)))
                         return -EFAULT;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index daa149b7003c..38c00f142203 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1008,7 +1008,7 @@ static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *c
         if (!conn)
                 return;
 
-        if (chan->mode == L2CAP_MODE_ERTM) {
+        if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
                 __clear_retrans_timer(chan);
                 __clear_monitor_timer(chan);
                 __clear_ack_timer(chan);
@@ -1199,14 +1199,15 @@ clean:
 static void l2cap_conn_ready(struct l2cap_conn *conn)
 {
         struct l2cap_chan *chan;
+        struct hci_conn *hcon = conn->hcon;
 
         BT_DBG("conn %p", conn);
 
-        if (!conn->hcon->out && conn->hcon->type == LE_LINK)
+        if (!hcon->out && hcon->type == LE_LINK)
                 l2cap_le_conn_ready(conn);
 
-        if (conn->hcon->out && conn->hcon->type == LE_LINK)
-                smp_conn_security(conn, conn->hcon->pending_sec_level);
+        if (hcon->out && hcon->type == LE_LINK)
+                smp_conn_security(hcon, hcon->pending_sec_level);
 
         mutex_lock(&conn->chan_lock);
 
@@ -1219,8 +1220,8 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
                         continue;
                 }
 
-                if (conn->hcon->type == LE_LINK) {
-                        if (smp_conn_security(conn, chan->sec_level))
+                if (hcon->type == LE_LINK) {
+                        if (smp_conn_security(hcon, chan->sec_level))
                                 l2cap_chan_ready(chan);
 
                 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1497edd191a2..34bbe1c5e389 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -616,7 +616,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                                 break;
                         }
 
-                        if (smp_conn_security(conn, sec.level))
+                        if (smp_conn_security(conn->hcon, sec.level))
                                 break;
                         sk->sk_state = BT_CONFIG;
                         chan->state = BT_CONFIG;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index ad6613d17ca6..eba022de3c20 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2875,6 +2875,22 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
                 if (scan)
                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 
+                if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+                        u8 ssp = 1;
+
+                        hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
+                }
+
+                if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+                        struct hci_cp_write_le_host_supported cp;
+
+                        cp.le = 1;
+                        cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
+
+                        hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
+                                     sizeof(cp), &cp);
+                }
+
                 update_class(hdev);
                 update_name(hdev, hdev->dev_name);
                 update_eir(hdev);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 901a616c8083..8c225ef349cd 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -267,10 +267,10 @@ static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
         mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
                          hcon->dst_type, reason);
 
-        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
-                cancel_delayed_work_sync(&conn->security_timer);
+        cancel_delayed_work_sync(&conn->security_timer);
+
+        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
                 smp_chan_destroy(conn);
-        }
 }
 
 #define JUST_WORKS      0x00
@@ -760,9 +760,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
         return 0;
 }
 
-int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 {
-        struct hci_conn *hcon = conn->hcon;
+        struct l2cap_conn *conn = hcon->l2cap_data;
         struct smp_chan *smp = conn->smp_chan;
         __u8 authreq;
 
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index f88ee537fb2b..92de5e5f9db2 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -80,7 +80,7 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum,
         unsigned int bitmask;
 
         spin_lock_bh(&ebt_log_lock);
-        printk("<%c>%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x",
+        printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x",
                '0' + loginfo->u.log.level, prefix,
                in ? in->name : "", out ? out->name : "",
                eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index dd485f6128e8..ba217e90765e 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -211,9 +211,10 @@ void caif_client_register_refcnt(struct cflayer *adapt_layer,
                                         void (*put)(struct cflayer *lyr))
 {
         struct cfsrvl *service;
-        service = container_of(adapt_layer->dn, struct cfsrvl, layer);
 
-        WARN_ON(adapt_layer == NULL || adapt_layer->dn == NULL);
+        if (WARN_ON(adapt_layer == NULL || adapt_layer->dn == NULL))
+                return;
+        service = container_of(adapt_layer->dn, struct cfsrvl, layer);
         service->hold = hold;
         service->put = put;
 }
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 24c5eea8c45b..159aa8bef9e7 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -1073,16 +1073,13 @@ static int write_partial_msg_pages(struct ceph_connection *con)
                         BUG_ON(kaddr == NULL);
                         base = kaddr + con->out_msg_pos.page_pos + bio_offset;
                         crc = crc32c(crc, base, len);
+                        kunmap(page);
                         msg->footer.data_crc = cpu_to_le32(crc);
                         con->out_msg_pos.did_page_crc = true;
                 }
                 ret = ceph_tcp_sendpage(con->sock, page,
                                       con->out_msg_pos.page_pos + bio_offset,
                                       len, 1);
-
-                if (do_datacrc)
-                        kunmap(page);
-
                 if (ret <= 0)
                         goto out;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 83988362805e..89e33a5d4d93 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2134,7 +2134,8 @@ static bool can_checksum_protocol(netdev_features_t features, __be16 protocol)
 static netdev_features_t harmonize_features(struct sk_buff *skb,
         __be16 protocol, netdev_features_t features)
 {
-        if (!can_checksum_protocol(features, protocol)) {
+        if (skb->ip_summed != CHECKSUM_NONE &&
+            !can_checksum_protocol(features, protocol)) {
                 features &= ~NETIF_F_ALL_CSUM;
                 features &= ~NETIF_F_SG;
         } else if (illegal_highdma(skb->dev, skb)) {
@@ -2647,15 +2648,16 @@ void __skb_get_rxhash(struct sk_buff *skb)
         if (!skb_flow_dissect(skb, &keys))
                 return;
 
-        if (keys.ports) {
-                if ((__force u16)keys.port16[1] < (__force u16)keys.port16[0])
-                        swap(keys.port16[0], keys.port16[1]);
+        if (keys.ports)
                 skb->l4_rxhash = 1;
-        }
 
         /* get a consistent hash (same value on both flow directions) */
-        if ((__force u32)keys.dst < (__force u32)keys.src)
+        if (((__force u32)keys.dst < (__force u32)keys.src) ||
+            (((__force u32)keys.dst == (__force u32)keys.src) &&
+             ((__force u16)keys.port16[1] < (__force u16)keys.port16[0]))) {
                 swap(keys.dst, keys.src);
+                swap(keys.port16[0], keys.port16[1]);
+        }
 
         hash = jhash_3words((__force u32)keys.dst,
                             (__force u32)keys.src,
@@ -3321,7 +3323,7 @@ ncls:
 
         if (pt_prev) {
                 if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
-                        ret = -ENOMEM;
+                        goto drop;
                 else
                         ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
         } else {
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index cce9e53528b1..148e73d2c451 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2721,7 +2721,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         /* Eth + IPh + UDPh + mpls */
         datalen = pkt_dev->cur_pkt_size - 14 - 20 - 8 -
                   pkt_dev->pkt_overhead;
-        if (datalen < sizeof(struct pktgen_hdr))
+        if (datalen < 0 || datalen < sizeof(struct pktgen_hdr))
                 datalen = sizeof(struct pktgen_hdr);
 
         udph->source = htons(pkt_dev->cur_udp_src);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index fe00d1208167..e33ebae519c8 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3502,7 +3502,9 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
         if (!skb_cloned(from))
                 skb_shinfo(from)->nr_frags = 0;
 
-        /* if the skb is cloned this does nothing since we set nr_frags to 0 */
+        /* if the skb is not cloned this does nothing
+         * since we set nr_frags to 0.
+         */
         for (i = 0; i < skb_shinfo(from)->nr_frags; i++)
                 skb_frag_ref(from, i);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 8f67ced8d6a8..a6000fbad294 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -691,7 +691,8 @@ set_rcvbuf:
 
         case SO_KEEPALIVE:
 #ifdef CONFIG_INET
-                if (sk->sk_protocol == IPPROTO_TCP)
+                if (sk->sk_protocol == IPPROTO_TCP &&
+                    sk->sk_type == SOCK_STREAM)
                         tcp_set_keepalive(sk, valbool);
 #endif
                 sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
@@ -1523,7 +1524,14 @@ EXPORT_SYMBOL(sock_rfree);
 
 void sock_edemux(struct sk_buff *skb)
 {
-        sock_put(skb->sk);
+        struct sock *sk = skb->sk;
+
+#ifdef CONFIG_INET
+        if (sk->sk_state == TCP_TIME_WAIT)
+                inet_twsk_put(inet_twsk(sk));
+        else
+#endif
+                sock_put(sk);
 }
 EXPORT_SYMBOL(sock_edemux);
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 77e87aff419a..47800459e4cb 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1225,7 +1225,7 @@ static int arp_netdev_event(struct notifier_block *this, unsigned long event,
         switch (event) {
         case NETDEV_CHANGEADDR:
                 neigh_changeaddr(&arp_tbl, dev);
-                rt_cache_flush(dev_net(dev), 0);
+                rt_cache_flush(dev_net(dev));
                 break;
         default:
                 break;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 44bf82e3aef7..e12fad773852 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -725,7 +725,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 break;
 
         case SIOCSIFFLAGS:
-                ret = -EACCES;
+                ret = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         goto out;
                 break;
@@ -733,7 +733,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         case SIOCSIFBRDADDR:    /* Set the broadcast address */
         case SIOCSIFDSTADDR:    /* Set the destination address */
         case SIOCSIFNETMASK:    /* Set the netmask for the interface */
-                ret = -EACCES;
+                ret = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         goto out;
                 ret = -EINVAL;
@@ -1503,7 +1503,7 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
                 if (i == IPV4_DEVCONF_ACCEPT_LOCAL - 1 ||
                     i == IPV4_DEVCONF_ROUTE_LOCALNET - 1)
                         if ((new_value == 0) && (old_value != 0))
-                                rt_cache_flush(net, 0);
+                                rt_cache_flush(net);
         }
 
         return ret;
@@ -1537,7 +1537,7 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
                                 dev_disable_lro(idev->dev);
                         }
                         rtnl_unlock();
-                        rt_cache_flush(net, 0);
+                        rt_cache_flush(net);
                 }
         }
 
@@ -1554,7 +1554,7 @@ static int ipv4_doint_and_flush(ctl_table *ctl, int write,
         struct net *net = ctl->extra2;
 
         if (write && *valp != val)
-                rt_cache_flush(net, 0);
+                rt_cache_flush(net);
 
         return ret;
 }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index c43ae3fba792..8e2b475da9fa 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -148,7 +148,7 @@ static void fib_flush(struct net *net)
         }
 
         if (flushed)
-                rt_cache_flush(net, -1);
+                rt_cache_flush(net);
 }
 
 /*
@@ -999,11 +999,11 @@ static void nl_fib_lookup_exit(struct net *net)
         net->ipv4.fibnl = NULL;
 }
 
-static void fib_disable_ip(struct net_device *dev, int force, int delay)
+static void fib_disable_ip(struct net_device *dev, int force)
 {
         if (fib_sync_down_dev(dev, force))
                 fib_flush(dev_net(dev));
-        rt_cache_flush(dev_net(dev), delay);
+        rt_cache_flush(dev_net(dev));
         arp_ifdown(dev);
 }
 
@@ -1020,7 +1020,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
                 fib_sync_up(dev);
 #endif
                 atomic_inc(&net->ipv4.dev_addr_genid);
-                rt_cache_flush(dev_net(dev), -1);
+                rt_cache_flush(dev_net(dev));
                 break;
         case NETDEV_DOWN:
                 fib_del_ifaddr(ifa, NULL);
@@ -1029,9 +1029,9 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
                         /* Last address was deleted from this interface.
                          * Disable IP.
                          */
-                        fib_disable_ip(dev, 1, 0);
+                        fib_disable_ip(dev, 1);
                 } else {
-                        rt_cache_flush(dev_net(dev), -1);
+                        rt_cache_flush(dev_net(dev));
                 }
                 break;
         }
@@ -1045,7 +1045,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
         struct net *net = dev_net(dev);
 
         if (event == NETDEV_UNREGISTER) {
-                fib_disable_ip(dev, 2, -1);
+                fib_disable_ip(dev, 2);
                 rt_flush_dev(dev);
                 return NOTIFY_DONE;
         }
@@ -1062,14 +1062,14 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
                 fib_sync_up(dev);
 #endif
                 atomic_inc(&net->ipv4.dev_addr_genid);
-                rt_cache_flush(dev_net(dev), -1);
+                rt_cache_flush(dev_net(dev));
                 break;
         case NETDEV_DOWN:
-                fib_disable_ip(dev, 0, 0);
+                fib_disable_ip(dev, 0);
                 break;
         case NETDEV_CHANGEMTU:
         case NETDEV_CHANGE:
-                rt_cache_flush(dev_net(dev), 0);
+                rt_cache_flush(dev_net(dev));
                 break;
         case NETDEV_UNREGISTER_BATCH:
                 break;
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index a83d74e498d2..274309d3aded 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -259,7 +259,7 @@ static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
 
 static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
 {
-        rt_cache_flush(ops->fro_net, -1);
+        rt_cache_flush(ops->fro_net);
 }
 
 static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = {
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 57bd978483e1..d1b93595b4a7 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1286,7 +1286,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 
                         fib_release_info(fi_drop);
                         if (state & FA_S_ACCESSED)
-                                rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
+                                rt_cache_flush(cfg->fc_nlinfo.nl_net);
                         rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen,
                                 tb->tb_id, &cfg->fc_nlinfo, NLM_F_REPLACE);
 
@@ -1333,7 +1333,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
         list_add_tail_rcu(&new_fa->fa_list,
                           (fa ? &fa->fa_list : fa_head));
 
-        rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
+        rt_cache_flush(cfg->fc_nlinfo.nl_net);
         rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, tb->tb_id,
                   &cfg->fc_nlinfo, 0);
 succeeded:
@@ -1708,7 +1708,7 @@ int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
                 trie_leaf_remove(t, l);
 
         if (fa->fa_state & FA_S_ACCESSED)
-                rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
+                rt_cache_flush(cfg->fc_nlinfo.nl_net);
 
         fib_release_info(fa->fa_info);
         alias_free_mem_rcu(fa);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index e1e0a4e8fd34..c7527f6b9ad9 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -510,7 +510,10 @@ relookup:
                                         secure_ipv6_id(daddr->addr.a6));
                 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
                 p->rate_tokens = 0;
-                p->rate_last = 0;
+                /* 60*HZ is arbitrary, but chosen enough high so that the first
+                 * calculation of tokens is at its maximum.
+                 */
+                p->rate_last = jiffies - 60*HZ;
                 INIT_LIST_HEAD(&p->gc_list);
 
                 /* Link the node. */
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ff0f071969ea..d23c6571ba1c 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -131,18 +131,20 @@ found:
  *      0 - deliver
  *      1 - block
  */
-static __inline__ int icmp_filter(struct sock *sk, struct sk_buff *skb)
+static int icmp_filter(const struct sock *sk, const struct sk_buff *skb)
 {
-        int type;
+        struct icmphdr _hdr;
+        const struct icmphdr *hdr;
 
-        if (!pskb_may_pull(skb, sizeof(struct icmphdr)))
+        hdr = skb_header_pointer(skb, skb_transport_offset(skb),
+                                 sizeof(_hdr), &_hdr);
+        if (!hdr)
                 return 1;
 
-        type = icmp_hdr(skb)->type;
-        if (type < 32) {
+        if (hdr->type < 32) {
                 __u32 data = raw_sk(sk)->filter.data;
 
-                return ((1 << type) & data) != 0;
+                return ((1U << hdr->type) & data) != 0;
         }
 
         /* Do not block unknown ICMP types */
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 82cf2a722b23..fd9af60397b5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -202,11 +202,6 @@ EXPORT_SYMBOL(ip_tos2prio);
 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
 #define RT_CACHE_STAT_INC(field) __this_cpu_inc(rt_cache_stat.field)
 
-static inline int rt_genid(struct net *net)
-{
-        return atomic_read(&net->ipv4.rt_genid);
-}
-
 #ifdef CONFIG_PROC_FS
 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
 {
@@ -447,27 +442,9 @@ static inline bool rt_is_expired(const struct rtable *rth)
         return rth->rt_genid != rt_genid(dev_net(rth->dst.dev));
 }
 
-/*
- * Perturbation of rt_genid by a small quantity [1..256]
- * Using 8 bits of shuffling ensure we can call rt_cache_invalidate()
- * many times (2^24) without giving recent rt_genid.
- * Jenkins hash is strong enough that litle changes of rt_genid are OK.
- */
-static void rt_cache_invalidate(struct net *net)
+void rt_cache_flush(struct net *net)
 {
-        unsigned char shuffle;
-
-        get_random_bytes(&shuffle, sizeof(shuffle));
-        atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-}
-
-/*
- * delay < 0  : invalidate cache (fast : entries will be deleted later)
- * delay >= 0 : invalidate & flush cache (can be long)
- */
-void rt_cache_flush(struct net *net, int delay)
-{
-        rt_cache_invalidate(net);
+        rt_genid_bump(net);
 }
 
 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
@@ -2345,7 +2322,7 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
 
 void ip_rt_multicast_event(struct in_device *in_dev)
 {
-        rt_cache_flush(dev_net(in_dev->dev), 0);
+        rt_cache_flush(dev_net(in_dev->dev));
 }
 
 #ifdef CONFIG_SYSCTL
@@ -2354,16 +2331,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
                                         size_t *lenp, loff_t *ppos)
 {
         if (write) {
-                int flush_delay;
-                ctl_table ctl;
-                struct net *net;
-
-                memcpy(&ctl, __ctl, sizeof(ctl));
-                ctl.data = &flush_delay;
-                proc_dointvec(&ctl, write, buffer, lenp, ppos);
-
-                net = (struct net *)__ctl->extra1;
-                rt_cache_flush(net, flush_delay);
+                rt_cache_flush((struct net *)__ctl->extra1);
                 return 0;
         }
 
@@ -2533,8 +2501,7 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
 
 static __net_init int rt_genid_init(struct net *net)
 {
-        get_random_bytes(&net->ipv4.rt_genid,
-                         sizeof(net->ipv4.rt_genid));
+        atomic_set(&net->rt_genid, 0);
         get_random_bytes(&net->ipv4.dev_addr_genid,
                          sizeof(net->ipv4.dev_addr_genid));
         return 0;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2109ff4a1daf..5f6419341821 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1762,8 +1762,14 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 }
 
 #ifdef CONFIG_NET_DMA
-                if (tp->ucopy.dma_chan)
-                        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+                if (tp->ucopy.dma_chan) {
+                        if (tp->rcv_wnd == 0 &&
+                            !skb_queue_empty(&sk->sk_async_wait_queue)) {
+                                tcp_service_net_dma(sk, true);
+                                tcp_cleanup_rbuf(sk, copied);
+                        } else
+                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+                }
 #endif
                 if (copied >= target) {
                         /* Do not sleep, just process backlog. */
@@ -2325,10 +2331,17 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                         tp->rx_opt.mss_clamp = opt.opt_val;
                         break;
                 case TCPOPT_WINDOW:
-                        if (opt.opt_val > 14)
-                                return -EFBIG;
+                        {
+                                u16 snd_wscale = opt.opt_val & 0xFFFF;
+                                u16 rcv_wscale = opt.opt_val >> 16;
+
+                                if (snd_wscale > 14 || rcv_wscale > 14)
+                                        return -EFBIG;
 
-                        tp->rx_opt.snd_wscale = opt.opt_val;
+                                tp->rx_opt.snd_wscale = snd_wscale;
+                                tp->rx_opt.rcv_wscale = rcv_wscale;
+                                tp->rx_opt.wscale_ok = 1;
+                        }
                         break;
                 case TCPOPT_SACK_PERM:
                         if (opt.opt_val != 0)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6e38c6c23caa..d377f4854cb8 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4661,7 +4661,7 @@ queue_and_out:
 
                 if (eaten > 0)
                         kfree_skb_partial(skb, fragstolen);
-                else if (!sock_flag(sk, SOCK_DEAD))
+                if (!sock_flag(sk, SOCK_DEAD))
                         sk->sk_data_ready(sk, 0);
                 return;
         }
@@ -5556,8 +5556,7 @@ no_ack:
 #endif
                         if (eaten)
                                 kfree_skb_partial(skb, fragstolen);
-                        else
-                                sk->sk_data_ready(sk, 0);
+                        sk->sk_data_ready(sk, 0);
                         return 0;
                 }
         }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 6f6d1aca3c3d..2814f66dac64 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1226,6 +1226,11 @@ try_again:
 
         if (unlikely(err)) {
                 trace_kfree_skb(skb, udp_recvmsg);
+                if (!peeked) {
+                        atomic_inc(&sk->sk_drops);
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                           UDP_MIB_INERRORS, is_udplite);
+                }
                 goto out_free;
         }
 
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 0251a6005be8..c4f934176cab 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -175,33 +175,12 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
                            const struct in6_addr *saddr)
 {
         __ip6_dst_store(sk, dst, daddr, saddr);
-
-#ifdef CONFIG_XFRM
-        {
-                struct rt6_info *rt = (struct rt6_info  *)dst;
-                rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
-        }
-#endif
 }
 
 static inline
 struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
 {
-        struct dst_entry *dst;
-
-        dst = __sk_dst_check(sk, cookie);
-
-#ifdef CONFIG_XFRM
-        if (dst) {
-                struct rt6_info *rt = (struct rt6_info *)dst;
-                if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-                        __sk_dst_reset(sk);
-                        dst = NULL;
-                }
-        }
-#endif
-
-        return dst;
+        return __sk_dst_check(sk, cookie);
 }
 
 static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 13690d650c3e..286acfc21250 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -819,6 +819,10 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
                                         offsetof(struct rt6_info, rt6i_src),
                                         allow_create, replace_required);
 
+                        if (IS_ERR(sn)) {
+                                err = PTR_ERR(sn);
+                                sn = NULL;
+                        }
                         if (!sn) {
                                 /* If it is failed, discard just allocated
                                    root, and then (in st_failure) stale node
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 5b087c31d87b..0f9bdc5ee9f3 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -86,28 +86,30 @@ static int mip6_mh_len(int type)
 
 static int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 {
-        struct ip6_mh *mh;
+        struct ip6_mh _hdr;
+        const struct ip6_mh *mh;
 
-        if (!pskb_may_pull(skb, (skb_transport_offset(skb)) + 8) ||
-            !pskb_may_pull(skb, (skb_transport_offset(skb) +
-                                 ((skb_transport_header(skb)[1] + 1) << 3))))
+        mh = skb_header_pointer(skb, skb_transport_offset(skb),
+                                sizeof(_hdr), &_hdr);
+        if (!mh)
                 return -1;
 
-        mh = (struct ip6_mh *)skb_transport_header(skb);
+        if (((mh->ip6mh_hdrlen + 1) << 3) > skb->len)
+                return -1;
 
         if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n",
                                mh->ip6mh_hdrlen, mip6_mh_len(mh->ip6mh_type));
-                mip6_param_prob(skb, 0, ((&mh->ip6mh_hdrlen) -
-                                         skb_network_header(skb)));
+                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_hdrlen) +
+                                skb_network_header_len(skb));
                 return -1;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH invalid payload proto = %d\n",
                                mh->ip6mh_proto);
-                mip6_param_prob(skb, 0, ((&mh->ip6mh_proto) -
-                                         skb_network_header(skb)));
+                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_proto) +
+                                skb_network_header_len(skb));
                 return -1;
         }
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ef0579d5bca6..4a5f78b50495 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -107,21 +107,20 @@ found:
  *      0 - deliver
  *      1 - block
  */
-static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)
+static int icmpv6_filter(const struct sock *sk, const struct sk_buff *skb)
 {
-        struct icmp6hdr *icmph;
-        struct raw6_sock *rp = raw6_sk(sk);
-
-        if (pskb_may_pull(skb, sizeof(struct icmp6hdr))) {
-                __u32 *data = &rp->filter.data[0];
-                int bit_nr;
+        struct icmp6hdr *_hdr;
+        const struct icmp6hdr *hdr;
 
-                icmph = (struct icmp6hdr *) skb->data;
-                bit_nr = icmph->icmp6_type;
+        hdr = skb_header_pointer(skb, skb_transport_offset(skb),
+                                 sizeof(_hdr), &_hdr);
+        if (hdr) {
+                const __u32 *data = &raw6_sk(sk)->filter.data[0];
+                unsigned int type = hdr->icmp6_type;
 
-                return (data[bit_nr >> 5] & (1 << (bit_nr & 31))) != 0;
+                return (data[type >> 5] & (1U << (type & 31))) != 0;
         }
-        return 0;
+        return 1;
 }
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8e80fd279100..854e4018d205 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -226,7 +226,7 @@ static struct rt6_info ip6_null_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -ENETUNREACH,
                 .input          = ip6_pkt_discard,
                 .output         = ip6_pkt_discard_out,
@@ -246,7 +246,7 @@ static struct rt6_info ip6_prohibit_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -EACCES,
                 .input          = ip6_pkt_prohibit,
                 .output         = ip6_pkt_prohibit_out,
@@ -261,7 +261,7 @@ static struct rt6_info ip6_blk_hole_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -EINVAL,
                 .input          = dst_discard,
                 .output         = dst_discard,
@@ -281,13 +281,14 @@ static inline struct rt6_info *ip6_dst_alloc(struct net *net,
                                              struct fib6_table *table)
 {
         struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
-                                        0, DST_OBSOLETE_NONE, flags);
+                                        0, DST_OBSOLETE_FORCE_CHK, flags);
 
         if (rt) {
                 struct dst_entry *dst = &rt->dst;
 
                 memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
                 rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
+                rt->rt6i_genid = rt_genid(net);
         }
         return rt;
 }
@@ -1031,6 +1032,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
+        /* All IPV6 dsts are created with ->obsolete set to the value
+         * DST_OBSOLETE_FORCE_CHK which forces validation calls down
+         * into this function always.
+         */
+        if (rt->rt6i_genid != rt_genid(dev_net(rt->dst.dev)))
+                return NULL;
+
         if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie)) {
                 if (rt->rt6i_peer_genid != rt6_peer_genid()) {
                         if (!rt6_has_peer(rt))
@@ -1397,8 +1405,6 @@ int ip6_route_add(struct fib6_config *cfg)
                 goto out;
         }
 
-        rt->dst.obsolete = -1;
-
         if (cfg->fc_flags & RTF_EXPIRES)
                 rt6_set_expires(rt, jiffies +
                                 clock_t_to_jiffies(cfg->fc_expires));
@@ -2080,7 +2086,6 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         rt->dst.input = ip6_input;
         rt->dst.output = ip6_output;
         rt->rt6i_idev = idev;
-        rt->dst.obsolete = -1;
 
         rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
         if (anycast)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index a3e60cc04a8a..acd32e3f1b68 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -403,8 +403,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 tp->mtu_info = ntohl(info);
                 if (!sock_owned_by_user(sk))
                         tcp_v6_mtu_reduced(sk);
-                else
-                        set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags);
+                else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
+                                           &tp->tsq_flags))
+                        sock_hold(sk);
                 goto out;
         }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 99d0077b56b8..07e2bfef6845 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -394,6 +394,17 @@ try_again:
         }
         if (unlikely(err)) {
                 trace_kfree_skb(skb, udpv6_recvmsg);
+                if (!peeked) {
+                        atomic_inc(&sk->sk_drops);
+                        if (is_udp4)
+                                UDP_INC_STATS_USER(sock_net(sk),
+                                                   UDP_MIB_INERRORS,
+                                                   is_udplite);
+                        else
+                                UDP6_INC_STATS_USER(sock_net(sk),
+                                                    UDP_MIB_INERRORS,
+                                                    is_udplite);
+                }
                 goto out_free;
         }
         if (!peeked) {
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 513cab08a986..1a9f3723c13c 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1501,6 +1501,8 @@ out:
         return err;
 }
 
+static struct lock_class_key l2tp_socket_class;
+
 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
 {
         struct l2tp_tunnel *tunnel = NULL;
@@ -1605,6 +1607,8 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         tunnel->old_sk_destruct = sk->sk_destruct;
         sk->sk_destruct = &l2tp_tunnel_destruct;
         tunnel->sock = sk;
+        lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
+
         sk->sk_allocation = GFP_ATOMIC;
 
         /* Add tunnel to our list */
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index f9ee74deeac2..3bfb34aaee29 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
         }
 
-        if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
+        if (!pskb_may_pull(skb, ETH_HLEN))
                 goto error;
 
         secpath_reset(skb);
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index d71cd9229a47..6f936358d664 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -80,8 +80,8 @@ static int l2tp_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info)
 
         hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq,
                           &l2tp_nl_family, 0, L2TP_CMD_NOOP);
-        if (IS_ERR(hdr)) {
-                ret = PTR_ERR(hdr);
+        if (!hdr) {
+                ret = -EMSGSIZE;
                 goto err_out;
         }
 
@@ -250,8 +250,8 @@ static int l2tp_nl_tunnel_send(struct sk_buff *skb, u32 pid, u32 seq, int flags,
 
         hdr = genlmsg_put(skb, pid, seq, &l2tp_nl_family, flags,
                           L2TP_CMD_TUNNEL_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u8(skb, L2TP_ATTR_PROTO_VERSION, tunnel->version) ||
             nla_put_u32(skb, L2TP_ATTR_CONN_ID, tunnel->tunnel_id) ||
@@ -617,8 +617,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 pid, u32 seq, int flags
         sk = tunnel->sock;
 
         hdr = genlmsg_put(skb, pid, seq, &l2tp_nl_family, flags, L2TP_CMD_SESSION_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u32(skb, L2TP_ATTR_CONN_ID, tunnel->tunnel_id) ||
             nla_put_u32(skb, L2TP_ATTR_SESSION_ID, session->session_id) ||
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index d41974aacf51..a58c0b649ba1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1378,6 +1378,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         else
                 memset(next_hop, 0, ETH_ALEN);
 
+        memset(pinfo, 0, sizeof(*pinfo));
+
         pinfo->generation = mesh_paths_generation;
 
         pinfo->filled = MPATH_INFO_FRAME_QLEN |
@@ -1396,7 +1398,6 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         pinfo->discovery_timeout =
                         jiffies_to_msecs(mpath->discovery_timeout);
         pinfo->discovery_retries = mpath->discovery_retries;
-        pinfo->flags = 0;
         if (mpath->flags & MESH_PATH_ACTIVE)
                 pinfo->flags |= NL80211_MPATH_FLAG_ACTIVE;
         if (mpath->flags & MESH_PATH_RESOLVING)
@@ -1405,10 +1406,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                 pinfo->flags |= NL80211_MPATH_FLAG_SN_VALID;
         if (mpath->flags & MESH_PATH_FIXED)
                 pinfo->flags |= NL80211_MPATH_FLAG_FIXED;
-        if (mpath->flags & MESH_PATH_RESOLVING)
-                pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
-
-        pinfo->flags = mpath->flags;
+        if (mpath->flags & MESH_PATH_RESOLVED)
+                pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
 }
 
 static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a4a5acdbaa4d..f76b83341cf9 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3248,6 +3248,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         goto out_unlock;
 
  err_clear:
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
         ifmgd->auth_data = NULL;
  err_free:
         kfree(auth_data);
@@ -3439,6 +3441,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         err = 0;
         goto out;
  err_clear:
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
         ifmgd->assoc_data = NULL;
  err_free:
         kfree(assoc_data);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index a5ac11ebef33..e046b3756aab 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -158,21 +158,18 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
  *      sCL -> sSS
  */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
-/*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
+/*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
 /*
  *      sNO -> sIV      Too late and no reason to do anything
  *      sSS -> sIV      Client can't send SYN and then SYN/ACK
  *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
- *      sSR -> sIG
- *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
- *                      are errors. Receiver will reply with RST
- *                      and close the connection.
- *                      Or we are not in sync and hold a dead connection.
- *      sFW -> sIG
- *      sCW -> sIG
- *      sLA -> sIG
- *      sTW -> sIG
- *      sCL -> sIG
+ *      sSR -> sSR      Late retransmitted SYN/ACK in simultaneous open
+ *      sES -> sIV      Invalid SYN/ACK packets sent by the client
+ *      sFW -> sIV
+ *      sCW -> sIV
+ *      sLA -> sIV
+ *      sTW -> sIV
+ *      sCL -> sIV
  */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
@@ -633,15 +630,9 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 ack = sack = receiver->td_end;
         }
 
-        if (seq == end
-            && (!tcph->rst
-                || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
+        if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)
                 /*
-                 * Packets contains no data: we assume it is valid
-                 * and check the ack value only.
-                 * However RST segments are always validated by their
-                 * SEQ number, except when seq == 0 (reset sent answering
-                 * SYN.
+                 * RST sent answering SYN.
                  */
                 seq = end = sender->td_end;
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 14e2f3903142..5cfb5bedb2b8 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -381,6 +381,7 @@ __build_packet_message(struct nfulnl_instance *inst,
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
         sk_buff_data_t old_tail = inst->skb->tail;
+        struct sock *sk;
 
         nlh = nlmsg_put(inst->skb, 0, 0,
                         NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
@@ -499,18 +500,19 @@ __build_packet_message(struct nfulnl_instance *inst,
         }
 
         /* UID */
-        if (skb->sk) {
-                read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
-                        struct file *file = skb->sk->sk_socket->file;
+        sk = skb->sk;
+        if (sk && sk->sk_state != TCP_TIME_WAIT) {
+                read_lock_bh(&sk->sk_callback_lock);
+                if (sk->sk_socket && sk->sk_socket->file) {
+                        struct file *file = sk->sk_socket->file;
                         __be32 uid = htonl(file->f_cred->fsuid);
                         __be32 gid = htonl(file->f_cred->fsgid);
-                        read_unlock_bh(&skb->sk->sk_callback_lock);
+                        read_unlock_bh(&sk->sk_callback_lock);
                         if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
                             nla_put_be32(inst->skb, NFULA_GID, gid))
                                 goto nla_put_failure;
                 } else
-                        read_unlock_bh(&skb->sk->sk_callback_lock);
+                        read_unlock_bh(&sk->sk_callback_lock);
         }
 
         /* local sequence number */
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index ff5f75fddb15..91e9af4d1f42 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -145,6 +145,19 @@ static int dump_tcp_header(struct sbuff *m, const struct sk_buff *skb,
         return 0;
 }
 
+static void dump_sk_uid_gid(struct sbuff *m, struct sock *sk)
+{
+        if (!sk || sk->sk_state == TCP_TIME_WAIT)
+                return;
+
+        read_lock_bh(&sk->sk_callback_lock);
+        if (sk->sk_socket && sk->sk_socket->file)
+                sb_add(m, "UID=%u GID=%u ",
+                        sk->sk_socket->file->f_cred->fsuid,
+                        sk->sk_socket->file->f_cred->fsgid);
+        read_unlock_bh(&sk->sk_callback_lock);
+}
+
 /* One level of recursion won't kill us */
 static void dump_ipv4_packet(struct sbuff *m,
                         const struct nf_loginfo *info,
@@ -361,14 +374,8 @@ static void dump_ipv4_packet(struct sbuff *m,
         }
 
         /* Max length: 15 "UID=4294967295 " */
-        if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {
-                read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
-                read_unlock_bh(&skb->sk->sk_callback_lock);
-        }
+        if ((logflags & XT_LOG_UID) && !iphoff)
+                dump_sk_uid_gid(m, skb->sk);
 
         /* Max length: 16 "MARK=0xFFFFFFFF " */
         if (!iphoff && skb->mark)
@@ -436,8 +443,8 @@ log_packet_common(struct sbuff *m,
                   const struct nf_loginfo *loginfo,
                   const char *prefix)
 {
-        sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
-               prefix,
+        sb_add(m, KERN_SOH "%c%sIN=%s OUT=%s ",
+               '0' + loginfo->u.log.level, prefix,
                in ? in->name : "",
                out ? out->name : "");
 #ifdef CONFIG_BRIDGE_NETFILTER
@@ -717,14 +724,8 @@ static void dump_ipv6_packet(struct sbuff *m,
         }
 
         /* Max length: 15 "UID=4294967295 " */
-        if ((logflags & XT_LOG_UID) && recurse && skb->sk) {
-                read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
-                read_unlock_bh(&skb->sk->sk_callback_lock);
-        }
+        if ((logflags & XT_LOG_UID) && recurse)
+                dump_sk_uid_gid(m, skb->sk);
 
         /* Max length: 16 "MARK=0xFFFFFFFF " */
         if (!recurse && skb->mark)
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index 5c22ce8ab309..a4c1e4528cac 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -117,11 +117,11 @@ static int limit_mt_check(const struct xt_mtchk_param *par)
 
         /* For SMP, we only want to use one set of state. */
         r->master = priv;
+        /* User avg in seconds * XT_LIMIT_SCALE: convert to jiffies *
+           128. */
+        priv->prev = jiffies;
+        priv->credit = user2credits(r->avg * r->burst); /* Credits full. */
         if (r->cost == 0) {
-                /* User avg in seconds * XT_LIMIT_SCALE: convert to jiffies *
-                   128. */
-                priv->prev = jiffies;
-                priv->credit = user2credits(r->avg * r->burst); /* Credits full. */
                 r->credit_cap = priv->credit; /* Credits full. */
                 r->cost = user2credits(r->avg);
         }
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 06592d8b4a2b..7261eb81974f 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -601,7 +601,7 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 if (!capable(CAP_NET_BIND_SERVICE)) {
                         dev_put(dev);
                         release_sock(sk);
-                        return -EACCES;
+                        return -EPERM;
                 }
                 nr->user_addr   = addr->fsa_digipeater[0];
                 nr->source_addr = addr->fsa_ax25.sax25_call;
@@ -1169,7 +1169,12 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
                 msg->msg_flags |= MSG_TRUNC;
         }
 
-        skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        er = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        if (er < 0) {
+                skb_free_datagram(sk, skb);
+                release_sock(sk);
+                return er;
+        }
 
         if (sax != NULL) {
                 sax->sax25_family = AF_NETROM;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index f3f96badf5aa..954405ceae9e 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -45,7 +45,7 @@ static int make_writable(struct sk_buff *skb, int write_len)
         return pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
 }
 
-/* remove VLAN header from packet and update csum accrodingly. */
+/* remove VLAN header from packet and update csum accordingly. */
 static int __pop_vlan_tci(struct sk_buff *skb, __be16 *current_tci)
 {
         struct vlan_hdr *vhdr;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index d8277d29e710..cf58cedad083 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -425,10 +425,10 @@ static int validate_sample(const struct nlattr *attr,
 static int validate_tp_port(const struct sw_flow_key *flow_key)
 {
         if (flow_key->eth.type == htons(ETH_P_IP)) {
-                if (flow_key->ipv4.tp.src && flow_key->ipv4.tp.dst)
+                if (flow_key->ipv4.tp.src || flow_key->ipv4.tp.dst)
                         return 0;
         } else if (flow_key->eth.type == htons(ETH_P_IPV6)) {
-                if (flow_key->ipv6.tp.src && flow_key->ipv6.tp.dst)
+                if (flow_key->ipv6.tp.src || flow_key->ipv6.tp.dst)
                         return 0;
         }
 
@@ -460,7 +460,7 @@ static int validate_set(const struct nlattr *a,
                 if (flow_key->eth.type != htons(ETH_P_IP))
                         return -EINVAL;
 
-                if (!flow_key->ipv4.addr.src || !flow_key->ipv4.addr.dst)
+                if (!flow_key->ip.proto)
                         return -EINVAL;
 
                 ipv4_key = nla_data(ovs_key);
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index 9b75617ca4e0..c30df1a10c67 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -145,15 +145,17 @@ u64 ovs_flow_used_time(unsigned long flow_jiffies);
  *  OVS_KEY_ATTR_PRIORITY      4    --     4      8
  *  OVS_KEY_ATTR_IN_PORT       4    --     4      8
  *  OVS_KEY_ATTR_ETHERNET     12    --     4     16
+ *  OVS_KEY_ATTR_ETHERTYPE     2     2     4      8  (outer VLAN ethertype)
  *  OVS_KEY_ATTR_8021Q         4    --     4      8
- *  OVS_KEY_ATTR_ETHERTYPE     2     2     4      8
+ *  OVS_KEY_ATTR_ENCAP         0    --     4      4  (VLAN encapsulation)
+ *  OVS_KEY_ATTR_ETHERTYPE     2     2     4      8  (inner VLAN ethertype)
  *  OVS_KEY_ATTR_IPV6         40    --     4     44
  *  OVS_KEY_ATTR_ICMPV6        2     2     4      8
  *  OVS_KEY_ATTR_ND           28    --     4     32
  *  -------------------------------------------------
- *  total                                       132
+ *  total                                       144
  */
-#define FLOW_BUFSIZE 132
+#define FLOW_BUFSIZE 144
 
 int ovs_flow_to_nlattrs(const struct sw_flow_key *, struct sk_buff *);
 int ovs_flow_from_nlattrs(struct sw_flow_key *swkey, int *key_lenp,
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 6aabd77d1cfd..564b9fc8efd3 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -250,10 +250,11 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                         else if ((cl = defmap[res.classid & TC_PRIO_MAX]) == NULL)
                                 cl = defmap[TC_PRIO_BESTEFFORT];
 
-                        if (cl == NULL || cl->level >= head->level)
+                        if (cl == NULL)
                                 goto fallback;
                 }
-
+                if (cl->level >= head->level)
+                        goto fallback;
 #ifdef CONFIG_NET_CLS_ACT
                 switch (result) {
                 case TC_ACT_QUEUED:
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 9fc1c62ec80e..4e606fcb2534 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -191,7 +191,6 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         if (list_empty(&flow->flowchain)) {
                 list_add_tail(&flow->flowchain, &q->new_flows);
-                codel_vars_init(&flow->cvars);
                 q->new_flow_count++;
                 flow->deficit = q->quantum;
                 flow->dropped = 0;
@@ -418,6 +417,7 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt)
                         struct fq_codel_flow *flow = q->flows + i;
 
                         INIT_LIST_HEAD(&flow->flowchain);
+                        codel_vars_init(&flow->cvars);
                 }
         }
         if (sch->limit >= 1)
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index e901583e4ea5..d42234c0f13b 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -102,9 +102,8 @@ static inline int gred_wred_mode_check(struct Qdisc *sch)
                 if (q == NULL)
                         continue;
 
-                for (n = 0; n < table->DPs; n++)
-                        if (table->tab[n] && table->tab[n] != q &&
-                            table->tab[n]->prio == q->prio)
+                for (n = i + 1; n < table->DPs; n++)
+                        if (table->tab[n] && table->tab[n]->prio == q->prio)
                                 return 1;
         }
 
@@ -137,6 +136,7 @@ static inline void gred_store_wred_set(struct gred_sched *table,
                                        struct gred_sched_data *q)
 {
         table->wred_set.qavg = q->vars.qavg;
+        table->wred_set.qidlestart = q->vars.qidlestart;
 }
 
 static inline int gred_use_ecn(struct gred_sched *t)
@@ -176,7 +176,7 @@ static int gred_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 skb->tc_index = (skb->tc_index & ~GRED_VQ_MASK) | dp;
         }
 
-        /* sum up all the qaves of prios <= to ours to get the new qave */
+        /* sum up all the qaves of prios < ours to get the new qave */
         if (!gred_wred_mode(t) && gred_rio_mode(t)) {
                 int i;
 
@@ -260,16 +260,18 @@ static struct sk_buff *gred_dequeue(struct Qdisc *sch)
                 } else {
                         q->backlog -= qdisc_pkt_len(skb);
 
-                        if (!q->backlog && !gred_wred_mode(t))
-                                red_start_of_idle_period(&q->vars);
+                        if (gred_wred_mode(t)) {
+                                if (!sch->qstats.backlog)
+                                        red_start_of_idle_period(&t->wred_set);
+                        } else {
+                                if (!q->backlog)
+                                        red_start_of_idle_period(&q->vars);
+                        }
                 }
 
                 return skb;
         }
 
-        if (gred_wred_mode(t) && !red_is_idling(&t->wred_set))
-                red_start_of_idle_period(&t->wred_set);
-
         return NULL;
 }
 
@@ -291,19 +293,20 @@ static unsigned int gred_drop(struct Qdisc *sch)
                         q->backlog -= len;
                         q->stats.other++;
 
-                        if (!q->backlog && !gred_wred_mode(t))
-                                red_start_of_idle_period(&q->vars);
+                        if (gred_wred_mode(t)) {
+                                if (!sch->qstats.backlog)
+                                        red_start_of_idle_period(&t->wred_set);
+                        } else {
+                                if (!q->backlog)
+                                        red_start_of_idle_period(&q->vars);
+                        }
                 }
 
                 qdisc_drop(skb, sch);
                 return len;
         }
 
-        if (gred_wred_mode(t) && !red_is_idling(&t->wred_set))
-                red_start_of_idle_period(&t->wred_set);
-
         return 0;
-
 }
 
 static void gred_reset(struct Qdisc *sch)
@@ -535,6 +538,7 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
         for (i = 0; i < MAX_DPs; i++) {
                 struct gred_sched_data *q = table->tab[i];
                 struct tc_gred_qopt opt;
+                unsigned long qavg;
 
                 memset(&opt, 0, sizeof(opt));
 
@@ -566,7 +570,9 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
                 if (gred_wred_mode(table))
                         gred_load_wred_set(table, q);
 
-                opt.qave = red_calc_qavg(&q->parms, &q->vars, q->vars.qavg);
+                qavg = red_calc_qavg(&q->parms, &q->vars,
+                                     q->vars.qavg >> q->parms.Wlog);
+                opt.qave = qavg >> q->parms.Wlog;
 
 append_opt:
                 if (nla_append(skb, sizeof(opt), &opt) < 0)
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index e4723d31fdd5..211a21217045 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -865,7 +865,10 @@ static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
                 if (mask) {
                         struct qfq_group *next = qfq_ffs(q, mask);
                         if (qfq_gt(roundedF, next->F)) {
-                                cl->S = next->F;
+                                if (qfq_gt(limit, next->F))
+                                        cl->S = next->F;
+                                else /* preserve timestamp correctness */
+                                        cl->S = limit;
                                 return;
                         }
                 }
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 838e18b4d7ea..be50aa234dcd 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -364,6 +364,25 @@ finish:
         return retval;
 }
 
+static void sctp_packet_release_owner(struct sk_buff *skb)
+{
+        sk_free(skb->sk);
+}
+
+static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
+{
+        skb_orphan(skb);
+        skb->sk = sk;
+        skb->destructor = sctp_packet_release_owner;
+
+        /*
+         * The data chunks have already been accounted for in sctp_sendmsg(),
+         * therefore only reserve a single byte to keep socket around until
+         * the packet has been transmitted.
+         */
+        atomic_inc(&sk->sk_wmem_alloc);
+}
+
 /* All packets are sent to the network through this function from
  * sctp_outq_tail().
  *
@@ -405,7 +424,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         /* Set the owning socket so that we know where to get the
          * destination IP address.
          */
-        skb_set_owner_w(nskb, sk);
+        sctp_packet_set_owner_w(nskb, sk);
 
         if (!sctp_transport_dst_check(tp)) {
                 sctp_transport_route(tp, NULL, sctp_sk(sk));
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index a5a402a7d21f..5d7f61d7559c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -969,11 +969,11 @@ static bool xprt_dynamic_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
         return false;
 }
 
-static void xprt_alloc_slot(struct rpc_task *task)
+void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
 {
-        struct rpc_xprt *xprt = task->tk_xprt;
         struct rpc_rqst *req;
 
+        spin_lock(&xprt->reserve_lock);
         if (!list_empty(&xprt->free)) {
                 req = list_entry(xprt->free.next, struct rpc_rqst, rq_list);
                 list_del(&req->rq_list);
@@ -994,12 +994,29 @@ static void xprt_alloc_slot(struct rpc_task *task)
         default:
                 task->tk_status = -EAGAIN;
         }
+        spin_unlock(&xprt->reserve_lock);
         return;
 out_init_req:
         task->tk_status = 0;
         task->tk_rqstp = req;
         xprt_request_init(task, xprt);
+        spin_unlock(&xprt->reserve_lock);
+}
+EXPORT_SYMBOL_GPL(xprt_alloc_slot);
+
+void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
+{
+        /* Note: grabbing the xprt_lock_write() ensures that we throttle
+         * new slot allocation if the transport is congested (i.e. when
+         * reconnecting a stream transport or when out of socket write
+         * buffer space).
+         */
+        if (xprt_lock_write(xprt, task)) {
+                xprt_alloc_slot(xprt, task);
+                xprt_release_write(xprt, task);
+        }
 }
+EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_slot);
 
 static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
 {
@@ -1083,20 +1100,9 @@ void xprt_reserve(struct rpc_task *task)
         if (task->tk_rqstp != NULL)
                 return;
 
-        /* Note: grabbing the xprt_lock_write() here is not strictly needed,
-         * but ensures that we throttle new slot allocation if the transport
-         * is congested (e.g. if reconnecting or if we're out of socket
-         * write buffer space).
-         */
         task->tk_timeout = 0;
         task->tk_status = -EAGAIN;
-        if (!xprt_lock_write(xprt, task))
-                return;
-
-        spin_lock(&xprt->reserve_lock);
-        xprt_alloc_slot(task);
-        spin_unlock(&xprt->reserve_lock);
-        xprt_release_write(xprt, task);
+        xprt->ops->alloc_slot(xprt, task);
 }
 
 static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 06cdbff79e4a..5d9202dc7cb1 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -713,6 +713,7 @@ static void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
 static struct rpc_xprt_ops xprt_rdma_procs = {
         .reserve_xprt           = xprt_rdma_reserve_xprt,
         .release_xprt           = xprt_release_xprt_cong, /* sunrpc/xprt.c */
+        .alloc_slot             = xprt_alloc_slot,
         .release_request        = xprt_release_rqst_cong,       /* ditto */
         .set_retrans_timeout    = xprt_set_retrans_timeout_def, /* ditto */
         .rpcbind                = rpcb_getport_async,   /* sunrpc/rpcb_clnt.c */
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 400567243f84..a35b8e52e551 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2473,6 +2473,7 @@ static void bc_destroy(struct rpc_xprt *xprt)
 static struct rpc_xprt_ops xs_local_ops = {
         .reserve_xprt           = xprt_reserve_xprt,
         .release_xprt           = xs_tcp_release_xprt,
+        .alloc_slot             = xprt_alloc_slot,
         .rpcbind                = xs_local_rpcbind,
         .set_port               = xs_local_set_port,
         .connect                = xs_connect,
@@ -2489,6 +2490,7 @@ static struct rpc_xprt_ops xs_udp_ops = {
         .set_buffer_size        = xs_udp_set_buffer_size,
         .reserve_xprt           = xprt_reserve_xprt_cong,
         .release_xprt           = xprt_release_xprt_cong,
+        .alloc_slot             = xprt_alloc_slot,
         .rpcbind                = rpcb_getport_async,
         .set_port               = xs_set_port,
         .connect                = xs_connect,
@@ -2506,6 +2508,7 @@ static struct rpc_xprt_ops xs_udp_ops = {
 static struct rpc_xprt_ops xs_tcp_ops = {
         .reserve_xprt           = xprt_reserve_xprt,
         .release_xprt           = xs_tcp_release_xprt,
+        .alloc_slot             = xprt_lock_and_alloc_slot,
         .rpcbind                = rpcb_getport_async,
         .set_port               = xs_set_port,
         .connect                = xs_connect,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 97026f3b215a..1e37dbf00cb3 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5633,8 +5633,10 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                        sizeof(connect.ht_capa_mask));
 
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
-                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
+                        kfree(connkeys);
                         return -EINVAL;
+                }
                 memcpy(&connect.ht_capa,
                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
                        sizeof(connect.ht_capa));
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2ded3c7fad06..72d170ca3406 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -350,6 +350,9 @@ static void reg_regdb_search(struct work_struct *work)
         struct reg_regdb_search_request *request;
         const struct ieee80211_regdomain *curdom, *regdom;
         int i, r;
+        bool set_reg = false;
+
+        mutex_lock(&cfg80211_mutex);
 
         mutex_lock(&reg_regdb_search_mutex);
         while (!list_empty(&reg_regdb_search_list)) {
@@ -365,9 +368,7 @@ static void reg_regdb_search(struct work_struct *work)
                                 r = reg_copy_regd(&regdom, curdom);
                                 if (r)
                                         break;
-                                mutex_lock(&cfg80211_mutex);
-                                set_regdom(regdom);
-                                mutex_unlock(&cfg80211_mutex);
+                                set_reg = true;
                                 break;
                         }
                 }
@@ -375,6 +376,11 @@ static void reg_regdb_search(struct work_struct *work)
                 kfree(request);
         }
         mutex_unlock(&reg_regdb_search_mutex);
+
+        if (set_reg)
+                set_regdom(regdom);
+
+        mutex_unlock(&cfg80211_mutex);
 }
 
 static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 54a0dc2e2f8d..ab2bb42fe094 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -212,7 +212,7 @@ resume:
                 /* only the first xfrm gets the encap type */
                 encap_type = 0;
 
-                if (async && x->repl->check(x, skb, seq)) {
+                if (async && x->repl->recheck(x, skb, seq)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
                         goto drop_unlock;
                 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5a2aa17e4d3c..387848e90078 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -585,6 +585,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         xfrm_pol_hold(policy);
         net->xfrm.policy_count[dir]++;
         atomic_inc(&flow_cache_genid);
+        rt_genid_bump(net);
         if (delpol)
                 __xfrm_policy_unlink(delpol, dir);
         policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
@@ -1763,7 +1764,7 @@ static struct dst_entry *make_blackhole(struct net *net, u16 family,
 
         if (!afinfo) {
                 dst_release(dst_orig);
-                ret = ERR_PTR(-EINVAL);
+                return ERR_PTR(-EINVAL);
         } else {
                 ret = afinfo->blackhole_route(net, dst_orig);
         }
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 2f6d11d04a2b..3efb07d3eb27 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -420,6 +420,18 @@ err:
         return -EINVAL;
 }
 
+static int xfrm_replay_recheck_esn(struct xfrm_state *x,
+                                   struct sk_buff *skb, __be32 net_seq)
+{
+        if (unlikely(XFRM_SKB_CB(skb)->seq.input.hi !=
+                     htonl(xfrm_replay_seqhi(x, net_seq)))) {
+                        x->stats.replay_window++;
+                        return -EINVAL;
+        }
+
+        return xfrm_replay_check_esn(x, skb, net_seq);
+}
+
 static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
 {
         unsigned int bitnr, nr, i;
@@ -479,6 +491,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
 static struct xfrm_replay xfrm_replay_legacy = {
         .advance        = xfrm_replay_advance,
         .check          = xfrm_replay_check,
+        .recheck        = xfrm_replay_check,
         .notify         = xfrm_replay_notify,
         .overflow       = xfrm_replay_overflow,
 };
@@ -486,6 +499,7 @@ static struct xfrm_replay xfrm_replay_legacy = {
 static struct xfrm_replay xfrm_replay_bmp = {
         .advance        = xfrm_replay_advance_bmp,
         .check          = xfrm_replay_check_bmp,
+        .recheck        = xfrm_replay_check_bmp,
         .notify         = xfrm_replay_notify_bmp,
         .overflow       = xfrm_replay_overflow_bmp,
 };
@@ -493,6 +507,7 @@ static struct xfrm_replay xfrm_replay_bmp = {
 static struct xfrm_replay xfrm_replay_esn = {
         .advance        = xfrm_replay_advance_esn,
         .check          = xfrm_replay_check_esn,
+        .recheck        = xfrm_replay_recheck_esn,
         .notify         = xfrm_replay_notify_bmp,
         .overflow       = xfrm_replay_overflow_esn,
 };
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e75d8e47f35c..289f4bf18ff0 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -123,9 +123,21 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
                                 struct nlattr **attrs)
 {
         struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
+        struct xfrm_replay_state_esn *rs;
 
-        if ((p->flags & XFRM_STATE_ESN) && !rt)
-                return -EINVAL;
+        if (p->flags & XFRM_STATE_ESN) {
+                if (!rt)
+                        return -EINVAL;
+
+                rs = nla_data(rt);
+
+                if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
+                        return -EINVAL;
+
+                if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
+                    nla_len(rt) != sizeof(*rs))
+                        return -EINVAL;
+        }
 
         if (!rt)
                 return 0;
@@ -370,14 +382,15 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
                                          struct nlattr *rp)
 {
         struct xfrm_replay_state_esn *up;
+        int ulen;
 
         if (!replay_esn || !rp)
                 return 0;
 
         up = nla_data(rp);
+        ulen = xfrm_replay_state_esn_len(up);
 
-        if (xfrm_replay_state_esn_len(replay_esn) !=
-                        xfrm_replay_state_esn_len(up))
+        if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
                 return -EINVAL;
 
         return 0;
@@ -388,22 +401,28 @@ static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn
                                        struct nlattr *rta)
 {
         struct xfrm_replay_state_esn *p, *pp, *up;
+        int klen, ulen;
 
         if (!rta)
                 return 0;
 
         up = nla_data(rta);
+        klen = xfrm_replay_state_esn_len(up);
+        ulen = nla_len(rta) >= klen ? klen : sizeof(*up);
 
-        p = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
+        p = kzalloc(klen, GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
 
-        pp = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
+        pp = kzalloc(klen, GFP_KERNEL);
         if (!pp) {
                 kfree(p);
                 return -ENOMEM;
         }
 
+        memcpy(p, up, ulen);
+        memcpy(pp, up, ulen);
+
         *replay_esn = p;
         *preplay_esn = pp;
 
@@ -442,10 +461,11 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
  * somehow made shareable and move it to xfrm_state.c - JHS
  *
 */
-static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
+static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
+                                  int update_esn)
 {
         struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
-        struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
+        struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
         struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
         struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
         struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
@@ -555,7 +575,7 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
                 goto error;
 
         /* override default values from above */
-        xfrm_update_ae_params(x, attrs);
+        xfrm_update_ae_params(x, attrs, 0);
 
         return x;
 
@@ -689,6 +709,7 @@ out:
 
 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
 {
+        memset(p, 0, sizeof(*p));
         memcpy(&p->id, &x->id, sizeof(p->id));
         memcpy(&p->sel, &x->sel, sizeof(p->sel));
         memcpy(&p->lft, &x->lft, sizeof(p->lft));
@@ -742,7 +763,7 @@ static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
                 return -EMSGSIZE;
 
         algo = nla_data(nla);
-        strcpy(algo->alg_name, auth->alg_name);
+        strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
         memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
         algo->alg_key_len = auth->alg_key_len;
 
@@ -878,6 +899,7 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
 {
         struct xfrm_dump_info info;
         struct sk_buff *skb;
+        int err;
 
         skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
         if (!skb)
@@ -888,9 +910,10 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
         info.nlmsg_seq = seq;
         info.nlmsg_flags = 0;
 
-        if (dump_one_state(x, 0, &info)) {
+        err = dump_one_state(x, 0, &info);
+        if (err) {
                 kfree_skb(skb);
-                return NULL;
+                return ERR_PTR(err);
         }
 
         return skb;
@@ -1317,6 +1340,7 @@ static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy
 
 static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
 {
+        memset(p, 0, sizeof(*p));
         memcpy(&p->sel, &xp->selector, sizeof(p->sel));
         memcpy(&p->lft, &xp->lft, sizeof(p->lft));
         memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
@@ -1421,6 +1445,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
                 struct xfrm_user_tmpl *up = &vec[i];
                 struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
 
+                memset(up, 0, sizeof(*up));
                 memcpy(&up->id, &kp->id, sizeof(up->id));
                 up->family = kp->encap_family;
                 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
@@ -1546,6 +1571,7 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
 {
         struct xfrm_dump_info info;
         struct sk_buff *skb;
+        int err;
 
         skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!skb)
@@ -1556,9 +1582,10 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
         info.nlmsg_seq = seq;
         info.nlmsg_flags = 0;
 
-        if (dump_one_policy(xp, dir, 0, &info) < 0) {
+        err = dump_one_policy(xp, dir, 0, &info);
+        if (err) {
                 kfree_skb(skb);
-                return NULL;
+                return ERR_PTR(err);
         }
 
         return skb;
@@ -1822,7 +1849,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
                 goto out;
 
         spin_lock_bh(&x->lock);
-        xfrm_update_ae_params(x, attrs);
+        xfrm_update_ae_params(x, attrs, 1);
         spin_unlock_bh(&x->lock);
 
         c.event = nlh->nlmsg_type;
diff --git a/scripts/Makefile.fwinst b/scripts/Makefile.fwinst
index c3f69ae275d1..4d908d16c035 100644
--- a/scripts/Makefile.fwinst
+++ b/scripts/Makefile.fwinst
@@ -27,7 +27,7 @@ endif
 installed-mod-fw := $(addprefix $(INSTALL_FW_PATH)/,$(mod-fw))
 
 installed-fw := $(addprefix $(INSTALL_FW_PATH)/,$(fw-shipped-all))
-installed-fw-dirs := $(sort $(dir $(installed-fw))) $(INSTALL_FW_PATH)/.
+installed-fw-dirs := $(sort $(dir $(installed-fw))) $(INSTALL_FW_PATH)/./
 
 # Workaround for make < 3.81, where .SECONDEXPANSION doesn't work.
 PHONY += $(INSTALL_FW_PATH)/$$(%) install-all-dirs
@@ -42,7 +42,7 @@ quiet_cmd_install = INSTALL $(subst $(srctree)/,,$@)
 $(installed-fw-dirs):
         $(call cmd,mkdir)
 
-$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $$(dir $(INSTALL_FW_PATH)/%)
+$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $(INSTALL_FW_PATH)/$$(dir %)
         $(call cmd,install)
 
 PHONY +=  __fw_install __fw_modinst FORCE
diff --git a/scripts/checksyscalls.sh b/scripts/checksyscalls.sh
index d24810fc6af6..fd8fa9aa7c4e 100755
--- a/scripts/checksyscalls.sh
+++ b/scripts/checksyscalls.sh
@@ -200,7 +200,7 @@ EOF
 syscall_list() {
     grep '^[0-9]' "$1" | sort -n | (
         while read nr abi name entry ; do
-            echo <<EOF
+            cat <<EOF
 #if !defined(__NR_${name}) && !defined(__IGNORE_${name})
 #warning syscall ${name} not implemented
 #endif
diff --git a/scripts/coccinelle/api/memdup_user.cocci b/scripts/coccinelle/api/memdup_user.cocci
index 2efac289fd59..2b131a8a1306 100644
--- a/scripts/coccinelle/api/memdup_user.cocci
+++ b/scripts/coccinelle/api/memdup_user.cocci
@@ -51,10 +51,10 @@ statement S1,S2;
 p << r.p;
 @@
 
-coccilib.org.print_todo(p[0], "WARNING opportunity for memdep_user")
+coccilib.org.print_todo(p[0], "WARNING opportunity for memdup_user")
 
 @script:python depends on report@
 p << r.p;
 @@
 
-coccilib.report.print_report(p[0], "WARNING opportunity for memdep_user")
+coccilib.report.print_report(p[0], "WARNING opportunity for memdup_user")
diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
index 2fbbbc1ddea0..33689396953a 100644
--- a/scripts/kconfig/streamline_config.pl
+++ b/scripts/kconfig/streamline_config.pl
@@ -100,7 +100,7 @@ my @searchconfigs = (
         },
 );
 
-sub find_config {
+sub read_config {
     foreach my $conf (@searchconfigs) {
         my $file = $conf->{"file"};
 
@@ -115,17 +115,15 @@ sub find_config {
 
         print STDERR "using config: '$file'\n";
 
-        open(CIN, "$exec $file |") || die "Failed to run $exec $file";
-        return;
+        open(my $infile, '-|', "$exec $file") || die "Failed to run $exec $file";
+        my @x = <$infile>;
+        close $infile;
+        return @x;
     }
     die "No config file found";
 }
 
-find_config;
-
-# Read in the entire config file into config_file
-my @config_file = <CIN>;
-close CIN;
+my @config_file = read_config;
 
 # Parse options
 my $localmodconfig = 0;
@@ -135,7 +133,7 @@ GetOptions("localmodconfig" => \$localmodconfig,
            "localyesconfig" => \$localyesconfig);
 
 # Get the build source and top level Kconfig file (passed in)
-my $ksource = $ARGV[0];
+my $ksource = ($ARGV[0] ? $ARGV[0] : '.');
 my $kconfig = $ARGV[1];
 my $lsmod_file = $ENV{'LSMOD'};
 
@@ -173,8 +171,8 @@ sub read_kconfig {
         $source =~ s/\$$env/$ENV{$env}/;
     }
 
-    open(KIN, "$source") || die "Can't open $kconfig";
-    while (<KIN>) {
+    open(my $kinfile, '<', $source) || die "Can't open $kconfig";
+    while (<$kinfile>) {
         chomp;
 
         # Make sure that lines ending with \ continue
@@ -251,10 +249,10 @@ sub read_kconfig {
             $state = "NONE";
         }
     }
-    close(KIN);
+    close($kinfile);
 
     # read in any configs that were found.
-    foreach $kconfig (@kconfigs) {
+    foreach my $kconfig (@kconfigs) {
         if (!defined($read_kconfigs{$kconfig})) {
             $read_kconfigs{$kconfig} = 1;
             read_kconfig($kconfig);
@@ -295,8 +293,8 @@ foreach my $makefile (@makefiles) {
     my $line = "";
     my %make_vars;
 
-    open(MIN,$makefile) || die "Can't open $makefile";
-    while (<MIN>) {
+    open(my $infile, '<', $makefile) || die "Can't open $makefile";
+    while (<$infile>) {
         # if this line ends with a backslash, continue
         chomp;
         if (/^(.*)\\$/) {
@@ -343,10 +341,11 @@ foreach my $makefile (@makefiles) {
             }
         }
     }
-    close(MIN);
+    close($infile);
 }
 
 my %modules;
+my $linfile;
 
 if (defined($lsmod_file)) {
     if ( ! -f $lsmod_file) {
@@ -356,13 +355,10 @@ if (defined($lsmod_file)) {
                 die "$lsmod_file not found";
         }
     }
-    if ( -x $lsmod_file) {
-        # the file is executable, run it
-        open(LIN, "$lsmod_file|");
-    } else {
-        # Just read the contents
-        open(LIN, "$lsmod_file");
-    }
+
+    my $otype = ( -x $lsmod_file) ? '-|' : '<';
+    open($linfile, $otype, $lsmod_file);
+
 } else {
 
     # see what modules are loaded on this system
@@ -379,16 +375,16 @@ if (defined($lsmod_file)) {
         $lsmod = "lsmod";
     }
 
-    open(LIN,"$lsmod|") || die "Can not call lsmod with $lsmod";
+    open($linfile, '-|', $lsmod) || die "Can not call lsmod with $lsmod";
 }
 
-while (<LIN>) {
+while (<$linfile>) {
         next if (/^Module/);  # Skip the first line.
         if (/^(\S+)/) {
                 $modules{$1} = 1;
         }
 }
-close (LIN);
+close ($linfile);
 
 # add to the configs hash all configs that are needed to enable
 # a loaded module. This is a direct obj-${CONFIG_FOO} += bar.o
@@ -605,6 +601,8 @@ foreach my $line (@config_file) {
         if (defined($configs{$1})) {
             if ($localyesconfig) {
                 $setconfigs{$1} = 'y';
+                print "$1=y\n";
+                next;
             } else {
                 $setconfigs{$1} = $2;
             }
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 4235a6361fec..b3d907eb93a9 100644
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -74,8 +74,13 @@ kallsyms()
         info KSYM ${2}
         local kallsymopt;
 
+        if [ -n "${CONFIG_SYMBOL_PREFIX}" ]; then
+                kallsymopt="${kallsymopt} \
+                            --symbol-prefix=${CONFIG_SYMBOL_PREFIX}"
+        fi
+
         if [ -n "${CONFIG_KALLSYMS_ALL}" ]; then
-                kallsymopt=--all-symbols
+                kallsymopt="${kallsymopt} --all-symbols"
         fi
 
         local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}               \
diff --git a/security/apparmor/.gitignore b/security/apparmor/.gitignore
index 4d995aeaebc0..9cdec70d72b8 100644
--- a/security/apparmor/.gitignore
+++ b/security/apparmor/.gitignore
@@ -1,6 +1,5 @@
 #
 # Generated include files
 #
-af_names.h
 capability_names.h
 rlim_names.h
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 3364fbf46807..6cfc6478863e 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1486,7 +1486,6 @@ long keyctl_session_to_parent(void)
         oldwork = NULL;
         parent = me->real_parent;
 
-        task_lock(parent);
         /* the parent mustn't be init and mustn't be a kernel thread */
         if (parent->pid <= 1 || !parent->mm)
                 goto unlock;
@@ -1530,7 +1529,6 @@ long keyctl_session_to_parent(void)
         if (!ret)
                 newwork = NULL;
 unlock:
-        task_unlock(parent);
         write_unlock_irq(&tasklist_lock);
         rcu_read_unlock();
         if (oldwork)
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index c220f314709c..65f67cb0aefb 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -51,6 +51,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
 static inline void selinux_xfrm_notify_policyload(void)
 {
         atomic_inc(&flow_cache_genid);
+        rt_genid_bump(&init_net);
 }
 #else
 static inline int selinux_xfrm_enabled(void)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index ec2118d0e27a..eb60cb8dbb8a 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -80,14 +80,12 @@ static int snd_compr_open(struct inode *inode, struct file *f)
         int maj = imajor(inode);
         int ret;
 
-        if (f->f_flags & O_WRONLY)
+        if ((f->f_flags & O_ACCMODE) == O_WRONLY)
                 dirn = SND_COMPRESS_PLAYBACK;
-        else if (f->f_flags & O_RDONLY)
+        else if ((f->f_flags & O_ACCMODE) == O_RDONLY)
                 dirn = SND_COMPRESS_CAPTURE;
-        else {
-                pr_err("invalid direction\n");
+        else
                 return -EINVAL;
-        }
 
         if (maj == snd_major)
                 compr = snd_lookup_minor_data(iminor(inode),
diff --git a/sound/oss/.gitignore b/sound/oss/.gitignore
index 7efb12b45502..12a3920d6fb6 100644
--- a/sound/oss/.gitignore
+++ b/sound/oss/.gitignore
@@ -1,4 +1,3 @@
 #Ignore generated files
-maui_boot.h
 pss_boot.h
 trix_boot.h
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index f25c24c743f9..1c65cc5e3a31 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2353,6 +2353,7 @@ int snd_hda_codec_reset(struct hda_codec *codec)
         }
         if (codec->patch_ops.free)
                 codec->patch_ops.free(codec);
+        memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
         snd_hda_jack_tbl_clear(codec);
         codec->proc_widget_hook = NULL;
         codec->spec = NULL;
@@ -2368,7 +2369,6 @@ int snd_hda_codec_reset(struct hda_codec *codec)
         codec->num_pcms = 0;
         codec->pcm_info = NULL;
         codec->preset = NULL;
-        memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
         codec->slave_dig_outs = NULL;
         codec->spdif_status_reset = 0;
         module_put(codec->owner);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 60882c62f180..c4763c52eaf6 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2701,6 +2701,8 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
         SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
+        SND_PCI_QUIRK(0x1043, 0x1ac3, "ASUS X53S", POS_FIX_POSBUF),
+        SND_PCI_QUIRK(0x1043, 0x1b43, "ASUS K53E", POS_FIX_POSBUF),
         SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x10de, 0xcb89, "Macbook Pro 7,1", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6f806d3e56bb..3d4722f0a1ca 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1075,7 +1075,7 @@ static struct snd_kcontrol_new stac_smux_mixer = {
 
 static const char * const slave_pfxs[] = {
         "Front", "Surround", "Center", "LFE", "Side",
-        "Headphone", "Speaker", "IEC958",
+        "Headphone", "Speaker", "IEC958", "PCM",
         NULL
 };
 
diff --git a/sound/pci/ice1712/prodigy_hifi.c b/sound/pci/ice1712/prodigy_hifi.c
index 764cc93dbca4..075d5aa1fee0 100644
--- a/sound/pci/ice1712/prodigy_hifi.c
+++ b/sound/pci/ice1712/prodigy_hifi.c
@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem
 }
 
 static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1);
+static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0);
 
 static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
     {
@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
         .info = ak4396_dac_vol_info,
         .get = ak4396_dac_vol_get,
         .put = ak4396_dac_vol_put,
-        .tlv = { .p = db_scale_wm_dac },
+        .tlv = { .p = ak4396_db_scale },
     },
 };
 
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index 5c9cacaf2d52..1cf7a32d1b21 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -426,7 +426,7 @@ static const int arizona_44k1_bclk_rates[] = {
         940800,
         1411200,
         1881600,
-        2882400,
+        2822400,
         3763200,
         5644800,
         7526400,
diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c
index 8f726c063f42..115a40301810 100644
--- a/sound/soc/codecs/mc13783.c
+++ b/sound/soc/codecs/mc13783.c
@@ -659,7 +659,7 @@ static struct snd_soc_dai_driver mc13783_dai_async[] = {
                 .id = MC13783_ID_STEREO_DAC,
                 .playback = {
                         .stream_name = "Playback",
-                        .channels_min = 1,
+                        .channels_min = 2,
                         .channels_max = 2,
                         .rates = SNDRV_PCM_RATE_8000_96000,
                         .formats = MC13783_FORMATS,
@@ -670,7 +670,7 @@ static struct snd_soc_dai_driver mc13783_dai_async[] = {
                 .id = MC13783_ID_STEREO_CODEC,
                 .capture = {
                         .stream_name = "Capture",
-                        .channels_min = 1,
+                        .channels_min = 2,
                         .channels_max = 2,
                         .rates = MC13783_RATES_RECORD,
                         .formats = MC13783_FORMATS,
@@ -692,14 +692,14 @@ static struct snd_soc_dai_driver mc13783_dai_sync[] = {
                 .id = MC13783_ID_SYNC,
                 .playback = {
                         .stream_name = "Playback",
-                        .channels_min = 1,
+                        .channels_min = 2,
                         .channels_max = 2,
                         .rates = SNDRV_PCM_RATE_8000_96000,
                         .formats = MC13783_FORMATS,
                 },
                 .capture = {
                         .stream_name = "Capture",
-                        .channels_min = 1,
+                        .channels_min = 2,
                         .channels_max = 2,
                         .rates = MC13783_RATES_RECORD,
                         .formats = MC13783_FORMATS,
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index 3fd5b29dc933..a3acb7a85f6a 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -702,7 +702,7 @@ static bool wm2000_readable_reg(struct device *dev, unsigned int reg)
 }
 
 static const struct regmap_config wm2000_regmap = {
-        .reg_bits = 8,
+        .reg_bits = 16,
         .val_bits = 8,
 
         .max_register = WM2000_REG_IF_CTL,
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index 0013afe48e66..dc4262eea4b7 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -100,7 +100,7 @@ static const struct reg_default wm8904_reg_defaults[] = {
         { 14,  0x0000 },     /* R14  - Power Management 2 */
         { 15,  0x0000 },     /* R15  - Power Management 3 */
         { 18,  0x0000 },     /* R18  - Power Management 6 */
-        { 19,  0x945E },     /* R20  - Clock Rates 0 */
+        { 20,  0x945E },     /* R20  - Clock Rates 0 */
         { 21,  0x0C05 },     /* R21  - Clock Rates 1 */
         { 22,  0x0006 },     /* R22  - Clock Rates 2 */
         { 24,  0x0050 },     /* R24  - Audio Interface 0 */
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index fb21b17f17f5..199408ec4261 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -94,7 +94,7 @@ static int __devinit imx_sgtl5000_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "audmux internal port setup failed\n");
                 return ret;
         }
-        imx_audmux_v2_configure_port(ext_port,
+        ret = imx_audmux_v2_configure_port(ext_port,
                         IMX_AUDMUX_V2_PTCR_SYN,
                         IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
         if (ret) {
diff --git a/sound/soc/omap/am3517evm.c b/sound/soc/omap/am3517evm.c
index 009533ab8d18..df65f98211ec 100644
--- a/sound/soc/omap/am3517evm.c
+++ b/sound/soc/omap/am3517evm.c
@@ -59,7 +59,7 @@ static int am3517evm_hw_params(struct snd_pcm_substream *substream,
                 return ret;
         }
 
-        snd_soc_dai_set_sysclk(cpu_dai, OMAP_MCBSP_FSR_SRC_FSX, 0,
+        ret = snd_soc_dai_set_sysclk(cpu_dai, OMAP_MCBSP_FSR_SRC_FSX, 0,
                                 SND_SOC_CLOCK_IN);
         if (ret < 0) {
                 printk(KERN_ERR "can't set CPU system clock OMAP_MCBSP_FSR_SRC_FSX\n");
diff --git a/sound/soc/samsung/dma.c b/sound/soc/samsung/dma.c
index f3ebc38c10fe..b70964ea448c 100644
--- a/sound/soc/samsung/dma.c
+++ b/sound/soc/samsung/dma.c
@@ -34,9 +34,7 @@ static const struct snd_pcm_hardware dma_hardware = {
         .info                   = SNDRV_PCM_INFO_INTERLEAVED |
                                     SNDRV_PCM_INFO_BLOCK_TRANSFER |
                                     SNDRV_PCM_INFO_MMAP |
-                                    SNDRV_PCM_INFO_MMAP_VALID |
-                                    SNDRV_PCM_INFO_PAUSE |
-                                    SNDRV_PCM_INFO_RESUME,
+                                    SNDRV_PCM_INFO_MMAP_VALID,
         .formats                = SNDRV_PCM_FMTBIT_S16_LE |
                                     SNDRV_PCM_FMTBIT_U16_LE |
                                     SNDRV_PCM_FMTBIT_U8 |
@@ -248,15 +246,11 @@ static int dma_trigger(struct snd_pcm_substream *substream, int cmd)
 
         switch (cmd) {
         case SNDRV_PCM_TRIGGER_START:
-        case SNDRV_PCM_TRIGGER_RESUME:
-        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
                 prtd->state |= ST_RUNNING;
                 prtd->params->ops->trigger(prtd->params->ch);
                 break;
 
         case SNDRV_PCM_TRIGGER_STOP:
-        case SNDRV_PCM_TRIGGER_SUSPEND:
-        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                 prtd->state &= ~ST_RUNNING;
                 prtd->params->ops->stop(prtd->params->ch);
                 break;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index dd7c49fafd75..f90139b5f50d 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -291,8 +291,11 @@ static int snd_soc_dapm_set_bias_level(struct snd_soc_dapm_context *dapm,
                 if (dapm->codec->driver->set_bias_level)
                         ret = dapm->codec->driver->set_bias_level(dapm->codec,
                                                                   level);
-        } else
+                else
+                        dapm->bias_level = level;
+        } else if (!card || dapm != &card->dapm) {
                 dapm->bias_level = level;
+        }
 
         if (ret != 0)
                 goto out;
diff --git a/sound/soc/spear/spear_pcm.c b/sound/soc/spear/spear_pcm.c
index 97c2cac8e92c..8c7f23729446 100644
--- a/sound/soc/spear/spear_pcm.c
+++ b/sound/soc/spear/spear_pcm.c
@@ -138,7 +138,7 @@ static void spear_pcm_free(struct snd_pcm *pcm)
                         continue;
 
                 buf = &substream->dma_buffer;
-                if (!buf && !buf->area)
+                if (!buf || !buf->area)
                         continue;
 
                 dma_free_writecombine(pcm->card->dev, buf->bytes,
diff --git a/sound/soc/tegra/tegra_alc5632.c b/sound/soc/tegra/tegra_alc5632.c
index e463529b38bb..76cb1b363b71 100644
--- a/sound/soc/tegra/tegra_alc5632.c
+++ b/sound/soc/tegra/tegra_alc5632.c
@@ -89,7 +89,6 @@ static struct snd_soc_jack_gpio tegra_alc5632_hp_jack_gpio = {
         .name = "Headset detection",
         .report = SND_JACK_HEADSET,
         .debounce_time = 150,
-        .invert = 1,
 };
 
 static const struct snd_soc_dapm_widget tegra_alc5632_dapm_widgets[] = {
diff --git a/sound/soc/tegra/tegra_pcm.c b/sound/soc/tegra/tegra_pcm.c
index 5658bcec1931..8d6900c1ee47 100644
--- a/sound/soc/tegra/tegra_pcm.c
+++ b/sound/soc/tegra/tegra_pcm.c
@@ -334,11 +334,11 @@ static int tegra_pcm_hw_params(struct snd_pcm_substream *substream,
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 slave_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
                 slave_config.dst_addr = dmap->addr;
-                slave_config.src_maxburst = 0;
+                slave_config.dst_maxburst = 4;
         } else {
                 slave_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
                 slave_config.src_addr = dmap->addr;
-                slave_config.dst_maxburst = 0;
+                slave_config.src_maxburst = 4;
         }
         slave_config.slave_id = dmap->req_sel;
 
diff --git a/sound/soc/ux500/ux500_msp_i2s.c b/sound/soc/ux500/ux500_msp_i2s.c
index 5c472f335a64..eb85113d472a 100644
--- a/sound/soc/ux500/ux500_msp_i2s.c
+++ b/sound/soc/ux500/ux500_msp_i2s.c
@@ -663,7 +663,6 @@ int ux500_msp_i2s_init_msp(struct platform_device *pdev,
                         struct ux500_msp **msp_p,
                         struct msp_i2s_platform_data *platform_data)
 {
-        int ret = 0;
         struct resource *res = NULL;
         struct i2s_controller *i2s_cont;
         struct ux500_msp *msp;
@@ -685,15 +684,14 @@ int ux500_msp_i2s_init_msp(struct platform_device *pdev,
         if (res == NULL) {
                 dev_err(&pdev->dev, "%s: ERROR: Unable to get resource!\n",
                         __func__);
-                ret = -ENOMEM;
-                goto err_res;
+                return -ENOMEM;
         }
 
-        msp->registers = ioremap(res->start, (res->end - res->start + 1));
+        msp->registers = devm_ioremap(&pdev->dev, res->start,
+                                      resource_size(res));
         if (msp->registers == NULL) {
                 dev_err(&pdev->dev, "%s: ERROR: ioremap failed!\n", __func__);
-                ret = -ENOMEM;
-                goto err_res;
+                return -ENOMEM;
         }
 
         msp->msp_state = MSP_STATE_IDLE;
@@ -705,7 +703,7 @@ int ux500_msp_i2s_init_msp(struct platform_device *pdev,
                 dev_err(&pdev->dev,
                         "%s: ERROR: Failed to allocate I2S-controller!\n",
                         __func__);
-                goto err_i2s_cont;
+                return -ENOMEM;
         }
         i2s_cont->dev.parent = &pdev->dev;
         i2s_cont->data = (void *)msp;
@@ -716,14 +714,6 @@ int ux500_msp_i2s_init_msp(struct platform_device *pdev,
         msp->i2s_cont = i2s_cont;
 
         return 0;
-
-err_i2s_cont:
-        iounmap(msp->registers);
-
-err_res:
-        devm_kfree(&pdev->dev, msp);
-
-        return ret;
 }
 
 void ux500_msp_i2s_cleanup_msp(struct platform_device *pdev,
@@ -732,11 +722,6 @@ void ux500_msp_i2s_cleanup_msp(struct platform_device *pdev,
         dev_dbg(msp->dev, "%s: Enter (id = %d).\n", __func__, msp->id);
 
         device_unregister(&msp->i2s_cont->dev);
-        devm_kfree(&pdev->dev, msp->i2s_cont);
-
-        iounmap(msp->registers);
-
-        devm_kfree(&pdev->dev, msp);
 }
 
 MODULE_LICENSE("GPL v2");
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index d6e2bb49c59c..060dccb9ec75 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -197,7 +197,13 @@ static void prepare_outbound_urb(struct snd_usb_endpoint *ep,
                         /* no data provider, so send silence */
                         unsigned int offs = 0;
                         for (i = 0; i < ctx->packets; ++i) {
-                                int counts = ctx->packet_size[i];
+                                int counts;
+
+                                if (ctx->packet_size[i])
+                                        counts = ctx->packet_size[i];
+                                else
+                                        counts = snd_usb_endpoint_next_packet_size(ep);
+
                                 urb->iso_frame_desc[i].offset = offs * ep->stride;
                                 urb->iso_frame_desc[i].length = counts * ep->stride;
                                 offs += counts;
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index fd5e982fc98c..f782ce19bf5a 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1140,6 +1140,12 @@ static void retire_playback_urb(struct snd_usb_substream *subs,
         int processed = urb->transfer_buffer_length / stride;
         int est_delay;
 
+        /* ignore the delay accounting when procssed=0 is given, i.e.
+         * silent payloads are procssed before handling the actual data
+         */
+        if (!processed)
+                return;
+
         spin_lock_irqsave(&subs->lock, flags);
         est_delay = snd_usb_pcm_delay(subs, runtime->rate);
         /* update delay with exact number of samples played */
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 3bdb407f9cd9..eb340571e7d6 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -58,7 +58,7 @@ struct callchain_list {
 /*
  * A callchain cursor is a single linked list that
  * let one feed a callchain progressively.
- * It keeps persitent allocated entries to minimize
+ * It keeps persistent allocated entries to minimize
  * allocations.
  */
 struct callchain_cursor_node {
diff --git a/tools/perf/util/parse-events-test.c b/tools/perf/util/parse-events-test.c
index d7244e553670..28c18d1d52c3 100644
--- a/tools/perf/util/parse-events-test.c
+++ b/tools/perf/util/parse-events-test.c
@@ -1016,7 +1016,7 @@ static int test_pmu(void)
 
         ret = stat(path, &st);
         if (ret)
-                pr_debug("ommiting PMU cpu tests\n");
+                pr_debug("omitting PMU cpu tests\n");
         return !ret;
 }
 
diff --git a/tools/perf/util/python-ext-sources b/tools/perf/util/python-ext-sources
index 213362850abd..c40c2d33199e 100644
--- a/tools/perf/util/python-ext-sources
+++ b/tools/perf/util/python-ext-sources
@@ -1,5 +1,5 @@
 #
-# List of files needed by perf python extention
+# List of files needed by perf python extension
 #
 # Each source file must be placed on its own line so that it can be
 # processed by Makefile and util/setup.py accordingly.
diff --git a/tools/testing/ktest/examples/include/defaults.conf b/tools/testing/ktest/examples/include/defaults.conf
index 323a552ce642..63a1a83f4f0b 100644
--- a/tools/testing/ktest/examples/include/defaults.conf
+++ b/tools/testing/ktest/examples/include/defaults.conf
@@ -33,7 +33,7 @@ DEFAULTS
 THIS_DIR := ${PWD}
 
 
-# to orginize your configs, having each machine save their configs
+# to organize your configs, having each machine save their configs
 # into a separate directly is useful.
 CONFIG_DIR := ${THIS_DIR}/configs/${MACHINE}
 
diff --git a/tools/testing/ktest/examples/include/tests.conf b/tools/testing/ktest/examples/include/tests.conf
index 4fdb811bd810..60cedb1a1154 100644
--- a/tools/testing/ktest/examples/include/tests.conf
+++ b/tools/testing/ktest/examples/include/tests.conf
@@ -47,7 +47,7 @@ BUILD_NOCLEAN = 1
 # Build, install, boot and test with a randconfg 10 times.
 # It is important that you have set MIN_CONFIG in the config
 # that includes this file otherwise it is likely that the
-# randconfig will not have the neccessary configs needed to
+# randconfig will not have the necessary configs needed to
 # boot your box. This version of the test requires a min
 # config that has enough to make sure the target has network
 # working.
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 52b7959cd513..c05bcd293d8c 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -840,7 +840,9 @@ sub __read_config {
 
                 if ($rest =~ /\sIF\s+(.*)/) {
                     # May be a ELSE IF section.
-                    if (!process_if($name, $1)) {
+                    if (process_if($name, $1)) {
+                        $if_set = 1;
+                    } else {
                         $skip = 1;
                     }
                     $rest = "";
diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests
index 8b40bd5e5cc2..4c53cae6c273 100644
--- a/tools/testing/selftests/vm/run_vmtests
+++ b/tools/testing/selftests/vm/run_vmtests
@@ -36,7 +36,7 @@ mkdir $mnt
 mount -t hugetlbfs none $mnt
 
 echo "--------------------"
-echo "runing hugepage-mmap"
+echo "running hugepage-mmap"
 echo "--------------------"
 ./hugepage-mmap
 if [ $? -ne 0 ]; then
@@ -50,7 +50,7 @@ shmall=`cat /proc/sys/kernel/shmall`
 echo 268435456 > /proc/sys/kernel/shmmax
 echo 4194304 > /proc/sys/kernel/shmall
 echo "--------------------"
-echo "runing hugepage-shm"
+echo "running hugepage-shm"
 echo "--------------------"
 ./hugepage-shm
 if [ $? -ne 0 ]; then
@@ -62,7 +62,7 @@ echo $shmmax > /proc/sys/kernel/shmmax
 echo $shmall > /proc/sys/kernel/shmall
 
 echo "--------------------"
-echo "runing map_hugetlb"
+echo "running map_hugetlb"
 echo "--------------------"
 ./map_hugetlb
 if [ $? -ne 0 ]; then