277 files changed, 2768 insertions, 1198 deletions

diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 1f89424c36a6..65bbd2622396 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -272,6 +272,8 @@ printk-formats.txt
         - how to get printk format specifiers right
 prio_tree.txt
         - info on radix-priority-search-tree use for indexing vmas.
+ramoops.txt
+        - documentation of the ramoops oops/panic logging module.
 rbtree.txt
         - info on what red-black trees are and what they are for.
 robust-futex-ABI.txt
diff --git a/Documentation/SubmittingDrivers b/Documentation/SubmittingDrivers
index 319baa8b60dd..36d16bbf72c6 100644
--- a/Documentation/SubmittingDrivers
+++ b/Documentation/SubmittingDrivers
@@ -130,7 +130,7 @@ Linux kernel master tree:
         ftp.??.kernel.org:/pub/linux/kernel/...
         ?? == your country code, such as "us", "uk", "fr", etc.
 
-        http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git
+        http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git
 
 Linux kernel mailing list:
         linux-kernel@vger.kernel.org
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 569f3532e138..4468ce24427c 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -303,7 +303,7 @@ patches that are being emailed around.
 
 The sign-off is a simple line at the end of the explanation for the
 patch, which certifies that you wrote it or otherwise have the right to
-pass it on as a open-source patch.  The rules are pretty simple: if you
+pass it on as an open-source patch.  The rules are pretty simple: if you
 can certify the below:
 
         Developer's Certificate of Origin 1.1
diff --git a/Documentation/email-clients.txt b/Documentation/email-clients.txt
index a0b58e29f911..860c29a472ad 100644
--- a/Documentation/email-clients.txt
+++ b/Documentation/email-clients.txt
@@ -199,18 +199,16 @@ to coerce it into behaving.
 
 To beat some sense out of the internal editor, do this:
 
-- Under account settings, composition and addressing, uncheck "Compose
-  messages in HTML format".
-
 - Edit your Thunderbird config settings so that it won't use format=flowed.
   Go to "edit->preferences->advanced->config editor" to bring up the
   thunderbird's registry editor, and set "mailnews.send_plaintext_flowed" to
   "false".
 
-- Enable "preformat" mode: Shft-click on the Write icon to bring up the HTML
-  composer, select "Preformat" from the drop-down box just under the subject
-  line, then close the message without saving.  (This setting also applies to
-  the text composer, but the only control for it is in the HTML composer.)
+- Disable HTML Format: Set "mail.identity.id1.compose_html" to "false".
+
+- Enable "preformat" mode: Set "editor.quotesPreformatted" to "true".
+
+- Enable UTF8: Set "prefs.converted-to-utf8" to "true".
 
 - Install the "toggle wordwrap" extension.  Download the file from:
     https://addons.mozilla.org/thunderbird/addon/2351/
diff --git a/Documentation/filesystems/befs.txt b/Documentation/filesystems/befs.txt
index 6e49c363938e..da45e6c842b8 100644
--- a/Documentation/filesystems/befs.txt
+++ b/Documentation/filesystems/befs.txt
@@ -27,7 +27,7 @@ His original code can still be found at:
 Does anyone know of a more current email address for Makoto? He doesn't
 respond to the address given above...
 
-Current maintainer: Sergey S. Kostyliov <rathamahata@php4.ru>
+This filesystem doesn't have a maintainer.
 
 WHAT IS THIS DRIVER?
 ==================
diff --git a/Documentation/kernel-docs.txt b/Documentation/kernel-docs.txt
index 9a8674629a07..0e0734b509d8 100644
--- a/Documentation/kernel-docs.txt
+++ b/Documentation/kernel-docs.txt
@@ -620,17 +620,6 @@
        (including this document itself) have been moved there, and might
        be more up to date than the web version.
 
-     * Name: "Linux Source Driver"
-       URL: http://lsd.linux.cz
-       Keywords: Browsing source code.
-       Description: "Linux Source Driver (LSD) is an application, which
-       can make browsing source codes of Linux kernel easier than you can
-       imagine. You can select between multiple versions of kernel (e.g.
-       0.01, 1.0.0, 2.0.33, 2.0.34pre13, 2.0.0, 2.1.101 etc.). With LSD
-       you can search Linux kernel (fulltext, macros, types, functions
-       and variables) and LSD can generate patches for you on the fly
-       (files, directories or kernel)".
-
      * Name: "Linux Kernel Source Reference"
        Author: Thomas Graichen.
        URL: http://marc.info/?l=linux-kernel&m=96446640102205&w=4
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e279b7242912..6ca1f5cb71e0 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -40,6 +40,7 @@ parameter is applicable:
         ALSA    ALSA sound support is enabled.
         APIC    APIC support is enabled.
         APM     Advanced Power Management support is enabled.
+        ARM     ARM architecture is enabled.
         AVR32   AVR32 architecture is enabled.
         AX25    Appropriate AX.25 support is enabled.
         BLACKFIN Blackfin architecture is enabled.
@@ -49,6 +50,7 @@ parameter is applicable:
         EFI     EFI Partitioning (GPT) is enabled
         EIDE    EIDE/ATAPI support is enabled.
         FB      The frame buffer device is enabled.
+        FTRACE  Function tracing enabled.
         GCOV    GCOV profiling is enabled.
         HW      Appropriate hardware is enabled.
         IA-64   IA-64 architecture is enabled.
@@ -69,6 +71,7 @@ parameter is applicable:
                         Documentation/m68k/kernel-options.txt.
         MCA     MCA bus support is enabled.
         MDA     MDA console support is enabled.
+        MIPS    MIPS architecture is enabled.
         MOUSE   Appropriate mouse support is enabled.
         MSI     Message Signaled Interrupts (PCI).
         MTD     MTD (Memory Technology Device) support is enabled.
@@ -100,7 +103,6 @@ parameter is applicable:
         SPARC   Sparc architecture is enabled.
         SWSUSP  Software suspend (hibernation) is enabled.
         SUSPEND System suspend states are enabled.
-        FTRACE  Function tracing enabled.
         TPM     TPM drivers are enabled.
         TS      Appropriate touchscreen support is enabled.
         UMS     USB Mass Storage support is enabled.
@@ -115,7 +117,7 @@ parameter is applicable:
         X86-64  X86-64 architecture is enabled.
                         More X86-64 boot options can be found in
                         Documentation/x86/x86_64/boot-options.txt .
-        X86     Either 32bit or 64bit x86 (same as X86-32+X86-64)
+        X86     Either 32-bit or 64-bit x86 (same as X86-32+X86-64)
         XEN     Xen support is enabled
 
 In addition, the following text indicates that the option:
@@ -376,7 +378,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         atkbd.softrepeat= [HW]
                         Use software keyboard repeat
 
-        autotest        [IA64]
+        autotest        [IA-64]
 
         baycom_epp=     [HW,AX25]
                         Format: <io>,<mode>
@@ -681,8 +683,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                 uart[8250],mmio32,<addr>[,options]
                         Start an early, polled-mode console on the 8250/16550
                         UART at the specified I/O port or MMIO address.
-                        MMIO inter-register address stride is either 8bit (mmio)
-                        or 32bit (mmio32).
+                        MMIO inter-register address stride is either 8-bit
+                        (mmio) or 32-bit (mmio32).
                         The options are the same as for ttyS, above.
 
         earlyprintk=    [X86,SH,BLACKFIN]
@@ -725,7 +727,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         See Documentation/block/as-iosched.txt and
                         Documentation/block/deadline-iosched.txt for details.
 
-        elfcorehdr=     [IA64,PPC,SH,X86]
+        elfcorehdr=     [IA-64,PPC,SH,X86]
                         Specifies physical address of start of kernel core
                         image elf header. Generally kexec loader will
                         pass this option to capture kernel.
@@ -791,7 +793,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         tracer at boot up. function-list is a comma separated
                         list of functions. This list can be changed at run
                         time by the set_ftrace_filter file in the debugfs
-                        tracing directory. 
+                        tracing directory.
 
         ftrace_notrace=[function-list]
                         [FTRACE] Do not trace the functions specified in
@@ -829,7 +831,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         hashdist=       [KNL,NUMA] Large hashes allocated during boot
                         are distributed across NUMA nodes.  Defaults on
-                        for 64bit NUMA, off otherwise.
+                        for 64-bit NUMA, off otherwise.
                         Format: 0 | 1 (for off | on)
 
         hcl=            [IA-64] SGI's Hardware Graph compatibility layer
@@ -998,10 +1000,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         DMA.
                 forcedac [x86_64]
                         With this option iommu will not optimize to look
-                        for io virtual address below 32 bit forcing dual
+                        for io virtual address below 32-bit forcing dual
                         address cycle on pci bus for cards supporting greater
-                        than 32 bit addressing. The default is to look
-                        for translation below 32 bit and if not available
+                        than 32-bit addressing. The default is to look
+                        for translation below 32-bit and if not available
                         then look in the higher range.
                 strict [Default Off]
                         With this option on every unmap_single operation will
@@ -1017,7 +1019,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         off     disable Interrupt Remapping
                         nosid   disable Source ID checking
 
-        inttest=        [IA64]
+        inttest=        [IA-64]
 
         iomem=          Disable strict checking of access to MMIO memory
                 strict  regions from userspace.
@@ -1034,7 +1036,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                 nomerge
                 forcesac
                 soft
-                pt      [x86, IA64]
+                pt      [x86, IA-64]
 
         io7=            [HW] IO7 for Marvel based alpha systems
                         See comment before marvel_specify_io7 in
@@ -1165,7 +1167,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         kvm-amd.npt=    [KVM,AMD] Disable nested paging (virtualized MMU)
                         for all guests.
-                        Default is 1 (enabled) if in 64bit or 32bit-PAE mode
+                        Default is 1 (enabled) if in 64-bit or 32-bit PAE mode.
 
         kvm-intel.ept=  [KVM,Intel] Disable extended page tables
                         (virtualized MMU) support on capable Intel chips.
@@ -1202,10 +1204,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         libata.dma=0      Disable all PATA and SATA DMA
                         libata.dma=1      PATA and SATA Disk DMA only
                         libata.dma=2      ATAPI (CDROM) DMA only
-                        libata.dma=4      Compact Flash DMA only 
+                        libata.dma=4      Compact Flash DMA only
                         Combinations also work, so libata.dma=3 enables DMA
                         for disks and CDROMs, but not CFs.
-        
+
         libata.ignore_hpa=      [LIBATA] Ignore HPA limit
                         libata.ignore_hpa=0       keep BIOS limits (default)
                         libata.ignore_hpa=1       ignore limits, using full disk
@@ -1331,7 +1333,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         ltpc=           [NET]
                         Format: <io>,<irq>,<dma>
 
-        machvec=        [IA64] Force the use of a particular machine-vector
+        machvec=        [IA-64] Force the use of a particular machine-vector
                         (machvec) in a generic kernel.
                         Example: machvec=hpzx1_swiotlb
 
@@ -1734,7 +1736,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         nointroute      [IA-64]
 
-        nojitter        [IA64] Disables jitter checking for ITC timers.
+        nojitter        [IA-64] Disables jitter checking for ITC timers.
 
         no-kvmclock     [X86,KVM] Disable paravirtualized KVM clock driver
 
@@ -1800,7 +1802,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         nox2apic        [X86-64,APIC] Do not enable x2APIC mode.
 
-        nptcg=          [IA64] Override max number of concurrent global TLB
+        nptcg=          [IA-64] Override max number of concurrent global TLB
                         purges which is reported from either PAL_VM_SUMMARY or
                         SAL PALO.
 
@@ -2077,7 +2079,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         Format: { parport<nr> | timid | 0 }
                         See also Documentation/parport.txt.
 
-        pmtmr=          [X86] Manual setup of pmtmr I/O Port. 
+        pmtmr=          [X86] Manual setup of pmtmr I/O Port.
                         Override pmtimer IOPort with a hex value.
                         e.g. pmtmr=0x508
 
@@ -2635,6 +2637,16 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                                         medium is write-protected).
                         Example: quirks=0419:aaf5:rl,0421:0433:rc
 
+        user_debug=     [KNL,ARM]
+                        Format: <int>
+                        See arch/arm/Kconfig.debug help text.
+                                 1 - undefined instruction events
+                                 2 - system calls
+                                 4 - invalid data aborts
+                                 8 - SIGSEGV faults
+                                16 - SIGBUS faults
+                        Example: user_debug=31
+
         userpte=
                         [X86] Flags controlling user PTE allocations.
 
@@ -2680,6 +2692,27 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         vmpoff=         [KNL,S390] Perform z/VM CP command after power off.
                         Format: <command>
 
+        vsyscall=       [X86-64]
+                        Controls the behavior of vsyscalls (i.e. calls to
+                        fixed addresses of 0xffffffffff600x00 from legacy
+                        code).  Most statically-linked binaries and older
+                        versions of glibc use these calls.  Because these
+                        functions are at fixed addresses, they make nice
+                        targets for exploits that can control RIP.
+
+                        emulate     [default] Vsyscalls turn into traps and are
+                                    emulated reasonably safely.
+
+                        native      Vsyscalls are native syscall instructions.
+                                    This is a little bit faster than trapping
+                                    and makes a few dynamic recompilers work
+                                    better than they would in emulation mode.
+                                    It also makes exploits much easier to write.
+
+                        none        Vsyscalls don't work at all.  This makes
+                                    them quite hard to use for exploits but
+                                    might break your system.
+
         vt.cur_default= [VT] Default cursor shape.
                         Format: 0xCCBBAA, where AA, BB, and CC are the same as
                         the parameters of the <Esc>[?A;B;Cc escape sequence;
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 5dd960d75174..91df678fb7f8 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -238,6 +238,18 @@ ad_select
 
         This option was added in bonding version 3.4.0.
 
+all_slaves_active
+
+        Specifies that duplicate frames (received on inactive ports) should be
+        dropped (0) or delivered (1).
+
+        Normally, bonding will drop duplicate frames (received on inactive
+        ports), which is desirable for most users. But there are some times
+        it is nice to allow duplicate frames to be delivered.
+
+        The default value is 0 (drop duplicate frames received on inactive
+        ports).
+
 arp_interval
 
         Specifies the ARP link monitoring frequency in milliseconds.
@@ -433,6 +445,23 @@ miimon
         determined.  See the High Availability section for additional
         information.  The default value is 0.
 
+min_links
+
+        Specifies the minimum number of links that must be active before
+        asserting carrier. It is similar to the Cisco EtherChannel min-links
+        feature. This allows setting the minimum number of member ports that
+        must be up (link-up state) before marking the bond device as up
+        (carrier on). This is useful for situations where higher level services
+        such as clustering want to ensure a minimum number of low bandwidth
+        links are active before switchover. This option only affect 802.3ad
+        mode.
+
+        The default value is 0. This will cause carrier to be asserted (for
+        802.3ad mode) whenever there is an active aggregator, regardless of the
+        number of available links in that aggregator. Note that, because an
+        aggregator cannot be active without at least one available link,
+        setting this option to 0 or to 1 has the exact same effect.
+
 mode
 
         Specifies one of the bonding policies. The default is
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
new file mode 100644
index 000000000000..7254b4b5910e
--- /dev/null
+++ b/Documentation/networking/scaling.txt
@@ -0,0 +1,371 @@
+Scaling in the Linux Networking Stack
+
+
+Introduction
+============
+
+This document describes a set of complementary techniques in the Linux
+networking stack to increase parallelism and improve performance for
+multi-processor systems.
+
+The following technologies are described:
+
+  RSS: Receive Side Scaling
+  RPS: Receive Packet Steering
+  RFS: Receive Flow Steering
+  Accelerated Receive Flow Steering
+  XPS: Transmit Packet Steering
+
+
+RSS: Receive Side Scaling
+=========================
+
+Contemporary NICs support multiple receive and transmit descriptor queues
+(multi-queue). On reception, a NIC can send different packets to different
+queues to distribute processing among CPUs. The NIC distributes packets by
+applying a filter to each packet that assigns it to one of a small number
+of logical flows. Packets for each flow are steered to a separate receive
+queue, which in turn can be processed by separate CPUs. This mechanism is
+generally known as “Receive-side Scaling” (RSS). The goal of RSS and
+the other scaling techniques to increase performance uniformly.
+Multi-queue distribution can also be used for traffic prioritization, but
+that is not the focus of these techniques.
+
+The filter used in RSS is typically a hash function over the network
+and/or transport layer headers-- for example, a 4-tuple hash over
+IP addresses and TCP ports of a packet. The most common hardware
+implementation of RSS uses a 128-entry indirection table where each entry
+stores a queue number. The receive queue for a packet is determined
+by masking out the low order seven bits of the computed hash for the
+packet (usually a Toeplitz hash), taking this number as a key into the
+indirection table and reading the corresponding value.
+
+Some advanced NICs allow steering packets to queues based on
+programmable filters. For example, webserver bound TCP port 80 packets
+can be directed to their own receive queue. Such “n-tuple” filters can
+be configured from ethtool (--config-ntuple).
+
+==== RSS Configuration
+
+The driver for a multi-queue capable NIC typically provides a kernel
+module parameter for specifying the number of hardware queues to
+configure. In the bnx2x driver, for instance, this parameter is called
+num_queues. A typical RSS configuration would be to have one receive queue
+for each CPU if the device supports enough queues, or otherwise at least
+one for each cache domain at a particular cache level (L1, L2, etc.).
+
+The indirection table of an RSS device, which resolves a queue by masked
+hash, is usually programmed by the driver at initialization. The
+default mapping is to distribute the queues evenly in the table, but the
+indirection table can be retrieved and modified at runtime using ethtool
+commands (--show-rxfh-indir and --set-rxfh-indir). Modifying the
+indirection table could be done to give different queues different
+relative weights.
+
+== RSS IRQ Configuration
+
+Each receive queue has a separate IRQ associated with it. The NIC triggers
+this to notify a CPU when new packets arrive on the given queue. The
+signaling path for PCIe devices uses message signaled interrupts (MSI-X),
+that can route each interrupt to a particular CPU. The active mapping
+of queues to IRQs can be determined from /proc/interrupts. By default,
+an IRQ may be handled on any CPU. Because a non-negligible part of packet
+processing takes place in receive interrupt handling, it is advantageous
+to spread receive interrupts between CPUs. To manually adjust the IRQ
+affinity of each interrupt see Documentation/IRQ-affinity. Some systems
+will be running irqbalance, a daemon that dynamically optimizes IRQ
+assignments and as a result may override any manual settings.
+
+== Suggested Configuration
+
+RSS should be enabled when latency is a concern or whenever receive
+interrupt processing forms a bottleneck. Spreading load between CPUs
+decreases queue length. For low latency networking, the optimal setting
+is to allocate as many queues as there are CPUs in the system (or the
+NIC maximum, if lower). Because the aggregate number of interrupts grows
+with each additional queue, the most efficient high-rate configuration
+is likely the one with the smallest number of receive queues where no
+CPU that processes receive interrupts reaches 100% utilization. Per-cpu
+load can be observed using the mpstat utility.
+
+
+RPS: Receive Packet Steering
+============================
+
+Receive Packet Steering (RPS) is logically a software implementation of
+RSS. Being in software, it is necessarily called later in the datapath.
+Whereas RSS selects the queue and hence CPU that will run the hardware
+interrupt handler, RPS selects the CPU to perform protocol processing
+above the interrupt handler. This is accomplished by placing the packet
+on the desired CPU’s backlog queue and waking up the CPU for processing.
+RPS has some advantages over RSS: 1) it can be used with any NIC,
+2) software filters can easily be added to hash over new protocols,
+3) it does not increase hardware device interrupt rate (although it does
+introduce inter-processor interrupts (IPIs)).
+
+RPS is called during bottom half of the receive interrupt handler, when
+a driver sends a packet up the network stack with netif_rx() or
+netif_receive_skb(). These call the get_rps_cpu() function, which
+selects the queue that should process a packet.
+
+The first step in determining the target CPU for RPS is to calculate a
+flow hash over the packet’s addresses or ports (2-tuple or 4-tuple hash
+depending on the protocol). This serves as a consistent hash of the
+associated flow of the packet. The hash is either provided by hardware
+or will be computed in the stack. Capable hardware can pass the hash in
+the receive descriptor for the packet; this would usually be the same
+hash used for RSS (e.g. computed Toeplitz hash). The hash is saved in
+skb->rx_hash and can be used elsewhere in the stack as a hash of the
+packet’s flow.
+
+Each receive hardware queue has an associated list of CPUs to which
+RPS may enqueue packets for processing. For each received packet,
+an index into the list is computed from the flow hash modulo the size
+of the list. The indexed CPU is the target for processing the packet,
+and the packet is queued to the tail of that CPU’s backlog queue. At
+the end of the bottom half routine, IPIs are sent to any CPUs for which
+packets have been queued to their backlog queue. The IPI wakes backlog
+processing on the remote CPU, and any queued packets are then processed
+up the networking stack.
+
+==== RPS Configuration
+
+RPS requires a kernel compiled with the CONFIG_RPS kconfig symbol (on
+by default for SMP). Even when compiled in, RPS remains disabled until
+explicitly configured. The list of CPUs to which RPS may forward traffic
+can be configured for each receive queue using a sysfs file entry:
+
+ /sys/class/net/<dev>/queues/rx-<n>/rps_cpus
+
+This file implements a bitmap of CPUs. RPS is disabled when it is zero
+(the default), in which case packets are processed on the interrupting
+CPU. Documentation/IRQ-affinity.txt explains how CPUs are assigned to
+the bitmap.
+
+== Suggested Configuration
+
+For a single queue device, a typical RPS configuration would be to set
+the rps_cpus to the CPUs in the same cache domain of the interrupting
+CPU. If NUMA locality is not an issue, this could also be all CPUs in
+the system. At high interrupt rate, it might be wise to exclude the
+interrupting CPU from the map since that already performs much work.
+
+For a multi-queue system, if RSS is configured so that a hardware
+receive queue is mapped to each CPU, then RPS is probably redundant
+and unnecessary. If there are fewer hardware queues than CPUs, then
+RPS might be beneficial if the rps_cpus for each queue are the ones that
+share the same cache domain as the interrupting CPU for that queue.
+
+
+RFS: Receive Flow Steering
+==========================
+
+While RPS steers packets solely based on hash, and thus generally
+provides good load distribution, it does not take into account
+application locality. This is accomplished by Receive Flow Steering
+(RFS). The goal of RFS is to increase datacache hitrate by steering
+kernel processing of packets to the CPU where the application thread
+consuming the packet is running. RFS relies on the same RPS mechanisms
+to enqueue packets onto the backlog of another CPU and to wake up that
+CPU.
+
+In RFS, packets are not forwarded directly by the value of their hash,
+but the hash is used as index into a flow lookup table. This table maps
+flows to the CPUs where those flows are being processed. The flow hash
+(see RPS section above) is used to calculate the index into this table.
+The CPU recorded in each entry is the one which last processed the flow.
+If an entry does not hold a valid CPU, then packets mapped to that entry
+are steered using plain RPS. Multiple table entries may point to the
+same CPU. Indeed, with many flows and few CPUs, it is very likely that
+a single application thread handles flows with many different flow hashes.
+
+rps_sock_table is a global flow table that contains the *desired* CPU for
+flows: the CPU that is currently processing the flow in userspace. Each
+table value is a CPU index that is updated during calls to recvmsg and
+sendmsg (specifically, inet_recvmsg(), inet_sendmsg(), inet_sendpage()
+and tcp_splice_read()).
+
+When the scheduler moves a thread to a new CPU while it has outstanding
+receive packets on the old CPU, packets may arrive out of order. To
+avoid this, RFS uses a second flow table to track outstanding packets
+for each flow: rps_dev_flow_table is a table specific to each hardware
+receive queue of each device. Each table value stores a CPU index and a
+counter. The CPU index represents the *current* CPU onto which packets
+for this flow are enqueued for further kernel processing. Ideally, kernel
+and userspace processing occur on the same CPU, and hence the CPU index
+in both tables is identical. This is likely false if the scheduler has
+recently migrated a userspace thread while the kernel still has packets
+enqueued for kernel processing on the old CPU.
+
+The counter in rps_dev_flow_table values records the length of the current
+CPU's backlog when a packet in this flow was last enqueued. Each backlog
+queue has a head counter that is incremented on dequeue. A tail counter
+is computed as head counter + queue length. In other words, the counter
+in rps_dev_flow_table[i] records the last element in flow i that has
+been enqueued onto the currently designated CPU for flow i (of course,
+entry i is actually selected by hash and multiple flows may hash to the
+same entry i).
+
+And now the trick for avoiding out of order packets: when selecting the
+CPU for packet processing (from get_rps_cpu()) the rps_sock_flow table
+and the rps_dev_flow table of the queue that the packet was received on
+are compared. If the desired CPU for the flow (found in the
+rps_sock_flow table) matches the current CPU (found in the rps_dev_flow
+table), the packet is enqueued onto that CPU’s backlog. If they differ,
+the current CPU is updated to match the desired CPU if one of the
+following is true:
+
+- The current CPU's queue head counter >= the recorded tail counter
+  value in rps_dev_flow[i]
+- The current CPU is unset (equal to NR_CPUS)
+- The current CPU is offline
+
+After this check, the packet is sent to the (possibly updated) current
+CPU. These rules aim to ensure that a flow only moves to a new CPU when
+there are no packets outstanding on the old CPU, as the outstanding
+packets could arrive later than those about to be processed on the new
+CPU.
+
+==== RFS Configuration
+
+RFS is only available if the kconfig symbol CONFIG_RFS is enabled (on
+by default for SMP). The functionality remains disabled until explicitly
+configured. The number of entries in the global flow table is set through:
+
+ /proc/sys/net/core/rps_sock_flow_entries
+
+The number of entries in the per-queue flow table are set through:
+
+ /sys/class/net/<dev>/queues/tx-<n>/rps_flow_cnt
+
+== Suggested Configuration
+
+Both of these need to be set before RFS is enabled for a receive queue.
+Values for both are rounded up to the nearest power of two. The
+suggested flow count depends on the expected number of active connections
+at any given time, which may be significantly less than the number of open
+connections. We have found that a value of 32768 for rps_sock_flow_entries
+works fairly well on a moderately loaded server.
+
+For a single queue device, the rps_flow_cnt value for the single queue
+would normally be configured to the same value as rps_sock_flow_entries.
+For a multi-queue device, the rps_flow_cnt for each queue might be
+configured as rps_sock_flow_entries / N, where N is the number of
+queues. So for instance, if rps_flow_entries is set to 32768 and there
+are 16 configured receive queues, rps_flow_cnt for each queue might be
+configured as 2048.
+
+
+Accelerated RFS
+===============
+
+Accelerated RFS is to RFS what RSS is to RPS: a hardware-accelerated load
+balancing mechanism that uses soft state to steer flows based on where
+the application thread consuming the packets of each flow is running.
+Accelerated RFS should perform better than RFS since packets are sent
+directly to a CPU local to the thread consuming the data. The target CPU
+will either be the same CPU where the application runs, or at least a CPU
+which is local to the application thread’s CPU in the cache hierarchy.
+
+To enable accelerated RFS, the networking stack calls the
+ndo_rx_flow_steer driver function to communicate the desired hardware
+queue for packets matching a particular flow. The network stack
+automatically calls this function every time a flow entry in
+rps_dev_flow_table is updated. The driver in turn uses a device specific
+method to program the NIC to steer the packets.
+
+The hardware queue for a flow is derived from the CPU recorded in
+rps_dev_flow_table. The stack consults a CPU to hardware queue map which
+is maintained by the NIC driver. This is an auto-generated reverse map of
+the IRQ affinity table shown by /proc/interrupts. Drivers can use
+functions in the cpu_rmap (“CPU affinity reverse map”) kernel library
+to populate the map. For each CPU, the corresponding queue in the map is
+set to be one whose processing CPU is closest in cache locality.
+
+==== Accelerated RFS Configuration
+
+Accelerated RFS is only available if the kernel is compiled with
+CONFIG_RFS_ACCEL and support is provided by the NIC device and driver.
+It also requires that ntuple filtering is enabled via ethtool. The map
+of CPU to queues is automatically deduced from the IRQ affinities
+configured for each receive queue by the driver, so no additional
+configuration should be necessary.
+
+== Suggested Configuration
+
+This technique should be enabled whenever one wants to use RFS and the
+NIC supports hardware acceleration.
+
+XPS: Transmit Packet Steering
+=============================
+
+Transmit Packet Steering is a mechanism for intelligently selecting
+which transmit queue to use when transmitting a packet on a multi-queue
+device. To accomplish this, a mapping from CPU to hardware queue(s) is
+recorded. The goal of this mapping is usually to assign queues
+exclusively to a subset of CPUs, where the transmit completions for
+these queues are processed on a CPU within this set. This choice
+provides two benefits. First, contention on the device queue lock is
+significantly reduced since fewer CPUs contend for the same queue
+(contention can be eliminated completely if each CPU has its own
+transmit queue). Secondly, cache miss rate on transmit completion is
+reduced, in particular for data cache lines that hold the sk_buff
+structures.
+
+XPS is configured per transmit queue by setting a bitmap of CPUs that
+may use that queue to transmit. The reverse mapping, from CPUs to
+transmit queues, is computed and maintained for each network device.
+When transmitting the first packet in a flow, the function
+get_xps_queue() is called to select a queue. This function uses the ID
+of the running CPU as a key into the CPU-to-queue lookup table. If the
+ID matches a single queue, that is used for transmission. If multiple
+queues match, one is selected by using the flow hash to compute an index
+into the set.
+
+The queue chosen for transmitting a particular flow is saved in the
+corresponding socket structure for the flow (e.g. a TCP connection).
+This transmit queue is used for subsequent packets sent on the flow to
+prevent out of order (ooo) packets. The choice also amortizes the cost
+of calling get_xps_queues() over all packets in the connection. To avoid
+ooo packets, the queue for a flow can subsequently only be changed if
+skb->ooo_okay is set for a packet in the flow. This flag indicates that
+there are no outstanding packets in the flow, so the transmit queue can
+change without the risk of generating out of order packets. The
+transport layer is responsible for setting ooo_okay appropriately. TCP,
+for instance, sets the flag when all data for a connection has been
+acknowledged.
+
+==== XPS Configuration
+
+XPS is only available if the kconfig symbol CONFIG_XPS is enabled (on by
+default for SMP). The functionality remains disabled until explicitly
+configured. To enable XPS, the bitmap of CPUs that may use a transmit
+queue is configured using the sysfs file entry:
+
+/sys/class/net/<dev>/queues/tx-<n>/xps_cpus
+
+== Suggested Configuration
+
+For a network device with a single transmission queue, XPS configuration
+has no effect, since there is no choice in this case. In a multi-queue
+system, XPS is preferably configured so that each CPU maps onto one queue.
+If there are as many queues as there are CPUs in the system, then each
+queue can also map onto one CPU, resulting in exclusive pairings that
+experience no contention. If there are fewer queues than CPUs, then the
+best CPUs to share a given queue are probably those that share the cache
+with the CPU that processes transmit completions for that queue
+(transmit interrupts).
+
+
+Further Information
+===================
+RPS and RFS were introduced in kernel 2.6.35. XPS was incorporated into
+2.6.38. Original patches were submitted by Tom Herbert
+(therbert@google.com)
+
+Accelerated RFS was introduced in 2.6.35. Original patches were
+submitted by Ben Hutchings (bhutchings@solarflare.com)
+
+Authors:
+Tom Herbert (therbert@google.com)
+Willem de Bruijn (willemb@google.com)
diff --git a/Documentation/ramoops.txt b/Documentation/ramoops.txt
new file mode 100644
index 000000000000..8fb1ba7fe7bf
--- /dev/null
+++ b/Documentation/ramoops.txt
@@ -0,0 +1,76 @@
+Ramoops oops/panic logger
+=========================
+
+Sergiu Iordache <sergiu@chromium.org>
+
+Updated: 8 August 2011
+
+0. Introduction
+
+Ramoops is an oops/panic logger that writes its logs to RAM before the system
+crashes. It works by logging oopses and panics in a circular buffer. Ramoops
+needs a system with persistent RAM so that the content of that area can
+survive after a restart.
+
+1. Ramoops concepts
+
+Ramoops uses a predefined memory area to store the dump. The start and size of
+the memory area are set using two variables:
+  * "mem_address" for the start
+  * "mem_size" for the size. The memory size will be rounded down to a
+  power of two.
+
+The memory area is divided into "record_size" chunks (also rounded down to
+power of two) and each oops/panic writes a "record_size" chunk of
+information.
+
+Dumping both oopses and panics can be done by setting 1 in the "dump_oops"
+variable while setting 0 in that variable dumps only the panics.
+
+The module uses a counter to record multiple dumps but the counter gets reset
+on restart (i.e. new dumps after the restart will overwrite old ones).
+
+2. Setting the parameters
+
+Setting the ramoops parameters can be done in 2 different manners:
+ 1. Use the module parameters (which have the names of the variables described
+ as before).
+ 2. Use a platform device and set the platform data. The parameters can then
+ be set through that platform data. An example of doing that is:
+
+#include <linux/ramoops.h>
+[...]
+
+static struct ramoops_platform_data ramoops_data = {
+        .mem_size               = <...>,
+        .mem_address            = <...>,
+        .record_size            = <...>,
+        .dump_oops              = <...>,
+};
+
+static struct platform_device ramoops_dev = {
+        .name = "ramoops",
+        .dev = {
+                .platform_data = &ramoops_data,
+        },
+};
+
+[... inside a function ...]
+int ret;
+
+ret = platform_device_register(&ramoops_dev);
+if (ret) {
+        printk(KERN_ERR "unable to register platform device\n");
+        return ret;
+}
+
+3. Dump format
+
+The data dump begins with a header, currently defined as "====" followed by a
+timestamp and a new line. The dump then continues with the actual data.
+
+4. Reading the data
+
+The dump data can be read from memory (through /dev/mem or other means).
+Getting the module parameters, which are needed in order to parse the data, can
+be done through /sys/module/ramoops/parameters/* .
diff --git a/MAINTAINERS b/MAINTAINERS
index 51d42fbc8dc4..1d445f572987 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3905,9 +3905,9 @@ F:	arch/powerpc/platforms/powermac/
 F:      drivers/macintosh/
 
 LINUX FOR POWERPC EMBEDDED MPC5XXX
-M:      Grant Likely <grant.likely@secretlab.ca>
+M:      Anatolij Gustschin <agust@denx.de>
 L:      linuxppc-dev@lists.ozlabs.org
-T:      git git://git.secretlab.ca/git/linux-2.6.git
+T:      git git://git.denx.de/linux-2.6-agust.git
 S:      Maintained
 F:      arch/powerpc/platforms/512x/
 F:      arch/powerpc/platforms/52xx/
@@ -4604,7 +4604,7 @@ F:	arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
 F:      arch/arm/mach-omap2/clockdomain44xx.c
 
 OMAP AUDIO SUPPORT
-M:      Jarkko Nikula <jhnikula@gmail.com>
+M:      Jarkko Nikula <jarkko.nikula@bitmer.com>
 L:      alsa-devel@alsa-project.org (subscribers-only)
 L:      linux-omap@vger.kernel.org
 S:      Maintained
@@ -7357,7 +7357,7 @@ THE REST
 M:      Linus Torvalds <torvalds@linux-foundation.org>
 L:      linux-kernel@vger.kernel.org
 Q:      http://patchwork.kernel.org/project/LKML/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
 S:      Buried alive in reporters
 F:      *
 F:      */
diff --git a/Makefile b/Makefile
index b4ca4e111c9a..3241d41dfbff 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
-NAME = Sneaky Weasel
+EXTRAVERSION = -rc2
+NAME = Wet Seal
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 2c71a8f3535a..5ebc5d922ea1 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -195,8 +195,7 @@ config VECTORS_BASE
           The base address of exception vectors.
 
 config ARM_PATCH_PHYS_VIRT
-        bool "Patch physical to virtual translations at runtime (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        bool "Patch physical to virtual translations at runtime"
         depends on !XIP_KERNEL && MMU
         depends on !ARCH_REALVIEW || !SPARSEMEM
         help
diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
index 7fa3bb0d2397..a08783823b32 100644
--- a/arch/arm/kernel/iwmmxt.S
+++ b/arch/arm/kernel/iwmmxt.S
@@ -195,10 +195,10 @@ ENTRY(iwmmxt_task_disable)
 
         @ enable access to CP0 and CP1
         XSC(mrc p15, 0, r4, c15, c1, 0)
-        XSC(orr r4, r4, #0xf)
+        XSC(orr r4, r4, #0x3)
         XSC(mcr p15, 0, r4, c15, c1, 0)
         PJ4(mrc p15, 0, r4, c1, c0, 2)
-        PJ4(orr r4, r4, #0x3)
+        PJ4(orr r4, r4, #0xf)
         PJ4(mcr p15, 0, r4, c1, c0, 2)
 
         mov     r0, #0                          @ nothing to load
@@ -313,7 +313,7 @@ ENTRY(iwmmxt_task_switch)
         teq     r2, r3                          @ next task owns it?
         movne   pc, lr                          @ no: leave Concan disabled
 
-1:      @ flip Conan access
+1:      @ flip Concan access
         XSC(eor r1, r1, #0x3)
         XSC(mcr p15, 0, r1, c15, c1, 0)
         PJ4(eor r1, r1, #0xf)
diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
index 05b377616fd5..cc2020c2c709 100644
--- a/arch/arm/kernel/module.c
+++ b/arch/arm/kernel/module.c
@@ -323,7 +323,11 @@ int module_finalize(const Elf32_Ehdr *hdr, const Elf_Shdr *sechdrs,
 #endif
         s = find_mod_section(hdr, sechdrs, ".alt.smp.init");
         if (s && !is_smp())
+#ifdef CONFIG_SMP_ON_UP
                 fixup_smp((void *)s->sh_addr, s->sh_size);
+#else
+                return -EINVAL;
+#endif
         return 0;
 }
 
diff --git a/arch/arm/mach-imx/clock-imx25.c b/arch/arm/mach-imx/clock-imx25.c
index 0fc7ba56d616..e63e23504fe5 100644
--- a/arch/arm/mach-imx/clock-imx25.c
+++ b/arch/arm/mach-imx/clock-imx25.c
@@ -331,6 +331,9 @@ int __init mx25_clocks_init(void)
         __raw_writel(__raw_readl(CRM_BASE+0x64) | (1 << 7) | (1 << 0),
                         CRM_BASE + 0x64);
 
+        /* Clock source for gpt is ahb_div */
+        __raw_writel(__raw_readl(CRM_BASE+0x64) & ~(1 << 5), CRM_BASE + 0x64);
+
         mxc_timer_init(&gpt_clk, MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), 54);
 
         return 0;
diff --git a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
index 6707de0ab716..6778f8193bc6 100644
--- a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
+++ b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
@@ -30,6 +30,7 @@
 #include <linux/input.h>
 #include <linux/gpio.h>
 #include <linux/delay.h>
+#include <sound/tlv320aic32x4.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
@@ -196,6 +197,17 @@ static struct pca953x_platform_data visstrim_m10_pca9555_pdata = {
         .invert = 0,
 };
 
+static struct aic32x4_pdata visstrim_m10_aic32x4_pdata = {
+        .power_cfg = AIC32X4_PWR_MICBIAS_2075_LDOIN |
+                     AIC32X4_PWR_AVDD_DVDD_WEAK_DISABLE |
+                     AIC32X4_PWR_AIC32X4_LDO_ENABLE |
+                     AIC32X4_PWR_CMMODE_LDOIN_RANGE_18_36 |
+                     AIC32X4_PWR_CMMODE_HP_LDOIN_POWERED,
+        .micpga_routing = AIC32X4_MICPGA_ROUTE_LMIC_IN2R_10K |
+                         AIC32X4_MICPGA_ROUTE_RMIC_IN1L_10K,
+        .swapdacs = false,
+};
+
 static struct i2c_board_info visstrim_m10_i2c_devices[] = {
         {
                 I2C_BOARD_INFO("pca9555", 0x20),
@@ -203,6 +215,7 @@ static struct i2c_board_info visstrim_m10_i2c_devices[] = {
         },
         {
                 I2C_BOARD_INFO("tlv320aic32x4", 0x18),
+                .platform_data = &visstrim_m10_aic32x4_pdata,
         }
 };
 
diff --git a/arch/arm/mach-imx/mach-mx31ads.c b/arch/arm/mach-imx/mach-mx31ads.c
index 0ce49478a479..29ca8907a780 100644
--- a/arch/arm/mach-imx/mach-mx31ads.c
+++ b/arch/arm/mach-imx/mach-mx31ads.c
@@ -468,7 +468,7 @@ static struct i2c_board_info __initdata mx31ads_i2c1_devices[] = {
 #endif
 };
 
-static void mxc_init_i2c(void)
+static void __init mxc_init_i2c(void)
 {
         i2c_register_board_info(1, mx31ads_i2c1_devices,
                                 ARRAY_SIZE(mx31ads_i2c1_devices));
@@ -486,7 +486,7 @@ static unsigned int ssi_pins[] = {
         MX31_PIN_STXD5__STXD5,
 };
 
-static void mxc_init_audio(void)
+static void __init mxc_init_audio(void)
 {
         imx31_add_imx_ssi(0, NULL);
         mxc_iomux_setup_multiple_pins(ssi_pins, ARRAY_SIZE(ssi_pins), "ssi");
diff --git a/arch/arm/mach-imx/mach-mx31lilly.c b/arch/arm/mach-imx/mach-mx31lilly.c
index 750368ddf0f9..126913ad106a 100644
--- a/arch/arm/mach-imx/mach-mx31lilly.c
+++ b/arch/arm/mach-imx/mach-mx31lilly.c
@@ -192,7 +192,7 @@ static struct mxc_usbh_platform_data usbh2_pdata __initdata = {
         .portsc = MXC_EHCI_MODE_ULPI | MXC_EHCI_UTMI_8BIT,
 };
 
-static void lilly1131_usb_init(void)
+static void __init lilly1131_usb_init(void)
 {
         imx31_add_mxc_ehci_hs(1, &usbh1_pdata);
 
diff --git a/arch/arm/mach-mmp/gplugd.c b/arch/arm/mach-mmp/gplugd.c
index c070c24255f4..98e25d9aaab6 100644
--- a/arch/arm/mach-mmp/gplugd.c
+++ b/arch/arm/mach-mmp/gplugd.c
@@ -16,16 +16,18 @@
 #include <mach/gpio.h>
 #include <mach/pxa168.h>
 #include <mach/mfp-pxa168.h>
-#include <mach/mfp-gplugd.h>
 
 #include "common.h"
 
 static unsigned long gplugd_pin_config[] __initdata = {
         /* UART3 */
-        GPIO8_UART3_SOUT,
-        GPIO9_UART3_SIN,
-        GPI1O_UART3_CTS,
-        GPI11_UART3_RTS,
+        GPIO8_UART3_TXD,
+        GPIO9_UART3_RXD,
+        GPIO1O_UART3_CTS,
+        GPIO11_UART3_RTS,
+
+        /* USB OTG PEN */
+        GPIO18_GPIO,
 
         /* MMC2 */
         GPIO28_MMC2_CMD,
@@ -109,6 +111,12 @@ static unsigned long gplugd_pin_config[] __initdata = {
         GPIO105_CI2C_SDA,
         GPIO106_CI2C_SCL,
 
+        /* SPI NOR Flash on SSP2 */
+        GPIO107_SSP2_RXD,
+        GPIO108_SSP2_TXD,
+        GPIO110_GPIO,     /* SPI_CSn */
+        GPIO111_SSP2_CLK,
+
         /* Select JTAG */
         GPIO109_GPIO,
 
@@ -154,7 +162,7 @@ static void __init select_disp_freq(void)
                                 "frequency\n");
         } else {
                 gpio_direction_output(35, 1);
-                gpio_free(104);
+                gpio_free(35);
         }
 
         if (unlikely(gpio_request(85, "DISP_FREQ_SEL_2"))) {
@@ -162,7 +170,7 @@ static void __init select_disp_freq(void)
                                 "frequency\n");
         } else {
                 gpio_direction_output(85, 0);
-                gpio_free(104);
+                gpio_free(85);
         }
 }
 
diff --git a/arch/arm/mach-mmp/include/mach/mfp-gplugd.h b/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
deleted file mode 100644
index b8cf38d85600..000000000000
--- a/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * linux/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
- *
- *   MFP definitions used in gplugD
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef __MACH_MFP_GPLUGD_H
-#define __MACH_MFP_GPLUGD_H
-
-#include <plat/mfp.h>
-#include <mach/mfp.h>
-
-/* UART3 */
-#define GPIO8_UART3_SOUT       MFP_CFG(GPIO8, AF2)
-#define GPIO9_UART3_SIN        MFP_CFG(GPIO9, AF2)
-#define GPI1O_UART3_CTS        MFP_CFG(GPIO10, AF2)
-#define GPI11_UART3_RTS        MFP_CFG(GPIO11, AF2)
-
-/* MMC2 */
-#define GPIO28_MMC2_CMD         MFP_CFG_DRV(GPIO28, AF6, FAST)
-#define GPIO29_MMC2_CLK         MFP_CFG_DRV(GPIO29, AF6, FAST)
-#define GPIO30_MMC2_DAT0        MFP_CFG_DRV(GPIO30, AF6, FAST)
-#define GPIO31_MMC2_DAT1        MFP_CFG_DRV(GPIO31, AF6, FAST)
-#define GPIO32_MMC2_DAT2        MFP_CFG_DRV(GPIO32, AF6, FAST)
-#define GPIO33_MMC2_DAT3        MFP_CFG_DRV(GPIO33, AF6, FAST)
-
-/* I2S */
-#undef GPIO114_I2S_FRM
-#undef GPIO115_I2S_BCLK
-
-#define GPIO114_I2S_FRM         MFP_CFG_DRV(GPIO114, AF1, FAST)
-#define GPIO115_I2S_BCLK        MFP_CFG_DRV(GPIO115, AF1, FAST)
-#define GPIO116_I2S_TXD         MFP_CFG_DRV(GPIO116, AF1, FAST)
-
-/* MMC4 */
-#define GPIO125_MMC4_DAT3       MFP_CFG_DRV(GPIO125, AF7, FAST)
-#define GPIO126_MMC4_DAT2       MFP_CFG_DRV(GPIO126, AF7, FAST)
-#define GPIO127_MMC4_DAT1       MFP_CFG_DRV(GPIO127, AF7, FAST)
-#define GPIO0_2_MMC4_DAT0       MFP_CFG_DRV(GPIO0_2, AF7, FAST)
-#define GPIO1_2_MMC4_CMD        MFP_CFG_DRV(GPIO1_2, AF7, FAST)
-#define GPIO2_2_MMC4_CLK        MFP_CFG_DRV(GPIO2_2, AF7, FAST)
-
-/* OTG GPIO */
-#define GPIO_USB_OTG_PEN        18
-#define GPIO_USB_OIDIR          20
-
-/* Other GPIOs are 35, 84, 85 */
-#endif /* __MACH_MFP_GPLUGD_H */
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
index 8c782328b21c..92aaa3c19d61 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
@@ -203,6 +203,10 @@
 #define GPIO33_CF_nCD2          MFP_CFG(GPIO33, AF3)
 
 /* UART */
+#define GPIO8_UART3_TXD         MFP_CFG(GPIO8, AF2)
+#define GPIO9_UART3_RXD         MFP_CFG(GPIO9, AF2)
+#define GPIO1O_UART3_CTS        MFP_CFG(GPIO10, AF2)
+#define GPIO11_UART3_RTS        MFP_CFG(GPIO11, AF2)
 #define GPIO88_UART2_TXD        MFP_CFG(GPIO88, AF2)
 #define GPIO89_UART2_RXD        MFP_CFG(GPIO89, AF2)
 #define GPIO107_UART1_TXD       MFP_CFG_DRV(GPIO107, AF1, FAST)
@@ -232,6 +236,22 @@
 #define GPIO53_MMC1_CD          MFP_CFG(GPIO53, AF1)
 #define GPIO46_MMC1_WP          MFP_CFG(GPIO46, AF1)
 
+/* MMC2 */
+#define GPIO28_MMC2_CMD         MFP_CFG_DRV(GPIO28, AF6, FAST)
+#define GPIO29_MMC2_CLK         MFP_CFG_DRV(GPIO29, AF6, FAST)
+#define GPIO30_MMC2_DAT0        MFP_CFG_DRV(GPIO30, AF6, FAST)
+#define GPIO31_MMC2_DAT1        MFP_CFG_DRV(GPIO31, AF6, FAST)
+#define GPIO32_MMC2_DAT2        MFP_CFG_DRV(GPIO32, AF6, FAST)
+#define GPIO33_MMC2_DAT3        MFP_CFG_DRV(GPIO33, AF6, FAST)
+
+/* MMC4 */
+#define GPIO125_MMC4_DAT3       MFP_CFG_DRV(GPIO125, AF7, FAST)
+#define GPIO126_MMC4_DAT2       MFP_CFG_DRV(GPIO126, AF7, FAST)
+#define GPIO127_MMC4_DAT1       MFP_CFG_DRV(GPIO127, AF7, FAST)
+#define GPIO0_2_MMC4_DAT0       MFP_CFG_DRV(GPIO0_2, AF7, FAST)
+#define GPIO1_2_MMC4_CMD        MFP_CFG_DRV(GPIO1_2, AF7, FAST)
+#define GPIO2_2_MMC4_CLK        MFP_CFG_DRV(GPIO2_2, AF7, FAST)
+
 /* LCD */
 #define GPIO84_LCD_CS           MFP_CFG(GPIO84, AF1)
 #define GPIO60_LCD_DD0          MFP_CFG(GPIO60, AF1)
@@ -269,11 +289,12 @@
 #define GPIO106_CI2C_SCL        MFP_CFG(GPIO106, AF1)
 
 /* I2S */
-#define GPIO113_I2S_MCLK        MFP_CFG(GPIO113,AF6)
-#define GPIO114_I2S_FRM         MFP_CFG(GPIO114,AF1)
-#define GPIO115_I2S_BCLK        MFP_CFG(GPIO115,AF1)
-#define GPIO116_I2S_RXD         MFP_CFG(GPIO116,AF2)
-#define GPIO117_I2S_TXD         MFP_CFG(GPIO117,AF2)
+#define GPIO113_I2S_MCLK        MFP_CFG(GPIO113, AF6)
+#define GPIO114_I2S_FRM         MFP_CFG(GPIO114, AF1)
+#define GPIO115_I2S_BCLK        MFP_CFG(GPIO115, AF1)
+#define GPIO116_I2S_RXD         MFP_CFG(GPIO116, AF2)
+#define GPIO116_I2S_TXD         MFP_CFG(GPIO116, AF1)
+#define GPIO117_I2S_TXD         MFP_CFG(GPIO117, AF2)
 
 /* PWM */
 #define GPIO96_PWM3_OUT         MFP_CFG(GPIO96, AF1)
@@ -324,4 +345,10 @@
 #define GPIO101_MII_MDIO        MFP_CFG(GPIO101, AF5)
 #define GPIO103_RX_DV           MFP_CFG(GPIO103, AF5)
 
+/* SSP2 */
+#define GPIO107_SSP2_RXD        MFP_CFG(GPIO107, AF4)
+#define GPIO108_SSP2_TXD        MFP_CFG(GPIO108, AF4)
+#define GPIO111_SSP2_CLK        MFP_CFG(GPIO111, AF4)
+#define GPIO112_SSP2_FRM        MFP_CFG(GPIO112, AF4)
+
 #endif /* __ASM_MACH_MFP_PXA168_H */
diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c
index 99833b9485cf..4e91ee6e27c8 100644
--- a/arch/arm/mach-mmp/time.c
+++ b/arch/arm/mach-mmp/time.c
@@ -51,12 +51,12 @@ static inline uint32_t timer_read(void)
 {
         int delay = 100;
 
-        __raw_writel(1, TIMERS_VIRT_BASE + TMR_CVWR(0));
+        __raw_writel(1, TIMERS_VIRT_BASE + TMR_CVWR(1));
 
         while (delay--)
                 cpu_relax();
 
-        return __raw_readl(TIMERS_VIRT_BASE + TMR_CVWR(0));
+        return __raw_readl(TIMERS_VIRT_BASE + TMR_CVWR(1));
 }
 
 unsigned long long notrace sched_clock(void)
@@ -75,28 +75,51 @@ static irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
         struct clock_event_device *c = dev_id;
 
-        /* disable and clear pending interrupt status */
-        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(0));
-        __raw_writel(0x1, TIMERS_VIRT_BASE + TMR_ICR(0));
+        /*
+         * Clear pending interrupt status.
+         */
+        __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_ICR(0));
+
+        /*
+         * Disable timer 0.
+         */
+        __raw_writel(0x02, TIMERS_VIRT_BASE + TMR_CER);
+
         c->event_handler(c);
+
         return IRQ_HANDLED;
 }
 
 static int timer_set_next_event(unsigned long delta,
                                 struct clock_event_device *dev)
 {
-        unsigned long flags, next;
+        unsigned long flags;
 
         local_irq_save(flags);
 
-        /* clear pending interrupt status and enable */
+        /*
+         * Disable timer 0.
+         */
+        __raw_writel(0x02, TIMERS_VIRT_BASE + TMR_CER);
+
+        /*
+         * Clear and enable timer match 0 interrupt.
+         */
         __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_ICR(0));
         __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_IER(0));
 
-        next = timer_read() + delta;
-        __raw_writel(next, TIMERS_VIRT_BASE + TMR_TN_MM(0, 0));
+        /*
+         * Setup new clockevent timer value.
+         */
+        __raw_writel(delta - 1, TIMERS_VIRT_BASE + TMR_TN_MM(0, 0));
+
+        /*
+         * Enable timer 0.
+         */
+        __raw_writel(0x03, TIMERS_VIRT_BASE + TMR_CER);
 
         local_irq_restore(flags);
+
         return 0;
 }
 
@@ -145,23 +168,26 @@ static struct clocksource cksrc = {
 static void __init timer_config(void)
 {
         uint32_t ccr = __raw_readl(TIMERS_VIRT_BASE + TMR_CCR);
-        uint32_t cer = __raw_readl(TIMERS_VIRT_BASE + TMR_CER);
-        uint32_t cmr = __raw_readl(TIMERS_VIRT_BASE + TMR_CMR);
 
-        __raw_writel(cer & ~0x1, TIMERS_VIRT_BASE + TMR_CER); /* disable */
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_CER); /* disable */
 
-        ccr &= (cpu_is_mmp2()) ? TMR_CCR_CS_0(0) : TMR_CCR_CS_0(3);
+        ccr &= (cpu_is_mmp2()) ? (TMR_CCR_CS_0(0) | TMR_CCR_CS_1(0)) :
+                (TMR_CCR_CS_0(3) | TMR_CCR_CS_1(3));
         __raw_writel(ccr, TIMERS_VIRT_BASE + TMR_CCR);
 
-        /* free-running mode */
-        __raw_writel(cmr | 0x01, TIMERS_VIRT_BASE + TMR_CMR);
+        /* set timer 0 to periodic mode, and timer 1 to free-running mode */
+        __raw_writel(0x2, TIMERS_VIRT_BASE + TMR_CMR);
 
-        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_PLCR(0)); /* free-running */
+        __raw_writel(0x1, TIMERS_VIRT_BASE + TMR_PLCR(0)); /* periodic */
         __raw_writel(0x7, TIMERS_VIRT_BASE + TMR_ICR(0));  /* clear status */
         __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(0));
 
-        /* enable timer counter */
-        __raw_writel(cer | 0x01, TIMERS_VIRT_BASE + TMR_CER);
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_PLCR(1)); /* free-running */
+        __raw_writel(0x7, TIMERS_VIRT_BASE + TMR_ICR(1));  /* clear status */
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(1));
+
+        /* enable timer 1 counter */
+        __raw_writel(0x2, TIMERS_VIRT_BASE + TMR_CER);
 }
 
 static struct irqaction timer_irq = {
diff --git a/arch/arm/mach-mx5/board-cpuimx51.c b/arch/arm/mach-mx5/board-cpuimx51.c
index 7c893fa70266..68934ea8725a 100644
--- a/arch/arm/mach-mx5/board-cpuimx51.c
+++ b/arch/arm/mach-mx5/board-cpuimx51.c
@@ -81,7 +81,7 @@ static struct plat_serial8250_port serial_platform_data[] = {
                 .flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_IOREMAP,
         }, {
                 .mapbase = (unsigned long)(MX51_CS1_BASE_ADDR + 0x2000000),
-                .irq = irq_to_gpio(CPUIMX51_QUARTD_GPIO),
+                .irq = gpio_to_irq(CPUIMX51_QUARTD_GPIO),
                 .irqflags = IRQF_TRIGGER_HIGH,
                 .uartclk = CPUIMX51_QUART_XTAL,
                 .regshift = CPUIMX51_QUART_REGSHIFT,
diff --git a/arch/arm/mach-mx5/board-mx51_babbage.c b/arch/arm/mach-mx5/board-mx51_babbage.c
index e400b09109ce..11b0ff67f89d 100644
--- a/arch/arm/mach-mx5/board-mx51_babbage.c
+++ b/arch/arm/mach-mx5/board-mx51_babbage.c
@@ -369,7 +369,7 @@ static void __init mx51_babbage_init(void)
                                         ARRAY_SIZE(mx51babbage_pads));
 
         imx51_add_imx_uart(0, &uart_pdata);
-        imx51_add_imx_uart(1, &uart_pdata);
+        imx51_add_imx_uart(1, NULL);
         imx51_add_imx_uart(2, &uart_pdata);
 
         babbage_fec_reset();
diff --git a/arch/arm/mach-mx5/board-mx51_efikamx.c b/arch/arm/mach-mx5/board-mx51_efikamx.c
index f70700dc0ec1..551daf85ff8c 100644
--- a/arch/arm/mach-mx5/board-mx51_efikamx.c
+++ b/arch/arm/mach-mx5/board-mx51_efikamx.c
@@ -108,9 +108,9 @@ static void __init mx51_efikamx_board_id(void)
         gpio_request(EFIKAMX_PCBID2, "pcbid2");
         gpio_direction_input(EFIKAMX_PCBID2);
 
-        id = gpio_get_value(EFIKAMX_PCBID0);
-        id |= gpio_get_value(EFIKAMX_PCBID1) << 1;
-        id |= gpio_get_value(EFIKAMX_PCBID2) << 2;
+        id = gpio_get_value(EFIKAMX_PCBID0) ? 1 : 0;
+        id |= (gpio_get_value(EFIKAMX_PCBID1) ? 1 : 0) << 1;
+        id |= (gpio_get_value(EFIKAMX_PCBID2) ? 1 : 0) << 2;
 
         switch (id) {
         case 7:
diff --git a/arch/arm/mach-mx5/board-mx51_efikasb.c b/arch/arm/mach-mx5/board-mx51_efikasb.c
index 2e4d9d32a87c..8a9bca22beb5 100644
--- a/arch/arm/mach-mx5/board-mx51_efikasb.c
+++ b/arch/arm/mach-mx5/board-mx51_efikasb.c
@@ -156,23 +156,24 @@ static struct gpio_keys_button mx51_efikasb_keys[] = {
         {
                 .code = KEY_POWER,
                 .gpio = EFIKASB_PWRKEY,
-                .type = EV_PWR,
+                .type = EV_KEY,
                 .desc = "Power Button",
                 .wakeup = 1,
-                .debounce_interval = 10, /* ms */
+                .active_low = 1,
         },
         {
                 .code = SW_LID,
                 .gpio = EFIKASB_LID,
                 .type = EV_SW,
                 .desc = "Lid Switch",
+                .active_low = 1,
         },
         {
-                /* SW_RFKILLALL vs KEY_RFKILL ? */
-                .code = SW_RFKILL_ALL,
+                .code = KEY_RFKILL,
                 .gpio = EFIKASB_RFKILL,
-                .type = EV_SW,
+                .type = EV_KEY,
                 .desc = "rfkill",
+                .active_low = 1,
         },
 };
 
@@ -224,8 +225,8 @@ static void __init mx51_efikasb_board_id(void)
         gpio_request(EFIKASB_PCBID1, "pcb id1");
         gpio_direction_input(EFIKASB_PCBID1);
 
-        id = gpio_get_value(EFIKASB_PCBID0);
-        id |= gpio_get_value(EFIKASB_PCBID1) << 1;
+        id = gpio_get_value(EFIKASB_PCBID0) ? 1 : 0;
+        id |= (gpio_get_value(EFIKASB_PCBID1) ? 1 : 0) << 1;
 
         switch (id) {
         default:
diff --git a/arch/arm/mach-mx5/clock-mx51-mx53.c b/arch/arm/mach-mx5/clock-mx51-mx53.c
index 7f20308c4dbd..f7bf996f463b 100644
--- a/arch/arm/mach-mx5/clock-mx51-mx53.c
+++ b/arch/arm/mach-mx5/clock-mx51-mx53.c
@@ -271,7 +271,11 @@ static int _clk_pll_enable(struct clk *clk)
         int i = 0;
 
         pllbase = _get_pll_base(clk);
-        reg = __raw_readl(pllbase + MXC_PLL_DP_CTL) | MXC_PLL_DP_CTL_UPEN;
+        reg = __raw_readl(pllbase + MXC_PLL_DP_CTL);
+        if (reg & MXC_PLL_DP_CTL_UPEN)
+                return 0;
+
+        reg |= MXC_PLL_DP_CTL_UPEN;
         __raw_writel(reg, pllbase + MXC_PLL_DP_CTL);
 
         /* Wait for lock */
diff --git a/arch/arm/mach-mx5/mx51_efika.c b/arch/arm/mach-mx5/mx51_efika.c
index 4435e03cea5d..c9209454807a 100644
--- a/arch/arm/mach-mx5/mx51_efika.c
+++ b/arch/arm/mach-mx5/mx51_efika.c
@@ -186,7 +186,7 @@ static int initialize_usbh1_port(struct platform_device *pdev)
 
         mdelay(10);
 
-        return mx51_initialize_usb_hw(0, MXC_EHCI_ITC_NO_THRESHOLD);
+        return mx51_initialize_usb_hw(pdev->id, MXC_EHCI_ITC_NO_THRESHOLD);
 }
 
 static struct mxc_usbh_platform_data usbh1_config = {
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 4ae6257b39a4..57b66d590c52 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -7,7 +7,6 @@ config ARCH_OMAP2PLUS_TYPICAL
         default y
         select AEABI
         select REGULATOR
-        select PM
         select PM_RUNTIME
         select VFP
         select NEON if ARCH_OMAP3 || ARCH_OMAP4
diff --git a/arch/arm/mach-omap2/board-am3517crane.c b/arch/arm/mach-omap2/board-am3517crane.c
index 5f2b55ff04ff..933e9353cb37 100644
--- a/arch/arm/mach-omap2/board-am3517crane.c
+++ b/arch/arm/mach-omap2/board-am3517crane.c
@@ -45,8 +45,6 @@ static struct omap_board_config_kernel am3517_crane_config[] __initdata = {
 static struct omap_board_mux board_mux[] __initdata = {
         { .reg_offset = OMAP_MUX_TERMINATOR },
 };
-#else
-#define board_mux       NULL
 #endif
 
 static void __init am3517_crane_init_early(void)
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 32f5f895568a..3ae16b4e3f52 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -491,23 +491,22 @@ static void __init beagle_opp_init(void)
 
         /* Custom OPP enabled for all xM versions */
         if (cpu_is_omap3630()) {
-                struct omap_hwmod *mh = omap_hwmod_lookup("mpu");
-                struct omap_hwmod *dh = omap_hwmod_lookup("iva");
-                struct device *dev;
+                struct device *mpu_dev, *iva_dev;
 
-                if (!mh || !dh) {
+                mpu_dev = omap2_get_mpuss_device();
+                iva_dev = omap2_get_iva_device();
+
+                if (!mpu_dev || !iva_dev) {
                         pr_err("%s: Aiee.. no mpu/dsp devices? %p %p\n",
-                                __func__, mh, dh);
+                                __func__, mpu_dev, iva_dev);
                         return;
                 }
                 /* Enable MPU 1GHz and lower opps */
-                dev = &mh->od->pdev.dev;
-                r = opp_enable(dev, 800000000);
+                r = opp_enable(mpu_dev, 800000000);
                 /* TODO: MPU 1GHz needs SR and ABB */
 
                 /* Enable IVA 800MHz and lower opps */
-                dev = &dh->od->pdev.dev;
-                r |= opp_enable(dev, 660000000);
+                r |= opp_enable(iva_dev, 660000000);
                 /* TODO: DSP 800MHz needs SR and ABB */
                 if (r) {
                         pr_err("%s: failed to enable higher opp %d\n",
@@ -516,10 +515,8 @@ static void __init beagle_opp_init(void)
                          * Cleanup - disable the higher freqs - we dont care
                          * about the results
                          */
-                        dev = &mh->od->pdev.dev;
-                        opp_disable(dev, 800000000);
-                        dev = &dh->od->pdev.dev;
-                        opp_disable(dev, 660000000);
+                        opp_disable(mpu_dev, 800000000);
+                        opp_disable(iva_dev, 660000000);
                 }
         }
         return;
diff --git a/arch/arm/mach-omap2/cminst44xx.h b/arch/arm/mach-omap2/cminst44xx.h
index f2ea6453ade0..a018a7327879 100644
--- a/arch/arm/mach-omap2/cminst44xx.h
+++ b/arch/arm/mach-omap2/cminst44xx.h
@@ -18,13 +18,36 @@ extern void omap4_cminst_clkdm_force_sleep(u8 part, s16 inst, u16 cdoffs);
 extern void omap4_cminst_clkdm_force_wakeup(u8 part, s16 inst, u16 cdoffs);
 
 extern int omap4_cminst_wait_module_ready(u8 part, u16 inst, s16 cdoffs, u16 clkctrl_offs);
-extern int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs, u16 clkctrl_offs);
+
+# ifdef CONFIG_ARCH_OMAP4
+extern int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs,
+                                         u16 clkctrl_offs);
 
 extern void omap4_cminst_module_enable(u8 mode, u8 part, u16 inst, s16 cdoffs,
                                        u16 clkctrl_offs);
 extern void omap4_cminst_module_disable(u8 part, u16 inst, s16 cdoffs,
                                         u16 clkctrl_offs);
 
+# else
+
+static inline int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs,
+                                        u16 clkctrl_offs)
+{
+        return 0;
+}
+
+static inline void omap4_cminst_module_enable(u8 mode, u8 part, u16 inst,
+                                s16 cdoffs, u16 clkctrl_offs)
+{
+}
+
+static inline void omap4_cminst_module_disable(u8 part, u16 inst, s16 cdoffs,
+                                 u16 clkctrl_offs)
+{
+}
+
+# endif
+
 /*
  * In an ideal world, we would not export these low-level functions,
  * but this will probably take some time to fix properly
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index c7fb22abc219..655e9480eb98 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -821,11 +821,10 @@ static void __init omap_mux_set_cmdline_signals(void)
         if (!omap_mux_options)
                 return;
 
-        options = kmalloc(strlen(omap_mux_options) + 1, GFP_KERNEL);
+        options = kstrdup(omap_mux_options, GFP_KERNEL);
         if (!options)
                 return;
 
-        strcpy(options, omap_mux_options);
         next_opt = options;
 
         while ((token = strsep(&next_opt, ",")) != NULL) {
@@ -855,24 +854,19 @@ static int __init omap_mux_copy_names(struct omap_mux *src,
 
         for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
                 if (src->muxnames[i]) {
-                        dst->muxnames[i] =
-                                kmalloc(strlen(src->muxnames[i]) + 1,
-                                        GFP_KERNEL);
+                        dst->muxnames[i] = kstrdup(src->muxnames[i],
+                                                   GFP_KERNEL);
                         if (!dst->muxnames[i])
                                 goto free;
-                        strcpy(dst->muxnames[i], src->muxnames[i]);
                 }
         }
 
 #ifdef CONFIG_DEBUG_FS
         for (i = 0; i < OMAP_MUX_NR_SIDES; i++) {
                 if (src->balls[i]) {
-                        dst->balls[i] =
-                                kmalloc(strlen(src->balls[i]) + 1,
-                                        GFP_KERNEL);
+                        dst->balls[i] = kstrdup(src->balls[i], GFP_KERNEL);
                         if (!dst->balls[i])
                                 goto free;
-                        strcpy(dst->balls[i], src->balls[i]);
                 }
         }
 #endif
diff --git a/arch/arm/mach-omap2/smartreflex.c b/arch/arm/mach-omap2/smartreflex.c
index 2ce2fb7664bc..34c01a7de810 100644
--- a/arch/arm/mach-omap2/smartreflex.c
+++ b/arch/arm/mach-omap2/smartreflex.c
@@ -621,7 +621,7 @@ void sr_disable(struct voltagedomain *voltdm)
                         sr_v2_disable(sr);
         }
 
-        pm_runtime_put_sync(&sr->pdev->dev);
+        pm_runtime_put_sync_suspend(&sr->pdev->dev);
 }
 
 /**
@@ -860,6 +860,7 @@ static int __init omap_sr_probe(struct platform_device *pdev)
         irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
 
         pm_runtime_enable(&pdev->dev);
+        pm_runtime_irq_safe(&pdev->dev);
 
         sr_info->pdev = pdev;
         sr_info->srid = pdev->id;
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index e9640728239b..cf1de7d2630d 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -293,7 +293,8 @@ static void __init omap2_gp_clocksource_init(int gptimer_id,
         pr_info("OMAP clocksource: GPTIMER%d at %lu Hz\n",
                 gptimer_id, clksrc.rate);
 
-        __omap_dm_timer_load_start(clksrc.io_base, OMAP_TIMER_CTRL_ST, 0, 1);
+        __omap_dm_timer_load_start(clksrc.io_base,
+                        OMAP_TIMER_CTRL_ST | OMAP_TIMER_CTRL_AR, 0, 1);
         init_sched_clock(&cd, dmtimer_update_sched_clock, 32, clksrc.rate);
 
         if (clocksource_register_hz(&clocksource_gpt, clksrc.rate))
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 2543342dbccb..daa056ed8738 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -48,14 +48,7 @@ void __init omap_pmic_init(int bus, u32 clkrate,
         omap_register_i2c_bus(bus, clkrate, &pmic_i2c_board_info, 1);
 }
 
-static struct twl4030_usb_data omap4_usb_pdata = {
-        .phy_init       = omap4430_phy_init,
-        .phy_exit       = omap4430_phy_exit,
-        .phy_power      = omap4430_phy_power,
-        .phy_set_clock  = omap4430_phy_set_clk,
-        .phy_suspend    = omap4430_phy_suspend,
-};
-
+#if defined(CONFIG_ARCH_OMAP3)
 static struct twl4030_usb_data omap3_usb_pdata = {
         .usb_mode       = T2_USB_MODE_ULPI,
 };
@@ -122,6 +115,45 @@ static struct regulator_init_data omap3_vpll2_idata = {
         .consumer_supplies              = omap3_vpll2_supplies,
 };
 
+void __init omap3_pmic_get_config(struct twl4030_platform_data *pmic_data,
+                                  u32 pdata_flags, u32 regulators_flags)
+{
+        if (!pmic_data->irq_base)
+                pmic_data->irq_base = TWL4030_IRQ_BASE;
+        if (!pmic_data->irq_end)
+                pmic_data->irq_end = TWL4030_IRQ_END;
+
+        /* Common platform data configurations */
+        if (pdata_flags & TWL_COMMON_PDATA_USB && !pmic_data->usb)
+                pmic_data->usb = &omap3_usb_pdata;
+
+        if (pdata_flags & TWL_COMMON_PDATA_BCI && !pmic_data->bci)
+                pmic_data->bci = &omap3_bci_pdata;
+
+        if (pdata_flags & TWL_COMMON_PDATA_MADC && !pmic_data->madc)
+                pmic_data->madc = &omap3_madc_pdata;
+
+        if (pdata_flags & TWL_COMMON_PDATA_AUDIO && !pmic_data->audio)
+                pmic_data->audio = &omap3_audio_pdata;
+
+        /* Common regulator configurations */
+        if (regulators_flags & TWL_COMMON_REGULATOR_VDAC && !pmic_data->vdac)
+                pmic_data->vdac = &omap3_vdac_idata;
+
+        if (regulators_flags & TWL_COMMON_REGULATOR_VPLL2 && !pmic_data->vpll2)
+                pmic_data->vpll2 = &omap3_vpll2_idata;
+}
+#endif /* CONFIG_ARCH_OMAP3 */
+
+#if defined(CONFIG_ARCH_OMAP4)
+static struct twl4030_usb_data omap4_usb_pdata = {
+        .phy_init       = omap4430_phy_init,
+        .phy_exit       = omap4430_phy_exit,
+        .phy_power      = omap4430_phy_power,
+        .phy_set_clock  = omap4430_phy_set_clk,
+        .phy_suspend    = omap4430_phy_suspend,
+};
+
 static struct regulator_init_data omap4_vdac_idata = {
         .constraints = {
                 .min_uV                 = 1800000,
@@ -273,32 +305,4 @@ void __init omap4_pmic_get_config(struct twl4030_platform_data *pmic_data,
             !pmic_data->clk32kg)
                 pmic_data->clk32kg = &omap4_clk32kg_idata;
 }
-
-void __init omap3_pmic_get_config(struct twl4030_platform_data *pmic_data,
-                                  u32 pdata_flags, u32 regulators_flags)
-{
-        if (!pmic_data->irq_base)
-                pmic_data->irq_base = TWL4030_IRQ_BASE;
-        if (!pmic_data->irq_end)
-                pmic_data->irq_end = TWL4030_IRQ_END;
-
-        /* Common platform data configurations */
-        if (pdata_flags & TWL_COMMON_PDATA_USB && !pmic_data->usb)
-                pmic_data->usb = &omap3_usb_pdata;
-
-        if (pdata_flags & TWL_COMMON_PDATA_BCI && !pmic_data->bci)
-                pmic_data->bci = &omap3_bci_pdata;
-
-        if (pdata_flags & TWL_COMMON_PDATA_MADC && !pmic_data->madc)
-                pmic_data->madc = &omap3_madc_pdata;
-
-        if (pdata_flags & TWL_COMMON_PDATA_AUDIO && !pmic_data->audio)
-                pmic_data->audio = &omap3_audio_pdata;
-
-        /* Common regulator configurations */
-        if (regulators_flags & TWL_COMMON_REGULATOR_VDAC && !pmic_data->vdac)
-                pmic_data->vdac = &omap3_vdac_idata;
-
-        if (regulators_flags & TWL_COMMON_REGULATOR_VPLL2 && !pmic_data->vpll2)
-                pmic_data->vpll2 = &omap3_vpll2_idata;
-}
+#endif /* CONFIG_ARCH_OMAP4 */
diff --git a/arch/arm/mach-sa1100/pci-nanoengine.c b/arch/arm/mach-sa1100/pci-nanoengine.c
index 964c6c3cd7a6..dd39fee59549 100644
--- a/arch/arm/mach-sa1100/pci-nanoengine.c
+++ b/arch/arm/mach-sa1100/pci-nanoengine.c
@@ -28,6 +28,7 @@
 #include <asm/mach-types.h>
 
 #include <mach/nanoengine.h>
+#include <mach/hardware.h>
 
 static DEFINE_SPINLOCK(nano_lock);
 
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index be7c638b648b..cfbcf8b95599 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -22,6 +22,7 @@
 #include <linux/sched.h>
 #include <linux/uaccess.h>
 
+#include <asm/system.h>
 #include <asm/unaligned.h>
 
 #include "fault.h"
@@ -95,6 +96,33 @@ static const char *usermode_action[] = {
         "signal+warn"
 };
 
+/* Return true if and only if the ARMv6 unaligned access model is in use. */
+static bool cpu_is_v6_unaligned(void)
+{
+        return cpu_architecture() >= CPU_ARCH_ARMv6 && (cr_alignment & CR_U);
+}
+
+static int safe_usermode(int new_usermode, bool warn)
+{
+        /*
+         * ARMv6 and later CPUs can perform unaligned accesses for
+         * most single load and store instructions up to word size.
+         * LDM, STM, LDRD and STRD still need to be handled.
+         *
+         * Ignoring the alignment fault is not an option on these
+         * CPUs since we spin re-faulting the instruction without
+         * making any progress.
+         */
+        if (cpu_is_v6_unaligned() && !(new_usermode & (UM_FIXUP | UM_SIGNAL))) {
+                new_usermode |= UM_FIXUP;
+
+                if (warn)
+                        printk(KERN_WARNING "alignment: ignoring faults is unsafe on this CPU.  Defaulting to fixup mode.\n");
+        }
+
+        return new_usermode;
+}
+
 static int alignment_proc_show(struct seq_file *m, void *v)
 {
         seq_printf(m, "User:\t\t%lu\n", ai_user);
@@ -125,7 +153,7 @@ static ssize_t alignment_proc_write(struct file *file, const char __user *buffer
                 if (get_user(mode, buffer))
                         return -EFAULT;
                 if (mode >= '0' && mode <= '5')
-                        ai_usermode = mode - '0';
+                        ai_usermode = safe_usermode(mode - '0', true);
         }
         return count;
 }
@@ -886,9 +914,16 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
         if (ai_usermode & UM_FIXUP)
                 goto fixup;
 
-        if (ai_usermode & UM_SIGNAL)
-                force_sig(SIGBUS, current);
-        else {
+        if (ai_usermode & UM_SIGNAL) {
+                siginfo_t si;
+
+                si.si_signo = SIGBUS;
+                si.si_errno = 0;
+                si.si_code = BUS_ADRALN;
+                si.si_addr = (void __user *)addr;
+
+                force_sig_info(si.si_signo, &si, current);
+        } else {
                 /*
                  * We're about to disable the alignment trap and return to
                  * user space.  But if an interrupt occurs before actually
@@ -926,20 +961,11 @@ static int __init alignment_init(void)
                 return -ENOMEM;
 #endif
 
-        /*
-         * ARMv6 and later CPUs can perform unaligned accesses for
-         * most single load and store instructions up to word size.
-         * LDM, STM, LDRD and STRD still need to be handled.
-         *
-         * Ignoring the alignment fault is not an option on these
-         * CPUs since we spin re-faulting the instruction without
-         * making any progress.
-         */
-        if (cpu_architecture() >= CPU_ARCH_ARMv6 && (cr_alignment & CR_U)) {
+        if (cpu_is_v6_unaligned()) {
                 cr_alignment &= ~CR_A;
                 cr_no_alignment &= ~CR_A;
                 set_cr(cr_alignment);
-                ai_usermode = UM_FIXUP;
+                ai_usermode = safe_usermode(ai_usermode, false);
         }
 
         hook_fault_code(1, do_alignment, SIGBUS, BUS_ADRALN,
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 2fee782077c1..91bca355cd31 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -441,7 +441,7 @@ static inline int free_area(unsigned long pfn, unsigned long end, char *s)
 static inline void poison_init_mem(void *s, size_t count)
 {
         u32 *p = (u32 *)s;
-        while ((count = count - 4))
+        for (; count != 0; count -= 4)
                 *p++ = 0xe7fddef0;
 }
 
diff --git a/arch/arm/mm/proc-arm946.S b/arch/arm/mm/proc-arm946.S
index f8f7ea34bfc5..683af3a182b7 100644
--- a/arch/arm/mm/proc-arm946.S
+++ b/arch/arm/mm/proc-arm946.S
@@ -410,6 +410,7 @@ __arm946_proc_info:
         .long   0x41009460
         .long   0xff00fff0
         .long   0
+        .long   0
         b       __arm946_setup
         .long   cpu_arch_name
         .long   cpu_elf_name
@@ -418,6 +419,6 @@ __arm946_proc_info:
         .long   arm946_processor_functions
         .long   0
         .long   0
-        .long   arm940_cache_fns
+        .long   arm946_cache_fns
         .size   __arm946_proc_info, . - __arm946_proc_info
 
diff --git a/arch/arm/plat-mxc/include/mach/debug-macro.S b/arch/arm/plat-mxc/include/mach/debug-macro.S
index 91fc7cdb5dc9..e4dde91f0231 100644
--- a/arch/arm/plat-mxc/include/mach/debug-macro.S
+++ b/arch/arm/plat-mxc/include/mach/debug-macro.S
@@ -44,6 +44,14 @@
 #define UART_PADDR      MX51_UART1_BASE_ADDR
 #endif
 
+/* iMX50/53 have same addresses, but not iMX51 */
+#if defined(CONFIG_SOC_IMX50) || defined(CONFIG_SOC_IMX53)
+#ifdef UART_PADDR
+#error "CONFIG_DEBUG_LL is incompatible with multiple archs"
+#endif
+#define UART_PADDR      MX53_UART1_BASE_ADDR
+#endif
+
 #define UART_VADDR      IMX_IO_ADDRESS(UART_PADDR)
 
                 .macro  addruart, rp, rv
diff --git a/arch/arm/plat-mxc/include/mach/iomux-mx53.h b/arch/arm/plat-mxc/include/mach/iomux-mx53.h
index 9440b9e00e89..5408fd1fc736 100644
--- a/arch/arm/plat-mxc/include/mach/iomux-mx53.h
+++ b/arch/arm/plat-mxc/include/mach/iomux-mx53.h
@@ -30,6 +30,9 @@
 #define MX53_SDHC_PAD_CTRL      (PAD_CTL_HYS | PAD_CTL_PKE | PAD_CTL_PUE | \
                                 PAD_CTL_PUS_47K_UP | PAD_CTL_DSE_HIGH | \
                                 PAD_CTL_SRE_FAST)
+#define PAD_CTRL_I2C    (PAD_CTL_SRE_FAST | PAD_CTL_ODE | PAD_CTL_PKE | \
+                        PAD_CTL_PUE | PAD_CTL_DSE_HIGH | PAD_CTL_PUS_100K_UP \
+                        | PAD_CTL_HYS)
 
 #define _MX53_PAD_GPIO_19__KPP_COL_5            IOMUX_PAD(0x348, 0x20, 0, 0x840, 0, 0)
 #define _MX53_PAD_GPIO_19__GPIO4_5              IOMUX_PAD(0x348, 0x20, 1, 0x0, 0, 0)
@@ -1256,7 +1259,7 @@
 #define MX53_PAD_KEY_COL3__GPIO4_12             (_MX53_PAD_KEY_COL3__GPIO4_12 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__USBOH3_H2_DP         (_MX53_PAD_KEY_COL3__USBOH3_H2_DP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__SPDIF_IN1            (_MX53_PAD_KEY_COL3__SPDIF_IN1 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_KEY_COL3__I2C2_SCL             (_MX53_PAD_KEY_COL3__I2C2_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_KEY_COL3__I2C2_SCL             (_MX53_PAD_KEY_COL3__I2C2_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_KEY_COL3__ECSPI1_SS3           (_MX53_PAD_KEY_COL3__ECSPI1_SS3 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__FEC_CRS              (_MX53_PAD_KEY_COL3__FEC_CRS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__USBPHY1_SIECLOCK             (_MX53_PAD_KEY_COL3__USBPHY1_SIECLOCK | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1264,7 +1267,7 @@
 #define MX53_PAD_KEY_ROW3__GPIO4_13             (_MX53_PAD_KEY_ROW3__GPIO4_13 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__USBOH3_H2_DM         (_MX53_PAD_KEY_ROW3__USBOH3_H2_DM | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__CCM_ASRC_EXT_CLK             (_MX53_PAD_KEY_ROW3__CCM_ASRC_EXT_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_KEY_ROW3__I2C2_SDA             (_MX53_PAD_KEY_ROW3__I2C2_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_KEY_ROW3__I2C2_SDA             (_MX53_PAD_KEY_ROW3__I2C2_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_KEY_ROW3__OSC32K_32K_OUT               (_MX53_PAD_KEY_ROW3__OSC32K_32K_OUT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__CCM_PLL4_BYP         (_MX53_PAD_KEY_ROW3__CCM_PLL4_BYP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__USBPHY1_LINESTATE_0          (_MX53_PAD_KEY_ROW3__USBPHY1_LINESTATE_0 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1536,7 +1539,7 @@
 #define MX53_PAD_CSI0_DAT8__KPP_COL_7           (_MX53_PAD_CSI0_DAT8__KPP_COL_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__ECSPI2_SCLK         (_MX53_PAD_CSI0_DAT8__ECSPI2_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__USBOH3_USBH3_OC             (_MX53_PAD_CSI0_DAT8__USBOH3_USBH3_OC | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_CSI0_DAT8__I2C1_SDA            (_MX53_PAD_CSI0_DAT8__I2C1_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_CSI0_DAT8__I2C1_SDA            (_MX53_PAD_CSI0_DAT8__I2C1_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_CSI0_DAT8__EMI_EMI_DEBUG_37            (_MX53_PAD_CSI0_DAT8__EMI_EMI_DEBUG_37 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__TPIU_TRACE_5                (_MX53_PAD_CSI0_DAT8__TPIU_TRACE_5 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__IPU_CSI0_D_9                (_MX53_PAD_CSI0_DAT9__IPU_CSI0_D_9 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1544,7 +1547,7 @@
 #define MX53_PAD_CSI0_DAT9__KPP_ROW_7           (_MX53_PAD_CSI0_DAT9__KPP_ROW_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__ECSPI2_MOSI         (_MX53_PAD_CSI0_DAT9__ECSPI2_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__USBOH3_USBH3_PWR            (_MX53_PAD_CSI0_DAT9__USBOH3_USBH3_PWR | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_CSI0_DAT9__I2C1_SCL            (_MX53_PAD_CSI0_DAT9__I2C1_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_CSI0_DAT9__I2C1_SCL            (_MX53_PAD_CSI0_DAT9__I2C1_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_CSI0_DAT9__EMI_EMI_DEBUG_38            (_MX53_PAD_CSI0_DAT9__EMI_EMI_DEBUG_38 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__TPIU_TRACE_6                (_MX53_PAD_CSI0_DAT9__TPIU_TRACE_6 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT10__IPU_CSI0_D_10              (_MX53_PAD_CSI0_DAT10__IPU_CSI0_D_10 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1631,25 +1634,25 @@
 #define MX53_PAD_EIM_EB2__CCM_DI1_EXT_CLK               (_MX53_PAD_EIM_EB2__CCM_DI1_EXT_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_EB2__IPU_SER_DISP1_CS              (_MX53_PAD_EIM_EB2__IPU_SER_DISP1_CS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_EB2__ECSPI1_SS0            (_MX53_PAD_EIM_EB2__ECSPI1_SS0 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_EB2__I2C2_SCL              (_MX53_PAD_EIM_EB2__I2C2_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_EB2__I2C2_SCL              (_MX53_PAD_EIM_EB2__I2C2_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D16__EMI_WEIM_D_16         (_MX53_PAD_EIM_D16__EMI_WEIM_D_16 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__GPIO3_16              (_MX53_PAD_EIM_D16__GPIO3_16 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__IPU_DI0_PIN5          (_MX53_PAD_EIM_D16__IPU_DI0_PIN5 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__IPU_DISPB1_SER_CLK            (_MX53_PAD_EIM_D16__IPU_DISPB1_SER_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__ECSPI1_SCLK           (_MX53_PAD_EIM_D16__ECSPI1_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D16__I2C2_SDA              (_MX53_PAD_EIM_D16__I2C2_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D16__I2C2_SDA              (_MX53_PAD_EIM_D16__I2C2_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D17__EMI_WEIM_D_17         (_MX53_PAD_EIM_D17__EMI_WEIM_D_17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__GPIO3_17              (_MX53_PAD_EIM_D17__GPIO3_17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__IPU_DI0_PIN6          (_MX53_PAD_EIM_D17__IPU_DI0_PIN6 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__IPU_DISPB1_SER_DIN            (_MX53_PAD_EIM_D17__IPU_DISPB1_SER_DIN | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__ECSPI1_MISO           (_MX53_PAD_EIM_D17__ECSPI1_MISO | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D17__I2C3_SCL              (_MX53_PAD_EIM_D17__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D17__I2C3_SCL              (_MX53_PAD_EIM_D17__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D18__EMI_WEIM_D_18         (_MX53_PAD_EIM_D18__EMI_WEIM_D_18 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__GPIO3_18              (_MX53_PAD_EIM_D18__GPIO3_18 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__IPU_DI0_PIN7          (_MX53_PAD_EIM_D18__IPU_DI0_PIN7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__IPU_DISPB1_SER_DIO            (_MX53_PAD_EIM_D18__IPU_DISPB1_SER_DIO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__ECSPI1_MOSI           (_MX53_PAD_EIM_D18__ECSPI1_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D18__I2C3_SDA              (_MX53_PAD_EIM_D18__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D18__I2C3_SDA              (_MX53_PAD_EIM_D18__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D18__IPU_DI1_D0_CS         (_MX53_PAD_EIM_D18__IPU_DI1_D0_CS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D19__EMI_WEIM_D_19         (_MX53_PAD_EIM_D19__EMI_WEIM_D_19 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D19__GPIO3_19              (_MX53_PAD_EIM_D19__GPIO3_19 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1672,7 +1675,7 @@
 #define MX53_PAD_EIM_D21__IPU_DI0_PIN17         (_MX53_PAD_EIM_D21__IPU_DI0_PIN17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D21__IPU_DISPB0_SER_CLK            (_MX53_PAD_EIM_D21__IPU_DISPB0_SER_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D21__CSPI_SCLK             (_MX53_PAD_EIM_D21__CSPI_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D21__I2C1_SCL              (_MX53_PAD_EIM_D21__I2C1_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D21__I2C1_SCL              (_MX53_PAD_EIM_D21__I2C1_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D21__USBOH3_USBOTG_OC              (_MX53_PAD_EIM_D21__USBOH3_USBOTG_OC | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D22__EMI_WEIM_D_22         (_MX53_PAD_EIM_D22__EMI_WEIM_D_22 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D22__GPIO3_22              (_MX53_PAD_EIM_D22__GPIO3_22 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1732,7 +1735,7 @@
 #define MX53_PAD_EIM_D28__UART2_CTS             (_MX53_PAD_EIM_D28__UART2_CTS | MUX_PAD_CTRL(MX53_UART_PAD_CTRL))
 #define MX53_PAD_EIM_D28__IPU_DISPB0_SER_DIO            (_MX53_PAD_EIM_D28__IPU_DISPB0_SER_DIO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D28__CSPI_MOSI             (_MX53_PAD_EIM_D28__CSPI_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D28__I2C1_SDA              (_MX53_PAD_EIM_D28__I2C1_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D28__I2C1_SDA              (_MX53_PAD_EIM_D28__I2C1_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D28__IPU_EXT_TRIG          (_MX53_PAD_EIM_D28__IPU_EXT_TRIG | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D28__IPU_DI0_PIN13         (_MX53_PAD_EIM_D28__IPU_DI0_PIN13 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D29__EMI_WEIM_D_29         (_MX53_PAD_EIM_D29__EMI_WEIM_D_29 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2297,7 +2300,7 @@
 #define MX53_PAD_GPIO_9__SCC_FAIL_STATE         (_MX53_PAD_GPIO_9__SCC_FAIL_STATE | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__ESAI1_HCKR             (_MX53_PAD_GPIO_3__ESAI1_HCKR | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__GPIO1_3                (_MX53_PAD_GPIO_3__GPIO1_3 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_3__I2C3_SCL               (_MX53_PAD_GPIO_3__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_3__I2C3_SCL               (_MX53_PAD_GPIO_3__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_3__DPLLIP1_TOG_EN         (_MX53_PAD_GPIO_3__DPLLIP1_TOG_EN | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__CCM_CLKO2              (_MX53_PAD_GPIO_3__CCM_CLKO2 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__OBSERVE_MUX_OBSRV_INT_OUT0             (_MX53_PAD_GPIO_3__OBSERVE_MUX_OBSRV_INT_OUT0 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2305,7 +2308,7 @@
 #define MX53_PAD_GPIO_3__MLB_MLBCLK             (_MX53_PAD_GPIO_3__MLB_MLBCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__ESAI1_SCKT             (_MX53_PAD_GPIO_6__ESAI1_SCKT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__GPIO1_6                (_MX53_PAD_GPIO_6__GPIO1_6 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_6__I2C3_SDA               (_MX53_PAD_GPIO_6__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_6__I2C3_SDA               (_MX53_PAD_GPIO_6__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_6__CCM_CCM_OUT_0          (_MX53_PAD_GPIO_6__CCM_CCM_OUT_0 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__CSU_CSU_INT_DEB                (_MX53_PAD_GPIO_6__CSU_CSU_INT_DEB | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__OBSERVE_MUX_OBSRV_INT_OUT1             (_MX53_PAD_GPIO_6__OBSERVE_MUX_OBSRV_INT_OUT1 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2333,7 +2336,7 @@
 #define MX53_PAD_GPIO_5__CCM_CLKO               (_MX53_PAD_GPIO_5__CCM_CLKO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_5__CSU_CSU_ALARM_AUT_2            (_MX53_PAD_GPIO_5__CSU_CSU_ALARM_AUT_2 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_5__OBSERVE_MUX_OBSRV_INT_OUT4             (_MX53_PAD_GPIO_5__OBSERVE_MUX_OBSRV_INT_OUT4 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_5__I2C3_SCL               (_MX53_PAD_GPIO_5__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_5__I2C3_SCL               (_MX53_PAD_GPIO_5__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_5__CCM_PLL1_BYP           (_MX53_PAD_GPIO_5__CCM_PLL1_BYP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_7__ESAI1_TX4_RX1          (_MX53_PAD_GPIO_7__ESAI1_TX4_RX1 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_7__GPIO1_7                (_MX53_PAD_GPIO_7__GPIO1_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2356,7 +2359,7 @@
 #define MX53_PAD_GPIO_16__TZIC_PWRFAIL_INT              (_MX53_PAD_GPIO_16__TZIC_PWRFAIL_INT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_16__RTC_CE_RTC_EXT_TRIG1          (_MX53_PAD_GPIO_16__RTC_CE_RTC_EXT_TRIG1 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_16__SPDIF_IN1             (_MX53_PAD_GPIO_16__SPDIF_IN1 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_16__I2C3_SDA              (_MX53_PAD_GPIO_16__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_16__I2C3_SDA              (_MX53_PAD_GPIO_16__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_16__SJC_DE_B              (_MX53_PAD_GPIO_16__SJC_DE_B | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_17__ESAI1_TX0             (_MX53_PAD_GPIO_17__ESAI1_TX0 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_17__GPIO7_12              (_MX53_PAD_GPIO_17__GPIO7_12 | MUX_PAD_CTRL(NO_PAD_CTRL))
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index 6e6735f04ee3..bb8f4a6b3e37 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -13,6 +13,7 @@ config ARCH_OMAP1
         bool "TI OMAP1"
         select CLKDEV_LOOKUP
         select CLKSRC_MMIO
+        select GENERIC_IRQ_CHIP
         help
           "Systems based on omap7xx, omap15xx or omap16xx"
 
diff --git a/arch/arm/plat-omap/include/plat/dma.h b/arch/arm/plat-omap/include/plat/dma.h
index d1c916fcf770..dc562a5c0a8a 100644
--- a/arch/arm/plat-omap/include/plat/dma.h
+++ b/arch/arm/plat-omap/include/plat/dma.h
@@ -195,6 +195,11 @@
 
 #define OMAP36XX_DMA_UART4_TX           81      /* S_DMA_80 */
 #define OMAP36XX_DMA_UART4_RX           82      /* S_DMA_81 */
+
+/* Only for AM35xx */
+#define AM35XX_DMA_UART4_TX             54
+#define AM35XX_DMA_UART4_RX             55
+
 /*----------------------------------------------------------------------------*/
 
 #define OMAP1_DMA_TOUT_IRQ              (1 << 0)
diff --git a/arch/arm/plat-omap/include/plat/irqs.h b/arch/arm/plat-omap/include/plat/irqs.h
index 926d25c780f3..30e10719b774 100644
--- a/arch/arm/plat-omap/include/plat/irqs.h
+++ b/arch/arm/plat-omap/include/plat/irqs.h
@@ -357,6 +357,7 @@
 #define INT_35XX_EMAC_C0_TX_PULSE_IRQ   69
 #define INT_35XX_EMAC_C0_MISC_PULSE_IRQ 70
 #define INT_35XX_USBOTG_IRQ             71
+#define INT_35XX_UART4                  84
 #define INT_35XX_CCDC_VD0_IRQ           88
 #define INT_35XX_CCDC_VD1_IRQ           92
 #define INT_35XX_CCDC_VD2_IRQ           93
diff --git a/arch/arm/plat-omap/include/plat/serial.h b/arch/arm/plat-omap/include/plat/serial.h
index 2723f9166ea2..de3b10c18127 100644
--- a/arch/arm/plat-omap/include/plat/serial.h
+++ b/arch/arm/plat-omap/include/plat/serial.h
@@ -56,6 +56,9 @@
 #define TI816X_UART2_BASE       0x48022000
 #define TI816X_UART3_BASE       0x48024000
 
+/* AM3505/3517 UART4 */
+#define AM35XX_UART4_BASE       0x4809E000      /* Only on AM3505/3517 */
+
 /* External port on Zoom2/3 */
 #define ZOOM_UART_BASE          0x10000000
 #define ZOOM_UART_VIRT          0xfa400000
diff --git a/arch/arm/plat-omap/iovmm.c b/arch/arm/plat-omap/iovmm.c
index c60737c49a32..79e7fedb8602 100644
--- a/arch/arm/plat-omap/iovmm.c
+++ b/arch/arm/plat-omap/iovmm.c
@@ -423,9 +423,6 @@ static void sgtable_fill_kmalloc(struct sg_table *sgt, u32 pa, u32 da,
 {
         unsigned int i;
         struct scatterlist *sg;
-        void *va;
-
-        va = phys_to_virt(pa);
 
         for_each_sg(sgt->sgl, sg, sgt->nents, i) {
                 unsigned bytes;
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 3b3776d0a1a7..fff68d0d521b 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -910,7 +910,7 @@ omapl138_case_a3	MACH_OMAPL138_CASE_A3	OMAPL138_CASE_A3	3280
 uemd                    MACH_UEMD               UEMD                    3281
 ccwmx51mut              MACH_CCWMX51MUT         CCWMX51MUT              3282
 rockhopper              MACH_ROCKHOPPER         ROCKHOPPER              3283
-nookcolor               MACH_NOOKCOLOR          NOOKCOLOR               3284
+encore                  MACH_ENCORE             ENCORE                  3284
 hkdkc100                MACH_HKDKC100           HKDKC100                3285
 ts42xx                  MACH_TS42XX             TS42XX                  3286
 aebl                    MACH_AEBL               AEBL                    3287
diff --git a/arch/powerpc/include/asm/jump_label.h b/arch/powerpc/include/asm/jump_label.h
index 1f780b95c0f0..938986e412f1 100644
--- a/arch/powerpc/include/asm/jump_label.h
+++ b/arch/powerpc/include/asm/jump_label.h
@@ -22,7 +22,6 @@ static __always_inline bool arch_static_branch(struct jump_label_key *key)
         asm goto("1:\n\t"
                  "nop\n\t"
                  ".pushsection __jump_table,  \"aw\"\n\t"
-                 ".align 4\n\t"
                  JUMP_ENTRY_TYPE "1b, %l[l_yes], %c0\n\t"
                  ".popsection \n\t"
                  : :  "i" (key) : : l_yes);
@@ -41,7 +40,6 @@ struct jump_entry {
         jump_label_t code;
         jump_label_t target;
         jump_label_t key;
-        jump_label_t pad;
 };
 
 #endif /* _ASM_POWERPC_JUMP_LABEL_H */
diff --git a/arch/powerpc/include/asm/kdump.h b/arch/powerpc/include/asm/kdump.h
index 6857af58b02e..bffd062adf79 100644
--- a/arch/powerpc/include/asm/kdump.h
+++ b/arch/powerpc/include/asm/kdump.h
@@ -3,17 +3,7 @@
 
 #include <asm/page.h>
 
-/*
- * If CONFIG_RELOCATABLE is enabled we can place the kdump kernel anywhere.
- * To keep enough space in the RMO for the first stage kernel on 64bit, we
- * place it at 64MB. If CONFIG_RELOCATABLE is not enabled we must place
- * the second stage at 32MB.
- */
-#if defined(CONFIG_RELOCATABLE) && defined(CONFIG_PPC64)
-#define KDUMP_KERNELBASE        0x4000000
-#else
 #define KDUMP_KERNELBASE        0x2000000
-#endif
 
 /* How many bytes to reserve at zero for kdump. The reserve limit should
  * be greater or equal to the trampoline's end address.
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index e8aaf6fce38b..559da199edb5 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -1003,7 +1003,6 @@
 #define PV_970          0x0039
 #define PV_POWER5       0x003A
 #define PV_POWER5p      0x003B
-#define PV_POWER7       0x003F
 #define PV_970FX        0x003C
 #define PV_POWER6       0x003E
 #define PV_POWER7       0x003F
@@ -1024,13 +1023,16 @@
 #define mtmsrd(v)       __mtmsrd((v), 0)
 #define mtmsr(v)        mtmsrd(v)
 #else
-#define mtmsr(v)        asm volatile("mtmsr %0" : : "r" (v) : "memory")
+#define mtmsr(v)        asm volatile("mtmsr %0" : \
+                                     : "r" ((unsigned long)(v)) \
+                                     : "memory")
 #endif
 
 #define mfspr(rn)       ({unsigned long rval; \
                         asm volatile("mfspr %0," __stringify(rn) \
                                 : "=r" (rval)); rval;})
-#define mtspr(rn, v)    asm volatile("mtspr " __stringify(rn) ",%0" : : "r" (v)\
+#define mtspr(rn, v)    asm volatile("mtspr " __stringify(rn) ",%0" : \
+                                     : "r" ((unsigned long)(v)) \
                                      : "memory")
 
 #ifdef __powerpc64__
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 9fb933248ab6..fa44ff538861 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -2051,7 +2051,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
 
 static struct cpu_spec the_cpu_spec;
 
-static void __init setup_cpu_spec(unsigned long offset, struct cpu_spec *s)
+static struct cpu_spec * __init setup_cpu_spec(unsigned long offset,
+                                               struct cpu_spec *s)
 {
         struct cpu_spec *t = &the_cpu_spec;
         struct cpu_spec old;
@@ -2114,6 +2115,8 @@ static void __init setup_cpu_spec(unsigned long offset, struct cpu_spec *s)
                 t->cpu_setup(offset, t);
         }
 #endif /* CONFIG_PPC64 || CONFIG_BOOKE */
+
+        return t;
 }
 
 struct cpu_spec * __init identify_cpu(unsigned long offset, unsigned int pvr)
@@ -2124,10 +2127,8 @@ struct cpu_spec * __init identify_cpu(unsigned long offset, unsigned int pvr)
         s = PTRRELOC(s);
 
         for (i = 0; i < ARRAY_SIZE(cpu_specs); i++,s++) {
-                if ((pvr & s->pvr_mask) == s->pvr_value) {
-                        setup_cpu_spec(offset, s);
-                        return s;
-                }
+                if ((pvr & s->pvr_mask) == s->pvr_value)
+                        return setup_cpu_spec(offset, s);
         }
 
         BUG();
diff --git a/arch/powerpc/kernel/iomap.c b/arch/powerpc/kernel/iomap.c
index 1577434f4088..b25f6325fc70 100644
--- a/arch/powerpc/kernel/iomap.c
+++ b/arch/powerpc/kernel/iomap.c
@@ -117,6 +117,7 @@ void ioport_unmap(void __iomem *addr)
 EXPORT_SYMBOL(ioport_map);
 EXPORT_SYMBOL(ioport_unmap);
 
+#ifdef CONFIG_PCI
 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max)
 {
         resource_size_t start = pci_resource_start(dev, bar);
@@ -146,3 +147,4 @@ void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 
 EXPORT_SYMBOL(pci_iomap);
 EXPORT_SYMBOL(pci_iounmap);
+#endif /* CONFIG_PCI */
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index 6658a1589955..9ce1672afb59 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -136,12 +136,16 @@ void __init reserve_crashkernel(void)
         crashk_res.start = KDUMP_KERNELBASE;
 #else
         if (!crashk_res.start) {
+#ifdef CONFIG_PPC64
                 /*
-                 * unspecified address, choose a region of specified size
-                 * can overlap with initrd (ignoring corruption when retained)
-                 * ppc64 requires kernel and some stacks to be in first segemnt
+                 * On 64bit we split the RMO in half but cap it at half of
+                 * a small SLB (128MB) since the crash kernel needs to place
+                 * itself and some stacks to be in the first segment.
                  */
+                crashk_res.start = min(0x80000000ULL, (ppc64_rma_size / 2));
+#else
                 crashk_res.start = KDUMP_KERNELBASE;
+#endif
         }
 
         crash_base = PAGE_ALIGN(crashk_res.start);
diff --git a/arch/powerpc/kernel/perf_callchain.c b/arch/powerpc/kernel/perf_callchain.c
index d05ae4204bbf..564c1d8bdb5c 100644
--- a/arch/powerpc/kernel/perf_callchain.c
+++ b/arch/powerpc/kernel/perf_callchain.c
@@ -154,8 +154,12 @@ static int read_user_stack_64(unsigned long __user *ptr, unsigned long *ret)
             ((unsigned long)ptr & 7))
                 return -EFAULT;
 
-        if (!__get_user_inatomic(*ret, ptr))
+        pagefault_disable();
+        if (!__get_user_inatomic(*ret, ptr)) {
+                pagefault_enable();
                 return 0;
+        }
+        pagefault_enable();
 
         return read_user_stack_slow(ptr, ret, 8);
 }
@@ -166,8 +170,12 @@ static int read_user_stack_32(unsigned int __user *ptr, unsigned int *ret)
             ((unsigned long)ptr & 3))
                 return -EFAULT;
 
-        if (!__get_user_inatomic(*ret, ptr))
+        pagefault_disable();
+        if (!__get_user_inatomic(*ret, ptr)) {
+                pagefault_enable();
                 return 0;
+        }
+        pagefault_enable();
 
         return read_user_stack_slow(ptr, ret, 4);
 }
@@ -294,11 +302,17 @@ static inline int current_is_64bit(void)
  */
 static int read_user_stack_32(unsigned int __user *ptr, unsigned int *ret)
 {
+        int rc;
+
         if ((unsigned long)ptr > TASK_SIZE - sizeof(unsigned int) ||
             ((unsigned long)ptr & 3))
                 return -EFAULT;
 
-        return __get_user_inatomic(*ret, ptr);
+        pagefault_disable();
+        rc = __get_user_inatomic(*ret, ptr);
+        pagefault_enable();
+
+        return rc;
 }
 
 static inline void perf_callchain_user_64(struct perf_callchain_entry *entry,
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index c016033ba78d..a909f4e9343b 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -1020,7 +1020,7 @@ static unsigned long __init alloc_up(unsigned long size, unsigned long align)
         }
         if (addr == 0)
                 return 0;
-        RELOC(alloc_bottom) = addr;
+        RELOC(alloc_bottom) = addr + size;
 
         prom_debug(" -> %x\n", addr);
         prom_debug("  alloc_bottom : %x\n", RELOC(alloc_bottom));
@@ -1830,11 +1830,13 @@ static void __init *make_room(unsigned long *mem_start, unsigned long *mem_end,
                 if (room > DEVTREE_CHUNK_SIZE)
                         room = DEVTREE_CHUNK_SIZE;
                 if (room < PAGE_SIZE)
-                        prom_panic("No memory for flatten_device_tree (no room)");
+                        prom_panic("No memory for flatten_device_tree "
+                                   "(no room)\n");
                 chunk = alloc_up(room, 0);
                 if (chunk == 0)
-                        prom_panic("No memory for flatten_device_tree (claim failed)");
-                *mem_end = RELOC(alloc_top);
+                        prom_panic("No memory for flatten_device_tree "
+                                   "(claim failed)\n");
+                *mem_end = chunk + room;
         }
 
         ret = (void *)*mem_start;
@@ -2042,7 +2044,7 @@ static void __init flatten_device_tree(void)
 
         /*
          * Check how much room we have between alloc top & bottom (+/- a
-         * few pages), crop to 4Mb, as this is our "chuck" size
+         * few pages), crop to 1MB, as this is our "chunk" size
          */
         room = RELOC(alloc_top) - RELOC(alloc_bottom) - 0x4000;
         if (room > DEVTREE_CHUNK_SIZE)
@@ -2053,7 +2055,7 @@ static void __init flatten_device_tree(void)
         mem_start = (unsigned long)alloc_up(room, PAGE_SIZE);
         if (mem_start == 0)
                 prom_panic("Can't allocate initial device-tree chunk\n");
-        mem_end = RELOC(alloc_top);
+        mem_end = mem_start + room;
 
         /* Get root of tree */
         root = call_prom("peer", 1, 1, (phandle)0);
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 6dd33581a228..de2950135e6e 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1251,7 +1251,7 @@ BEGIN_FTR_SECTION
         reg = 0
         .rept   32
         li      r6,reg*16+VCPU_VSRS
-        stxvd2x reg,r6,r3
+        STXVD2X(reg,r6,r3)
         reg = reg + 1
         .endr
 FTR_SECTION_ELSE
@@ -1313,7 +1313,7 @@ BEGIN_FTR_SECTION
         reg = 0
         .rept   32
         li      r7,reg*16+VCPU_VSRS
-        lxvd2x  reg,r7,r4
+        LXVD2X(reg,r7,r4)
         reg = reg + 1
         .endr
 FTR_SECTION_ELSE
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index d0af7fb2f344..b9ba86191aed 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -24,7 +24,7 @@ source "arch/powerpc/platforms/wsp/Kconfig"
 
 config KVM_GUEST
         bool "KVM Guest support"
-        default y
+        default n
         ---help---
           This option enables various optimizations for running under the KVM
           hypervisor. Overhead for the kernel when not running inside KVM should
diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
index e9190073bb97..0e8656370063 100644
--- a/arch/powerpc/platforms/pseries/dtl.c
+++ b/arch/powerpc/platforms/pseries/dtl.c
@@ -181,7 +181,7 @@ static void dtl_stop(struct dtl *dtl)
 
         lppaca_of(dtl->cpu).dtl_enable_mask = 0x0;
 
-        unregister_dtl(hwcpu, __pa(dtl->buf));
+        unregister_dtl(hwcpu);
 }
 
 static u64 dtl_current_index(struct dtl *dtl)
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index bc0288501f17..83a3ca2fd282 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -135,7 +135,7 @@ static void pseries_mach_cpu_die(void)
                 get_lppaca()->idle = 0;
 
                 if (get_preferred_offline_state(cpu) == CPU_STATE_ONLINE) {
-                        unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
+                        unregister_slb_shadow(hwcpu);
 
                         /*
                          * Call to start_secondary_resume() will not return.
@@ -150,7 +150,7 @@ static void pseries_mach_cpu_die(void)
         WARN_ON(get_preferred_offline_state(cpu) != CPU_STATE_OFFLINE);
 
         set_cpu_current_state(cpu, CPU_STATE_OFFLINE);
-        unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
+        unregister_slb_shadow(hwcpu);
         rtas_stop_self();
 
         /* Should never get here... */
diff --git a/arch/powerpc/platforms/pseries/io_event_irq.c b/arch/powerpc/platforms/pseries/io_event_irq.c
index c829e6067d54..2c4dd1fb8333 100644
--- a/arch/powerpc/platforms/pseries/io_event_irq.c
+++ b/arch/powerpc/platforms/pseries/io_event_irq.c
@@ -212,17 +212,15 @@ static int __init ioei_init(void)
         struct device_node *np;
 
         ioei_check_exception_token = rtas_token("check-exception");
-        if (ioei_check_exception_token == RTAS_UNKNOWN_SERVICE) {
-                pr_warning("IO Event IRQ not supported on this system !\n");
+        if (ioei_check_exception_token == RTAS_UNKNOWN_SERVICE)
                 return -ENODEV;
-        }
+
         np = of_find_node_by_path("/event-sources/ibm,io-events");
         if (np) {
                 request_event_sources_irqs(np, ioei_interrupt, "IO_EVENT");
+                pr_info("IBM I/O event interrupts enabled\n");
                 of_node_put(np);
         } else {
-                pr_err("io_event_irq: No ibm,io-events on system! "
-                       "IO Event interrupt disabled.\n");
                 return -ENODEV;
         }
         return 0;
diff --git a/arch/powerpc/platforms/pseries/kexec.c b/arch/powerpc/platforms/pseries/kexec.c
index 54cf3a4aa16b..7d94bdc63d50 100644
--- a/arch/powerpc/platforms/pseries/kexec.c
+++ b/arch/powerpc/platforms/pseries/kexec.c
@@ -25,20 +25,30 @@ static void pseries_kexec_cpu_down(int crash_shutdown, int secondary)
 {
         /* Don't risk a hypervisor call if we're crashing */
         if (firmware_has_feature(FW_FEATURE_SPLPAR) && !crash_shutdown) {
-                unsigned long addr;
+                int ret;
+                int cpu = smp_processor_id();
+                int hwcpu = hard_smp_processor_id();
 
-                addr = __pa(get_slb_shadow());
-                if (unregister_slb_shadow(hard_smp_processor_id(), addr))
-                        printk("SLB shadow buffer deregistration of "
-                               "cpu %u (hw_cpu_id %d) failed\n",
-                               smp_processor_id(),
-                               hard_smp_processor_id());
+                if (get_lppaca()->dtl_enable_mask) {
+                        ret = unregister_dtl(hwcpu);
+                        if (ret) {
+                                pr_err("WARNING: DTL deregistration for cpu "
+                                       "%d (hw %d) failed with %d\n",
+                                       cpu, hwcpu, ret);
+                        }
+                }
+
+                ret = unregister_slb_shadow(hwcpu);
+                if (ret) {
+                        pr_err("WARNING: SLB shadow buffer deregistration "
+                               "for cpu %d (hw %d) failed with %d\n",
+                               cpu, hwcpu, ret);
+                }
 
-                addr = __pa(get_lppaca());
-                if (unregister_vpa(hard_smp_processor_id(), addr)) {
-                        printk("VPA deregistration of cpu %u (hw_cpu_id %d) "
-                                        "failed\n", smp_processor_id(),
-                                        hard_smp_processor_id());
+                ret = unregister_vpa(hwcpu);
+                if (ret) {
+                        pr_err("WARNING: VPA deregistration for cpu %d "
+                               "(hw %d) failed with %d\n", cpu, hwcpu, ret);
                 }
         }
 }
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index f7205d344efd..c9a29dae8c05 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -67,9 +67,8 @@ void vpa_init(int cpu)
         ret = register_vpa(hwcpu, addr);
 
         if (ret) {
-                printk(KERN_ERR "WARNING: vpa_init: VPA registration for "
-                                "cpu %d (hw %d) of area %lx returns %ld\n",
-                                cpu, hwcpu, addr, ret);
+                pr_err("WARNING: VPA registration for cpu %d (hw %d) of area "
+                       "%lx failed with %ld\n", cpu, hwcpu, addr, ret);
                 return;
         }
         /*
@@ -80,10 +79,9 @@ void vpa_init(int cpu)
         if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
                 ret = register_slb_shadow(hwcpu, addr);
                 if (ret)
-                        printk(KERN_ERR
-                               "WARNING: vpa_init: SLB shadow buffer "
-                               "registration for cpu %d (hw %d) of area %lx "
-                               "returns %ld\n", cpu, hwcpu, addr, ret);
+                        pr_err("WARNING: SLB shadow buffer registration for "
+                               "cpu %d (hw %d) of area %lx failed with %ld\n",
+                               cpu, hwcpu, addr, ret);
         }
 
         /*
@@ -100,8 +98,9 @@ void vpa_init(int cpu)
                 dtl->enqueue_to_dispatch_time = DISPATCH_LOG_BYTES;
                 ret = register_dtl(hwcpu, __pa(dtl));
                 if (ret)
-                        pr_warn("DTL registration failed for cpu %d (%ld)\n",
-                                cpu, ret);
+                        pr_err("WARNING: DTL registration of cpu %d (hw %d) "
+                               "failed with %ld\n", smp_processor_id(),
+                               hwcpu, ret);
                 lppaca_of(cpu).dtl_enable_mask = 2;
         }
 }
@@ -204,7 +203,7 @@ static void pSeries_lpar_hptab_clear(void)
                 unsigned long ptel;
         } ptes[4];
         long lpar_rc;
-        int i, j;
+        unsigned long i, j;
 
         /* Read in batches of 4,
          * invalidate only valid entries not in the VRMA
diff --git a/arch/powerpc/platforms/pseries/plpar_wrappers.h b/arch/powerpc/platforms/pseries/plpar_wrappers.h
index 4bf21207d7d3..41c24c146d6a 100644
--- a/arch/powerpc/platforms/pseries/plpar_wrappers.h
+++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h
@@ -53,9 +53,9 @@ static inline long vpa_call(unsigned long flags, unsigned long cpu,
         return plpar_hcall_norets(H_REGISTER_VPA, flags, cpu, vpa);
 }
 
-static inline long unregister_vpa(unsigned long cpu, unsigned long vpa)
+static inline long unregister_vpa(unsigned long cpu)
 {
-        return vpa_call(0x5, cpu, vpa);
+        return vpa_call(0x5, cpu, 0);
 }
 
 static inline long register_vpa(unsigned long cpu, unsigned long vpa)
@@ -63,9 +63,9 @@ static inline long register_vpa(unsigned long cpu, unsigned long vpa)
         return vpa_call(0x1, cpu, vpa);
 }
 
-static inline long unregister_slb_shadow(unsigned long cpu, unsigned long vpa)
+static inline long unregister_slb_shadow(unsigned long cpu)
 {
-        return vpa_call(0x7, cpu, vpa);
+        return vpa_call(0x7, cpu, 0);
 }
 
 static inline long register_slb_shadow(unsigned long cpu, unsigned long vpa)
@@ -73,9 +73,9 @@ static inline long register_slb_shadow(unsigned long cpu, unsigned long vpa)
         return vpa_call(0x3, cpu, vpa);
 }
 
-static inline long unregister_dtl(unsigned long cpu, unsigned long vpa)
+static inline long unregister_dtl(unsigned long cpu)
 {
-        return vpa_call(0x6, cpu, vpa);
+        return vpa_call(0x6, cpu, 0);
 }
 
 static inline long register_dtl(unsigned long cpu, unsigned long vpa)
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index d00e52926b71..0969fd98c4fa 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -324,8 +324,9 @@ static int alloc_dispatch_logs(void)
         dtl->enqueue_to_dispatch_time = DISPATCH_LOG_BYTES;
         ret = register_dtl(hard_smp_processor_id(), __pa(dtl));
         if (ret)
-                pr_warn("DTL registration failed for boot cpu %d (%d)\n",
-                        smp_processor_id(), ret);
+                pr_err("WARNING: DTL registration of cpu %d (hw %d) failed "
+                       "with %d\n", smp_processor_id(),
+                       hard_smp_processor_id(), ret);
         get_paca()->lppaca_ptr->dtl_enable_mask = 2;
 
         return 0;
diff --git a/arch/powerpc/sysdev/ppc4xx_pci.c b/arch/powerpc/sysdev/ppc4xx_pci.c
index a59ba96d2c21..dbfe96bc878a 100644
--- a/arch/powerpc/sysdev/ppc4xx_pci.c
+++ b/arch/powerpc/sysdev/ppc4xx_pci.c
@@ -655,8 +655,6 @@ struct ppc4xx_pciex_hwops
 
 static struct ppc4xx_pciex_hwops *ppc4xx_pciex_hwops;
 
-#ifdef CONFIG_44x
-
 static int __init ppc4xx_pciex_wait_on_sdr(struct ppc4xx_pciex_port *port,
                                            unsigned int sdr_offset,
                                            unsigned int mask,
@@ -688,6 +686,7 @@ static int __init ppc4xx_pciex_port_reset_sdr(struct ppc4xx_pciex_port *port)
         return 0;
 }
 
+
 static void __init ppc4xx_pciex_check_link_sdr(struct ppc4xx_pciex_port *port)
 {
         printk(KERN_INFO "PCIE%d: Checking link...\n", port->index);
@@ -718,6 +717,8 @@ static void __init ppc4xx_pciex_check_link_sdr(struct ppc4xx_pciex_port *port)
                 printk(KERN_INFO "PCIE%d: No device detected.\n", port->index);
 }
 
+#ifdef CONFIG_44x
+
 /* Check various reset bits of the 440SPe PCIe core */
 static int __init ppc440spe_pciex_check_reset(struct device_node *np)
 {
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 490e5418740d..7429b47c3aca 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -1256,13 +1256,14 @@ static int __init ds_init(void)
 {
         unsigned long hv_ret, major, minor;
 
-        hv_ret = sun4v_get_version(HV_GRP_REBOOT_DATA, &major, &minor);
-        if (hv_ret == HV_EOK) {
-                pr_info("SUN4V: Reboot data supported (maj=%lu,min=%lu).\n",
-                        major, minor);
-                reboot_data_supported = 1;
+        if (tlb_type == hypervisor) {
+                hv_ret = sun4v_get_version(HV_GRP_REBOOT_DATA, &major, &minor);
+                if (hv_ret == HV_EOK) {
+                        pr_info("SUN4V: Reboot data supported (maj=%lu,min=%lu).\n",
+                                major, minor);
+                        reboot_data_supported = 1;
+                }
         }
-
         kthread_run(ds_thread, NULL, "kldomd");
 
         return vio_register_driver(&ds_driver);
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index 7b439d9aea2a..41935fadfdfc 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -27,8 +27,8 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
 
         desc->base2             = (info->base_addr & 0xff000000) >> 24;
         /*
-         * Don't allow setting of the lm bit. It is useless anyway
-         * because 64bit system calls require __USER_CS:
+         * Don't allow setting of the lm bit. It would confuse
+         * user_64bit_mode and would get overridden by sysret anyway.
          */
         desc->l                 = 0;
 }
diff --git a/arch/x86/include/asm/irq_vectors.h b/arch/x86/include/asm/irq_vectors.h
index f9a320984a10..7e50f06393aa 100644
--- a/arch/x86/include/asm/irq_vectors.h
+++ b/arch/x86/include/asm/irq_vectors.h
@@ -17,7 +17,6 @@
  *  Vectors   0 ...  31 : system traps and exceptions - hardcoded events
  *  Vectors  32 ... 127 : device interrupts
  *  Vector  128         : legacy int80 syscall interface
- *  Vector  204         : legacy x86_64 vsyscall emulation
  *  Vectors 129 ... INVALIDATE_TLB_VECTOR_START-1 except 204 : device interrupts
  *  Vectors INVALIDATE_TLB_VECTOR_START ... 255 : special interrupts
  *
@@ -51,9 +50,6 @@
 #ifdef CONFIG_X86_32
 # define SYSCALL_VECTOR                 0x80
 #endif
-#ifdef CONFIG_X86_64
-# define VSYSCALL_EMU_VECTOR            0xcc
-#endif
 
 /*
  * Vectors 0x30-0x3f are used for ISA interrupts.
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 2c7652163111..8e8b9a4987ee 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -41,6 +41,7 @@
 
 #include <asm/desc_defs.h>
 #include <asm/kmap_types.h>
+#include <asm/pgtable_types.h>
 
 struct page;
 struct thread_struct;
@@ -63,6 +64,11 @@ struct paravirt_callee_save {
 struct pv_info {
         unsigned int kernel_rpl;
         int shared_kernel_pmd;
+
+#ifdef CONFIG_X86_64
+        u16 extra_user_64bit_cs;  /* __USER_CS if none */
+#endif
+
         int paravirt_enabled;
         const char *name;
 };
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 94e7618fcac8..35664547125b 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -131,6 +131,9 @@ struct pt_regs {
 #ifdef __KERNEL__
 
 #include <linux/init.h>
+#ifdef CONFIG_PARAVIRT
+#include <asm/paravirt_types.h>
+#endif
 
 struct cpuinfo_x86;
 struct task_struct;
@@ -187,6 +190,22 @@ static inline int v8086_mode(struct pt_regs *regs)
 #endif
 }
 
+#ifdef CONFIG_X86_64
+static inline bool user_64bit_mode(struct pt_regs *regs)
+{
+#ifndef CONFIG_PARAVIRT
+        /*
+         * On non-paravirt systems, this is the only long mode CPL 3
+         * selector.  We do not allow long mode selectors in the LDT.
+         */
+        return regs->cs == __USER_CS;
+#else
+        /* Headers are too twisted for this to go in paravirt.h. */
+        return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
+#endif
+}
+#endif
+
 /*
  * X86_32 CPUs don't save ss and esp if the CPU is already in kernel mode
  * when it traps.  The previous stack will be directly underneath the saved
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 2bae0a513b40..0012d0902c5f 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -40,7 +40,6 @@ asmlinkage void alignment_check(void);
 asmlinkage void machine_check(void);
 #endif /* CONFIG_X86_MCE */
 asmlinkage void simd_coprocessor_error(void);
-asmlinkage void emulate_vsyscall(void);
 
 dotraplinkage void do_divide_error(struct pt_regs *, long);
 dotraplinkage void do_debug(struct pt_regs *, long);
@@ -67,7 +66,6 @@ dotraplinkage void do_alignment_check(struct pt_regs *, long);
 dotraplinkage void do_machine_check(struct pt_regs *, long);
 #endif
 dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long);
-dotraplinkage void do_emulate_vsyscall(struct pt_regs *, long);
 #ifdef CONFIG_X86_32
 dotraplinkage void do_iret_error(struct pt_regs *, long);
 #endif
diff --git a/arch/x86/include/asm/unistd_64.h b/arch/x86/include/asm/unistd_64.h
index 705bf139288c..d92641cc7acc 100644
--- a/arch/x86/include/asm/unistd_64.h
+++ b/arch/x86/include/asm/unistd_64.h
@@ -681,6 +681,8 @@ __SYSCALL(__NR_syncfs, sys_syncfs)
 __SYSCALL(__NR_sendmmsg, sys_sendmmsg)
 #define __NR_setns                              308
 __SYSCALL(__NR_setns, sys_setns)
+#define __NR_getcpu                             309
+__SYSCALL(__NR_getcpu, sys_getcpu)
 
 #ifndef __NO_STUBS
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
index 60107072c28b..eaea1d31f753 100644
--- a/arch/x86/include/asm/vsyscall.h
+++ b/arch/x86/include/asm/vsyscall.h
@@ -27,6 +27,12 @@ extern struct timezone sys_tz;
 
 extern void map_vsyscall(void);
 
+/*
+ * Called on instruction fetch fault in vsyscall page.
+ * Returns true if handled.
+ */
+extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address);
+
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_X86_VSYSCALL_H */
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 04105574c8e9..82f2912155a5 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -17,19 +17,6 @@ CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_early_printk.o = -pg
 endif
 
-#
-# vsyscalls (which work on the user stack) should have
-# no stack-protector checks:
-#
-nostackp := $(call cc-option, -fno-stack-protector)
-CFLAGS_vsyscall_64.o    := $(PROFILING) -g0 $(nostackp)
-CFLAGS_hpet.o           := $(nostackp)
-CFLAGS_paravirt.o       := $(nostackp)
-GCOV_PROFILE_vsyscall_64.o      := n
-GCOV_PROFILE_hpet.o             := n
-GCOV_PROFILE_tsc.o              := n
-GCOV_PROFILE_paravirt.o         := n
-
 obj-y                   := process_$(BITS).o signal.o entry_$(BITS).o
 obj-y                   += traps.o irq.o irq_$(BITS).o dumpstack_$(BITS).o
 obj-y                   += time.o ioport.o ldt.o dumpstack.o
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 45fbb8f7f549..f88af2c2a561 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1590,6 +1590,7 @@ static __init int intel_pmu_init(void)
                 break;
 
         case 42: /* SandyBridge */
+        case 45: /* SandyBridge, "Romely-EP" */
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
 
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index e13329d800c8..6419bb05ecd5 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1111,7 +1111,6 @@ zeroentry spurious_interrupt_bug do_spurious_interrupt_bug
 zeroentry coprocessor_error do_coprocessor_error
 errorentry alignment_check do_alignment_check
 zeroentry simd_coprocessor_error do_simd_coprocessor_error
-zeroentry emulate_vsyscall do_emulate_vsyscall
 
 
         /* Reload gs selector with exception handling */
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 613a7931ecc1..d90272e6bc40 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -307,6 +307,10 @@ struct pv_info pv_info = {
         .paravirt_enabled = 0,
         .kernel_rpl = 0,
         .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
+
+#ifdef CONFIG_X86_64
+        .extra_user_64bit_cs = __USER_CS,
+#endif
 };
 
 struct pv_init_ops pv_init_ops = {
diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
index 7977f0cfe339..c346d1161488 100644
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -74,7 +74,7 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
 
 #ifdef CONFIG_X86_64
                 case 0x40 ... 0x4f:
-                        if (regs->cs != __USER_CS)
+                        if (!user_64bit_mode(regs))
                                 /* 32-bit mode: register increment */
                                 return 0;
                         /* 64-bit mode: REX prefix */
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 9682ec50180c..6913369c234c 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -872,12 +872,6 @@ void __init trap_init(void)
         set_bit(SYSCALL_VECTOR, used_vectors);
 #endif
 
-#ifdef CONFIG_X86_64
-        BUG_ON(test_bit(VSYSCALL_EMU_VECTOR, used_vectors));
-        set_system_intr_gate(VSYSCALL_EMU_VECTOR, &emulate_vsyscall);
-        set_bit(VSYSCALL_EMU_VECTOR, used_vectors);
-#endif
-
         /*
          * Should be a barrier for any external CPU state:
          */
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 4aa9c54a9b76..0f703f10901a 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -71,7 +71,6 @@ PHDRS {
         text PT_LOAD FLAGS(5);          /* R_E */
         data PT_LOAD FLAGS(6);          /* RW_ */
 #ifdef CONFIG_X86_64
-        user PT_LOAD FLAGS(5);          /* R_E */
 #ifdef CONFIG_SMP
         percpu PT_LOAD FLAGS(6);        /* RW_ */
 #endif
@@ -154,44 +153,16 @@ SECTIONS
 
 #ifdef CONFIG_X86_64
 
-#define VSYSCALL_ADDR (-10*1024*1024)
-
-#define VLOAD_OFFSET (VSYSCALL_ADDR - __vsyscall_0 + LOAD_OFFSET)
-#define VLOAD(x) (ADDR(x) - VLOAD_OFFSET)
-
-#define VVIRT_OFFSET (VSYSCALL_ADDR - __vsyscall_0)
-#define VVIRT(x) (ADDR(x) - VVIRT_OFFSET)
-
-        . = ALIGN(4096);
-        __vsyscall_0 = .;
-
-        . = VSYSCALL_ADDR;
-        .vsyscall : AT(VLOAD(.vsyscall)) {
-                *(.vsyscall_0)
-
-                . = 1024;
-                *(.vsyscall_1)
-
-                . = 2048;
-                *(.vsyscall_2)
-
-                . = 4096;  /* Pad the whole page. */
-        } :user =0xcc
-        . = ALIGN(__vsyscall_0 + PAGE_SIZE, PAGE_SIZE);
-
-#undef VSYSCALL_ADDR
-#undef VLOAD_OFFSET
-#undef VLOAD
-#undef VVIRT_OFFSET
-#undef VVIRT
-
+        . = ALIGN(PAGE_SIZE);
         __vvar_page = .;
 
         .vvar : AT(ADDR(.vvar) - LOAD_OFFSET) {
+                /* work around gold bug 13023 */
+                __vvar_beginning_hack = .;
 
-              /* Place all vvars at the offsets in asm/vvar.h. */
-#define EMIT_VVAR(name, offset)                 \
-                . = offset;             \
+                /* Place all vvars at the offsets in asm/vvar.h. */
+#define EMIT_VVAR(name, offset)                         \
+                . = __vvar_beginning_hack + offset;     \
                 *(.vvar_ ## name)
 #define __VVAR_KERNEL_LDS
 #include <asm/vvar.h>
diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
index dda7dff9cef7..18ae83dd1cd7 100644
--- a/arch/x86/kernel/vsyscall_64.c
+++ b/arch/x86/kernel/vsyscall_64.c
@@ -18,9 +18,6 @@
  *  use the vDSO.
  */
 
-/* Disable profiling for userspace code: */
-#define DISABLE_BRANCH_PROFILING
-
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -50,12 +47,36 @@
 #include <asm/vgtod.h>
 #include <asm/traps.h>
 
+#define CREATE_TRACE_POINTS
+#include "vsyscall_trace.h"
+
 DEFINE_VVAR(int, vgetcpu_mode);
 DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
 {
         .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
 };
 
+static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
+
+static int __init vsyscall_setup(char *str)
+{
+        if (str) {
+                if (!strcmp("emulate", str))
+                        vsyscall_mode = EMULATE;
+                else if (!strcmp("native", str))
+                        vsyscall_mode = NATIVE;
+                else if (!strcmp("none", str))
+                        vsyscall_mode = NONE;
+                else
+                        return -EINVAL;
+
+                return 0;
+        }
+
+        return -EINVAL;
+}
+early_param("vsyscall", vsyscall_setup);
+
 void update_vsyscall_tz(void)
 {
         unsigned long flags;
@@ -100,7 +121,7 @@ static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
 
         printk("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
                level, tsk->comm, task_pid_nr(tsk),
-               message, regs->ip - 2, regs->cs,
+               message, regs->ip, regs->cs,
                regs->sp, regs->ax, regs->si, regs->di);
 }
 
@@ -118,46 +139,39 @@ static int addr_to_vsyscall_nr(unsigned long addr)
         return nr;
 }
 
-void dotraplinkage do_emulate_vsyscall(struct pt_regs *regs, long error_code)
+bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 {
         struct task_struct *tsk;
         unsigned long caller;
         int vsyscall_nr;
         long ret;
 
-        local_irq_enable();
-
         /*
-         * Real 64-bit user mode code has cs == __USER_CS.  Anything else
-         * is bogus.
+         * No point in checking CS -- the only way to get here is a user mode
+         * trap to a high address, which means that we're in 64-bit user code.
          */
-        if (regs->cs != __USER_CS) {
-                /*
-                 * If we trapped from kernel mode, we might as well OOPS now
-                 * instead of returning to some random address and OOPSing
-                 * then.
-                 */
-                BUG_ON(!user_mode(regs));
 
-                /* Compat mode and non-compat 32-bit CS should both segfault. */
-                warn_bad_vsyscall(KERN_WARNING, regs,
-                                  "illegal int 0xcc from 32-bit mode");
-                goto sigsegv;
+        WARN_ON_ONCE(address != regs->ip);
+
+        if (vsyscall_mode == NONE) {
+                warn_bad_vsyscall(KERN_INFO, regs,
+                                  "vsyscall attempted with vsyscall=none");
+                return false;
         }
 
-        /*
-         * x86-ism here: regs->ip points to the instruction after the int 0xcc,
-         * and int 0xcc is two bytes long.
-         */
-        vsyscall_nr = addr_to_vsyscall_nr(regs->ip - 2);
+        vsyscall_nr = addr_to_vsyscall_nr(address);
+
+        trace_emulate_vsyscall(vsyscall_nr);
+
         if (vsyscall_nr < 0) {
                 warn_bad_vsyscall(KERN_WARNING, regs,
-                                  "illegal int 0xcc (exploit attempt?)");
+                                  "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
                 goto sigsegv;
         }
 
         if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
-                warn_bad_vsyscall(KERN_WARNING, regs, "int 0xcc with bad stack (exploit attempt?)");
+                warn_bad_vsyscall(KERN_WARNING, regs,
+                                  "vsyscall with bad stack (exploit attempt?)");
                 goto sigsegv;
         }
 
@@ -202,13 +216,11 @@ void dotraplinkage do_emulate_vsyscall(struct pt_regs *regs, long error_code)
         regs->ip = caller;
         regs->sp += 8;
 
-        local_irq_disable();
-        return;
+        return true;
 
 sigsegv:
-        regs->ip -= 2;  /* The faulting instruction should be the int 0xcc. */
         force_sig(SIGSEGV, current);
-        local_irq_disable();
+        return true;
 }
 
 /*
@@ -256,15 +268,21 @@ cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
 
 void __init map_vsyscall(void)
 {
-        extern char __vsyscall_0;
-        unsigned long physaddr_page0 = __pa_symbol(&__vsyscall_0);
+        extern char __vsyscall_page;
+        unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
         extern char __vvar_page;
         unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
 
-        /* Note that VSYSCALL_MAPPED_PAGES must agree with the code below. */
-        __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_page0, PAGE_KERNEL_VSYSCALL);
+        __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
+                     vsyscall_mode == NATIVE
+                     ? PAGE_KERNEL_VSYSCALL
+                     : PAGE_KERNEL_VVAR);
+        BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
+                     (unsigned long)VSYSCALL_START);
+
         __set_fixmap(VVAR_PAGE, physaddr_vvar_page, PAGE_KERNEL_VVAR);
-        BUILD_BUG_ON((unsigned long)__fix_to_virt(VVAR_PAGE) != (unsigned long)VVAR_ADDRESS);
+        BUILD_BUG_ON((unsigned long)__fix_to_virt(VVAR_PAGE) !=
+                     (unsigned long)VVAR_ADDRESS);
 }
 
 static int __init vsyscall_init(void)
diff --git a/arch/x86/kernel/vsyscall_emu_64.S b/arch/x86/kernel/vsyscall_emu_64.S
index ffa845eae5ca..c9596a9af159 100644
--- a/arch/x86/kernel/vsyscall_emu_64.S
+++ b/arch/x86/kernel/vsyscall_emu_64.S
@@ -7,21 +7,31 @@
  */
 
 #include <linux/linkage.h>
+
 #include <asm/irq_vectors.h>
+#include <asm/page_types.h>
+#include <asm/unistd_64.h>
+
+__PAGE_ALIGNED_DATA
+        .globl __vsyscall_page
+        .balign PAGE_SIZE, 0xcc
+        .type __vsyscall_page, @object
+__vsyscall_page:
+
+        mov $__NR_gettimeofday, %rax
+        syscall
+        ret
 
-/* The unused parts of the page are filled with 0xcc by the linker script. */
+        .balign 1024, 0xcc
+        mov $__NR_time, %rax
+        syscall
+        ret
 
-.section .vsyscall_0, "a"
-ENTRY(vsyscall_0)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_0)
+        .balign 1024, 0xcc
+        mov $__NR_getcpu, %rax
+        syscall
+        ret
 
-.section .vsyscall_1, "a"
-ENTRY(vsyscall_1)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_1)
+        .balign 4096, 0xcc
 
-.section .vsyscall_2, "a"
-ENTRY(vsyscall_2)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_2)
+        .size __vsyscall_page, 4096
diff --git a/arch/x86/kernel/vsyscall_trace.h b/arch/x86/kernel/vsyscall_trace.h
new file mode 100644
index 000000000000..a8b2edec54fe
--- /dev/null
+++ b/arch/x86/kernel/vsyscall_trace.h
@@ -0,0 +1,29 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM vsyscall
+
+#if !defined(__VSYSCALL_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define __VSYSCALL_TRACE_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(emulate_vsyscall,
+
+            TP_PROTO(int nr),
+
+            TP_ARGS(nr),
+
+            TP_STRUCT__entry(__field(int, nr)),
+
+            TP_fast_assign(
+                           __entry->nr = nr;
+                           ),
+
+            TP_printk("nr = %d", __entry->nr)
+);
+
+#endif
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../arch/x86/kernel
+#define TRACE_INCLUDE_FILE vsyscall_trace
+#include <trace/define_trace.h>
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 4d09df054e39..247aae3dc008 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -105,7 +105,7 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
                  * but for now it's good enough to assume that long
                  * mode only uses well known segments or kernel.
                  */
-                return (!user_mode(regs)) || (regs->cs == __USER_CS);
+                return (!user_mode(regs) || user_64bit_mode(regs));
 #endif
         case 0x60:
                 /* 0x64 thru 0x67 are valid prefixes in all modes. */
@@ -720,6 +720,18 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
                 if (is_errata100(regs, address))
                         return;
 
+#ifdef CONFIG_X86_64
+                /*
+                 * Instruction fetch faults in the vsyscall page might need
+                 * emulation.
+                 */
+                if (unlikely((error_code & PF_INSTR) &&
+                             ((address & ~0xfff) == VSYSCALL_START))) {
+                        if (emulate_vsyscall(regs, address))
+                                return;
+                }
+#endif
+
                 if (unlikely(show_unhandled_signals))
                         show_signal_msg(regs, error_code, address, tsk);
 
diff --git a/arch/x86/vdso/vdso.S b/arch/x86/vdso/vdso.S
index 1b979c12ba85..01f5e3b4613c 100644
--- a/arch/x86/vdso/vdso.S
+++ b/arch/x86/vdso/vdso.S
@@ -9,6 +9,7 @@ __PAGE_ALIGNED_DATA
 vdso_start:
         .incbin "arch/x86/vdso/vdso.so"
 vdso_end:
+        .align PAGE_SIZE /* extra data here leaks to userspace. */
 
 .previous
 
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 974a528458a0..e2345af01af0 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -951,6 +951,10 @@ static const struct pv_info xen_info __initconst = {
         .paravirt_enabled = 1,
         .shared_kernel_pmd = 0,
 
+#ifdef CONFIG_X86_64
+        .extra_user_64bit_cs = FLAT_USER_CS64,
+#endif
+
         .name = "Xen",
 };
 
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index f987bde77c49..8cce339db5e7 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1916,6 +1916,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 # endif
 #else
         case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE:
+        case VVAR_PAGE:
 #endif
         case FIX_TEXT_POKE0:
         case FIX_TEXT_POKE1:
@@ -1956,7 +1957,8 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 #ifdef CONFIG_X86_64
         /* Replicate changes to map the vsyscall page into the user
            pagetable vsyscall mapping. */
-        if (idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) {
+        if ((idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) ||
+            idx == VVAR_PAGE) {
                 unsigned long vaddr = __fix_to_virt(idx);
                 set_pte_vaddr_pud(level3_user_vsyscall, vaddr, pte);
         }
diff --git a/drivers/base/regmap/regmap-i2c.c b/drivers/base/regmap/regmap-i2c.c
index c2231ff06cbc..c4f7a45cd2c3 100644
--- a/drivers/base/regmap/regmap-i2c.c
+++ b/drivers/base/regmap/regmap-i2c.c
@@ -113,3 +113,4 @@ struct regmap *regmap_init_i2c(struct i2c_client *i2c,
 }
 EXPORT_SYMBOL_GPL(regmap_init_i2c);
 
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c
index 4deba0621bc7..2bbc65999a5f 100644
--- a/drivers/base/regmap/regmap-spi.c
+++ b/drivers/base/regmap/regmap-spi.c
@@ -70,3 +70,5 @@ struct regmap *regmap_init_spi(struct spi_device *spi,
         return regmap_init(&spi->dev, &regmap_spi, config);
 }
 EXPORT_SYMBOL_GPL(regmap_init_spi);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index cf3565cae93d..0eef4da1ac61 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -317,7 +317,7 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
                 u8[0] |= map->bus->read_flag_mask;
 
         ret = map->bus->read(map->dev, map->work_buf, map->format.reg_bytes,
-                             val, map->format.val_bytes);
+                             val, val_len);
         if (ret != 0)
                 return ret;
 
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index 196a7378d332..be21e3f138a8 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -80,6 +80,7 @@
 #include <linux/interrupt.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
+#include <linux/dma-mapping.h>
 #include <linux/dmapool.h>
 #include <linux/dmaengine.h>
 #include <linux/amba/bus.h>
diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
index 1a409c5bc9bc..c316294c48b4 100644
--- a/drivers/hwmon/ibmaem.c
+++ b/drivers/hwmon/ibmaem.c
@@ -432,13 +432,15 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
         aem_send_message(ipmi);
 
         res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
-        if (!res)
-                return -ETIMEDOUT;
+        if (!res) {
+                res = -ETIMEDOUT;
+                goto out;
+        }
 
         if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
             memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
-                kfree(rs_resp);
-                return -ENOENT;
+                res = -ENOENT;
+                goto out;
         }
 
         switch (size) {
@@ -463,8 +465,11 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
                 break;
         }
         }
+        res = 0;
 
-        return 0;
+out:
+        kfree(rs_resp);
+        return res;
 }
 
 /* Update AEM energy registers */
diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
index d4bc114572de..ac254fba551b 100644
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -161,6 +161,17 @@ static int lm25066_write_word_data(struct i2c_client *client, int page, int reg,
         return ret;
 }
 
+static int lm25066_write_byte(struct i2c_client *client, int page, u8 value)
+{
+        if (page > 1)
+                return -EINVAL;
+
+        if (page == 0)
+                return pmbus_write_byte(client, 0, value);
+
+        return 0;
+}
+
 static int lm25066_probe(struct i2c_client *client,
                           const struct i2c_device_id *id)
 {
@@ -204,6 +215,7 @@ static int lm25066_probe(struct i2c_client *client,
 
         info->read_word_data = lm25066_read_word_data;
         info->write_word_data = lm25066_write_word_data;
+        info->write_byte = lm25066_write_byte;
 
         switch (id->driver_data) {
         case lm25066:
diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h
index 0808d986d75b..a6ae20ffef6b 100644
--- a/drivers/hwmon/pmbus/pmbus.h
+++ b/drivers/hwmon/pmbus/pmbus.h
@@ -325,6 +325,7 @@ struct pmbus_driver_info {
         int (*read_word_data)(struct i2c_client *client, int page, int reg);
         int (*write_word_data)(struct i2c_client *client, int page, int reg,
                                u16 word);
+        int (*write_byte)(struct i2c_client *client, int page, u8 value);
         /*
          * The identify function determines supported PMBus functionality.
          * This function is only necessary if a chip driver supports multiple
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 5c1b6cf31701..a561c3a0e916 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -182,6 +182,24 @@ int pmbus_write_byte(struct i2c_client *client, int page, u8 value)
 }
 EXPORT_SYMBOL_GPL(pmbus_write_byte);
 
+/*
+ * _pmbus_write_byte() is similar to pmbus_write_byte(), but checks if
+ * a device specific mapping funcion exists and calls it if necessary.
+ */
+static int _pmbus_write_byte(struct i2c_client *client, int page, u8 value)
+{
+        struct pmbus_data *data = i2c_get_clientdata(client);
+        const struct pmbus_driver_info *info = data->info;
+        int status;
+
+        if (info->write_byte) {
+                status = info->write_byte(client, page, value);
+                if (status != -ENODATA)
+                        return status;
+        }
+        return pmbus_write_byte(client, page, value);
+}
+
 int pmbus_write_word_data(struct i2c_client *client, u8 page, u8 reg, u16 word)
 {
         int rv;
@@ -281,7 +299,7 @@ static int _pmbus_read_byte_data(struct i2c_client *client, int page, int reg)
 
 static void pmbus_clear_fault_page(struct i2c_client *client, int page)
 {
-        pmbus_write_byte(client, page, PMBUS_CLEAR_FAULTS);
+        _pmbus_write_byte(client, page, PMBUS_CLEAR_FAULTS);
 }
 
 void pmbus_clear_faults(struct i2c_client *client)
diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
index efec4139c3f6..68cd05b6d829 100644
--- a/drivers/misc/cb710/core.c
+++ b/drivers/misc/cb710/core.c
@@ -33,7 +33,7 @@ EXPORT_SYMBOL_GPL(cb710_pci_update_config_reg);
 static int __devinit cb710_pci_configure(struct pci_dev *pdev)
 {
         unsigned int devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
-        struct pci_dev *pdev0 = pci_get_slot(pdev->bus, devfn);
+        struct pci_dev *pdev0;
         u32 val;
 
         cb710_pci_update_config_reg(pdev, 0x48,
@@ -43,6 +43,7 @@ static int __devinit cb710_pci_configure(struct pci_dev *pdev)
         if (val & 0x80000000)
                 return 0;
 
+        pdev0 = pci_get_slot(pdev->bus, devfn);
         if (!pdev0)
                 return -ENODEV;
 
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index 006a5e9f8ab8..2bf229acd3b8 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -224,7 +224,7 @@ static void mmc_test_prepare_mrq(struct mmc_test_card *test,
 static int mmc_test_busy(struct mmc_command *cmd)
 {
         return !(cmd->resp[0] & R1_READY_FOR_DATA) ||
-                (R1_CURRENT_STATE(cmd->resp[0]) == 7);
+                (R1_CURRENT_STATE(cmd->resp[0]) == R1_STATE_PRG);
 }
 
 /*
@@ -2900,7 +2900,7 @@ static const struct file_operations mmc_test_fops_testlist = {
         .release        = single_release,
 };
 
-static void mmc_test_free_file_test(struct mmc_card *card)
+static void mmc_test_free_dbgfs_file(struct mmc_card *card)
 {
         struct mmc_test_dbgfs_file *df, *dfs;
 
@@ -2917,34 +2917,21 @@ static void mmc_test_free_file_test(struct mmc_card *card)
         mutex_unlock(&mmc_test_lock);
 }
 
-static int mmc_test_register_file_test(struct mmc_card *card)
+static int __mmc_test_register_dbgfs_file(struct mmc_card *card,
+        const char *name, mode_t mode, const struct file_operations *fops)
 {
         struct dentry *file = NULL;
         struct mmc_test_dbgfs_file *df;
-        int ret = 0;
-
-        mutex_lock(&mmc_test_lock);
-
-        if (card->debugfs_root)
-                file = debugfs_create_file("test", S_IWUSR | S_IRUGO,
-                        card->debugfs_root, card, &mmc_test_fops_test);
-
-        if (IS_ERR_OR_NULL(file)) {
-                dev_err(&card->dev,
-                        "Can't create test. Perhaps debugfs is disabled.\n");
-                ret = -ENODEV;
-                goto err;
-        }
 
         if (card->debugfs_root)
-                file = debugfs_create_file("testlist", S_IRUGO,
-                        card->debugfs_root, card, &mmc_test_fops_testlist);
+                file = debugfs_create_file(name, mode, card->debugfs_root,
+                        card, fops);
 
         if (IS_ERR_OR_NULL(file)) {
                 dev_err(&card->dev,
-                        "Can't create testlist. Perhaps debugfs is disabled.\n");
-                ret = -ENODEV;
-                goto err;
+                        "Can't create %s. Perhaps debugfs is disabled.\n",
+                        name);
+                return -ENODEV;
         }
 
         df = kmalloc(sizeof(struct mmc_test_dbgfs_file), GFP_KERNEL);
@@ -2952,14 +2939,31 @@ static int mmc_test_register_file_test(struct mmc_card *card)
                 debugfs_remove(file);
                 dev_err(&card->dev,
                         "Can't allocate memory for internal usage.\n");
-                ret = -ENOMEM;
-                goto err;
+                return -ENOMEM;
         }
 
         df->card = card;
         df->file = file;
 
         list_add(&df->link, &mmc_test_file_test);
+        return 0;
+}
+
+static int mmc_test_register_dbgfs_file(struct mmc_card *card)
+{
+        int ret;
+
+        mutex_lock(&mmc_test_lock);
+
+        ret = __mmc_test_register_dbgfs_file(card, "test", S_IWUSR | S_IRUGO,
+                &mmc_test_fops_test);
+        if (ret)
+                goto err;
+
+        ret = __mmc_test_register_dbgfs_file(card, "testlist", S_IRUGO,
+                &mmc_test_fops_testlist);
+        if (ret)
+                goto err;
 
 err:
         mutex_unlock(&mmc_test_lock);
@@ -2974,7 +2978,7 @@ static int mmc_test_probe(struct mmc_card *card)
         if (!mmc_card_mmc(card) && !mmc_card_sd(card))
                 return -ENODEV;
 
-        ret = mmc_test_register_file_test(card);
+        ret = mmc_test_register_dbgfs_file(card);
         if (ret)
                 return ret;
 
@@ -2986,7 +2990,7 @@ static int mmc_test_probe(struct mmc_card *card)
 static void mmc_test_remove(struct mmc_card *card)
 {
         mmc_test_free_result(card);
-        mmc_test_free_file_test(card);
+        mmc_test_free_dbgfs_file(card);
 }
 
 static struct mmc_driver mmc_driver = {
@@ -3006,7 +3010,7 @@ static void __exit mmc_test_exit(void)
 {
         /* Clear stalled data if card is still plugged */
         mmc_test_free_result(NULL);
-        mmc_test_free_file_test(NULL);
+        mmc_test_free_dbgfs_file(NULL);
 
         mmc_unregister_driver(&mmc_driver);
 }
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 89bdeaec7182..91a0a7460ebb 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1502,7 +1502,7 @@ static int mmc_do_erase(struct mmc_card *card, unsigned int from,
                         goto out;
                 }
         } while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
-                 R1_CURRENT_STATE(cmd.resp[0]) == 7);
+                 R1_CURRENT_STATE(cmd.resp[0]) == R1_STATE_PRG);
 out:
         return err;
 }
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index aa7d1d79b8c5..5700b1cbdfec 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -259,7 +259,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
         }
 
         card->ext_csd.rev = ext_csd[EXT_CSD_REV];
-        if (card->ext_csd.rev > 5) {
+        if (card->ext_csd.rev > 6) {
                 printk(KERN_ERR "%s: unrecognised EXT_CSD revision %d\n",
                         mmc_hostname(card->host), card->ext_csd.rev);
                 err = -EINVAL;
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index 845ce7c533b9..770c3d06f5dc 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -407,7 +407,7 @@ int mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
                         break;
                 if (mmc_host_is_spi(card->host))
                         break;
-        } while (R1_CURRENT_STATE(status) == 7);
+        } while (R1_CURRENT_STATE(status) == R1_STATE_PRG);
 
         if (mmc_host_is_spi(card->host)) {
                 if (status & R1_SPI_ILLEGAL_COMMAND)
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 77f0b6b1681d..ff0f714b012c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -62,7 +62,7 @@ struct idmac_desc {
 
         u32             des1;   /* Buffer sizes */
 #define IDMAC_SET_BUFFER1_SIZE(d, s) \
-        ((d)->des1 = ((d)->des1 & 0x03ffc000) | ((s) & 0x3fff))
+        ((d)->des1 = ((d)->des1 & 0x03ffe000) | ((s) & 0x1fff))
 
         u32             des2;   /* buffer 1 physical address */
 
@@ -699,7 +699,7 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         }
 
         /* DDR mode set */
-        if (ios->ddr) {
+        if (ios->timing == MMC_TIMING_UHS_DDR50) {
                 regs = mci_readl(slot->host, UHS_REG);
                 regs |= (0x1 << slot->id) << 16;
                 mci_writel(slot->host, UHS_REG, regs);
@@ -1646,7 +1646,7 @@ static int __init dw_mci_init_slot(struct dw_mci *host, unsigned int id)
                         mmc->caps |= MMC_CAP_4_BIT_DATA;
 
         if (host->pdata->quirks & DW_MCI_QUIRK_HIGHSPEED)
-                mmc->caps |= MMC_CAP_SD_HIGHSPEED;
+                mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED;
 
 #ifdef CONFIG_MMC_DW_IDMAC
         mmc->max_segs = host->ring_size;
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 9ebfb4b482f5..0e9780f5a4a9 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -27,6 +27,7 @@
 #include "sdhci-pltfm.h"
 #include "sdhci-esdhc.h"
 
+#define SDHCI_CTRL_D3CD                 0x08
 /* VENDOR SPEC register */
 #define SDHCI_VENDOR_SPEC               0xC0
 #define  SDHCI_VENDOR_SPEC_SDIO_QUIRK   0x00000002
@@ -141,13 +142,32 @@ static void esdhc_writel_le(struct sdhci_host *host, u32 val, int reg)
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
         struct pltfm_imx_data *imx_data = pltfm_host->priv;
         struct esdhc_platform_data *boarddata = &imx_data->boarddata;
-
-        if (unlikely((reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE)
-                        && (boarddata->cd_type == ESDHC_CD_GPIO)))
-                /*
-                 * these interrupts won't work with a custom card_detect gpio
-                 */
-                val &= ~(SDHCI_INT_CARD_REMOVE | SDHCI_INT_CARD_INSERT);
+        u32 data;
+
+        if (unlikely(reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE)) {
+                if (boarddata->cd_type == ESDHC_CD_GPIO)
+                        /*
+                         * These interrupts won't work with a custom
+                         * card_detect gpio (only applied to mx25/35)
+                         */
+                        val &= ~(SDHCI_INT_CARD_REMOVE | SDHCI_INT_CARD_INSERT);
+
+                if (val & SDHCI_INT_CARD_INT) {
+                        /*
+                         * Clear and then set D3CD bit to avoid missing the
+                         * card interrupt.  This is a eSDHC controller problem
+                         * so we need to apply the following workaround: clear
+                         * and set D3CD bit will make eSDHC re-sample the card
+                         * interrupt. In case a card interrupt was lost,
+                         * re-sample it by the following steps.
+                         */
+                        data = readl(host->ioaddr + SDHCI_HOST_CONTROL);
+                        data &= ~SDHCI_CTRL_D3CD;
+                        writel(data, host->ioaddr + SDHCI_HOST_CONTROL);
+                        data |= SDHCI_CTRL_D3CD;
+                        writel(data, host->ioaddr + SDHCI_HOST_CONTROL);
+                }
+        }
 
         if (unlikely((imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT)
                                 && (reg == SDHCI_INT_STATUS)
@@ -217,8 +237,10 @@ static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
                  */
                 return;
         case SDHCI_HOST_CONTROL:
-                /* FSL messed up here, so we can just keep those two */
-                new_val = val & (SDHCI_CTRL_LED | SDHCI_CTRL_4BITBUS);
+                /* FSL messed up here, so we can just keep those three */
+                new_val = val & (SDHCI_CTRL_LED | \
+                                SDHCI_CTRL_4BITBUS | \
+                                SDHCI_CTRL_D3CD);
                 /* ensure the endianess */
                 new_val |= ESDHC_HOST_CONTROL_LE;
                 /* DMA mode bits are shifted */
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index 4198dbbc5c20..fc7e4a515629 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -195,7 +195,8 @@ static int __devinit sdhci_pxav3_probe(struct platform_device *pdev)
         clk_enable(clk);
 
         host->quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL
-                | SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC;
+                | SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC
+                | SDHCI_QUIRK_32BIT_ADMA_SIZE;
 
         /* enable 1/8V DDR capable */
         host->mmc->caps |= MMC_CAP_1_8V_DDR;
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 460ffaf0f6d7..2bd7bf4fece7 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -19,6 +19,7 @@
 #include <linux/clk.h>
 #include <linux/io.h>
 #include <linux/gpio.h>
+#include <linux/module.h>
 
 #include <linux/mmc/host.h>
 
@@ -502,6 +503,9 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
         /* This host supports the Auto CMD12 */
         host->quirks |= SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12;
 
+        /* Samsung SoCs need BROKEN_ADMA_ZEROLEN_DESC */
+        host->quirks |= SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC;
+
         if (pdata->cd_type == S3C_SDHCI_CD_NONE ||
             pdata->cd_type == S3C_SDHCI_CD_PERMANENT)
                 host->quirks |= SDHCI_QUIRK_BROKEN_CARD_DETECTION;
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index c31a3343340d..0e02cc1df12e 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -628,12 +628,11 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
         /* timeout in us */
         if (!data)
                 target_timeout = cmd->cmd_timeout_ms * 1000;
-        else
-                target_timeout = data->timeout_ns / 1000 +
-                        data->timeout_clks / host->clock;
-
-        if (host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)
-                host->timeout_clk = host->clock / 1000;
+        else {
+                target_timeout = data->timeout_ns / 1000;
+                if (host->clock)
+                        target_timeout += data->timeout_clks / host->clock;
+        }
 
         /*
          * Figure out needed cycles.
@@ -645,7 +644,6 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
          *     =>
          *     (1) / (2) > 2^6
          */
-        BUG_ON(!host->timeout_clk);
         count = 0;
         current_timeout = (1 << 13) * 1000 / host->timeout_clk;
         while (current_timeout < target_timeout) {
@@ -1867,9 +1865,6 @@ static void sdhci_tasklet_finish(unsigned long param)
 
         del_timer(&host->timer);
 
-        if (host->version >= SDHCI_SPEC_300)
-                del_timer(&host->tuning_timer);
-
         mrq = host->mrq;
 
         /*
@@ -2461,22 +2456,6 @@ int sdhci_add_host(struct sdhci_host *host)
                 host->max_clk = host->ops->get_max_clock(host);
         }
 
-        host->timeout_clk =
-                (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >> SDHCI_TIMEOUT_CLK_SHIFT;
-        if (host->timeout_clk == 0) {
-                if (host->ops->get_timeout_clock) {
-                        host->timeout_clk = host->ops->get_timeout_clock(host);
-                } else if (!(host->quirks &
-                                SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
-                        printk(KERN_ERR
-                               "%s: Hardware doesn't specify timeout clock "
-                               "frequency.\n", mmc_hostname(mmc));
-                        return -ENODEV;
-                }
-        }
-        if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
-                host->timeout_clk *= 1000;
-
         /*
          * In case of Host Controller v3.00, find out whether clock
          * multiplier is supported.
@@ -2509,10 +2488,26 @@ int sdhci_add_host(struct sdhci_host *host)
         } else
                 mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
 
+        host->timeout_clk =
+                (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >> SDHCI_TIMEOUT_CLK_SHIFT;
+        if (host->timeout_clk == 0) {
+                if (host->ops->get_timeout_clock) {
+                        host->timeout_clk = host->ops->get_timeout_clock(host);
+                } else if (!(host->quirks &
+                                SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
+                        printk(KERN_ERR
+                               "%s: Hardware doesn't specify timeout clock "
+                               "frequency.\n", mmc_hostname(mmc));
+                        return -ENODEV;
+                }
+        }
+        if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
+                host->timeout_clk *= 1000;
+
         if (host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)
-                mmc->max_discard_to = (1 << 27) / (mmc->f_max / 1000);
-        else
-                mmc->max_discard_to = (1 << 27) / host->timeout_clk;
+                host->timeout_clk = mmc->f_max / 1000;
+
+        mmc->max_discard_to = (1 << 27) / host->timeout_clk;
 
         mmc->caps |= MMC_CAP_SDIO_IRQ | MMC_CAP_ERASE | MMC_CAP_CMD23;
 
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index 8d185de90d20..44a9668c4b7a 100644
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -27,7 +27,6 @@
 static int tmio_mmc_suspend(struct platform_device *dev, pm_message_t state)
 {
         const struct mfd_cell *cell = mfd_get_cell(dev);
-        struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret;
 
         ret = tmio_mmc_host_suspend(&dev->dev);
@@ -42,7 +41,6 @@ static int tmio_mmc_suspend(struct platform_device *dev, pm_message_t state)
 static int tmio_mmc_resume(struct platform_device *dev)
 {
         const struct mfd_cell *cell = mfd_get_cell(dev);
-        struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
         /* Tell the MFD core we are ready to be enabled */
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index d724a18b5285..37e5790681ad 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -63,8 +63,9 @@ static inline void bnx2x_bz_fp(struct bnx2x *bp, int index)
         fp->disable_tpa = ((bp->flags & TPA_ENABLE_FLAG) == 0);
 
 #ifdef BCM_CNIC
-        /* We don't want TPA on FCoE, FWD and OOO L2 rings */
-        bnx2x_fcoe(bp, disable_tpa) = 1;
+        /* We don't want TPA on an FCoE L2 ring */
+        if (IS_FCOE_FP(fp))
+                fp->disable_tpa = 1;
 #endif
 }
 
@@ -1404,10 +1405,9 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         struct bnx2x *bp = netdev_priv(dev);
+
 #ifdef BCM_CNIC
-        if (NO_FCOE(bp))
-                return skb_tx_hash(dev, skb);
-        else {
+        if (!NO_FCOE(bp)) {
                 struct ethhdr *hdr = (struct ethhdr *)skb->data;
                 u16 ether_type = ntohs(hdr->h_proto);
 
@@ -1424,8 +1424,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
                         return bnx2x_fcoe_tx(bp, txq_index);
         }
 #endif
-        /* Select a none-FCoE queue:  if FCoE is enabled, exclude FCoE L2 ring
-         */
+        /* select a non-FCoE queue */
         return __skb_tx_hash(dev, skb, BNX2X_NUM_ETH_QUEUES(bp));
 }
 
@@ -1448,6 +1447,28 @@ void bnx2x_set_num_queues(struct bnx2x *bp)
         bp->num_queues += NON_ETH_CONTEXT_USE;
 }
 
+/**
+ * bnx2x_set_real_num_queues - configure netdev->real_num_[tx,rx]_queues
+ *
+ * @bp:         Driver handle
+ *
+ * We currently support for at most 16 Tx queues for each CoS thus we will
+ * allocate a multiple of 16 for ETH L2 rings according to the value of the
+ * bp->max_cos.
+ *
+ * If there is an FCoE L2 queue the appropriate Tx queue will have the next
+ * index after all ETH L2 indices.
+ *
+ * If the actual number of Tx queues (for each CoS) is less than 16 then there
+ * will be the holes at the end of each group of 16 ETh L2 indices (0..15,
+ * 16..31,...) with indicies that are not coupled with any real Tx queue.
+ *
+ * The proper configuration of skb->queue_mapping is handled by
+ * bnx2x_select_queue() and __skb_tx_hash().
+ *
+ * bnx2x_setup_tc() takes care of the proper TC mappings so that __skb_tx_hash()
+ * will return a proper Tx index if TC is enabled (netdev->num_tc > 0).
+ */
 static inline int bnx2x_set_real_num_queues(struct bnx2x *bp)
 {
         int rc, tx, rx;
diff --git a/drivers/net/bnx2x/bnx2x_dcb.c b/drivers/net/bnx2x/bnx2x_dcb.c
index a4ea35f6a456..a1e004a82f7a 100644
--- a/drivers/net/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/bnx2x/bnx2x_dcb.c
@@ -920,7 +920,7 @@ static void bnx2x_dcbx_admin_mib_updated_params(struct bnx2x *bp,
 
 void bnx2x_dcbx_set_state(struct bnx2x *bp, bool dcb_on, u32 dcbx_enabled)
 {
-        if (!CHIP_IS_E1x(bp)) {
+        if (!CHIP_IS_E1x(bp) && !CHIP_IS_E3(bp)) {
                 bp->dcb_state = dcb_on;
                 bp->dcbx_enabled = dcbx_enabled;
         } else {
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index 150709111548..f74582a22c68 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -5798,6 +5798,12 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
 
         DP(BNX2X_MSG_MCP, "starting common init  func %d\n", BP_ABS_FUNC(bp));
 
+        /*
+         * take the UNDI lock to protect undi_unload flow from accessing
+         * registers while we're resetting the chip
+         */
+        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+
         bnx2x_reset_common(bp);
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
 
@@ -5808,6 +5814,8 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
         }
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, val);
 
+        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+
         bnx2x_init_block(bp, BLOCK_MISC, PHASE_COMMON);
 
         if (!CHIP_IS_E1x(bp)) {
@@ -10251,10 +10259,17 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
         /* clean indirect addresses */
         pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                                PCICFG_VENDOR_ID_OFFSET);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0 + BP_PORT(bp)*16, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0 + BP_PORT(bp)*16, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0 + BP_PORT(bp)*16, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0 + BP_PORT(bp)*16, 0);
+        /* Clean the following indirect addresses for all functions since it
+         * is not used by the driver.
+         */
+        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
 
         /*
          * Enable internal target-read (in case we are probed after PF FLR).
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 27b5ecb11830..40266c14e6dc 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -3007,11 +3007,27 @@
 /* [R 6] Debug only: Number of used entries in the data FIFO */
 #define PXP2_REG_HST_DATA_FIFO_STATUS                            0x12047c
 /* [R 7] Debug only: Number of used entries in the header FIFO */
-#define PXP2_REG_HST_HEADER_FIFO_STATUS                          0x120478
-#define PXP2_REG_PGL_ADDR_88_F0                                  0x120534
-#define PXP2_REG_PGL_ADDR_8C_F0                                  0x120538
-#define PXP2_REG_PGL_ADDR_90_F0                                  0x12053c
-#define PXP2_REG_PGL_ADDR_94_F0                                  0x120540
+#define PXP2_REG_HST_HEADER_FIFO_STATUS                          0x120478
+#define PXP2_REG_PGL_ADDR_88_F0                                  0x120534
+/* [R 32] GRC address for configuration access to PCIE config address 0x88.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_88_F1                                  0x120544
+#define PXP2_REG_PGL_ADDR_8C_F0                                  0x120538
+/* [R 32] GRC address for configuration access to PCIE config address 0x8c.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_8C_F1                                  0x120548
+#define PXP2_REG_PGL_ADDR_90_F0                                  0x12053c
+/* [R 32] GRC address for configuration access to PCIE config address 0x90.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_90_F1                                  0x12054c
+#define PXP2_REG_PGL_ADDR_94_F0                                  0x120540
+/* [R 32] GRC address for configuration access to PCIE config address 0x94.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_94_F1                                  0x120550
 #define PXP2_REG_PGL_CONTROL0                                    0x120490
 #define PXP2_REG_PGL_CONTROL1                                    0x120514
 #define PXP2_REG_PGL_DEBUG                                       0x120520
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index f523f1cc5142..4b70b7e8bdeb 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -197,7 +197,7 @@ static void slc_bump(struct slcan *sl)
         skb->ip_summed = CHECKSUM_UNNECESSARY;
         memcpy(skb_put(skb, sizeof(struct can_frame)),
                &cf, sizeof(struct can_frame));
-        netif_rx(skb);
+        netif_rx_ni(skb);
 
         sl->dev->stats.rx_packets++;
         sl->dev->stats.rx_bytes += cf.can_dlc;
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 480f2592f8a5..536b3a55c45f 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -2085,7 +2085,8 @@ struct e1000_info e1000_82574_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .flags2                   = FLAG2_CHECK_PHY_HANG
-                                  | FLAG2_DISABLE_ASPM_L0S,
+                                  | FLAG2_DISABLE_ASPM_L0S
+                                  | FLAG2_NO_DISABLE_RX,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -2104,7 +2105,8 @@ struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
-        .flags2                 = FLAG2_DISABLE_ASPM_L0S,
+        .flags2                 = FLAG2_DISABLE_ASPM_L0S
+                                  | FLAG2_NO_DISABLE_RX,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 638d175792cf..35916f485028 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -453,6 +453,7 @@ struct e1000_info {
 #define FLAG2_DISABLE_ASPM_L0S            (1 << 7)
 #define FLAG2_DISABLE_AIM                 (1 << 8)
 #define FLAG2_CHECK_PHY_HANG              (1 << 9)
+#define FLAG2_NO_DISABLE_RX               (1 << 10)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 06d88f316dce..6a0526a59a8a 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -1206,7 +1206,8 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
         rx_ring->next_to_clean = 0;
 
         rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
         ew32(RDBAL, ((u64) rx_ring->dma & 0xFFFFFFFF));
         ew32(RDBAH, ((u64) rx_ring->dma >> 32));
         ew32(RDLEN, rx_ring->size);
diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
index 7898a67d6505..0893ab107adf 100644
--- a/drivers/net/e1000e/lib.c
+++ b/drivers/net/e1000e/lib.c
@@ -190,7 +190,8 @@ s32 e1000_check_alt_mac_addr_generic(struct e1000_hw *hw)
         /* Check for LOM (vs. NIC) or one of two valid mezzanine cards */
         if (!((nvm_data & NVM_COMPAT_LOM) ||
               (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_DUAL) ||
-              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)))
+              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD) ||
+              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES)))
                 goto out;
 
         ret_val = e1000_read_nvm(hw, NVM_ALT_MAC_ADDR_PTR, 1,
@@ -200,10 +201,10 @@ s32 e1000_check_alt_mac_addr_generic(struct e1000_hw *hw)
                 goto out;
         }
 
-        if (nvm_alt_mac_addr_offset == 0xFFFF) {
+        if ((nvm_alt_mac_addr_offset == 0xFFFF) ||
+            (nvm_alt_mac_addr_offset == 0x0000))
                 /* There is no Alternate MAC Address */
                 goto out;
-        }
 
         if (hw->bus.func == E1000_FUNC_1)
                 nvm_alt_mac_addr_offset += E1000_ALT_MAC_ADDRESS_OFFSET_LAN1;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index ab4be80f7ab5..362f70382cdd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -56,7 +56,7 @@
 
 #define DRV_EXTRAVERSION "-k"
 
-#define DRV_VERSION "1.3.16" DRV_EXTRAVERSION
+#define DRV_VERSION "1.4.4" DRV_EXTRAVERSION
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
 
@@ -2915,7 +2915,8 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
 
         /* disable receives while setting up the descriptors */
         rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
         e1e_flush();
         usleep_range(10000, 20000);
 
@@ -3394,7 +3395,8 @@ void e1000e_down(struct e1000_adapter *adapter)
 
         /* disable receives in the hardware */
         rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
         /* flush and sleep below */
 
         netif_stop_queue(netdev);
@@ -3403,6 +3405,7 @@ void e1000e_down(struct e1000_adapter *adapter)
         tctl = er32(TCTL);
         tctl &= ~E1000_TCTL_EN;
         ew32(TCTL, tctl);
+
         /* flush both disables and wait for them to finish */
         e1e_flush();
         usleep_range(10000, 20000);
diff --git a/drivers/net/gianfar_ptp.c b/drivers/net/gianfar_ptp.c
index 1c97861596f0..f67b8aebc89c 100644
--- a/drivers/net/gianfar_ptp.c
+++ b/drivers/net/gianfar_ptp.c
@@ -193,14 +193,9 @@ static void set_alarm(struct etsects *etsects)
 /* Caller must hold etsects->lock. */
 static void set_fipers(struct etsects *etsects)
 {
-        u32 tmr_ctrl = gfar_read(&etsects->regs->tmr_ctrl);
-
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl & (~TE));
-        gfar_write(&etsects->regs->tmr_prsc,   etsects->tmr_prsc);
+        set_alarm(etsects);
         gfar_write(&etsects->regs->tmr_fiper1, etsects->tmr_fiper1);
         gfar_write(&etsects->regs->tmr_fiper2, etsects->tmr_fiper2);
-        set_alarm(etsects);
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|TE);
 }
 
 /*
@@ -511,7 +506,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
         gfar_write(&etsects->regs->tmr_fiper1, etsects->tmr_fiper1);
         gfar_write(&etsects->regs->tmr_fiper2, etsects->tmr_fiper2);
         set_alarm(etsects);
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|FS|RTPE|TE);
+        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|FS|RTPE|TE|FRD);
 
         spin_unlock_irqrestore(&etsects->lock, flags);
 
diff --git a/drivers/net/irda/sh_irda.c b/drivers/net/irda/sh_irda.c
index 4488bd581eca..82660672dcd9 100644
--- a/drivers/net/irda/sh_irda.c
+++ b/drivers/net/irda/sh_irda.c
@@ -22,6 +22,8 @@
  *  - DMA transfer support
  *  - FIFO mode support
  */
+#include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 52a7c86af663..ed7d7d62bf68 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -12,6 +12,8 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
@@ -511,7 +513,7 @@ static void sh_sir_tx(struct sh_sir_self *self, int phase)
 
 static int sh_sir_read_data(struct sh_sir_self *self)
 {
-        u16 val;
+        u16 val = 0;
         int timeout = 1024;
 
         while (timeout--) {
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 8b3090dc4bcd..80b6f36a8074 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -82,7 +82,7 @@ static int cards_found;
 /*
  * VLB I/O addresses
  */
-static unsigned int pcnet32_portlist[] __initdata =
+static unsigned int pcnet32_portlist[] =
     { 0x300, 0x320, 0x340, 0x360, 0 };
 
 static int pcnet32_debug;
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 2cd8dc5847b4..cb6e0b486b1e 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -34,8 +34,7 @@
 #define PAGESEL         0x13
 #define LAYER4          0x02
 #define LAYER2          0x01
-#define MAX_RXTS        4
-#define MAX_TXTS        4
+#define MAX_RXTS        64
 #define N_EXT_TS        1
 #define PSF_PTPVER      2
 #define PSF_EVNT        0x4000
@@ -218,7 +217,7 @@ static void phy2rxts(struct phy_rxts *p, struct rxts *rxts)
         rxts->seqid = p->seqid;
         rxts->msgtype = (p->msgtype >> 12) & 0xf;
         rxts->hash = p->msgtype & 0x0fff;
-        rxts->tmo = jiffies + HZ;
+        rxts->tmo = jiffies + 2;
 }
 
 static u64 phy2txts(struct phy_txts *p)
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index f11b3f3df24f..4c617534f937 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -367,7 +367,7 @@ static void sl_bump(struct slip *sl)
         memcpy(skb_put(skb, count), sl->rbuff, count);
         skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IP);
-        netif_rx(skb);
+        netif_rx_ni(skb);
         dev->stats.rx_packets++;
 }
 
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 041fb7d43c4f..ef3b236b5145 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -977,7 +977,6 @@ static void rtl8150_disconnect(struct usb_interface *intf)
         usb_set_intfdata(intf, NULL);
         if (dev) {
                 set_bit(RTL8150_UNPLUG, &dev->flags);
-                tasklet_disable(&dev->tl);
                 tasklet_kill(&dev->tl);
                 unregister_netdev(dev->netdev);
                 unlink_all_urbs(dev);
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index f54dff44ed50..c3119a6caace 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1735,6 +1735,8 @@ ath5k_beacon_setup(struct ath5k_hw *ah, struct ath5k_buf *bf)
 
         if (dma_mapping_error(ah->dev, bf->skbaddr)) {
                 ATH5K_ERR(ah, "beacon DMA mapping failed\n");
+                dev_kfree_skb_any(skb);
+                bf->skb = NULL;
                 return -EIO;
         }
 
@@ -1819,8 +1821,6 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         ath5k_txbuf_free_skb(ah, avf->bbuf);
         avf->bbuf->skb = skb;
         ret = ath5k_beacon_setup(ah, avf->bbuf);
-        if (ret)
-                avf->bbuf->skb = NULL;
 out:
         return ret;
 }
@@ -1840,6 +1840,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
         struct ath5k_vif *avf;
         struct ath5k_buf *bf;
         struct sk_buff *skb;
+        int err;
 
         ATH5K_DBG_UNLIMIT(ah, ATH5K_DEBUG_BEACON, "in beacon_send\n");
 
@@ -1888,11 +1889,6 @@ ath5k_beacon_send(struct ath5k_hw *ah)
 
         avf = (void *)vif->drv_priv;
         bf = avf->bbuf;
-        if (unlikely(bf->skb == NULL || ah->opmode == NL80211_IFTYPE_STATION ||
-                     ah->opmode == NL80211_IFTYPE_MONITOR)) {
-                ATH5K_WARN(ah, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
-                return;
-        }
 
         /*
          * Stop any current dma and put the new frame on the queue.
@@ -1906,8 +1902,17 @@ ath5k_beacon_send(struct ath5k_hw *ah)
 
         /* refresh the beacon for AP or MESH mode */
         if (ah->opmode == NL80211_IFTYPE_AP ||
-            ah->opmode == NL80211_IFTYPE_MESH_POINT)
-                ath5k_beacon_update(ah->hw, vif);
+            ah->opmode == NL80211_IFTYPE_MESH_POINT) {
+                err = ath5k_beacon_update(ah->hw, vif);
+                if (err)
+                        return;
+        }
+
+        if (unlikely(bf->skb == NULL || ah->opmode == NL80211_IFTYPE_STATION ||
+                     ah->opmode == NL80211_IFTYPE_MONITOR)) {
+                ATH5K_WARN(ah, "bf=%p bf_skb=%p\n", bf, bf->skb);
+                return;
+        }
 
         trace_ath5k_tx(ah, bf->skb, &ah->txqs[ah->bhalq]);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index d109c25417f4..c34bef1bf2b0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -307,7 +307,7 @@ static const struct ar9300_eeprom ar9300_default = {
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
@@ -884,7 +884,7 @@ static const struct ar9300_eeprom ar9300_x113 = {
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
@@ -2040,7 +2040,7 @@ static const struct ar9300_eeprom ar9300_x112 = {
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
@@ -3734,7 +3734,7 @@ static void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
                                 }
                         } else {
                                 reg_pmu_set = (5 << 1) | (7 << 4) |
-                                              (1 << 8) | (2 << 14) |
+                                              (2 << 8) | (2 << 14) |
                                               (6 << 17) | (1 << 20) |
                                               (3 << 24) | (1 << 28);
                         }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 6de3f0bc18e6..5c590429f120 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -850,7 +850,7 @@
 #define AR_PHY_TPC_11_B1         (AR_SM1_BASE + 0x220)
 #define AR_PHY_PDADC_TAB_1       (AR_SM1_BASE + 0x240)
 #define AR_PHY_TX_IQCAL_STATUS_B1   (AR_SM1_BASE + 0x48c)
-#define AR_PHY_TX_IQCAL_CORR_COEFF_B1(_i)    (AR_SM_BASE + 0x450 + ((_i) << 2))
+#define AR_PHY_TX_IQCAL_CORR_COEFF_B1(_i)    (AR_SM1_BASE + 0x450 + ((_i) << 2))
 
 /*
  * Channel 2 Register Map
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 83cba22ac6e8..481e534534eb 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -795,9 +795,23 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
         u32 tmp;
         u16 mmio_base;
 
-        tmp = b43_read32(dev, SSB_TMSHIGH);
-        if (tmp & SSB_TMSHIGH_DMA64)
-                return DMA_BIT_MASK(64);
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
+                if (tmp & BCMA_IOST_DMA64)
+                        return DMA_BIT_MASK(64);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
+                if (tmp & SSB_TMSHIGH_DMA64)
+                        return DMA_BIT_MASK(64);
+                break;
+#endif
+        }
+
         mmio_base = b43_dmacontroller_base(0, 0);
         b43_write32(dev, mmio_base + B43_DMA32_TXCTL, B43_DMA32_TXADDREXT_MASK);
         tmp = b43_read32(dev, mmio_base + B43_DMA32_TXCTL);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 507559361d87..939563162fb3 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -921,6 +921,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c16) },
         /* Draytek */
         { USB_DEVICE(0x07fa, 0x7712) },
+        /* DVICO */
+        { USB_DEVICE(0x0fe9, 0xb307) },
         /* Edimax */
         { USB_DEVICE(0x7392, 0x7711) },
         { USB_DEVICE(0x7392, 0x7717) },
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 6a93939f44e8..0baeb894f093 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2420,6 +2420,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00d8) },
         { USB_DEVICE(0x0411, 0x00d9) },
+        { USB_DEVICE(0x0411, 0x00e6) },
         { USB_DEVICE(0x0411, 0x00f4) },
         { USB_DEVICE(0x0411, 0x0116) },
         { USB_DEVICE(0x0411, 0x0119) },
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 942f7a3969a7..ef63c0df006a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -281,6 +281,8 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817d, rtl92cu_hal_cfg)},
         /* 8188CE-VAU USB minCard (b/g mode only) */
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817e, rtl92cu_hal_cfg)},
+        /* 8188RU in Alfa AWUS036NHR */
+        {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817f, rtl92cu_hal_cfg)},
         /* 8188 Combo for BC4 */
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8754, rtl92cu_hal_cfg)},
 
@@ -303,20 +305,23 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
         /* HP - Lite-On ,8188CUS Slim Combo */
         {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
         {RTL_USB_DEVICE(0x2001, 0x3308, rtl92cu_hal_cfg)}, /*D-Link - Alpha*/
         {RTL_USB_DEVICE(0x2019, 0xab2a, rtl92cu_hal_cfg)}, /*Planex - Abocom*/
         {RTL_USB_DEVICE(0x2019, 0xed17, rtl92cu_hal_cfg)}, /*PCI - Edimax*/
         {RTL_USB_DEVICE(0x20f4, 0x648b, rtl92cu_hal_cfg)}, /*TRENDnet - Cameo*/
         {RTL_USB_DEVICE(0x7392, 0x7811, rtl92cu_hal_cfg)}, /*Edimax - Edimax*/
-        {RTL_USB_DEVICE(0x3358, 0x13d3, rtl92cu_hal_cfg)}, /*Azwave 8188CE-VAU*/
+        {RTL_USB_DEVICE(0x13d3, 0x3358, rtl92cu_hal_cfg)}, /*Azwave 8188CE-VAU*/
         /* Russian customer -Azwave (8188CE-VAU  b/g mode only) */
-        {RTL_USB_DEVICE(0x3359, 0x13d3, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x13d3, 0x3359, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x4855, 0x0090, rtl92cu_hal_cfg)}, /* Feixun */
+        {RTL_USB_DEVICE(0x4855, 0x0091, rtl92cu_hal_cfg)}, /* NetweeN-Feixun */
+        {RTL_USB_DEVICE(0x9846, 0x9041, rtl92cu_hal_cfg)}, /* Netgear Cameo */
 
         /****** 8192CU ********/
         {RTL_USB_DEVICE(0x0586, 0x341f, rtl92cu_hal_cfg)}, /*Zyxel -Abocom*/
         {RTL_USB_DEVICE(0x07aa, 0x0056, rtl92cu_hal_cfg)}, /*ATKK-Gemtek*/
         {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
-        {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Abocom -Abocom*/
         {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
         {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
         {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
diff --git a/drivers/net/wireless/wl1251/acx.c b/drivers/net/wireless/wl1251/acx.c
index ef8370edace7..ad87a1ac6462 100644
--- a/drivers/net/wireless/wl1251/acx.c
+++ b/drivers/net/wireless/wl1251/acx.c
@@ -140,8 +140,6 @@ int wl1251_acx_sleep_auth(struct wl1251 *wl, u8 sleep_auth)
         auth->sleep_auth = sleep_auth;
 
         ret = wl1251_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
-        if (ret < 0)
-                return ret;
 
 out:
         kfree(auth);
@@ -681,10 +679,8 @@ int wl1251_acx_cca_threshold(struct wl1251 *wl)
 
         ret = wl1251_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                    detection, sizeof(*detection));
-        if (ret < 0) {
+        if (ret < 0)
                 wl1251_warning("failed to set cca threshold: %d", ret);
-                return ret;
-        }
 
 out:
         kfree(detection);
diff --git a/drivers/net/wireless/wl1251/cmd.c b/drivers/net/wireless/wl1251/cmd.c
index 81f164bc4888..d14d69d733a0 100644
--- a/drivers/net/wireless/wl1251/cmd.c
+++ b/drivers/net/wireless/wl1251/cmd.c
@@ -241,7 +241,7 @@ int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
         if (ret < 0) {
                 wl1251_error("tx %s cmd for channel %d failed",
                              enable ? "start" : "stop", channel);
-                return ret;
+                goto out;
         }
 
         wl1251_debug(DEBUG_BOOT, "tx %s cmd channel %d",
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
index c01c0cb0af4e..b99a11a9dd69 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
@@ -812,7 +812,7 @@ int AthCreateCommandList(struct ps_cmd_packet **HciPacketList, u32 *numPackets)
     for(count = 0; count < Patch_Count; count++) {
 
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Freeing Patch Buffer %d \r\n",count));
-        kfree(RamPatch[Patch_Count].Data);
+        kfree(RamPatch[count].Data);
     }
 
     for(count = 0; count < Tag_Count; count++) {
diff --git a/drivers/staging/dt3155v4l/dt3155v4l.c b/drivers/staging/dt3155v4l/dt3155v4l.c
index fe02d22274b4..05aa41cf875b 100644
--- a/drivers/staging/dt3155v4l/dt3155v4l.c
+++ b/drivers/staging/dt3155v4l/dt3155v4l.c
@@ -22,6 +22,7 @@
 #include <linux/stringify.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <media/v4l2-dev.h>
 #include <media/v4l2-ioctl.h>
 #include <media/videobuf2-dma-contig.h>
diff --git a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
index 627a98b4ec30..9e728b3415e3 100644
--- a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
+++ b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
@@ -22,6 +22,7 @@
 #include <linux/string.h>
 #include <linux/vmalloc.h>
 #include <linux/netdevice.h>
+#include <asm/io.h>
 #include <asm/uaccess.h>
 #include "ft1000.h"
 
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index 3612574ca520..d286b2223181 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -325,7 +325,7 @@ static int blkvsc_do_operation(struct block_device_context *blkdev,
 
         page_buf = alloc_page(GFP_KERNEL);
         if (!page_buf) {
-                kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+                kmem_cache_free(blkdev->request_pool, blkvsc_req);
                 return -ENOMEM;
         }
 
@@ -422,7 +422,7 @@ cleanup:
 
         __free_page(page_buf);
 
-        kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+        kmem_cache_free(blkdev->request_pool, blkvsc_req);
 
         return ret;
 }
diff --git a/drivers/staging/iio/accel/adis16203_core.c b/drivers/staging/iio/accel/adis16203_core.c
index bf1988884e93..cf5d15da76ad 100644
--- a/drivers/staging/iio/accel/adis16203_core.c
+++ b/drivers/staging/iio/accel/adis16203_core.c
@@ -311,13 +311,17 @@ static int adis16203_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16203_addresses[chan->address][0];
                 ret = adis16203_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16203_ERROR_ACTIVE) {
                         ret = adis16203_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16204_core.c b/drivers/staging/iio/accel/adis16204_core.c
index cfd09b3b9937..3e2b62654b7d 100644
--- a/drivers/staging/iio/accel/adis16204_core.c
+++ b/drivers/staging/iio/accel/adis16204_core.c
@@ -341,13 +341,17 @@ static int adis16204_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16204_addresses[chan->address][0];
                 ret = adis16204_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16204_ERROR_ACTIVE) {
                         ret = adis16204_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16209_core.c b/drivers/staging/iio/accel/adis16209_core.c
index 55f3a7bcaf0a..bec1fa8de9b9 100644
--- a/drivers/staging/iio/accel/adis16209_core.c
+++ b/drivers/staging/iio/accel/adis16209_core.c
@@ -337,13 +337,17 @@ static int adis16209_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16209_addresses[chan->address][0];
                 ret = adis16209_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16209_ERROR_ACTIVE) {
                         ret = adis16209_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16240_core.c b/drivers/staging/iio/accel/adis16240_core.c
index 4a4eafc58630..aee8b69173c4 100644
--- a/drivers/staging/iio/accel/adis16240_core.c
+++ b/drivers/staging/iio/accel/adis16240_core.c
@@ -370,13 +370,17 @@ static int adis16240_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16240_addresses[chan->address][0];
                 ret = adis16240_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16240_ERROR_ACTIVE) {
                         ret = adis16240_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/gyro/adis16260_core.c b/drivers/staging/iio/gyro/adis16260_core.c
index 05797f404bea..f2d43cfcc493 100644
--- a/drivers/staging/iio/gyro/adis16260_core.c
+++ b/drivers/staging/iio/gyro/adis16260_core.c
@@ -446,13 +446,17 @@ static int adis16260_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16260_addresses[chan->address][0];
                 ret = adis16260_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16260_ERROR_ACTIVE) {
                         ret = adis16260_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/nvec/TODO b/drivers/staging/nvec/TODO
index 77b47f763f22..649d6b70deaa 100644
--- a/drivers/staging/nvec/TODO
+++ b/drivers/staging/nvec/TODO
@@ -4,5 +4,7 @@ ToDo list (incomplete, unordered)
         - add compile as module support
         - move nvec devices to mfd cells?
         - adjust to kernel style
-
-
+        - fix clk usage
+          should not be using clk_get_sys(), but clk_get(&pdev->dev, conn)
+          where conn is either NULL if the device only has one clock, or
+          the device specific name if it has multiple clocks.
diff --git a/drivers/staging/rtl8192u/r819xU_firmware.c b/drivers/staging/rtl8192u/r819xU_firmware.c
index 6766f468639f..4bb5fffca5b9 100644
--- a/drivers/staging/rtl8192u/r819xU_firmware.c
+++ b/drivers/staging/rtl8192u/r819xU_firmware.c
@@ -399,10 +399,7 @@ download_firmware_fail:
 
 }
 
-
-
-
-
-
-
+MODULE_FIRMWARE("RTL8192U/boot.img");
+MODULE_FIRMWARE("RTL8192U/main.img");
+MODULE_FIRMWARE("RTL8192U/data.img");
 
diff --git a/drivers/staging/rts_pstor/rtsx.c b/drivers/staging/rts_pstor/rtsx.c
index 5ff59f27d101..16c73fbff51f 100644
--- a/drivers/staging/rts_pstor/rtsx.c
+++ b/drivers/staging/rts_pstor/rtsx.c
@@ -66,12 +66,6 @@ static int msi_en;
 module_param(msi_en, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(msi_en, "enable msi");
 
-/* These are used to make sure the module doesn't unload before all the
- * threads have exited.
- */
-static atomic_t total_threads = ATOMIC_INIT(0);
-static DECLARE_COMPLETION(threads_gone);
-
 static irqreturn_t rtsx_interrupt(int irq, void *dev_id);
 
 /***********************************************************************
@@ -192,7 +186,7 @@ static int queuecommand_lck(struct scsi_cmnd *srb,
         /* enqueue the command and wake up the control thread */
         srb->scsi_done = done;
         chip->srb = srb;
-        up(&(dev->sema));
+        complete(&dev->cmnd_ready);
 
         return 0;
 }
@@ -475,7 +469,7 @@ static int rtsx_control_thread(void *__dev)
         current->flags |= PF_NOFREEZE;
 
         for (;;) {
-                if (down_interruptible(&dev->sema))
+                if (wait_for_completion_interruptible(&dev->cmnd_ready))
                         break;
 
                 /* lock the device pointers */
@@ -557,8 +551,6 @@ SkipForAbort:
                 mutex_unlock(&dev->dev_mutex);
         } /* for (;;) */
 
-        scsi_host_put(host);
-
         /* notify the exit routine that we're actually exiting now
          *
          * complete()/wait_for_completion() is similar to up()/down(),
@@ -573,7 +565,7 @@ SkipForAbort:
          * This is important in preemption kernels, which transfer the flow
          * of execution immediately upon a complete().
          */
-        complete_and_exit(&threads_gone, 0);
+        complete_and_exit(&dev->control_exit, 0);
 }
 
 
@@ -581,7 +573,6 @@ static int rtsx_polling_thread(void *__dev)
 {
         struct rtsx_dev *dev = (struct rtsx_dev *)__dev;
         struct rtsx_chip *chip = dev->chip;
-        struct Scsi_Host *host = rtsx_to_host(dev);
         struct sd_info *sd_card = &(chip->sd_card);
         struct xd_info *xd_card = &(chip->xd_card);
         struct ms_info *ms_card = &(chip->ms_card);
@@ -621,8 +612,7 @@ static int rtsx_polling_thread(void *__dev)
                 mutex_unlock(&dev->dev_mutex);
         }
 
-        scsi_host_put(host);
-        complete_and_exit(&threads_gone, 0);
+        complete_and_exit(&dev->polling_exit, 0);
 }
 
 /*
@@ -699,29 +689,38 @@ static void rtsx_release_resources(struct rtsx_dev *dev)
 {
         printk(KERN_INFO "-- %s\n", __func__);
 
+        /* Tell the control thread to exit.  The SCSI host must
+         * already have been removed so it won't try to queue
+         * any more commands.
+         */
+        printk(KERN_INFO "-- sending exit command to thread\n");
+        complete(&dev->cmnd_ready);
+        if (dev->ctl_thread)
+                wait_for_completion(&dev->control_exit);
+        if (dev->polling_thread)
+                wait_for_completion(&dev->polling_exit);
+
+        wait_timeout(200);
+
         if (dev->rtsx_resv_buf) {
-                dma_free_coherent(&(dev->pci->dev), HOST_CMDS_BUF_LEN,
+                dma_free_coherent(&(dev->pci->dev), RTSX_RESV_BUF_LEN,
                                 dev->rtsx_resv_buf, dev->rtsx_resv_buf_addr);
                 dev->chip->host_cmds_ptr = NULL;
                 dev->chip->host_sg_tbl_ptr = NULL;
         }
 
-        pci_disable_device(dev->pci);
-        pci_release_regions(dev->pci);
-
-        if (dev->irq > 0) {
+        if (dev->irq > 0)
                 free_irq(dev->irq, (void *)dev);
-        }
-        if (dev->chip->msi_en) {
+        if (dev->chip->msi_en)
                 pci_disable_msi(dev->pci);
-        }
+        if (dev->remap_addr)
+                iounmap(dev->remap_addr);
 
-        /* Tell the control thread to exit.  The SCSI host must
-         * already have been removed so it won't try to queue
-         * any more commands.
-         */
-        printk(KERN_INFO "-- sending exit command to thread\n");
-        up(&dev->sema);
+        pci_disable_device(dev->pci);
+        pci_release_regions(dev->pci);
+
+        rtsx_release_chip(dev->chip);
+        kfree(dev->chip);
 }
 
 /* First stage of disconnect processing: stop all commands and remove
@@ -739,6 +738,7 @@ static void quiesce_and_remove_host(struct rtsx_dev *dev)
         scsi_unlock(host);
         mutex_unlock(&dev->dev_mutex);
         wake_up(&dev->delay_wait);
+        wait_for_completion(&dev->scanning_done);
 
         /* Wait some time to let other threads exist */
         wait_timeout(100);
@@ -793,8 +793,7 @@ static int rtsx_scan_thread(void *__dev)
                 /* Should we unbind if no devices were detected? */
         }
 
-        scsi_host_put(rtsx_to_host(dev));
-        complete_and_exit(&threads_gone, 0);
+        complete_and_exit(&dev->scanning_done, 0);
 }
 
 static void rtsx_init_options(struct rtsx_chip *chip)
@@ -941,8 +940,11 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
 
         spin_lock_init(&dev->reg_lock);
         mutex_init(&(dev->dev_mutex));
-        sema_init(&(dev->sema), 0);
+        init_completion(&dev->cmnd_ready);
+        init_completion(&dev->control_exit);
+        init_completion(&dev->polling_exit);
         init_completion(&(dev->notify));
+        init_completion(&dev->scanning_done);
         init_waitqueue_head(&dev->delay_wait);
 
         dev->pci = pci;
@@ -992,28 +994,22 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
         pci_set_master(pci);
         synchronize_irq(dev->irq);
 
-        err = scsi_add_host(host, &pci->dev);
-        if (err) {
-                printk(KERN_ERR "Unable to add the scsi host\n");
-                goto errout;
-        }
-
         rtsx_init_chip(dev->chip);
 
         /* Start up our control thread */
-        th = kthread_create(rtsx_control_thread, dev, CR_DRIVER_NAME);
+        th = kthread_run(rtsx_control_thread, dev, CR_DRIVER_NAME);
         if (IS_ERR(th)) {
                 printk(KERN_ERR "Unable to start control thread\n");
                 err = PTR_ERR(th);
                 goto errout;
         }
+        dev->ctl_thread = th;
 
-        /* Take a reference to the host for the control thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
-        wake_up_process(th);
+        err = scsi_add_host(host, &pci->dev);
+        if (err) {
+                printk(KERN_ERR "Unable to add the scsi host\n");
+                goto errout;
+        }
 
         /* Start up the thread for delayed SCSI-device scanning */
         th = kthread_create(rtsx_scan_thread, dev, "rtsx-scan");
@@ -1024,28 +1020,17 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
                 goto errout;
         }
 
-        /* Take a reference to the host for the scanning thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
         wake_up_process(th);
 
         /* Start up the thread for polling thread */
-        th = kthread_create(rtsx_polling_thread, dev, "rtsx-polling");
+        th = kthread_run(rtsx_polling_thread, dev, "rtsx-polling");
         if (IS_ERR(th)) {
                 printk(KERN_ERR "Unable to start the device-polling thread\n");
                 quiesce_and_remove_host(dev);
                 err = PTR_ERR(th);
                 goto errout;
         }
-
-        /* Take a reference to the host for the polling thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
-        wake_up_process(th);
+        dev->polling_thread = th;
 
         pci_set_drvdata(pci, dev);
 
@@ -1108,16 +1093,6 @@ static void __exit rtsx_exit(void)
 
         pci_unregister_driver(&driver);
 
-        /* Don't return until all of our control and scanning threads
-         * have exited.  Since each thread signals threads_gone as its
-         * last act, we have to call wait_for_completion the right number
-         * of times.
-         */
-        while (atomic_read(&total_threads) > 0) {
-                wait_for_completion(&threads_gone);
-                atomic_dec(&total_threads);
-        }
-
         printk(KERN_INFO "%s module exit\n", CR_DRIVER_NAME);
 }
 
diff --git a/drivers/staging/rts_pstor/rtsx.h b/drivers/staging/rts_pstor/rtsx.h
index 247615ba1d2a..86e47c2e3e3c 100644
--- a/drivers/staging/rts_pstor/rtsx.h
+++ b/drivers/staging/rts_pstor/rtsx.h
@@ -112,9 +112,16 @@ struct rtsx_dev {
         /* locks */
         spinlock_t              reg_lock;
 
+        struct task_struct      *ctl_thread;     /* the control thread   */
+        struct task_struct      *polling_thread; /* the polling thread   */
+
         /* mutual exclusion and synchronization structures */
-        struct semaphore        sema;            /* to sleep thread on      */
+        struct completion       cmnd_ready;      /* to sleep thread on      */
+        struct completion       control_exit;    /* control thread exit     */
+        struct completion       polling_exit;    /* polling thread exit     */
         struct completion       notify;          /* thread begin/end        */
+        struct completion       scanning_done;   /* wait for scan thread    */
+
         wait_queue_head_t       delay_wait;      /* wait during scan, reset */
         struct mutex            dev_mutex;
 
diff --git a/drivers/staging/solo6x10/core.c b/drivers/staging/solo6x10/core.c
index 76779949f141..f974f6412ad7 100644
--- a/drivers/staging/solo6x10/core.c
+++ b/drivers/staging/solo6x10/core.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <linux/videodev2.h>
 #include "solo6x10.h"
 #include "tw28.h"
diff --git a/drivers/staging/solo6x10/enc.c b/drivers/staging/solo6x10/enc.c
index 285f7f350062..de502599bb19 100644
--- a/drivers/staging/solo6x10/enc.c
+++ b/drivers/staging/solo6x10/enc.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include "solo6x10.h"
 #include "osd-font.h"
 
diff --git a/drivers/staging/solo6x10/g723.c b/drivers/staging/solo6x10/g723.c
index bd8eb92c94b1..59274bfca95b 100644
--- a/drivers/staging/solo6x10/g723.c
+++ b/drivers/staging/solo6x10/g723.c
@@ -21,6 +21,7 @@
 #include <linux/mempool.h>
 #include <linux/poll.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <linux/freezer.h>
 #include <sound/core.h>
 #include <sound/initval.h>
diff --git a/drivers/staging/solo6x10/p2m.c b/drivers/staging/solo6x10/p2m.c
index 5717eabb04a4..56210f0fc5ec 100644
--- a/drivers/staging/solo6x10/p2m.c
+++ b/drivers/staging/solo6x10/p2m.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/scatterlist.h>
 #include "solo6x10.h"
 
diff --git a/drivers/staging/solo6x10/solo6x10.h b/drivers/staging/solo6x10/solo6x10.h
index 17c06bd6cc91..abee7213202f 100644
--- a/drivers/staging/solo6x10/solo6x10.h
+++ b/drivers/staging/solo6x10/solo6x10.h
@@ -28,6 +28,7 @@
 #include <linux/list.h>
 #include <linux/wait.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/atomic.h>
 #include <linux/videodev2.h>
diff --git a/drivers/staging/speakup/devsynth.c b/drivers/staging/speakup/devsynth.c
index 39dc586fc8bb..940769ef883f 100644
--- a/drivers/staging/speakup/devsynth.c
+++ b/drivers/staging/speakup/devsynth.c
@@ -18,13 +18,14 @@ static ssize_t speakup_file_write(struct file *fp, const char *buffer,
 {
         size_t count = nbytes;
         const char *ptr = buffer;
-        int bytes;
+        size_t bytes;
         unsigned long flags;
         u_char buf[256];
+
         if (synth == NULL)
                 return -ENODEV;
         while (count > 0) {
-                bytes = min_t(size_t, count, sizeof(buf));
+                bytes = min(count, sizeof(buf));
                 if (copy_from_user(buf, ptr, bytes))
                         return -EFAULT;
                 count -= bytes;
diff --git a/drivers/staging/zcache/Makefile b/drivers/staging/zcache/Makefile
index f5ec64f94470..60daa272c204 100644
--- a/drivers/staging/zcache/Makefile
+++ b/drivers/staging/zcache/Makefile
@@ -1,3 +1,3 @@
-zcache-y        :=      tmem.o
+zcache-y        :=      zcache-main.o tmem.o
 
 obj-$(CONFIG_ZCACHE)    +=      zcache.o
diff --git a/drivers/staging/zcache/zcache.c b/drivers/staging/zcache/zcache-main.c
index 65a81a0d7c49..855a5bb56a47 100644
--- a/drivers/staging/zcache/zcache.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -19,6 +19,7 @@
  *   http://marc.info/?l=linux-mm&m=127811271605009
  */
 
+#include <linux/module.h>
 #include <linux/cpu.h>
 #include <linux/highmem.h>
 #include <linux/list.h>
@@ -27,6 +28,7 @@
 #include <linux/spinlock.h>
 #include <linux/types.h>
 #include <linux/atomic.h>
+#include <linux/math64.h>
 #include "tmem.h"
 
 #include "../zram/xvmalloc.h" /* if built in drivers/staging */
@@ -53,6 +55,9 @@
 
 #define MAX_CLIENTS 16
 #define LOCAL_CLIENT ((uint16_t)-1)
+
+MODULE_LICENSE("GPL");
+
 struct zcache_client {
         struct tmem_pool *tmem_pools[MAX_POOLS_PER_CLIENT];
         struct xv_pool *xvpool;
@@ -1158,6 +1163,7 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
         uint16_t client_id = get_client_id_from_client(cli);
         unsigned long zv_mean_zsize;
         unsigned long curr_pers_pampd_count;
+        u64 total_zsize;
 
         if (eph) {
                 ret = zcache_compress(page, &cdata, &clen);
@@ -1190,8 +1196,9 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
                 }
                 /* reject if mean compression is too poor */
                 if ((clen > zv_max_mean_zsize) && (curr_pers_pampd_count > 0)) {
-                        zv_mean_zsize = xv_get_total_size_bytes(cli->xvpool) /
-                                                curr_pers_pampd_count;
+                        total_zsize = xv_get_total_size_bytes(cli->xvpool);
+                        zv_mean_zsize = div_u64(total_zsize,
+                                                curr_pers_pampd_count);
                         if (zv_mean_zsize > zv_max_mean_zsize) {
                                 zcache_mean_compress_poor++;
                                 goto out;
@@ -1929,9 +1936,9 @@ __setup("nofrontswap", no_frontswap);
 
 static int __init zcache_init(void)
 {
-#ifdef CONFIG_SYSFS
         int ret = 0;
 
+#ifdef CONFIG_SYSFS
         ret = sysfs_create_group(mm_kobj, &zcache_attr_group);
         if (ret) {
                 pr_err("zcache: can't create sysfs\n");
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 385acb895ab3..3f94ac34dce3 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -268,7 +268,7 @@ usbtmc_abort_bulk_in_status:
                                 dev_err(dev, "usb_bulk_msg returned %d\n", rv);
                                 goto exit;
                         }
-                } while ((actual = max_size) &&
+                } while ((actual == max_size) &&
                          (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
 
         if (actual == max_size) {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index c962608b4b9a..26678cadfb21 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -123,10 +123,11 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
         }
 
         if (usb_endpoint_xfer_isoc(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1) *
-                        (desc->bmAttributes + 1);
+                max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
+                        le16_to_cpu(ep->desc.wMaxPacketSize);
         else if (usb_endpoint_xfer_int(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1);
+                max_tx = le16_to_cpu(ep->desc.wMaxPacketSize) *
+                        (desc->bMaxBurst + 1);
         else
                 max_tx = 999999;
         if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) {
@@ -134,10 +135,10 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                 "config %d interface %d altsetting %d ep %d: "
                                 "setting to %d\n",
                                 usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int",
-                                desc->wBytesPerInterval,
+                                le16_to_cpu(desc->wBytesPerInterval),
                                 cfgno, inum, asnum, ep->desc.bEndpointAddress,
                                 max_tx);
-                ep->ss_ep_comp.wBytesPerInterval = max_tx;
+                ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx);
         }
 }
 
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 44b6b40aafb4..5a084b9cfa3c 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -310,7 +310,7 @@ config USB_PXA_U2O
 # musb builds in ../musb along with host support
 config USB_GADGET_MUSB_HDRC
         tristate "Inventra HDRC USB Peripheral (TI, ADI, ...)"
-        depends on USB_MUSB_HDRC && (USB_MUSB_PERIPHERAL || USB_MUSB_OTG)
+        depends on USB_MUSB_HDRC
         select USB_GADGET_DUALSPEED
         help
           This OTG-capable silicon IP is used in dual designs including
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 98cbc06c30fd..ddb118a76807 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -35,6 +35,7 @@
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
+#include <linux/prefetch.h>
 #include <linux/clk.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 5ef87794fd32..aef47414f5d5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1079,10 +1079,12 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                         cdev->desc.bMaxPacketSize0 =
                                 cdev->gadget->ep0->maxpacket;
                         if (gadget_is_superspeed(gadget)) {
-                                if (gadget->speed >= USB_SPEED_SUPER)
+                                if (gadget->speed >= USB_SPEED_SUPER) {
                                         cdev->desc.bcdUSB = cpu_to_le16(0x0300);
-                                else
+                                        cdev->desc.bMaxPacketSize0 = 9;
+                                } else {
                                         cdev->desc.bcdUSB = cpu_to_le16(0x0210);
+                                }
                         }
 
                         value = min(w_length, (u16) sizeof cdev->desc);
diff --git a/drivers/usb/gadget/f_hid.c b/drivers/usb/gadget/f_hid.c
index 403a48bcf560..83a266bdb40e 100644
--- a/drivers/usb/gadget/f_hid.c
+++ b/drivers/usb/gadget/f_hid.c
@@ -367,6 +367,13 @@ static int hidg_setup(struct usb_function *f,
         case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8
                   | USB_REQ_GET_DESCRIPTOR):
                 switch (value >> 8) {
+                case HID_DT_HID:
+                        VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n");
+                        length = min_t(unsigned short, length,
+                                                   hidg_desc.bLength);
+                        memcpy(req->buf, &hidg_desc, length);
+                        goto respond;
+                        break;
                 case HID_DT_REPORT:
                         VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: REPORT\n");
                         length = min_t(unsigned short, length,
diff --git a/drivers/usb/gadget/fusb300_udc.c b/drivers/usb/gadget/fusb300_udc.c
index 24a924330c81..4ec888f90002 100644
--- a/drivers/usb/gadget/fusb300_udc.c
+++ b/drivers/usb/gadget/fusb300_udc.c
@@ -609,107 +609,6 @@ void fusb300_rdcxf(struct fusb300 *fusb300,
         }
 }
 
-#if 0
-static void fusb300_dbg_fifo(struct fusb300_ep *ep,
-                                u8 entry, u16 length)
-{
-        u32 reg;
-        u32 i = 0;
-        u32 j = 0;
-
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
-                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
-        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
-                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
-        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
-
-        for (i = 0; i < (length >> 2); i++) {
-                if (i * 4 == 1024)
-                        break;
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i * 4);
-                printk(KERN_DEBUG"  0x%-8x", reg);
-                j++;
-                if ((j % 4)  == 0)
-                        printk(KERN_DEBUG "\n");
-        }
-
-        if (length % 4) {
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i * 4);
-                printk(KERN_DEBUG "  0x%x\n", reg);
-        }
-
-        if ((j % 4)  != 0)
-                printk(KERN_DEBUG "\n");
-
-        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
-                FUSB300_GTM_TST_FIFO_DEG);
-}
-
-static void fusb300_cmp_dbg_fifo(struct fusb300_ep *ep,
-                                u8 entry, u16 length, u8 *golden)
-{
-        u32 reg;
-        u32 i = 0;
-        u32 golden_value;
-        u8 *tmp;
-
-        tmp = golden;
-
-        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo (entry %d) : start\n", entry);
-
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
-                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
-        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
-                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
-        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
-
-        for (i = 0; i < (length >> 2); i++) {
-                if (i * 4 == 1024)
-                        break;
-                golden_value = *tmp | *(tmp + 1) << 8 |
-                                *(tmp + 2) << 16 | *(tmp + 3) << 24;
-
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i*4);
-
-                if (reg != golden_value) {
-                        printk(KERN_DEBUG "0x%x  :  ", (u32)(ep->fusb300->reg +
-                                FUSB300_OFFSET_BUFDBG_START + i*4));
-                        printk(KERN_DEBUG "    golden = 0x%x, reg = 0x%x\n",
-                                golden_value, reg);
-                }
-                tmp += 4;
-        }
-
-        switch (length % 4) {
-        case 1:
-                golden_value = *tmp;
-        case 2:
-                golden_value = *tmp | *(tmp + 1) << 8;
-        case 3:
-                golden_value = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16;
-        default:
-                break;
-
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_BUFDBG_START + i*4);
-        if (reg != golden_value) {
-                printk(KERN_DEBUG "0x%x:", (u32)(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i*4));
-                printk(KERN_DEBUG "  golden = 0x%x, reg = 0x%x\n",
-                        golden_value, reg);
-        }
-        }
-
-        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo : end\n");
-        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
-                FUSB300_GTM_TST_FIFO_DEG);
-}
-#endif
-
 static void fusb300_rdfifo(struct fusb300_ep *ep,
                           struct fusb300_request *req,
                           u32 length)
diff --git a/drivers/usb/gadget/net2272.c b/drivers/usb/gadget/net2272.c
index 7c7b0e120d88..ab98ea926a11 100644
--- a/drivers/usb/gadget/net2272.c
+++ b/drivers/usb/gadget/net2272.c
@@ -27,13 +27,13 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
-#include <linux/irq.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/pci.h>
 #include <linux/platform_device.h>
+#include <linux/prefetch.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index 85c1b0d66293..8d31848aab09 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -2060,6 +2060,7 @@ static int s3c2410_udc_resume(struct platform_device *pdev)
 static const struct platform_device_id s3c_udc_ids[] = {
         { "s3c2410-usbgadget", },
         { "s3c2440-usbgadget", },
+        { }
 };
 MODULE_DEVICE_TABLE(platform, s3c_udc_ids);
 
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index bf2c8f65e1ae..e051b30c1847 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1046,7 +1046,19 @@ static int ehci_hub_control (
                         if (!selector || selector > 5)
                                 goto error;
                         ehci_quiesce(ehci);
+
+                        /* Put all enabled ports into suspend */
+                        while (ports--) {
+                                u32 __iomem *sreg =
+                                                &ehci->regs->port_status[ports];
+
+                                temp = ehci_readl(ehci, sreg) & ~PORT_RWC_BITS;
+                                if (temp & PORT_PE)
+                                        ehci_writel(ehci, temp | PORT_SUSPEND,
+                                                        sreg);
+                        }
                         ehci_halt(ehci);
+                        temp = ehci_readl(ehci, status_reg);
                         temp |= selector << 16;
                         ehci_writel(ehci, temp, status_reg);
                         break;
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index 0c058be35a38..555a73c864b5 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -24,6 +24,7 @@
 #include <linux/usb/ulpi.h>
 #include <linux/slab.h>
 
+#include <mach/hardware.h>
 #include <mach/mxc_ehci.h>
 
 #include <asm/mach-types.h>
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 55a57c23dd0f..45240321ca09 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -98,6 +98,18 @@ static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
         }
 }
 
+static void disable_put_regulator(
+                struct ehci_hcd_omap_platform_data *pdata)
+{
+        int i;
+
+        for (i = 0 ; i < OMAP3_HS_USB_PORTS ; i++) {
+                if (pdata->regulator[i]) {
+                        regulator_disable(pdata->regulator[i]);
+                        regulator_put(pdata->regulator[i]);
+                }
+        }
+}
 
 /* configure so an HC device and id are always provided */
 /* always called with process context; sleeping is OK */
@@ -231,9 +243,11 @@ err_add_hcd:
         omap_usbhs_disable(dev);
 
 err_enable:
+        disable_put_regulator(pdata);
         usb_put_hcd(hcd);
 
 err_io:
+        iounmap(regs);
         return ret;
 }
 
@@ -253,6 +267,8 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
 
         usb_remove_hcd(hcd);
         omap_usbhs_disable(dev);
+        disable_put_regulator(dev->platform_data);
+        iounmap(hcd->regs);
         usb_put_hcd(hcd);
         return 0;
 }
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index 55d3d5859ac5..840beda66dd9 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1583,6 +1583,9 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
         int retval = 0;
 
         spin_lock_irqsave(&priv->lock, spinflags);
+        retval = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (retval)
+                goto out;
 
         qh = urb->ep->hcpriv;
         if (!qh) {
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index a9d315906e3d..629a96813fd6 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -535,7 +535,7 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
         iounmap(base);
 }
 
-static const struct dmi_system_id __initconst ehci_dmi_nohandoff_table[] = {
+static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = {
         {
                 /*  Pegatron Lucid (ExoPC) */
                 .matches = {
@@ -817,7 +817,7 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
 
         /* If the BIOS owns the HC, signal that the OS wants it, and wait */
         if (val & XHCI_HC_BIOS_OWNED) {
-                writel(val & XHCI_HC_OS_OWNED, base + ext_cap_offset);
+                writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
 
                 /* Wait for 5 seconds with 10 microsecond polling interval */
                 timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 763f484bc092..1c4432d8fc10 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -345,7 +345,8 @@ static void xhci_event_ring_work(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
         temp = xhci_readl(xhci, &xhci->op_regs->status);
         xhci_dbg(xhci, "op reg status = 0x%x\n", temp);
-        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg(xhci, "HW died, polling stopped.\n");
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 return;
@@ -939,8 +940,11 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
                 return 0;
         }
 
+        xhci = hcd_to_xhci(hcd);
+        if (xhci->xhc_state & XHCI_STATE_HALTED)
+                return -ENODEV;
+
         if (check_virt_dev) {
-                xhci = hcd_to_xhci(hcd);
                 if (!udev->slot_id || !xhci->devs
                         || !xhci->devs[udev->slot_id]) {
                         printk(KERN_DEBUG "xHCI %s called with unaddressed "
@@ -1242,7 +1246,8 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 xhci_urb_free_priv(xhci, urb_priv);
                 return ret;
         }
-        if (xhci->xhc_state & XHCI_STATE_DYING) {
+        if ((xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on "
                                 "non-responsive xHCI host.\n",
                                 urb->ep->desc.bEndpointAddress, urb);
@@ -2665,7 +2670,10 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         int i, ret;
 
         ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
-        if (ret <= 0)
+        /* If the host is halted due to driver unload, we still need to free the
+         * device.
+         */
+        if (ret <= 0 && ret != -ENODEV)
                 return;
 
         virt_dev = xhci->devs[udev->slot_id];
@@ -2679,7 +2687,8 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         spin_lock_irqsave(&xhci->lock, flags);
         /* Don't disable the slot if the host controller is dead. */
         state = xhci_readl(xhci, &xhci->op_regs->status);
-        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_free_virt_device(xhci, udev->slot_id);
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 return;
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 6192b45959f4..fc34b8b11910 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -3,9 +3,6 @@
 # for silicon based on Mentor Graphics INVENTRA designs
 #
 
-comment "Enable Host or Gadget support to see Inventra options"
-        depends on !USB && USB_GADGET=n
-
 # (M)HDRC = (Multipoint) Highspeed Dual-Role Controller
 config USB_MUSB_HDRC
         depends on USB && USB_GADGET
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index b67a062f556b..8c41a2e6ea77 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1698,6 +1698,8 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
 
         is_on = !!is_on;
 
+        pm_runtime_get_sync(musb->controller);
+
         /* NOTE: this assumes we are sensing vbus; we'd rather
          * not pullup unless the B-session is active.
          */
@@ -1707,6 +1709,9 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
                 musb_pullup(musb, is_on);
         }
         spin_unlock_irqrestore(&musb->lock, flags);
+
+        pm_runtime_put(musb->controller);
+
         return 0;
 }
 
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index c784e6c03aac..07c8a73dfe41 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -89,7 +89,7 @@ static inline int tusb_omap_use_shared_dmareq(struct tusb_omap_dma_ch *chdat)
         u32             reg = musb_readl(chdat->tbase, TUSB_DMA_EP_MAP);
 
         if (reg != 0) {
-                dev_dbg(musb->controller, "ep%i dmareq0 is busy for ep%i\n",
+                dev_dbg(chdat->musb->controller, "ep%i dmareq0 is busy for ep%i\n",
                         chdat->epnum, reg & 0xf);
                 return -EAGAIN;
         }
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index ba79dbf5adbc..cb2d451d511e 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -14,6 +14,7 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
+#include <linux/dma-mapping.h>
 #include <linux/io.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -76,7 +77,7 @@ struct usbhsg_recip_handle {
                 struct usbhsg_gpriv, mod)
 
 #define __usbhsg_for_each_uep(start, pos, g, i) \
-        for (i = start, pos = (g)->uep;         \
+        for (i = start, pos = (g)->uep + i;     \
              i < (g)->uep_size;                 \
              i++, pos = (g)->uep + i)
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 2e06b90aa1f8..78a2cf9551cc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -151,6 +151,7 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
  * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
  */
 static struct usb_device_id id_table_combined [] = {
+        { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
@@ -1171,7 +1172,7 @@ static __u32 get_ftdi_divisor(struct tty_struct *tty,
         case FT2232H: /* FT2232H chip */
         case FT4232H: /* FT4232H chip */
         case FT232H:  /* FT232H chip */
-                if ((baud <= 12000000) & (baud >= 1200)) {
+                if ((baud <= 12000000) && (baud >= 1200)) {
                         div_value = ftdi_2232h_baud_to_divisor(baud);
                 } else if (baud < 1200) {
                         div_value = ftdi_232bm_baud_to_divisor(baud);
@@ -1205,7 +1206,10 @@ static int change_speed(struct tty_struct *tty, struct usb_serial_port *port)
         urb_index_value = get_ftdi_divisor(tty, port);
         urb_value = (__u16)urb_index_value;
         urb_index = (__u16)(urb_index_value >> 16);
-        if (priv->interface) {  /* FT2232C */
+        if ((priv->chip_type == FT2232C) || (priv->chip_type == FT2232H) ||
+                (priv->chip_type == FT4232H) || (priv->chip_type == FT232H)) {
+                /* Probably the BM type needs the MSB of the encoded fractional
+                 * divider also moved like for the chips above. Any infos? */
                 urb_index = (__u16)((urb_index << 8) | priv->interface);
         }
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 19156d1049fe..bf5227ad3ef7 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1159,4 +1159,8 @@
 /* USB-Nano-485*/
 #define FTDI_CTI_NANO_PID       0xF60B
 
-
+/*
+ * ZeitControl cardsystems GmbH rfid-readers http://zeitconrol.de
+ */
+/* TagTracer MIFARE*/
+#define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID    0xF7C0
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 60b25d8ea0e2..815656198914 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -148,6 +148,10 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_E14AC                    0x14AC
+#define HUAWEI_PRODUCT_K3770                    0x14C9
+#define HUAWEI_PRODUCT_K3771                    0x14CA
+#define HUAWEI_PRODUCT_K4510                    0x14CB
+#define HUAWEI_PRODUCT_K4511                    0x14CC
 #define HUAWEI_PRODUCT_ETS1220                  0x1803
 #define HUAWEI_PRODUCT_E353                     0x1506
 
@@ -547,6 +551,14 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 54a9dab1f33b..aeccc7f0a93c 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -45,6 +45,7 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x05c6, 0x9203)},   /* Generic Gobi Modem device */
         {USB_DEVICE(0x05c6, 0x9222)},   /* Generic Gobi Modem device */
         {USB_DEVICE(0x05c6, 0x9008)},   /* Generic Gobi QDL device */
+        {USB_DEVICE(0x05c6, 0x9009)},   /* Generic Gobi Modem device */
         {USB_DEVICE(0x05c6, 0x9201)},   /* Generic Gobi QDL device */
         {USB_DEVICE(0x05c6, 0x9221)},   /* Generic Gobi QDL device */
         {USB_DEVICE(0x05c6, 0x9231)},   /* Generic Gobi QDL device */
@@ -78,6 +79,7 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x1199, 0x9008)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
         {USB_DEVICE(0x1199, 0x9009)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
         {USB_DEVICE(0x1199, 0x900a)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
+        {USB_DEVICE(0x1199, 0x9011)},   /* Sierra Wireless Gobi 2000 Modem device (MC8305) */
         {USB_DEVICE(0x16d8, 0x8001)},   /* CMDTech Gobi 2000 QDL device (VU922) */
         {USB_DEVICE(0x16d8, 0x8002)},   /* CMDTech Gobi 2000 Modem device (VU922) */
         {USB_DEVICE(0x05c6, 0x9204)},   /* Gobi 2000 QDL device */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ccff3483eebc..3041a974faf3 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1988,6 +1988,16 @@ UNUSUAL_DEV(  0x4146, 0xba01, 0x0100, 0x0100,
                 "Micro Mini 1GB",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
 
+/*
+ * Nick Bowler <nbowler@elliptictech.com>
+ * SCSI stack spams (otherwise harmless) error messages.
+ */
+UNUSUAL_DEV(  0xc251, 0x4003, 0x0100, 0x0100,
+                "Keil Software, Inc.",
+                "V2M MotherBoard",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NOT_LOCKABLE),
+
 /* Reported by Andrew Simmons <andrew.simmons@gmail.com> */
 UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
                 "DataStor",
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 8be086e9abe4..51352de88ef1 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1003,6 +1003,7 @@ COMPATIBLE_IOCTL(PPPIOCCONNECT)
 COMPATIBLE_IOCTL(PPPIOCDISCONN)
 COMPATIBLE_IOCTL(PPPIOCATTCHAN)
 COMPATIBLE_IOCTL(PPPIOCGCHAN)
+COMPATIBLE_IOCTL(PPPIOCGL2TPSTATS)
 /* PPPOX */
 COMPATIBLE_IOCTL(PPPOEIOCSFWD)
 COMPATIBLE_IOCTL(PPPOEIOCDFWD)
diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index 1cd6d9d3e29a..cc16562654de 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -1,6 +1,6 @@
 config ECRYPT_FS
         tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && KEYS && CRYPTO
+        depends on EXPERIMENTAL && KEYS && CRYPTO && (ENCRYPTED_KEYS || ENCRYPTED_KEYS=n)
         select CRYPTO_ECB
         select CRYPTO_CBC
         select CRYPTO_MD5
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 08a2b52bf565..ac1ad48c2376 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1973,7 +1973,7 @@ pki_encrypt_session_key(struct key *auth_tok_key,
 {
         struct ecryptfs_msg_ctx *msg_ctx = NULL;
         char *payload = NULL;
-        size_t payload_len;
+        size_t payload_len = 0;
         struct ecryptfs_message *msg;
         int rc;
 
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 9f1bb747d77d..b4a6befb1216 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -175,6 +175,7 @@ enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
        ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
        ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
        ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only,
+       ecryptfs_opt_check_dev_ruid,
        ecryptfs_opt_err };
 
 static const match_table_t tokens = {
@@ -191,6 +192,7 @@ static const match_table_t tokens = {
         {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
         {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
         {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"},
+        {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
         {ecryptfs_opt_err, NULL}
 };
 
@@ -236,6 +238,7 @@ static void ecryptfs_init_mount_crypt_stat(
  * ecryptfs_parse_options
  * @sb: The ecryptfs super block
  * @options: The options passed to the kernel
+ * @check_ruid: set to 1 if device uid should be checked against the ruid
  *
  * Parse mount options:
  * debug=N         - ecryptfs_verbosity level for debug output
@@ -251,7 +254,8 @@ static void ecryptfs_init_mount_crypt_stat(
  *
  * Returns zero on success; non-zero on error
  */
-static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
+static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
+                                  uid_t *check_ruid)
 {
         char *p;
         int rc = 0;
@@ -276,6 +280,8 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
         char *cipher_key_bytes_src;
         char *fn_cipher_key_bytes_src;
 
+        *check_ruid = 0;
+
         if (!options) {
                 rc = -EINVAL;
                 goto out;
@@ -380,6 +386,9 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
                         mount_crypt_stat->flags |=
                                 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;
                         break;
+                case ecryptfs_opt_check_dev_ruid:
+                        *check_ruid = 1;
+                        break;
                 case ecryptfs_opt_err:
                 default:
                         printk(KERN_WARNING
@@ -475,6 +484,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
         const char *err = "Getting sb failed";
         struct inode *inode;
         struct path path;
+        uid_t check_ruid;
         int rc;
 
         sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
@@ -483,7 +493,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                 goto out;
         }
 
-        rc = ecryptfs_parse_options(sbi, raw_data);
+        rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
         if (rc) {
                 err = "Error parsing options";
                 goto out;
@@ -521,6 +531,15 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                         "known incompatibilities\n");
                 goto out_free;
         }
+
+        if (check_ruid && path.dentry->d_inode->i_uid != current_uid()) {
+                rc = -EPERM;
+                printk(KERN_ERR "Mount of device (uid: %d) not owned by "
+                       "requested user (uid: %d)\n",
+                       path.dentry->d_inode->i_uid, current_uid());
+                goto out_free;
+        }
+
         ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
         s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
         s->s_blocksize = path.dentry->d_sb->s_blocksize;
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index 85d430963116..3745f7c2b9c2 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -39,15 +39,16 @@
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                          loff_t offset, size_t size)
 {
-        struct ecryptfs_inode_info *inode_info;
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        inode_info = ecryptfs_inode_to_private(ecryptfs_inode);
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_write(inode_info->lower_file, data, size, &offset);
+        rc = vfs_write(lower_file, data, size, &offset);
         set_fs(fs_save);
         mark_inode_dirty_sync(ecryptfs_inode);
         return rc;
@@ -225,15 +226,16 @@ out:
 int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
                         struct inode *ecryptfs_inode)
 {
-        struct ecryptfs_inode_info *inode_info =
-                ecryptfs_inode_to_private(ecryptfs_inode);
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_read(inode_info->lower_file, data, size, &offset);
+        rc = vfs_read(lower_file, data, size, &offset);
         set_fs(fs_save);
         return rc;
 }
diff --git a/fs/exec.c b/fs/exec.c
index da80612a35f4..25dcbe5fc356 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1459,6 +1459,23 @@ static int do_execve_common(const char *filename,
         struct files_struct *displaced;
         bool clear_in_exec;
         int retval;
+        const struct cred *cred = current_cred();
+
+        /*
+         * We move the actual failure in case of RLIMIT_NPROC excess from
+         * set*uid() to execve() because too many poorly written programs
+         * don't check setuid() return code.  Here we additionally recheck
+         * whether NPROC limit is still exceeded.
+         */
+        if ((current->flags & PF_NPROC_EXCEEDED) &&
+            atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) {
+                retval = -EAGAIN;
+                goto out_ret;
+        }
+
+        /* We're below the limit (still or again), so we don't want to make
+         * further execve() calls fail. */
+        current->flags &= ~PF_NPROC_EXCEEDED;
 
         retval = unshare_files(&displaced);
         if (retval)
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 6e18a0b7750d..5571708b6a58 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -2209,9 +2209,11 @@ static int ext3_symlink (struct inode * dir,
                 /*
                  * For non-fast symlinks, we just allocate inode and put it on
                  * orphan list in the first transaction => we need bitmap,
-                 * group descriptor, sb, inode block, quota blocks.
+                 * group descriptor, sb, inode block, quota blocks, and
+                 * possibly selinux xattr blocks.
                  */
-                credits = 4 + EXT3_MAXQUOTAS_INIT_BLOCKS(dir->i_sb);
+                credits = 4 + EXT3_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+                          EXT3_XATTR_TRANS_BLOCKS;
         } else {
                 /*
                  * Fast symlink. We have to add entry to directory
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 565a154e22d4..f8068c7bae9f 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2253,9 +2253,11 @@ static int ext4_symlink(struct inode *dir,
                 /*
                  * For non-fast symlinks, we just allocate inode and put it on
                  * orphan list in the first transaction => we need bitmap,
-                 * group descriptor, sb, inode block, quota blocks.
+                 * group descriptor, sb, inode block, quota blocks, and
+                 * possibly selinux xattr blocks.
                  */
-                credits = 4 + EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb);
+                credits = 4 + EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+                          EXT4_XATTR_TRANS_BLOCKS;
         } else {
                 /*
                  * Fast symlink. We have to add entry to directory
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index be020771c6b4..dbcd82126aed 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -79,12 +79,9 @@ config NFS_V4_1
         depends on NFS_FS && NFS_V4 && EXPERIMENTAL
         select SUNRPC_BACKCHANNEL
         select PNFS_FILE_LAYOUT
-        select PNFS_BLOCK
-        select MD
-        select BLK_DEV_DM
         help
           This option enables support for minor version 1 of the NFSv4 protocol
-          (RFC 5661 and RFC 5663) in the kernel's NFS client.
+          (RFC 5661) in the kernel's NFS client.
 
           If unsure, say N.
 
@@ -93,16 +90,13 @@ config PNFS_FILE_LAYOUT
 
 config PNFS_BLOCK
         tristate
+        depends on NFS_FS && NFS_V4_1 && BLK_DEV_DM
+        default m
 
 config PNFS_OBJLAYOUT
-        tristate "Provide support for the pNFS Objects Layout Driver for NFSv4.1 pNFS (EXPERIMENTAL)"
+        tristate
         depends on NFS_FS && NFS_V4_1 && SCSI_OSD_ULD
-        help
-          Say M here if you want your pNFS client to support the Objects Layout Driver.
-          Requires the SCSI osd initiator library (SCSI_OSD_INITIATOR) and
-          upper level driver (SCSI_OSD_ULD).
-
-          If unsure, say N.
+        default m
 
 config ROOT_NFS
         bool "Root file system on NFS"
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index d1fe74506c4c..c57836dc778f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -596,7 +596,7 @@ _xfs_buf_read(
         bp->b_flags |= flags & (XBF_READ | XBF_ASYNC | XBF_READ_AHEAD);
 
         status = xfs_buf_iorequest(bp);
-        if (status || XFS_BUF_ISERROR(bp) || (flags & XBF_ASYNC))
+        if (status || bp->b_error || (flags & XBF_ASYNC))
                 return status;
         return xfs_buf_iowait(bp);
 }
@@ -679,7 +679,6 @@ xfs_buf_read_uncached(
         /* set up the buffer for a read IO */
         XFS_BUF_SET_ADDR(bp, daddr);
         XFS_BUF_READ(bp);
-        XFS_BUF_BUSY(bp);
 
         xfsbdstrat(mp, bp);
         error = xfs_buf_iowait(bp);
@@ -1069,7 +1068,7 @@ xfs_bioerror(
         /*
          * No need to wait until the buffer is unpinned, we aren't flushing it.
          */
-        XFS_BUF_ERROR(bp, EIO);
+        xfs_buf_ioerror(bp, EIO);
 
         /*
          * We're calling xfs_buf_ioend, so delete XBF_DONE flag.
@@ -1094,7 +1093,7 @@ STATIC int
 xfs_bioerror_relse(
         struct xfs_buf  *bp)
 {
-        int64_t         fl = XFS_BUF_BFLAGS(bp);
+        int64_t         fl = bp->b_flags;
         /*
          * No need to wait until the buffer is unpinned.
          * We aren't flushing it.
@@ -1115,7 +1114,7 @@ xfs_bioerror_relse(
                  * There's no reason to mark error for
                  * ASYNC buffers.
                  */
-                XFS_BUF_ERROR(bp, EIO);
+                xfs_buf_ioerror(bp, EIO);
                 XFS_BUF_FINISH_IOWAIT(bp);
         } else {
                 xfs_buf_relse(bp);
@@ -1324,7 +1323,7 @@ xfs_buf_offset(
         struct page             *page;
 
         if (bp->b_flags & XBF_MAPPED)
-                return XFS_BUF_PTR(bp) + offset;
+                return bp->b_addr + offset;
 
         offset += bp->b_offset;
         page = bp->b_pages[offset >> PAGE_SHIFT];
@@ -1484,7 +1483,7 @@ xfs_setsize_buftarg_flags(
         if (set_blocksize(btp->bt_bdev, sectorsize)) {
                 xfs_warn(btp->bt_mount,
                         "Cannot set_blocksize to %u on device %s\n",
-                        sectorsize, XFS_BUFTARG_NAME(btp));
+                        sectorsize, xfs_buf_target_name(btp));
                 return EINVAL;
         }
 
@@ -1681,7 +1680,7 @@ xfs_buf_delwri_split(
         list_for_each_entry_safe(bp, n, dwq, b_list) {
                 ASSERT(bp->b_flags & XBF_DELWRI);
 
-                if (!XFS_BUF_ISPINNED(bp) && xfs_buf_trylock(bp)) {
+                if (!xfs_buf_ispinned(bp) && xfs_buf_trylock(bp)) {
                         if (!force &&
                             time_before(jiffies, bp->b_queuetime + age)) {
                                 xfs_buf_unlock(bp);
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 6a83b46b4bcf..620972b8094d 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -228,11 +228,15 @@ extern void xfs_buf_delwri_promote(xfs_buf_t *);
 extern int xfs_buf_init(void);
 extern void xfs_buf_terminate(void);
 
-#define xfs_buf_target_name(target)     \
-        ({ char __b[BDEVNAME_SIZE]; bdevname((target)->bt_bdev, __b); __b; })
+static inline const char *
+xfs_buf_target_name(struct xfs_buftarg *target)
+{
+        static char __b[BDEVNAME_SIZE];
+
+        return bdevname(target->bt_bdev, __b);
+}
 
 
-#define XFS_BUF_BFLAGS(bp)      ((bp)->b_flags)
 #define XFS_BUF_ZEROFLAGS(bp) \
         ((bp)->b_flags &= ~(XBF_READ|XBF_WRITE|XBF_ASYNC|XBF_DELWRI| \
                             XBF_SYNCIO|XBF_FUA|XBF_FLUSH))
@@ -251,23 +255,14 @@ void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNDELAYWRITE(bp)        xfs_buf_delwri_dequeue(bp)
 #define XFS_BUF_ISDELAYWRITE(bp)        ((bp)->b_flags & XBF_DELWRI)
 
-#define XFS_BUF_ERROR(bp,no)    xfs_buf_ioerror(bp,no)
-#define XFS_BUF_GETERROR(bp)    xfs_buf_geterror(bp)
-#define XFS_BUF_ISERROR(bp)     (xfs_buf_geterror(bp) ? 1 : 0)
-
 #define XFS_BUF_DONE(bp)        ((bp)->b_flags |= XBF_DONE)
 #define XFS_BUF_UNDONE(bp)      ((bp)->b_flags &= ~XBF_DONE)
 #define XFS_BUF_ISDONE(bp)      ((bp)->b_flags & XBF_DONE)
 
-#define XFS_BUF_BUSY(bp)        do { } while (0)
-#define XFS_BUF_UNBUSY(bp)      do { } while (0)
-#define XFS_BUF_ISBUSY(bp)      (1)
-
 #define XFS_BUF_ASYNC(bp)       ((bp)->b_flags |= XBF_ASYNC)
 #define XFS_BUF_UNASYNC(bp)     ((bp)->b_flags &= ~XBF_ASYNC)
 #define XFS_BUF_ISASYNC(bp)     ((bp)->b_flags & XBF_ASYNC)
 
-#define XFS_BUF_HOLD(bp)        xfs_buf_hold(bp)
 #define XFS_BUF_READ(bp)        ((bp)->b_flags |= XBF_READ)
 #define XFS_BUF_UNREAD(bp)      ((bp)->b_flags &= ~XBF_READ)
 #define XFS_BUF_ISREAD(bp)      ((bp)->b_flags & XBF_READ)
@@ -276,10 +271,6 @@ void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNWRITE(bp)     ((bp)->b_flags &= ~XBF_WRITE)
 #define XFS_BUF_ISWRITE(bp)     ((bp)->b_flags & XBF_WRITE)
 
-#define XFS_BUF_SET_START(bp)                   do { } while (0)
-
-#define XFS_BUF_PTR(bp)                 (xfs_caddr_t)((bp)->b_addr)
-#define XFS_BUF_SET_PTR(bp, val, cnt)   xfs_buf_associate_memory(bp, val, cnt)
 #define XFS_BUF_ADDR(bp)                ((bp)->b_bn)
 #define XFS_BUF_SET_ADDR(bp, bno)       ((bp)->b_bn = (xfs_daddr_t)(bno))
 #define XFS_BUF_OFFSET(bp)              ((bp)->b_file_offset)
@@ -299,14 +290,13 @@ xfs_buf_set_ref(
 #define XFS_BUF_SET_VTYPE_REF(bp, type, ref)    xfs_buf_set_ref(bp, ref)
 #define XFS_BUF_SET_VTYPE(bp, type)             do { } while (0)
 
-#define XFS_BUF_ISPINNED(bp)    atomic_read(&((bp)->b_pin_count))
+static inline int xfs_buf_ispinned(struct xfs_buf *bp)
+{
+        return atomic_read(&bp->b_pin_count);
+}
 
 #define XFS_BUF_FINISH_IOWAIT(bp)       complete(&bp->b_iowait);
 
-#define XFS_BUF_SET_TARGET(bp, target)  ((bp)->b_target = (target))
-#define XFS_BUF_TARGET(bp)              ((bp)->b_target)
-#define XFS_BUFTARG_NAME(target)        xfs_buf_target_name(target)
-
 static inline void xfs_buf_relse(xfs_buf_t *bp)
 {
         xfs_buf_unlock(bp);
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index e4c938afb910..4604f90f86a3 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -332,7 +332,7 @@ xfs_sync_fsdata(
          * between there and here.
          */
         bp = xfs_getsb(mp, 0);
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                 xfs_log_force(mp, 0);
 
         return xfs_bwrite(mp, bp);
diff --git a/fs/xfs/quota/xfs_dquot.c b/fs/xfs/quota/xfs_dquot.c
index 837f31158d43..db62959bed13 100644
--- a/fs/xfs/quota/xfs_dquot.c
+++ b/fs/xfs/quota/xfs_dquot.c
@@ -318,10 +318,9 @@ xfs_qm_init_dquot_blk(
         int             curid, i;
 
         ASSERT(tp);
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
 
-        d = (xfs_dqblk_t *)XFS_BUF_PTR(bp);
+        d = bp->b_addr;
 
         /*
          * ID of the first dquot in the block - id's are zero based.
@@ -403,7 +402,7 @@ xfs_qm_dqalloc(
                                dqp->q_blkno,
                                mp->m_quotainfo->qi_dqchunklen,
                                0);
-        if (!bp || (error = XFS_BUF_GETERROR(bp)))
+        if (!bp || (error = xfs_buf_geterror(bp)))
                 goto error1;
         /*
          * Make a chunk of dquots out of this buffer and log
@@ -534,13 +533,12 @@ xfs_qm_dqtobp(
                         return XFS_ERROR(error);
         }
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
 
         /*
          * calculate the location of the dquot inside the buffer.
          */
-        ddq = (struct xfs_disk_dquot *)(XFS_BUF_PTR(bp) + dqp->q_bufoffset);
+        ddq = bp->b_addr + dqp->q_bufoffset;
 
         /*
          * A simple sanity check in case we got a corrupted dquot...
@@ -553,7 +551,6 @@ xfs_qm_dqtobp(
                         xfs_trans_brelse(tp, bp);
                         return XFS_ERROR(EIO);
                 }
-                XFS_BUF_BUSY(bp); /* We dirtied this */
         }
 
         *O_bpp = bp;
@@ -622,7 +619,6 @@ xfs_qm_dqread(
          * this particular dquot was repaired. We still aren't afraid to
          * brelse it because we have the changes incore.
          */
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
         xfs_trans_brelse(tp, bp);
 
@@ -1204,7 +1200,7 @@ xfs_qm_dqflush(
         /*
          * Calculate the location of the dquot inside the buffer.
          */
-        ddqp = (struct xfs_disk_dquot *)(XFS_BUF_PTR(bp) + dqp->q_bufoffset);
+        ddqp = bp->b_addr + dqp->q_bufoffset;
 
         /*
          * A simple sanity check in case we got a corrupted dquot..
@@ -1240,7 +1236,7 @@ xfs_qm_dqflush(
          * If the buffer is pinned then push on the log so we won't
          * get stuck waiting in the write for too long.
          */
-        if (XFS_BUF_ISPINNED(bp)) {
+        if (xfs_buf_ispinned(bp)) {
                 trace_xfs_dqflush_force(dqp);
                 xfs_log_force(mp, 0);
         }
@@ -1447,7 +1443,7 @@ xfs_qm_dqflock_pushbuf_wait(
                 goto out_lock;
 
         if (XFS_BUF_ISDELAYWRITE(bp)) {
-                if (XFS_BUF_ISPINNED(bp))
+                if (xfs_buf_ispinned(bp))
                         xfs_log_force(mp, 0);
                 xfs_buf_delwri_promote(bp);
                 wake_up_process(bp->b_target->bt_task);
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 46e54ad9a2dc..9a0aa76facdf 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1240,7 +1240,7 @@ xfs_qm_reset_dqcounts(
         do_div(j, sizeof(xfs_dqblk_t));
         ASSERT(mp->m_quotainfo->qi_dqperchunk == j);
 #endif
-        ddq = (xfs_disk_dquot_t *)XFS_BUF_PTR(bp);
+        ddq = bp->b_addr;
         for (j = 0; j < mp->m_quotainfo->qi_dqperchunk; j++) {
                 /*
                  * Do a sanity check, and if needed, repair the dqblk. Don't
diff --git a/fs/xfs/xfs_ag.h b/fs/xfs/xfs_ag.h
index 6530769a999b..4805f009f923 100644
--- a/fs/xfs/xfs_ag.h
+++ b/fs/xfs/xfs_ag.h
@@ -103,7 +103,7 @@ typedef struct xfs_agf {
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
 #define XFS_AGF_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGF_DADDR(mp))
-#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)((bp)->b_addr))
 
 extern int xfs_read_agf(struct xfs_mount *mp, struct xfs_trans *tp,
                         xfs_agnumber_t agno, int flags, struct xfs_buf **bpp);
@@ -156,7 +156,7 @@ typedef struct xfs_agi {
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGI_DADDR(mp)       ((xfs_daddr_t)(2 << (mp)->m_sectbb_log))
 #define XFS_AGI_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGI_DADDR(mp))
-#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)((bp)->b_addr))
 
 extern int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
                                 xfs_agnumber_t agno, struct xfs_buf **bpp);
@@ -168,7 +168,7 @@ extern int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
 #define XFS_AGFL_DADDR(mp)      ((xfs_daddr_t)(3 << (mp)->m_sectbb_log))
 #define XFS_AGFL_BLOCK(mp)      XFS_HDR_BLOCK(mp, XFS_AGFL_DADDR(mp))
 #define XFS_AGFL_SIZE(mp)       ((mp)->m_sb.sb_sectsize / sizeof(xfs_agblock_t))
-#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)((bp)->b_addr))
 
 typedef struct xfs_agfl {
         __be32          agfl_bno[1];    /* actually XFS_AGFL_SIZE(mp) */
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 1e00b3ef6274..bdd9cb54d63b 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -451,8 +451,7 @@ xfs_alloc_read_agfl(
                         XFS_FSS_TO_BB(mp, 1), 0, &bp);
         if (error)
                 return error;
-        ASSERT(bp);
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         XFS_BUF_SET_VTYPE_REF(bp, B_FS_AGFL, XFS_AGFL_REF);
         *bpp = bp;
         return 0;
@@ -2116,7 +2115,7 @@ xfs_read_agf(
         if (!*bpp)
                 return 0;
 
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!(*bpp)->b_error);
         agf = XFS_BUF_TO_AGF(*bpp);
 
         /*
@@ -2168,7 +2167,7 @@ xfs_alloc_read_agf(
                 return error;
         if (!*bpp)
                 return 0;
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!(*bpp)->b_error);
 
         agf = XFS_BUF_TO_AGF(*bpp);
         pag = xfs_perag_get(mp, agno);
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index cbae424fe1ba..160bcdc34a6e 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -2121,8 +2121,7 @@ xfs_attr_rmtval_set(xfs_da_args_t *args)
 
                 bp = xfs_buf_get(mp->m_ddev_targp, dblkno, blkcnt,
                                  XBF_LOCK | XBF_DONT_BLOCK);
-                ASSERT(bp);
-                ASSERT(!XFS_BUF_GETERROR(bp));
+                ASSERT(!xfs_buf_geterror(bp));
 
                 tmp = (valuelen < XFS_BUF_SIZE(bp)) ? valuelen :
                                                         XFS_BUF_SIZE(bp);
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index ab3e5c6c4642..452a291383ab 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -3383,8 +3383,7 @@ xfs_bmap_local_to_extents(
                 ASSERT(args.len == 1);
                 *firstblock = args.fsbno;
                 bp = xfs_btree_get_bufl(args.mp, tp, args.fsbno, 0);
-                memcpy((char *)XFS_BUF_PTR(bp), ifp->if_u1.if_data,
-                        ifp->if_bytes);
+                memcpy(bp->b_addr, ifp->if_u1.if_data, ifp->if_bytes);
                 xfs_trans_log_buf(tp, bp, 0, ifp->if_bytes - 1);
                 xfs_bmap_forkoff_reset(args.mp, ip, whichfork);
                 xfs_idata_realloc(ip, -ifp->if_bytes, whichfork);
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index cabf4b5604aa..2b9fd385e27d 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -275,8 +275,7 @@ xfs_btree_dup_cursor(
                                 return error;
                         }
                         new->bc_bufs[i] = bp;
-                        ASSERT(bp);
-                        ASSERT(!XFS_BUF_GETERROR(bp));
+                        ASSERT(!xfs_buf_geterror(bp));
                 } else
                         new->bc_bufs[i] = NULL;
         }
@@ -467,8 +466,7 @@ xfs_btree_get_bufl(
         ASSERT(fsbno != NULLFSBLOCK);
         d = XFS_FSB_TO_DADDR(mp, fsbno);
         bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d, mp->m_bsize, lock);
-        ASSERT(bp);
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         return bp;
 }
 
@@ -491,8 +489,7 @@ xfs_btree_get_bufs(
         ASSERT(agbno != NULLAGBLOCK);
         d = XFS_AGB_TO_DADDR(mp, agno, agbno);
         bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d, mp->m_bsize, lock);
-        ASSERT(bp);
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         return bp;
 }
 
@@ -632,7 +629,7 @@ xfs_btree_read_bufl(
                         mp->m_bsize, lock, &bp))) {
                 return error;
         }
-        ASSERT(!bp || !XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         if (bp)
                 XFS_BUF_SET_VTYPE_REF(bp, B_FS_MAP, refval);
         *bpp = bp;
@@ -973,8 +970,7 @@ xfs_btree_get_buf_block(
         *bpp = xfs_trans_get_buf(cur->bc_tp, mp->m_ddev_targp, d,
                                  mp->m_bsize, flags);
 
-        ASSERT(*bpp);
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!xfs_buf_geterror(*bpp));
 
         *block = XFS_BUF_TO_BLOCK(*bpp);
         return 0;
@@ -1006,8 +1002,7 @@ xfs_btree_read_buf_block(
         if (error)
                 return error;
 
-        ASSERT(*bpp != NULL);
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!xfs_buf_geterror(*bpp));
 
         xfs_btree_set_refs(cur, *bpp);
         *block = XFS_BUF_TO_BLOCK(*bpp);
diff --git a/fs/xfs/xfs_btree.h b/fs/xfs/xfs_btree.h
index 8d05a6a46ce3..5b240de104c0 100644
--- a/fs/xfs/xfs_btree.h
+++ b/fs/xfs/xfs_btree.h
@@ -262,7 +262,7 @@ typedef struct xfs_btree_cur
 /*
  * Convert from buffer to btree block header.
  */
-#define XFS_BUF_TO_BLOCK(bp)    ((struct xfs_btree_block *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_BLOCK(bp)    ((struct xfs_btree_block *)((bp)->b_addr))
 
 
 /*
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 88492916c3dc..cac2ecfa6746 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -124,9 +124,9 @@ xfs_buf_item_log_check(
 
         bp = bip->bli_buf;
         ASSERT(XFS_BUF_COUNT(bp) > 0);
-        ASSERT(XFS_BUF_PTR(bp) != NULL);
+        ASSERT(bp->b_addr != NULL);
         orig = bip->bli_orig;
-        buffer = XFS_BUF_PTR(bp);
+        buffer = bp->b_addr;
         for (x = 0; x < XFS_BUF_COUNT(bp); x++) {
                 if (orig[x] != buffer[x] && !btst(bip->bli_logged, x)) {
                         xfs_emerg(bp->b_mount,
@@ -371,7 +371,6 @@ xfs_buf_item_pin(
 {
         struct xfs_buf_log_item *bip = BUF_ITEM(lip);
 
-        ASSERT(XFS_BUF_ISBUSY(bip->bli_buf));
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
         ASSERT((bip->bli_flags & XFS_BLI_LOGGED) ||
                (bip->bli_flags & XFS_BLI_STALE));
@@ -479,13 +478,13 @@ xfs_buf_item_trylock(
         struct xfs_buf_log_item *bip = BUF_ITEM(lip);
         struct xfs_buf          *bp = bip->bli_buf;
 
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                 return XFS_ITEM_PINNED;
         if (!xfs_buf_trylock(bp))
                 return XFS_ITEM_LOCKED;
 
         /* take a reference to the buffer.  */
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
 
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
         trace_xfs_buf_item_trylock(bip);
@@ -726,7 +725,7 @@ xfs_buf_item_init(
          * to have logged.
          */
         bip->bli_orig = (char *)kmem_alloc(XFS_BUF_COUNT(bp), KM_SLEEP);
-        memcpy(bip->bli_orig, XFS_BUF_PTR(bp), XFS_BUF_COUNT(bp));
+        memcpy(bip->bli_orig, bp->b_addr, XFS_BUF_COUNT(bp));
         bip->bli_logged = (char *)kmem_zalloc(XFS_BUF_COUNT(bp) / NBBY, KM_SLEEP);
 #endif
 
@@ -895,7 +894,6 @@ xfs_buf_attach_iodone(
 {
         xfs_log_item_t  *head_lip;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
 
         lip->li_cb = cb;
@@ -960,7 +958,7 @@ xfs_buf_iodone_callbacks(
         static ulong            lasttime;
         static xfs_buftarg_t    *lasttarg;
 
-        if (likely(!XFS_BUF_GETERROR(bp)))
+        if (likely(!xfs_buf_geterror(bp)))
                 goto do_callbacks;
 
         /*
@@ -973,14 +971,14 @@ xfs_buf_iodone_callbacks(
                 goto do_callbacks;
         }
 
-        if (XFS_BUF_TARGET(bp) != lasttarg ||
+        if (bp->b_target != lasttarg ||
             time_after(jiffies, (lasttime + 5*HZ))) {
                 lasttime = jiffies;
                 xfs_alert(mp, "Device %s: metadata write error block 0x%llx",
-                        XFS_BUFTARG_NAME(XFS_BUF_TARGET(bp)),
+                        xfs_buf_target_name(bp->b_target),
                       (__uint64_t)XFS_BUF_ADDR(bp));
         }
-        lasttarg = XFS_BUF_TARGET(bp);
+        lasttarg = bp->b_target;
 
         /*
          * If the write was asynchronous then no one will be looking for the
@@ -991,12 +989,11 @@ xfs_buf_iodone_callbacks(
          * around.
          */
         if (XFS_BUF_ISASYNC(bp)) {
-                XFS_BUF_ERROR(bp, 0); /* errno of 0 unsets the flag */
+                xfs_buf_ioerror(bp, 0); /* errno of 0 unsets the flag */
 
                 if (!XFS_BUF_ISSTALE(bp)) {
                         XFS_BUF_DELAYWRITE(bp);
                         XFS_BUF_DONE(bp);
-                        XFS_BUF_SET_START(bp);
                 }
                 ASSERT(bp->b_iodone != NULL);
                 trace_xfs_buf_item_iodone_async(bp, _RET_IP_);
@@ -1013,7 +1010,6 @@ xfs_buf_iodone_callbacks(
         XFS_BUF_UNDELAYWRITE(bp);
 
         trace_xfs_buf_error_relse(bp, _RET_IP_);
-        xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
 
 do_callbacks:
         xfs_buf_do_callbacks(bp);
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 5bfcb8779f9f..ee9d5427fcd4 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -2050,7 +2050,7 @@ xfs_da_do_buf(
                 case 0:
                         bp = xfs_trans_get_buf(trans, mp->m_ddev_targp,
                                 mappedbno, nmapped, 0);
-                        error = bp ? XFS_BUF_GETERROR(bp) : XFS_ERROR(EIO);
+                        error = bp ? bp->b_error : XFS_ERROR(EIO);
                         break;
                 case 1:
                 case 2:
@@ -2268,7 +2268,7 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps)
                 dabuf->nbuf = 1;
                 bp = bps[0];
                 dabuf->bbcount = (short)BTOBB(XFS_BUF_COUNT(bp));
-                dabuf->data = XFS_BUF_PTR(bp);
+                dabuf->data = bp->b_addr;
                 dabuf->bps[0] = bp;
         } else {
                 dabuf->nbuf = nbuf;
@@ -2279,7 +2279,7 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps)
                 dabuf->data = kmem_alloc(BBTOB(dabuf->bbcount), KM_SLEEP);
                 for (i = off = 0; i < nbuf; i++, off += XFS_BUF_COUNT(bp)) {
                         bp = bps[i];
-                        memcpy((char *)dabuf->data + off, XFS_BUF_PTR(bp),
+                        memcpy((char *)dabuf->data + off, bp->b_addr,
                                 XFS_BUF_COUNT(bp));
                 }
         }
@@ -2302,8 +2302,8 @@ xfs_da_buf_clean(xfs_dabuf_t *dabuf)
                 for (i = off = 0; i < dabuf->nbuf;
                                 i++, off += XFS_BUF_COUNT(bp)) {
                         bp = dabuf->bps[i];
-                        memcpy(XFS_BUF_PTR(bp), (char *)dabuf->data + off,
-                                XFS_BUF_COUNT(bp));
+                        memcpy(bp->b_addr, dabuf->data + off,
+                                                XFS_BUF_COUNT(bp));
                 }
         }
 }
@@ -2340,7 +2340,7 @@ xfs_da_log_buf(xfs_trans_t *tp, xfs_dabuf_t *dabuf, uint first, uint last)
 
         ASSERT(dabuf->nbuf && dabuf->data && dabuf->bbcount && dabuf->bps[0]);
         if (dabuf->nbuf == 1) {
-                ASSERT(dabuf->data == (void *)XFS_BUF_PTR(dabuf->bps[0]));
+                ASSERT(dabuf->data == dabuf->bps[0]->b_addr);
                 xfs_trans_log_buf(tp, dabuf->bps[0], first, last);
                 return;
         }
diff --git a/fs/xfs/xfs_dinode.h b/fs/xfs/xfs_dinode.h
index dffba9ba0db6..a3721633abc8 100644
--- a/fs/xfs/xfs_dinode.h
+++ b/fs/xfs/xfs_dinode.h
@@ -148,7 +148,7 @@ typedef enum xfs_dinode_fmt {
                 be32_to_cpu((dip)->di_nextents) : \
                 be16_to_cpu((dip)->di_anextents))
 
-#define XFS_BUF_TO_DINODE(bp)   ((xfs_dinode_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_DINODE(bp)   ((xfs_dinode_t *)((bp)->b_addr))
 
 /*
  * For block and character special files the 32bit dev_t is stored at the
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index dd5628bd8d0b..9f24ec28283b 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -202,8 +202,7 @@ xfs_ialloc_inode_init(
                 fbuf = xfs_trans_get_buf(tp, mp->m_ddev_targp, d,
                                          mp->m_bsize * blks_per_cluster,
                                          XBF_LOCK);
-                ASSERT(fbuf);
-                ASSERT(!XFS_BUF_GETERROR(fbuf));
+                ASSERT(!xfs_buf_geterror(fbuf));
 
                 /*
                  * Initialize all inodes in this buffer and then log them.
@@ -1486,7 +1485,7 @@ xfs_read_agi(
         if (error)
                 return error;
 
-        ASSERT(*bpp && !XFS_BUF_GETERROR(*bpp));
+        ASSERT(!xfs_buf_geterror(*bpp));
         agi = XFS_BUF_TO_AGI(*bpp);
 
         /*
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 2fcca4b03ed3..0239a7c7c886 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2473,7 +2473,7 @@ cluster_corrupt_out:
                 if (bp->b_iodone) {
                         XFS_BUF_UNDONE(bp);
                         XFS_BUF_STALE(bp);
-                        XFS_BUF_ERROR(bp,EIO);
+                        xfs_buf_ioerror(bp, EIO);
                         xfs_buf_ioend(bp, 0);
                 } else {
                         XFS_BUF_STALE(bp);
@@ -2585,7 +2585,7 @@ xfs_iflush(
          * If the buffer is pinned then push on the log now so we won't
          * get stuck waiting in the write for too long.
          */
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                 xfs_log_force(mp, 0);
 
         /*
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 06ff8437ed8e..3a8d4f66d702 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -878,7 +878,7 @@ xlog_iodone(xfs_buf_t *bp)
         /*
          * Race to shutdown the filesystem if we see an error.
          */
-        if (XFS_TEST_ERROR((XFS_BUF_GETERROR(bp)), l->l_mp,
+        if (XFS_TEST_ERROR((xfs_buf_geterror(bp)), l->l_mp,
                         XFS_ERRTAG_IODONE_IOERR, XFS_RANDOM_IODONE_IOERR)) {
                 xfs_ioerror_alert("xlog_iodone", l->l_mp, bp, XFS_BUF_ADDR(bp));
                 XFS_BUF_STALE(bp);
@@ -1051,7 +1051,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
         if (!bp)
                 goto out_free_log;
         bp->b_iodone = xlog_iodone;
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
         log->l_xbuf = bp;
 
@@ -1108,7 +1107,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
                 iclog->ic_callback_tail = &(iclog->ic_callback);
                 iclog->ic_datap = (char *)iclog->ic_data + log->l_iclog_hsize;
 
-                ASSERT(XFS_BUF_ISBUSY(iclog->ic_bp));
                 ASSERT(xfs_buf_islocked(iclog->ic_bp));
                 init_waitqueue_head(&iclog->ic_force_wait);
                 init_waitqueue_head(&iclog->ic_write_wait);
@@ -1248,7 +1246,7 @@ xlog_bdstrat(
         struct xlog_in_core     *iclog = bp->b_fspriv;
 
         if (iclog->ic_state & XLOG_STATE_IOERROR) {
-                XFS_BUF_ERROR(bp, EIO);
+                xfs_buf_ioerror(bp, EIO);
                 XFS_BUF_STALE(bp);
                 xfs_buf_ioend(bp, 0);
                 /*
@@ -1355,7 +1353,6 @@ xlog_sync(xlog_t		*log,
         XFS_BUF_SET_COUNT(bp, count);
         bp->b_fspriv = iclog;
         XFS_BUF_ZEROFLAGS(bp);
-        XFS_BUF_BUSY(bp);
         XFS_BUF_ASYNC(bp);
         bp->b_flags |= XBF_SYNCIO;
 
@@ -1398,16 +1395,15 @@ xlog_sync(xlog_t		*log,
         if (split) {
                 bp = iclog->ic_log->l_xbuf;
                 XFS_BUF_SET_ADDR(bp, 0);             /* logical 0 */
-                XFS_BUF_SET_PTR(bp, (xfs_caddr_t)((__psint_t)&(iclog->ic_header)+
-                                            (__psint_t)count), split);
+                xfs_buf_associate_memory(bp,
+                                (char *)&iclog->ic_header + count, split);
                 bp->b_fspriv = iclog;
                 XFS_BUF_ZEROFLAGS(bp);
-                XFS_BUF_BUSY(bp);
                 XFS_BUF_ASYNC(bp);
                 bp->b_flags |= XBF_SYNCIO;
                 if (log->l_mp->m_flags & XFS_MOUNT_BARRIER)
                         bp->b_flags |= XBF_FUA;
-                dptr = XFS_BUF_PTR(bp);
+                dptr = bp->b_addr;
                 /*
                  * Bump the cycle numbers at the start of each block
                  * since this part of the buffer is at the start of
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 052a2c0ec5fb..a199dbcee7d8 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -147,7 +147,7 @@ xlog_align(
         xfs_daddr_t     offset = blk_no & ((xfs_daddr_t)log->l_sectBBsize - 1);
 
         ASSERT(BBTOB(offset + nbblks) <= XFS_BUF_SIZE(bp));
-        return XFS_BUF_PTR(bp) + BBTOB(offset);
+        return bp->b_addr + BBTOB(offset);
 }
 
 
@@ -178,9 +178,7 @@ xlog_bread_noalign(
 
         XFS_BUF_SET_ADDR(bp, log->l_logBBstart + blk_no);
         XFS_BUF_READ(bp);
-        XFS_BUF_BUSY(bp);
         XFS_BUF_SET_COUNT(bp, BBTOB(nbblks));
-        XFS_BUF_SET_TARGET(bp, log->l_mp->m_logdev_targp);
 
         xfsbdstrat(log->l_mp, bp);
         error = xfs_buf_iowait(bp);
@@ -220,18 +218,18 @@ xlog_bread_offset(
         xfs_buf_t       *bp,
         xfs_caddr_t     offset)
 {
-        xfs_caddr_t     orig_offset = XFS_BUF_PTR(bp);
+        xfs_caddr_t     orig_offset = bp->b_addr;
         int             orig_len = bp->b_buffer_length;
         int             error, error2;
 
-        error = XFS_BUF_SET_PTR(bp, offset, BBTOB(nbblks));
+        error = xfs_buf_associate_memory(bp, offset, BBTOB(nbblks));
         if (error)
                 return error;
 
         error = xlog_bread_noalign(log, blk_no, nbblks, bp);
 
         /* must reset buffer pointer even on error */
-        error2 = XFS_BUF_SET_PTR(bp, orig_offset, orig_len);
+        error2 = xfs_buf_associate_memory(bp, orig_offset, orig_len);
         if (error)
                 return error;
         return error2;
@@ -266,11 +264,9 @@ xlog_bwrite(
 
         XFS_BUF_SET_ADDR(bp, log->l_logBBstart + blk_no);
         XFS_BUF_ZEROFLAGS(bp);
-        XFS_BUF_BUSY(bp);
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
         xfs_buf_lock(bp);
         XFS_BUF_SET_COUNT(bp, BBTOB(nbblks));
-        XFS_BUF_SET_TARGET(bp, log->l_mp->m_logdev_targp);
 
         if ((error = xfs_bwrite(log->l_mp, bp)))
                 xfs_ioerror_alert("xlog_bwrite", log->l_mp,
@@ -360,7 +356,7 @@ STATIC void
 xlog_recover_iodone(
         struct xfs_buf  *bp)
 {
-        if (XFS_BUF_GETERROR(bp)) {
+        if (bp->b_error) {
                 /*
                  * We're not going to bother about retrying
                  * this during recovery. One strike!
@@ -1262,7 +1258,7 @@ xlog_write_log_records(
                  */
                 ealign = round_down(end_block, sectbb);
                 if (j == 0 && (start_block + endcount > ealign)) {
-                        offset = XFS_BUF_PTR(bp) + BBTOB(ealign - start_block);
+                        offset = bp->b_addr + BBTOB(ealign - start_block);
                         error = xlog_bread_offset(log, ealign, sectbb,
                                                         bp, offset);
                         if (error)
@@ -2135,15 +2131,16 @@ xlog_recover_buffer_pass2(
 
         bp = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len,
                           buf_flags);
-        if (XFS_BUF_ISERROR(bp)) {
+        if (!bp)
+                return XFS_ERROR(ENOMEM);
+        error = bp->b_error;
+        if (error) {
                 xfs_ioerror_alert("xlog_recover_do..(read#1)", mp,
                                   bp, buf_f->blf_blkno);
-                error = XFS_BUF_GETERROR(bp);
                 xfs_buf_relse(bp);
                 return error;
         }
 
-        error = 0;
         if (buf_f->blf_flags & XFS_BLF_INODE_BUF) {
                 error = xlog_recover_do_inode_buffer(mp, item, bp, buf_f);
         } else if (buf_f->blf_flags &
@@ -2227,14 +2224,17 @@ xlog_recover_inode_pass2(
 
         bp = xfs_buf_read(mp->m_ddev_targp, in_f->ilf_blkno, in_f->ilf_len,
                           XBF_LOCK);
-        if (XFS_BUF_ISERROR(bp)) {
+        if (!bp) {
+                error = ENOMEM;
+                goto error;
+        }
+        error = bp->b_error;
+        if (error) {
                 xfs_ioerror_alert("xlog_recover_do..(read#2)", mp,
                                   bp, in_f->ilf_blkno);
-                error = XFS_BUF_GETERROR(bp);
                 xfs_buf_relse(bp);
                 goto error;
         }
-        error = 0;
         ASSERT(in_f->ilf_fields & XFS_ILOG_CORE);
         dip = (xfs_dinode_t *)xfs_buf_offset(bp, in_f->ilf_boffset);
 
@@ -3437,7 +3437,7 @@ xlog_do_recovery_pass(
                         /*
                          * Check for header wrapping around physical end-of-log
                          */
-                        offset = XFS_BUF_PTR(hbp);
+                        offset = hbp->b_addr;
                         split_hblks = 0;
                         wrapped_hblks = 0;
                         if (blk_no + hblks <= log->l_logBBsize) {
@@ -3497,7 +3497,7 @@ xlog_do_recovery_pass(
                         } else {
                                 /* This log record is split across the
                                  * physical end of log */
-                                offset = XFS_BUF_PTR(dbp);
+                                offset = dbp->b_addr;
                                 split_bblks = 0;
                                 if (blk_no != log->l_logBBsize) {
                                         /* some data is before the physical
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 092e16ae4d9d..0081657ad985 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1615,7 +1615,7 @@ xfs_unmountfs_writesb(xfs_mount_t *mp)
                 XFS_BUF_UNDELAYWRITE(sbp);
                 XFS_BUF_WRITE(sbp);
                 XFS_BUF_UNASYNC(sbp);
-                ASSERT(XFS_BUF_TARGET(sbp) == mp->m_ddev_targp);
+                ASSERT(sbp->b_target == mp->m_ddev_targp);
                 xfsbdstrat(mp, sbp);
                 error = xfs_buf_iowait(sbp);
                 if (error)
@@ -1938,7 +1938,7 @@ xfs_getsb(
                 xfs_buf_lock(bp);
         }
 
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
         ASSERT(XFS_BUF_ISDONE(bp));
         return bp;
 }
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 8f76fdff4f46..35561a511b57 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -168,7 +168,7 @@ error_cancel:
                                 xfs_trans_cancel(tp, cancelflags);
                                 goto error;
                         }
-                        memset(XFS_BUF_PTR(bp), 0, mp->m_sb.sb_blocksize);
+                        memset(bp->b_addr, 0, mp->m_sb.sb_blocksize);
                         xfs_trans_log_buf(tp, bp, 0, mp->m_sb.sb_blocksize - 1);
                         /*
                          * Commit the transaction.
@@ -883,7 +883,7 @@ xfs_rtbuf_get(
         if (error) {
                 return error;
         }
-        ASSERT(bp && !XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         *bpp = bp;
         return 0;
 }
@@ -943,7 +943,7 @@ xfs_rtcheck_range(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Compute the starting word's address, and starting bit.
          */
@@ -994,7 +994,7 @@ xfs_rtcheck_range(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1040,7 +1040,7 @@ xfs_rtcheck_range(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1158,7 +1158,7 @@ xfs_rtfind_back(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Get the first word's index & point to it.
          */
@@ -1210,7 +1210,7 @@ xfs_rtfind_back(
                         if (error) {
                                 return error;
                         }
-                        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        bufp = bp->b_addr;
                         word = XFS_BLOCKWMASK(mp);
                         b = &bufp[word];
                 } else {
@@ -1256,7 +1256,7 @@ xfs_rtfind_back(
                         if (error) {
                                 return error;
                         }
-                        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        bufp = bp->b_addr;
                         word = XFS_BLOCKWMASK(mp);
                         b = &bufp[word];
                 } else {
@@ -1333,7 +1333,7 @@ xfs_rtfind_forw(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Get the first word's index & point to it.
          */
@@ -1384,7 +1384,7 @@ xfs_rtfind_forw(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1429,7 +1429,7 @@ xfs_rtfind_forw(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1649,7 +1649,7 @@ xfs_rtmodify_range(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Compute the starting word's address, and starting bit.
          */
@@ -1694,7 +1694,7 @@ xfs_rtmodify_range(
                         if (error) {
                                 return error;
                         }
-                        first = b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        first = b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1734,7 +1734,7 @@ xfs_rtmodify_range(
                         if (error) {
                                 return error;
                         }
-                        first = b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        first = b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1832,8 +1832,8 @@ xfs_rtmodify_summary(
          */
         sp = XFS_SUMPTR(mp, bp, so);
         *sp += delta;
-        xfs_trans_log_buf(tp, bp, (uint)((char *)sp - (char *)XFS_BUF_PTR(bp)),
-                (uint)((char *)sp - (char *)XFS_BUF_PTR(bp) + sizeof(*sp) - 1));
+        xfs_trans_log_buf(tp, bp, (uint)((char *)sp - (char *)bp->b_addr),
+                (uint)((char *)sp - (char *)bp->b_addr + sizeof(*sp) - 1));
         return 0;
 }
 
diff --git a/fs/xfs/xfs_rtalloc.h b/fs/xfs/xfs_rtalloc.h
index 09e1f4f35e97..f7f3a359c1c5 100644
--- a/fs/xfs/xfs_rtalloc.h
+++ b/fs/xfs/xfs_rtalloc.h
@@ -47,7 +47,7 @@ struct xfs_trans;
 #define XFS_SUMOFFSTOBLOCK(mp,s)        \
         (((s) * (uint)sizeof(xfs_suminfo_t)) >> (mp)->m_sb.sb_blocklog)
 #define XFS_SUMPTR(mp,bp,so)    \
-        ((xfs_suminfo_t *)((char *)XFS_BUF_PTR(bp) + \
+        ((xfs_suminfo_t *)((bp)->b_addr + \
                 (((so) * (uint)sizeof(xfs_suminfo_t)) & XFS_BLOCKMASK(mp))))
 
 #define XFS_BITTOBLOCK(mp,bi)   ((bi) >> (mp)->m_blkbit_log)
diff --git a/fs/xfs/xfs_rw.c b/fs/xfs/xfs_rw.c
index d6d6fdfe9422..c96a8a05ac03 100644
--- a/fs/xfs/xfs_rw.c
+++ b/fs/xfs/xfs_rw.c
@@ -104,9 +104,9 @@ xfs_ioerror_alert(
         xfs_alert(mp,
                  "I/O error occurred: meta-data dev %s block 0x%llx"
                  "       (\"%s\") error %d buf count %zd",
-                XFS_BUFTARG_NAME(XFS_BUF_TARGET(bp)),
+                xfs_buf_target_name(bp->b_target),
                 (__uint64_t)blkno, func,
-                XFS_BUF_GETERROR(bp), XFS_BUF_COUNT(bp));
+                bp->b_error, XFS_BUF_COUNT(bp));
 }
 
 /*
@@ -137,8 +137,8 @@ xfs_read_buf(
         bp = xfs_buf_read(target, blkno, len, flags);
         if (!bp)
                 return XFS_ERROR(EIO);
-        error = XFS_BUF_GETERROR(bp);
-        if (bp && !error && !XFS_FORCED_SHUTDOWN(mp)) {
+        error = bp->b_error;
+        if (!error && !XFS_FORCED_SHUTDOWN(mp)) {
                 *bpp = bp;
         } else {
                 *bpp = NULL;
diff --git a/fs/xfs/xfs_sb.h b/fs/xfs/xfs_sb.h
index 1eb2ba586814..cb6ae715814a 100644
--- a/fs/xfs/xfs_sb.h
+++ b/fs/xfs/xfs_sb.h
@@ -509,7 +509,7 @@ static inline int xfs_sb_version_hasprojid32bit(xfs_sb_t *sbp)
 
 #define XFS_SB_DADDR            ((xfs_daddr_t)0) /* daddr in filesystem/ag */
 #define XFS_SB_BLOCK(mp)        XFS_HDR_BLOCK(mp, XFS_SB_DADDR)
-#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)((bp)->b_addr))
 
 #define XFS_HDR_BLOCK(mp,d)     ((xfs_agblock_t)XFS_BB_TO_FSBT(mp,d))
 #define XFS_DADDR_TO_FSB(mp,d)  XFS_AGB_TO_FSB(mp, \
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 43233e92f0f6..c15aa29fa169 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -299,7 +299,7 @@ xfs_trans_ail_cursor_last(
  * Splice the log item list into the AIL at the given LSN. We splice to the
  * tail of the given LSN to maintain insert order for push traversals. The
  * cursor is optional, allowing repeated updates to the same LSN to avoid
- * repeated traversals.
+ * repeated traversals.  This should not be called with an empty list.
  */
 static void
 xfs_ail_splice(
@@ -308,50 +308,39 @@ xfs_ail_splice(
         struct list_head        *list,
         xfs_lsn_t               lsn)
 {
-        struct xfs_log_item     *lip = cur ? cur->item : NULL;
-        struct xfs_log_item     *next_lip;
+        struct xfs_log_item     *lip;
+
+        ASSERT(!list_empty(list));
 
         /*
-         * Get a new cursor if we don't have a placeholder or the existing one
-         * has been invalidated.
+         * Use the cursor to determine the insertion point if one is
+         * provided.  If not, or if the one we got is not valid,
+         * find the place in the AIL where the items belong.
          */
-        if (!lip || (__psint_t)lip & 1) {
+        lip = cur ? cur->item : NULL;
+        if (!lip || (__psint_t) lip & 1)
                 lip = __xfs_trans_ail_cursor_last(ailp, lsn);
 
-                if (!lip) {
-                        /* The list is empty, so just splice and return.  */
-                        if (cur)
-                                cur->item = NULL;
-                        list_splice(list, &ailp->xa_ail);
-                        return;
-                }
-        }
+        /*
+         * If a cursor is provided, we know we're processing the AIL
+         * in lsn order, and future items to be spliced in will
+         * follow the last one being inserted now.  Update the
+         * cursor to point to that last item, now while we have a
+         * reliable pointer to it.
+         */
+        if (cur)
+                cur->item = list_entry(list->prev, struct xfs_log_item, li_ail);
 
         /*
-         * Our cursor points to the item we want to insert _after_, so we have
-         * to update the cursor to point to the end of the list we are splicing
-         * in so that it points to the correct location for the next splice.
-         * i.e. before the splice
-         *
-         *  lsn -> lsn -> lsn + x -> lsn + x ...
-         *          ^
-         *          | cursor points here
-         *
-         * After the splice we have:
-         *
-         *  lsn -> lsn -> lsn -> lsn -> .... -> lsn -> lsn + x -> lsn + x ...
-         *          ^                            ^
-         *          | cursor points here         | needs to move here
-         *
-         * So we set the cursor to the last item in the list to be spliced
-         * before we execute the splice, resulting in the cursor pointing to
-         * the correct item after the splice occurs.
+         * Finally perform the splice.  Unless the AIL was empty,
+         * lip points to the item in the AIL _after_ which the new
+         * items should go.  If lip is null the AIL was empty, so
+         * the new items go at the head of the AIL.
          */
-        if (cur) {
-                next_lip = list_entry(list->prev, struct xfs_log_item, li_ail);
-                cur->item = next_lip;
-        }
-        list_splice(list, &lip->li_ail);
+        if (lip)
+                list_splice(list, &lip->li_ail);
+        else
+                list_splice(list, &ailp->xa_ail);
 }
 
 /*
@@ -682,6 +671,7 @@ xfs_trans_ail_update_bulk(
         int                     i;
         LIST_HEAD(tmp);
 
+        ASSERT(nr_items > 0);           /* Not required, but true. */
         mlip = xfs_ail_min(ailp);
 
         for (i = 0; i < nr_items; i++) {
@@ -701,7 +691,8 @@ xfs_trans_ail_update_bulk(
                 list_add(&lip->li_ail, &tmp);
         }
 
-        xfs_ail_splice(ailp, cur, &tmp, lsn);
+        if (!list_empty(&tmp))
+                xfs_ail_splice(ailp, cur, &tmp, lsn);
 
         if (!mlip_changed) {
                 spin_unlock(&ailp->xa_lock);
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index 15584fc3ed7d..137e2b9e2948 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -54,7 +54,7 @@ xfs_trans_buf_item_match(
         list_for_each_entry(lidp, &tp->t_items, lid_trans) {
                 blip = (struct xfs_buf_log_item *)lidp->lid_item;
                 if (blip->bli_item.li_type == XFS_LI_BUF &&
-                    XFS_BUF_TARGET(blip->bli_buf) == target &&
+                    blip->bli_buf->b_target == target &&
                     XFS_BUF_ADDR(blip->bli_buf) == blkno &&
                     XFS_BUF_COUNT(blip->bli_buf) == len)
                         return blip->bli_buf;
@@ -80,7 +80,6 @@ _xfs_trans_bjoin(
 {
         struct xfs_buf_log_item *bip;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == NULL);
 
         /*
@@ -194,7 +193,7 @@ xfs_trans_get_buf(xfs_trans_t	*tp,
                 return NULL;
         }
 
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!bp->b_error);
 
         _xfs_trans_bjoin(tp, bp, 1);
         trace_xfs_trans_get_buf(bp->b_fspriv);
@@ -293,10 +292,10 @@ xfs_trans_read_buf(
                         return (flags & XBF_TRYLOCK) ?
                                         EAGAIN : XFS_ERROR(ENOMEM);
 
-                if (XFS_BUF_GETERROR(bp) != 0) {
+                if (bp->b_error) {
+                        error = bp->b_error;
                         xfs_ioerror_alert("xfs_trans_read_buf", mp,
                                           bp, blkno);
-                        error = XFS_BUF_GETERROR(bp);
                         xfs_buf_relse(bp);
                         return error;
                 }
@@ -330,7 +329,7 @@ xfs_trans_read_buf(
                 ASSERT(xfs_buf_islocked(bp));
                 ASSERT(bp->b_transp == tp);
                 ASSERT(bp->b_fspriv != NULL);
-                ASSERT((XFS_BUF_ISERROR(bp)) == 0);
+                ASSERT(!bp->b_error);
                 if (!(XFS_BUF_ISDONE(bp))) {
                         trace_xfs_trans_read_buf_io(bp, _RET_IP_);
                         ASSERT(!XFS_BUF_ISASYNC(bp));
@@ -386,10 +385,9 @@ xfs_trans_read_buf(
                 return (flags & XBF_TRYLOCK) ?
                                         0 : XFS_ERROR(ENOMEM);
         }
-        if (XFS_BUF_GETERROR(bp) != 0) {
-            XFS_BUF_SUPER_STALE(bp);
-                error = XFS_BUF_GETERROR(bp);
-
+        if (bp->b_error) {
+                error = bp->b_error;
+                XFS_BUF_SUPER_STALE(bp);
                 xfs_ioerror_alert("xfs_trans_read_buf", mp,
                                   bp, blkno);
                 if (tp->t_flags & XFS_TRANS_DIRTY)
@@ -430,7 +428,7 @@ shutdown_abort:
         if (XFS_BUF_ISSTALE(bp) && XFS_BUF_ISDELAYWRITE(bp))
                 xfs_notice(mp, "about to pop assert, bp == 0x%p", bp);
 #endif
-        ASSERT((XFS_BUF_BFLAGS(bp) & (XBF_STALE|XBF_DELWRI)) !=
+        ASSERT((bp->b_flags & (XBF_STALE|XBF_DELWRI)) !=
                                      (XBF_STALE|XBF_DELWRI));
 
         trace_xfs_trans_read_buf_shut(bp, _RET_IP_);
@@ -581,7 +579,6 @@ xfs_trans_bhold(xfs_trans_t	*tp,
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
@@ -602,7 +599,6 @@ xfs_trans_bhold_release(xfs_trans_t	*tp,
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
@@ -631,7 +627,6 @@ xfs_trans_log_buf(xfs_trans_t	*tp,
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT((first <= last) && (last < XFS_BUF_COUNT(bp)));
@@ -702,7 +697,6 @@ xfs_trans_binval(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -774,7 +768,6 @@ xfs_trans_inode_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -798,7 +791,6 @@ xfs_trans_stale_inode_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -823,7 +815,6 @@ xfs_trans_inode_alloc_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -851,7 +842,6 @@ xfs_trans_dquot_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(type == XFS_BLF_UDQUOT_BUF ||
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 9322e13f0c63..51fc429527bc 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -83,7 +83,9 @@ xfs_readlink_bmap(
 
                 bp = xfs_buf_read(mp->m_ddev_targp, d, BTOBB(byte_cnt),
                                   XBF_LOCK | XBF_MAPPED | XBF_DONT_BLOCK);
-                error = XFS_BUF_GETERROR(bp);
+                if (!bp)
+                        return XFS_ERROR(ENOMEM);
+                error = bp->b_error;
                 if (error) {
                         xfs_ioerror_alert("xfs_readlink",
                                   ip->i_mount, bp, XFS_BUF_ADDR(bp));
@@ -94,7 +96,7 @@ xfs_readlink_bmap(
                         byte_cnt = pathlen;
                 pathlen -= byte_cnt;
 
-                memcpy(link, XFS_BUF_PTR(bp), byte_cnt);
+                memcpy(link, bp->b_addr, byte_cnt);
                 xfs_buf_relse(bp);
         }
 
@@ -1648,13 +1650,13 @@ xfs_symlink(
                         byte_cnt = XFS_FSB_TO_B(mp, mval[n].br_blockcount);
                         bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d,
                                                BTOBB(byte_cnt), 0);
-                        ASSERT(bp && !XFS_BUF_GETERROR(bp));
+                        ASSERT(!xfs_buf_geterror(bp));
                         if (pathlen < byte_cnt) {
                                 byte_cnt = pathlen;
                         }
                         pathlen -= byte_cnt;
 
-                        memcpy(XFS_BUF_PTR(bp), cur_chunk, byte_cnt);
+                        memcpy(bp->b_addr, cur_chunk, byte_cnt);
                         cur_chunk += byte_cnt;
 
                         xfs_trans_log_buf(tp, bp, 0, byte_cnt - 1);
@@ -1999,7 +2001,7 @@ xfs_zero_remaining_bytes(
                                           mp, bp, XFS_BUF_ADDR(bp));
                         break;
                 }
-                memset(XFS_BUF_PTR(bp) +
+                memset(bp->b_addr +
                         (offset - XFS_FSB_TO_B(mp, imap.br_startoff)),
                       0, lastoffset - offset + 1);
                 XFS_BUF_UNDONE(bp);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 0f83858147a6..1d09562ccf73 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -56,8 +56,6 @@ struct mmc_ios {
 #define MMC_TIMING_UHS_SDR104   4
 #define MMC_TIMING_UHS_DDR50    5
 
-        unsigned char   ddr;                    /* dual data rate used */
-
 #define MMC_SDR_MODE            0
 #define MMC_1_2V_DDR_MODE       1
 #define MMC_1_8V_DDR_MODE       2
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 2e17c5dbdcb8..180540a84d37 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -29,7 +29,7 @@
 #define MAX_LINKS 32            
 
 struct sockaddr_nl {
-        sa_family_t     nl_family;      /* AF_NETLINK   */
+        __kernel_sa_family_t    nl_family;      /* AF_NETLINK   */
         unsigned short  nl_pad;         /* zero         */
         __u32           nl_pid;         /* port ID      */
         __u32           nl_groups;      /* multicast groups mask */
diff --git a/include/linux/of.h b/include/linux/of.h
index 0085bb01c041..9180dc5cb00b 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -256,6 +256,13 @@ static inline int of_property_read_string(struct device_node *np,
         return -ENOSYS;
 }
 
+static inline const void *of_get_property(const struct device_node *node,
+                                const char *name,
+                                int *lenp)
+{
+        return NULL;
+}
+
 #endif /* CONFIG_OF */
 
 static inline int of_property_read_u32(const struct device_node *np,
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 20b03bf94748..4ac2c0578e0f 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1767,6 +1767,7 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
 #define PF_DUMPCORE     0x00000200      /* dumped core */
 #define PF_SIGNALED     0x00000400      /* killed by a signal */
 #define PF_MEMALLOC     0x00000800      /* Allocating memory */
+#define PF_NPROC_EXCEEDED 0x00001000    /* set_user noticed that RLIMIT_NPROC was exceeded */
 #define PF_USED_MATH    0x00002000      /* if unset the fpu must be initialized before use */
 #define PF_FREEZING     0x00004000      /* freeze in progress. do not account to load */
 #define PF_NOFREEZE     0x00008000      /* this thread should not be frozen */
diff --git a/include/linux/socket.h b/include/linux/socket.h
index e17f82266639..d0e77f607a79 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -8,8 +8,10 @@
 #define _K_SS_ALIGNSIZE (__alignof__ (struct sockaddr *))
                                 /* Implementation specific desired alignment */
 
+typedef unsigned short __kernel_sa_family_t;
+
 struct __kernel_sockaddr_storage {
-        unsigned short  ss_family;              /* address family */
+        __kernel_sa_family_t    ss_family;              /* address family */
         /* Following field(s) are implementation specific */
         char            __data[_K_SS_MAXSIZE - sizeof(unsigned short)];
                                 /* space to achieve desired size, */
@@ -35,7 +37,7 @@ struct seq_file;
 extern void socket_seq_show(struct seq_file *seq);
 #endif
 
-typedef unsigned short  sa_family_t;
+typedef __kernel_sa_family_t    sa_family_t;
 
 /*
  *      1003.1g requires sa_family_t and that sa_data is char.
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index caaff5f5f39f..b897d6e6d0a5 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -238,7 +238,7 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
 {
         __u8 flags = 0;
 
-        if (inet_sk(sk)->transparent)
+        if (inet_sk(sk)->transparent || inet_sk(sk)->hdrincl)
                 flags |= FLOWI_FLAG_ANYSRC;
         if (sk->sk_protocol == IPPROTO_TCP)
                 flags |= FLOWI_FLAG_PRECOW_METRICS;
diff --git a/include/sound/tlv320aic3x.h b/include/sound/tlv320aic3x.h
index 99e0308bf2c2..ffd9bc793105 100644
--- a/include/sound/tlv320aic3x.h
+++ b/include/sound/tlv320aic3x.h
@@ -1,7 +1,7 @@
 /*
  * Platform data for Texas Instruments TLV320AIC3x codec
  *
- * Author: Jarkko Nikula <jhnikula@gmail.com>
+ * Author: Jarkko Nikula <jarkko.nikula@bitmer.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/kernel/Makefile b/kernel/Makefile
index d06467fc8f7c..eca595e2fd52 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -10,7 +10,7 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o pm_qos_params.o sched_clock.o cred.o \
-            async.o range.o jump_label.o
+            async.o range.o
 obj-y += groups.o
 
 ifdef CONFIG_FUNCTION_TRACER
@@ -107,6 +107,7 @@ obj-$(CONFIG_PERF_EVENTS) += events/
 obj-$(CONFIG_USER_RETURN_NOTIFIER) += user-return-notifier.o
 obj-$(CONFIG_PADATA) += padata.o
 obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
+obj-$(CONFIG_JUMP_LABEL) += jump_label.o
 
 ifneq ($(CONFIG_SCHED_OMIT_FRAME_POINTER),y)
 # According to Alan Modra <alan@linuxcare.com.au>, the -fno-omit-frame-pointer is
diff --git a/kernel/cred.c b/kernel/cred.c
index 174fa84eca30..8ef31f53c44c 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -508,10 +508,8 @@ int commit_creds(struct cred *new)
                 key_fsgid_changed(task);
 
         /* do it
-         * - What if a process setreuid()'s and this brings the
-         *   new uid over his NPROC rlimit?  We can check this now
-         *   cheaply with the new uid cache, so if it matters
-         *   we should be checking for it.  -DaveM
+         * RLIMIT_NPROC limits on user->processes have already been checked
+         * in set_user().
          */
         alter_cred_subscribers(new, 2);
         if (new->user != old->user)
diff --git a/kernel/fork.c b/kernel/fork.c
index e7ceaca89609..8e6b6f4fb272 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1111,6 +1111,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                     p->real_cred->user != INIT_USER)
                         goto bad_fork_free;
         }
+        current->flags &= ~PF_NPROC_EXCEEDED;
 
         retval = copy_creds(p, clone_flags);
         if (retval < 0)
diff --git a/kernel/printk.c b/kernel/printk.c
index 37dff3429adb..836a2ae0ac31 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -318,8 +318,10 @@ static int check_syslog_permissions(int type, bool from_file)
                         return 0;
                 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
                 if (capable(CAP_SYS_ADMIN)) {
-                        WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
-                                 "but no CAP_SYSLOG (deprecated).\n");
+                        printk_once(KERN_WARNING "%s (%d): "
+                                 "Attempt to access syslog with CAP_SYS_ADMIN "
+                                 "but no CAP_SYSLOG (deprecated).\n",
+                                 current->comm, task_pid_nr(current));
                         return 0;
                 }
                 return -EPERM;
diff --git a/kernel/sys.c b/kernel/sys.c
index a101ba36c444..dd948a1fca4c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -621,11 +621,18 @@ static int set_user(struct cred *new)
         if (!new_user)
                 return -EAGAIN;
 
+        /*
+         * We don't fail in case of NPROC limit excess here because too many
+         * poorly written programs don't check set*uid() return code, assuming
+         * it never fails if called by root.  We may still enforce NPROC limit
+         * for programs doing set*uid()+execve() by harmlessly deferring the
+         * failure to the execve() stage.
+         */
         if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) &&
-                        new_user != INIT_USER) {
-                free_uid(new_user);
-                return -EAGAIN;
-        }
+                        new_user != INIT_USER)
+                current->flags |= PF_NPROC_EXCEEDED;
+        else
+                current->flags &= ~PF_NPROC_EXCEEDED;
 
         free_uid(new->user);
         new->user = new_user;
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 2ad39e556cb4..cd3134510f3d 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -82,7 +82,7 @@ config EVENT_POWER_TRACING_DEPRECATED
           power:power_frequency
           This is for userspace compatibility
           and will vanish after 5 kernel iterations,
-          namely 2.6.41.
+          namely 3.1.
 
 config CONTEXT_SWITCH_TRACER
         bool
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f4ec4e7ca4cd..930de9437271 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2091,6 +2091,7 @@ struct memcg_stock_pcp {
 #define FLUSHING_CACHED_CHARGE  (0)
 };
 static DEFINE_PER_CPU(struct memcg_stock_pcp, memcg_stock);
+static DEFINE_MUTEX(percpu_charge_mutex);
 
 /*
  * Try to consume stocked charge on this cpu. If success, one page is consumed
@@ -2197,8 +2198,7 @@ static void drain_all_stock(struct mem_cgroup *root_mem, bool sync)
 
         for_each_online_cpu(cpu) {
                 struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu);
-                if (mem_cgroup_same_or_subtree(root_mem, stock->cached) &&
-                                test_bit(FLUSHING_CACHED_CHARGE, &stock->flags))
+                if (test_bit(FLUSHING_CACHED_CHARGE, &stock->flags))
                         flush_work(&stock->work);
         }
 out:
@@ -2213,14 +2213,22 @@ out:
  */
 static void drain_all_stock_async(struct mem_cgroup *root_mem)
 {
+        /*
+         * If someone calls draining, avoid adding more kworker runs.
+         */
+        if (!mutex_trylock(&percpu_charge_mutex))
+                return;
         drain_all_stock(root_mem, false);
+        mutex_unlock(&percpu_charge_mutex);
 }
 
 /* This is a synchronous drain interface. */
 static void drain_all_stock_sync(struct mem_cgroup *root_mem)
 {
         /* called when force_empty is called */
+        mutex_lock(&percpu_charge_mutex);
         drain_all_stock(root_mem, true);
+        mutex_unlock(&percpu_charge_mutex);
 }
 
 /*
diff --git a/mm/slub.c b/mm/slub.c
index 6da68597bde8..9f662d70eb47 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1854,7 +1854,7 @@ redo:
 
         new.frozen = 0;
 
-        if (!new.inuse && n->nr_partial < s->min_partial)
+        if (!new.inuse && n->nr_partial > s->min_partial)
                 m = M_FREE;
         else if (new.freelist) {
                 m = M_PARTIAL;
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 464621d18eb2..7ef0903058ee 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -725,9 +725,10 @@ static void free_unmap_vmap_area_addr(unsigned long addr)
 #define VMAP_BBMAP_BITS_MIN     (VMAP_MAX_ALLOC*2)
 #define VMAP_MIN(x, y)          ((x) < (y) ? (x) : (y)) /* can't use min() */
 #define VMAP_MAX(x, y)          ((x) > (y) ? (x) : (y)) /* can't use max() */
-#define VMAP_BBMAP_BITS         VMAP_MIN(VMAP_BBMAP_BITS_MAX,           \
-                                        VMAP_MAX(VMAP_BBMAP_BITS_MIN,   \
-                                                VMALLOC_PAGES / NR_CPUS / 16))
+#define VMAP_BBMAP_BITS         \
+                VMAP_MIN(VMAP_BBMAP_BITS_MAX,   \
+                VMAP_MAX(VMAP_BBMAP_BITS_MIN,   \
+                        VMALLOC_PAGES / roundup_pow_of_two(NR_CPUS) / 16))
 
 #define VMAP_BLOCK_SIZE         (VMAP_BBMAP_BITS * PAGE_SIZE)
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 3176e2e13d9b..2cdf0070419f 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -417,6 +417,7 @@ put_back:
 int br_del_if(struct net_bridge *br, struct net_device *dev)
 {
         struct net_bridge_port *p;
+        bool changed_addr;
 
         p = br_port_get_rtnl(dev);
         if (!p || p->br != br)
@@ -425,9 +426,12 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         del_nbp(p);
 
         spin_lock_bh(&br->lock);
-        br_stp_recalculate_bridge_id(br);
+        changed_addr = br_stp_recalculate_bridge_id(br);
         spin_unlock_bh(&br->lock);
 
+        if (changed_addr)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
+
         netdev_update_features(br->dev);
 
         return 0;
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 6545ee9591d1..a76b62135558 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -34,6 +34,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         struct net_device *dev = ptr;
         struct net_bridge_port *p;
         struct net_bridge *br;
+        bool changed_addr;
         int err;
 
         /* register of bridge completed, add sysfs entries */
@@ -57,8 +58,12 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         case NETDEV_CHANGEADDR:
                 spin_lock_bh(&br->lock);
                 br_fdb_changeaddr(p, dev->dev_addr);
-                br_stp_recalculate_bridge_id(br);
+                changed_addr = br_stp_recalculate_bridge_id(br);
                 spin_unlock_bh(&br->lock);
+
+                if (changed_addr)
+                        call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
+
                 break;
 
         case NETDEV_CHANGE:
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 2b5ca1a0054d..5864cc491369 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1198,7 +1198,8 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
 
         if (table->check && table->check(newinfo, table->valid_hooks)) {
                 BUGPRINT("The table doesn't like its own initial data, lol\n");
-                return ERR_PTR(-EINVAL);
+                ret = -EINVAL;
+                goto free_chainstack;
         }
 
         table->private = newinfo;
diff --git a/net/core/scm.c b/net/core/scm.c
index 4c1ef026d695..811b53fb330e 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -192,7 +192,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                                         goto error;
 
                                 cred->uid = cred->euid = p->creds.uid;
-                                cred->gid = cred->egid = p->creds.uid;
+                                cred->gid = cred->egid = p->creds.gid;
                                 put_cred(p->cred);
                                 p->cred = cred;
                         }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 77d3eded665a..8c6563361ab5 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -122,6 +122,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
+        skb_dst_force(newskb);
         netif_rx_ni(newskb);
         return 0;
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ab0c9efd1efa..8905e92f896a 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1067,7 +1067,7 @@ EXPORT_SYMBOL(compat_ip_setsockopt);
  */
 
 static int do_ip_getsockopt(struct sock *sk, int level, int optname,
-                            char __user *optval, int __user *optlen)
+                            char __user *optval, int __user *optlen, unsigned flags)
 {
         struct inet_sock *inet = inet_sk(sk);
         int val;
@@ -1240,7 +1240,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
 
                 msg.msg_control = optval;
                 msg.msg_controllen = len;
-                msg.msg_flags = 0;
+                msg.msg_flags = flags;
 
                 if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                         struct in_pktinfo info;
@@ -1294,7 +1294,7 @@ int ip_getsockopt(struct sock *sk, int level,
 {
         int err;
 
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen, 0);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
         if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS &&
@@ -1327,7 +1327,8 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
                 return compat_mc_getsockopt(sk, level, optname, optval, optlen,
                         ip_getsockopt);
 
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen,
+                MSG_CMSG_COMPAT);
 
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 2e97e3ec1eb7..929b27bdeb79 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -18,17 +18,15 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         struct rtable *rt;
         struct flowi4 fl4 = {};
         __be32 saddr = iph->saddr;
-        __u8 flags = 0;
+        __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
         unsigned int hh_len;
 
-        if (!skb->sk && addr_type != RTN_LOCAL) {
-                if (addr_type == RTN_UNSPEC)
-                        addr_type = inet_addr_type(net, saddr);
-                if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
-                        flags |= FLOWI_FLAG_ANYSRC;
-                else
-                        saddr = 0;
-        }
+        if (addr_type == RTN_UNSPEC)
+                addr_type = inet_addr_type(net, saddr);
+        if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
+                flags |= FLOWI_FLAG_ANYSRC;
+        else
+                saddr = 0;
 
         /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
          * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
@@ -38,7 +36,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
         fl4.flowi4_mark = skb->mark;
-        fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
+        fl4.flowi4_flags = flags;
         rt = ip_route_output_key(net, &fl4);
         if (IS_ERR(rt))
                 return -1;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 1457acb39cec..61714bd52925 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -563,7 +563,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                            RT_SCOPE_UNIVERSE,
                            inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           FLOWI_FLAG_CAN_SLEEP, daddr, saddr, 0, 0);
+                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP,
+                           daddr, saddr, 0, 0);
 
         if (!inet->hdrincl) {
                 err = raw_probe_proto_opt(&fl4, msg);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e3dec1c9f09d..075212e41b83 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -722,7 +722,7 @@ static inline bool compare_hash_inputs(const struct rtable *rt1,
 {
         return ((((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
                 ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0);
+                (rt1->rt_route_iif ^ rt2->rt_route_iif)) == 0);
 }
 
 static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
@@ -731,8 +731,8 @@ static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
                 ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
                 (rt1->rt_mark ^ rt2->rt_mark) |
                 (rt1->rt_key_tos ^ rt2->rt_key_tos) |
-                (rt1->rt_oif ^ rt2->rt_oif) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0;
+                (rt1->rt_route_iif ^ rt2->rt_route_iif) |
+                (rt1->rt_oif ^ rt2->rt_oif)) == 0;
 }
 
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
@@ -2320,8 +2320,7 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
              rth = rcu_dereference(rth->dst.rt_next)) {
                 if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
                      ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
-                     (rth->rt_iif ^ iif) |
-                     rth->rt_oif |
+                     (rth->rt_route_iif ^ iif) |
                      (rth->rt_key_tos ^ tos)) == 0 &&
                     rth->rt_mark == skb->mark &&
                     net_eq(dev_net(rth->dst.dev), net) &&
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 92bb9434b338..3bc5c8f7c71b 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -276,7 +276,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         int mss;
         struct rtable *rt;
         __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
 
         if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                 goto out;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 89d5bf806222..ac838965ff34 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -165,7 +165,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         int mss;
         struct dst_entry *dst;
         __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
 
         if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                 goto out;
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 5b466cd1272f..84d0fd47636a 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -312,6 +312,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
                 }
                 break;
         case NF_STOLEN:
+                break;
         default:
                 kfree_skb(skb);
         }
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 58107d060846..9c24de10a657 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -341,11 +341,11 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
 
         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
         if (entry == NULL)
-                return -ENOMEM;
+                goto out_entry;
         if (domain != NULL) {
                 entry->domain = kstrdup(domain, GFP_ATOMIC);
                 if (entry->domain == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_domain;
         }
 
         if (addr == NULL && mask == NULL) {
@@ -354,13 +354,13 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
         } else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrmap;
                 INIT_LIST_HEAD(&addrmap->list4);
                 INIT_LIST_HEAD(&addrmap->list6);
 
                 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                 if (addrinfo == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrinfo;
                 addrinfo->type_def.cipsov4 = doi_def;
                 addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
                 addrinfo->list.addr = addr->s_addr & mask->s_addr;
@@ -374,7 +374,7 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 entry->type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
-                goto cfg_cipsov4_map_add_failure;
+                goto out_addrmap;
         }
 
         ret_val = netlbl_domhsh_add(entry, audit_info);
@@ -384,11 +384,15 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
         return 0;
 
 cfg_cipsov4_map_add_failure:
-        cipso_v4_doi_putdef(doi_def);
+        kfree(addrinfo);
+out_addrinfo:
+        kfree(addrmap);
+out_addrmap:
         kfree(entry->domain);
+out_domain:
         kfree(entry);
-        kfree(addrmap);
-        kfree(addrinfo);
+out_entry:
+        cipso_v4_doi_putdef(doi_def);
         return ret_val;
 }
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 2a318f2dc3e5..b5d56a22b1d2 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -112,7 +112,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
 
         for (prio = 0; prio < q->bands; prio++) {
                 struct Qdisc *qdisc = q->queues[prio];
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
+                struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                 if (skb) {
                         qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index e4d76a270c9f..579fc0dce128 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -2625,16 +2625,19 @@ snd_azf3328_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
         int err;
 
         snd_azf3328_dbgcallenter();
-        if (dev >= SNDRV_CARDS)
-                return -ENODEV;
+        if (dev >= SNDRV_CARDS) {
+                err = -ENODEV;
+                goto out;
+        }
         if (!enable[dev]) {
                 dev++;
-                return -ENOENT;
+                err = -ENOENT;
+                goto out;
         }
 
         err = snd_card_create(index[dev], id[dev], THIS_MODULE, 0, &card);
         if (err < 0)
-                return err;
+                goto out;
 
         strcpy(card->driver, "AZF3328");
         strcpy(card->shortname, "Aztech AZF3328 (PCI168)");
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index aa376b59c006..5145b663ef6e 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -673,6 +673,7 @@ static int stac92xx_smux_enum_put(struct snd_kcontrol *kcontrol,
         return 0;
 }
 
+#ifdef CONFIG_SND_HDA_POWER_SAVE
 static int stac_vrefout_set(struct hda_codec *codec,
                                         hda_nid_t nid, unsigned int new_vref)
 {
@@ -696,6 +697,7 @@ static int stac_vrefout_set(struct hda_codec *codec,
 
         return 1;
 }
+#endif
 
 static unsigned int stac92xx_vref_set(struct hda_codec *codec,
                                         hda_nid_t nid, unsigned int new_vref)
diff --git a/sound/soc/codecs/wm8750.c b/sound/soc/codecs/wm8750.c
index 38f38fddd190..d0003cc3bcd6 100644
--- a/sound/soc/codecs/wm8750.c
+++ b/sound/soc/codecs/wm8750.c
@@ -778,11 +778,19 @@ static int __devexit wm8750_spi_remove(struct spi_device *spi)
         return 0;
 }
 
+static const struct spi_device_id wm8750_spi_ids[] = {
+        { "wm8750", 0 },
+        { "wm8987", 0 },
+        { },
+};
+MODULE_DEVICE_TABLE(spi, wm8750_spi_ids);
+
 static struct spi_driver wm8750_spi_driver = {
         .driver = {
                 .name   = "wm8750-codec",
                 .owner  = THIS_MODULE,
         },
+        .id_table       = wm8750_spi_ids,
         .probe          = wm8750_spi_probe,
         .remove         = __devexit_p(wm8750_spi_remove),
 };
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index 43e3d760766f..4ad8ebd290e3 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -2046,8 +2046,13 @@ static int wm8903_probe(struct snd_soc_codec *codec)
 /* power down chip */
 static int wm8903_remove(struct snd_soc_codec *codec)
 {
+        struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+
         wm8903_free_gpio(codec);
         wm8903_set_bias_level(codec, SND_SOC_BIAS_OFF);
+        if (wm8903->irq)
+                free_irq(wm8903->irq, codec);
+
         return 0;
 }
 
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 09e680ae88b2..b393f9fac97a 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -2981,6 +2981,7 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
                         wm8994->hubs.dcs_readback_mode = 1;
                         break;
                 }
+                break;
 
         case WM8958:
                 wm8994->hubs.dcs_readback_mode = 1;
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index 83d213bfd3d1..62e292f49313 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -402,6 +402,6 @@ static void __exit n810_soc_exit(void)
 module_init(n810_soc_init);
 module_exit(n810_soc_exit);
 
-MODULE_AUTHOR("Jarkko Nikula <jhnikula@gmail.com>");
+MODULE_AUTHOR("Jarkko Nikula <jarkko.nikula@bitmer.com>");
 MODULE_DESCRIPTION("ALSA SoC Nokia N810");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index 07b772357244..ebcc2d4d2b18 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
  *          Peter Ujfalusi <peter.ujfalusi@ti.com>
  *
  * This program is free software; you can redistribute it and/or
@@ -780,6 +780,6 @@ static void __exit snd_omap_mcbsp_exit(void)
 }
 module_exit(snd_omap_mcbsp_exit);
 
-MODULE_AUTHOR("Jarkko Nikula <jhnikula@gmail.com>");
+MODULE_AUTHOR("Jarkko Nikula <jarkko.nikula@bitmer.com>");
 MODULE_DESCRIPTION("OMAP I2S SoC Interface");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/omap/omap-mcbsp.h b/sound/soc/omap/omap-mcbsp.h
index 9a7dedd6f5a9..65cde9d3807b 100644
--- a/sound/soc/omap/omap-mcbsp.h
+++ b/sound/soc/omap/omap-mcbsp.h
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
  *          Peter Ujfalusi <peter.ujfalusi@ti.com>
  *
  * This program is free software; you can redistribute it and/or
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index b2f5751edae3..9b5c88ac35b9 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
  *          Peter Ujfalusi <peter.ujfalusi@ti.com>
  *
  * This program is free software; you can redistribute it and/or
@@ -436,6 +436,6 @@ static void __exit snd_omap_pcm_exit(void)
 }
 module_exit(snd_omap_pcm_exit);
 
-MODULE_AUTHOR("Jarkko Nikula <jhnikula@gmail.com>");
+MODULE_AUTHOR("Jarkko Nikula <jarkko.nikula@bitmer.com>");
 MODULE_DESCRIPTION("OMAP PCM DMA module");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/omap/omap-pcm.h b/sound/soc/omap/omap-pcm.h
index a0ed1dbb52d6..f95fe3064172 100644
--- a/sound/soc/omap/omap-pcm.h
+++ b/sound/soc/omap/omap-pcm.h
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation
  *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
  *          Peter Ujfalusi <peter.ujfalusi@ti.com>
  *
  * This program is free software; you can redistribute it and/or
diff --git a/sound/soc/omap/rx51.c b/sound/soc/omap/rx51.c
index 0aae998b6540..893300a53bab 100644
--- a/sound/soc/omap/rx51.c
+++ b/sound/soc/omap/rx51.c
@@ -5,7 +5,7 @@
  *
  * Contact: Peter Ujfalusi <peter.ujfalusi@ti.com>
  *          Eduardo Valentin <eduardo.valentin@nokia.com>
- *          Jarkko Nikula <jhnikula@gmail.com>
+ *          Jarkko Nikula <jarkko.nikula@bitmer.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/sound/soc/samsung/Makefile b/sound/soc/samsung/Makefile
index 9eb3b12eb72f..8509d3c4366e 100644
--- a/sound/soc/samsung/Makefile
+++ b/sound/soc/samsung/Makefile
@@ -1,5 +1,6 @@
 # S3c24XX Platform Support
 snd-soc-s3c24xx-objs := dma.o
+snd-soc-idma-objs := idma.o
 snd-soc-s3c24xx-i2s-objs := s3c24xx-i2s.o
 snd-soc-s3c2412-i2s-objs := s3c2412-i2s.o
 snd-soc-ac97-objs := ac97.o
@@ -16,6 +17,7 @@ obj-$(CONFIG_SND_S3C_I2SV2_SOC) += snd-soc-s3c-i2s-v2.o
 obj-$(CONFIG_SND_SAMSUNG_SPDIF) += snd-soc-samsung-spdif.o
 obj-$(CONFIG_SND_SAMSUNG_PCM) += snd-soc-pcm.o
 obj-$(CONFIG_SND_SAMSUNG_I2S) += snd-soc-i2s.o
+obj-$(CONFIG_SND_SAMSUNG_I2S) += snd-soc-idma.o
 
 # S3C24XX Machine Support
 snd-soc-jive-wm8750-objs := jive_wm8750.o
diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c
new file mode 100644
index 000000000000..ebde0740ab19
--- /dev/null
+++ b/sound/soc/samsung/idma.c
@@ -0,0 +1,453 @@
+/*
+ * sound/soc/samsung/idma.c
+ *
+ * Copyright (c) 2011 Samsung Electronics Co., Ltd.
+ *              http://www.samsung.com
+ *
+ * I2S0's Internal DMA driver
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+#include "i2s.h"
+#include "idma.h"
+#include "dma.h"
+#include "i2s-regs.h"
+
+#define ST_RUNNING              (1<<0)
+#define ST_OPENED               (1<<1)
+
+static const struct snd_pcm_hardware idma_hardware = {
+        .info = SNDRV_PCM_INFO_INTERLEAVED |
+                    SNDRV_PCM_INFO_BLOCK_TRANSFER |
+                    SNDRV_PCM_INFO_MMAP |
+                    SNDRV_PCM_INFO_MMAP_VALID |
+                    SNDRV_PCM_INFO_PAUSE |
+                    SNDRV_PCM_INFO_RESUME,
+        .formats = SNDRV_PCM_FMTBIT_S16_LE |
+                    SNDRV_PCM_FMTBIT_U16_LE |
+                    SNDRV_PCM_FMTBIT_S24_LE |
+                    SNDRV_PCM_FMTBIT_U24_LE |
+                    SNDRV_PCM_FMTBIT_U8 |
+                    SNDRV_PCM_FMTBIT_S8,
+        .channels_min = 2,
+        .channels_max = 2,
+        .buffer_bytes_max = MAX_IDMA_BUFFER,
+        .period_bytes_min = 128,
+        .period_bytes_max = MAX_IDMA_PERIOD,
+        .periods_min = 1,
+        .periods_max = 2,
+};
+
+struct idma_ctrl {
+        spinlock_t      lock;
+        int             state;
+        dma_addr_t      start;
+        dma_addr_t      pos;
+        dma_addr_t      end;
+        dma_addr_t      period;
+        dma_addr_t      periodsz;
+        void            *token;
+        void            (*cb)(void *dt, int bytes_xfer);
+};
+
+static struct idma_info {
+        spinlock_t      lock;
+        void             __iomem  *regs;
+        dma_addr_t      lp_tx_addr;
+} idma;
+
+static void idma_getpos(dma_addr_t *src)
+{
+        *src = idma.lp_tx_addr +
+                (readl(idma.regs + I2STRNCNT) & 0xffffff) * 4;
+}
+
+static int idma_enqueue(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        u32 val;
+
+        spin_lock(&prtd->lock);
+        prtd->token = (void *) substream;
+        spin_unlock(&prtd->lock);
+
+        /* Internal DMA Level0 Interrupt Address */
+        val = idma.lp_tx_addr + prtd->periodsz;
+        writel(val, idma.regs + I2SLVL0ADDR);
+
+        /* Start address0 of I2S internal DMA operation. */
+        val = idma.lp_tx_addr;
+        writel(val, idma.regs + I2SSTR0);
+
+        /*
+         * Transfer block size for I2S internal DMA.
+         * Should decide transfer size before start dma operation
+         */
+        val = readl(idma.regs + I2SSIZE);
+        val &= ~(I2SSIZE_TRNMSK << I2SSIZE_SHIFT);
+        val |= (((runtime->dma_bytes >> 2) &
+                        I2SSIZE_TRNMSK) << I2SSIZE_SHIFT);
+        writel(val, idma.regs + I2SSIZE);
+
+        val = readl(idma.regs + I2SAHB);
+        val |= AHB_INTENLVL0;
+        writel(val, idma.regs + I2SAHB);
+
+        return 0;
+}
+
+static void idma_setcallbk(struct snd_pcm_substream *substream,
+                                void (*cb)(void *, int))
+{
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+
+        spin_lock(&prtd->lock);
+        prtd->cb = cb;
+        spin_unlock(&prtd->lock);
+}
+
+static void idma_control(int op)
+{
+        u32 val = readl(idma.regs + I2SAHB);
+
+        spin_lock(&idma.lock);
+
+        switch (op) {
+        case LPAM_DMA_START:
+                val |= (AHB_INTENLVL0 | AHB_DMAEN);
+                break;
+        case LPAM_DMA_STOP:
+                val &= ~(AHB_INTENLVL0 | AHB_DMAEN);
+                break;
+        default:
+                spin_unlock(&idma.lock);
+                return;
+        }
+
+        writel(val, idma.regs + I2SAHB);
+        spin_unlock(&idma.lock);
+}
+
+static void idma_done(void *id, int bytes_xfer)
+{
+        struct snd_pcm_substream *substream = id;
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+
+        if (prtd && (prtd->state & ST_RUNNING))
+                snd_pcm_period_elapsed(substream);
+}
+
+static int idma_hw_params(struct snd_pcm_substream *substream,
+                                struct snd_pcm_hw_params *params)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        u32 mod = readl(idma.regs + I2SMOD);
+        u32 ahb = readl(idma.regs + I2SAHB);
+
+        ahb |= (AHB_DMARLD | AHB_INTMASK);
+        mod |= MOD_TXS_IDMA;
+        writel(ahb, idma.regs + I2SAHB);
+        writel(mod, idma.regs + I2SMOD);
+
+        snd_pcm_set_runtime_buffer(substream, &substream->dma_buffer);
+        runtime->dma_bytes = params_buffer_bytes(params);
+
+        prtd->start = prtd->pos = runtime->dma_addr;
+        prtd->period = params_periods(params);
+        prtd->periodsz = params_period_bytes(params);
+        prtd->end = runtime->dma_addr + runtime->dma_bytes;
+
+        idma_setcallbk(substream, idma_done);
+
+        return 0;
+}
+
+static int idma_hw_free(struct snd_pcm_substream *substream)
+{
+        snd_pcm_set_runtime_buffer(substream, NULL);
+
+        return 0;
+}
+
+static int idma_prepare(struct snd_pcm_substream *substream)
+{
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+
+        prtd->pos = prtd->start;
+
+        /* flush the DMA channel */
+        idma_control(LPAM_DMA_STOP);
+        idma_enqueue(substream);
+
+        return 0;
+}
+
+static int idma_trigger(struct snd_pcm_substream *substream, int cmd)
+{
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        int ret = 0;
+
+        spin_lock(&prtd->lock);
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                prtd->state |= ST_RUNNING;
+                idma_control(LPAM_DMA_START);
+                break;
+
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                prtd->state &= ~ST_RUNNING;
+                idma_control(LPAM_DMA_STOP);
+                break;
+
+        default:
+                ret = -EINVAL;
+                break;
+        }
+
+        spin_unlock(&prtd->lock);
+
+        return ret;
+}
+
+static snd_pcm_uframes_t
+        idma_pointer(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = runtime->private_data;
+        dma_addr_t src;
+        unsigned long res;
+
+        spin_lock(&prtd->lock);
+
+        idma_getpos(&src);
+        res = src - prtd->start;
+
+        spin_unlock(&prtd->lock);
+
+        return bytes_to_frames(substream->runtime, res);
+}
+
+static int idma_mmap(struct snd_pcm_substream *substream,
+        struct vm_area_struct *vma)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        unsigned long size, offset;
+        int ret;
+
+        /* From snd_pcm_lib_mmap_iomem */
+        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+        vma->vm_flags |= VM_IO;
+        size = vma->vm_end - vma->vm_start;
+        offset = vma->vm_pgoff << PAGE_SHIFT;
+        ret = io_remap_pfn_range(vma, vma->vm_start,
+                        (runtime->dma_addr + offset) >> PAGE_SHIFT,
+                        size, vma->vm_page_prot);
+
+        return ret;
+}
+
+static irqreturn_t iis_irq(int irqno, void *dev_id)
+{
+        struct idma_ctrl *prtd = (struct idma_ctrl *)dev_id;
+        u32 iiscon, iisahb, val, addr;
+
+        iisahb  = readl(idma.regs + I2SAHB);
+        iiscon  = readl(idma.regs + I2SCON);
+
+        val = (iisahb & AHB_LVL0INT) ? AHB_CLRLVL0INT : 0;
+
+        if (val) {
+                iisahb |= val;
+                writel(iisahb, idma.regs + I2SAHB);
+
+                addr = readl(idma.regs + I2SLVL0ADDR) - idma.lp_tx_addr;
+                addr += prtd->periodsz;
+                addr %= (prtd->end - prtd->start);
+                addr += idma.lp_tx_addr;
+
+                writel(addr, idma.regs + I2SLVL0ADDR);
+
+                if (prtd->cb)
+                        prtd->cb(prtd->token, prtd->period);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static int idma_open(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd;
+        int ret;
+
+        snd_soc_set_runtime_hwparams(substream, &idma_hardware);
+
+        prtd = kzalloc(sizeof(struct idma_ctrl), GFP_KERNEL);
+        if (prtd == NULL)
+                return -ENOMEM;
+
+        ret = request_irq(IRQ_I2S0, iis_irq, 0, "i2s", prtd);
+        if (ret < 0) {
+                pr_err("fail to claim i2s irq , ret = %d\n", ret);
+                kfree(prtd);
+                return ret;
+        }
+
+        spin_lock_init(&prtd->lock);
+
+        runtime->private_data = prtd;
+
+        return 0;
+}
+
+static int idma_close(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = runtime->private_data;
+
+        free_irq(IRQ_I2S0, prtd);
+
+        if (!prtd)
+                pr_err("idma_close called with prtd == NULL\n");
+
+        kfree(prtd);
+
+        return 0;
+}
+
+static struct snd_pcm_ops idma_ops = {
+        .open           = idma_open,
+        .close          = idma_close,
+        .ioctl          = snd_pcm_lib_ioctl,
+        .trigger        = idma_trigger,
+        .pointer        = idma_pointer,
+        .mmap           = idma_mmap,
+        .hw_params      = idma_hw_params,
+        .hw_free        = idma_hw_free,
+        .prepare        = idma_prepare,
+};
+
+static void idma_free(struct snd_pcm *pcm)
+{
+        struct snd_pcm_substream *substream;
+        struct snd_dma_buffer *buf;
+
+        substream = pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream;
+        if (!substream)
+                return;
+
+        buf = &substream->dma_buffer;
+        if (!buf->area)
+                return;
+
+        iounmap(buf->area);
+
+        buf->area = NULL;
+        buf->addr = 0;
+}
+
+static int preallocate_idma_buffer(struct snd_pcm *pcm, int stream)
+{
+        struct snd_pcm_substream *substream = pcm->streams[stream].substream;
+        struct snd_dma_buffer *buf = &substream->dma_buffer;
+
+        buf->dev.dev = pcm->card->dev;
+        buf->private_data = NULL;
+
+        /* Assign PCM buffer pointers */
+        buf->dev.type = SNDRV_DMA_TYPE_CONTINUOUS;
+        buf->addr = idma.lp_tx_addr;
+        buf->bytes = idma_hardware.buffer_bytes_max;
+        buf->area = (unsigned char *)ioremap(buf->addr, buf->bytes);
+
+        return 0;
+}
+
+static u64 idma_mask = DMA_BIT_MASK(32);
+
+static int idma_new(struct snd_soc_pcm_runtime *rtd)
+{
+        struct snd_card *card = rtd->card->snd_card;
+        struct snd_soc_dai *dai = rtd->cpu_dai;
+        struct snd_pcm *pcm = rtd->pcm;
+        int ret = 0;
+
+        if (!card->dev->dma_mask)
+                card->dev->dma_mask = &idma_mask;
+        if (!card->dev->coherent_dma_mask)
+                card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+
+        if (dai->driver->playback.channels_min)
+                ret = preallocate_idma_buffer(pcm,
+                                SNDRV_PCM_STREAM_PLAYBACK);
+
+        return ret;
+}
+
+void idma_reg_addr_init(void *regs, dma_addr_t addr)
+{
+        spin_lock_init(&idma.lock);
+        idma.regs = regs;
+        idma.lp_tx_addr = addr;
+}
+
+struct snd_soc_platform_driver asoc_idma_platform = {
+        .ops = &idma_ops,
+        .pcm_new = idma_new,
+        .pcm_free = idma_free,
+};
+
+static int __devinit asoc_idma_platform_probe(struct platform_device *pdev)
+{
+        return snd_soc_register_platform(&pdev->dev, &asoc_idma_platform);
+}
+
+static int __devexit asoc_idma_platform_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_platform(&pdev->dev);
+        return 0;
+}
+
+static struct platform_driver asoc_idma_driver = {
+        .driver = {
+                .name = "samsung-idma",
+                .owner = THIS_MODULE,
+        },
+
+        .probe = asoc_idma_platform_probe,
+        .remove = __devexit_p(asoc_idma_platform_remove),
+};
+
+static int __init asoc_idma_init(void)
+{
+        return platform_driver_register(&asoc_idma_driver);
+}
+module_init(asoc_idma_init);
+
+static void __exit asoc_idma_exit(void)
+{
+        platform_driver_unregister(&asoc_idma_driver);
+}
+module_exit(asoc_idma_exit);
+
+MODULE_AUTHOR("Jaswinder Singh, <jassisinghbrar@gmail.com>");
+MODULE_DESCRIPTION("Samsung ASoC IDMA Driver");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/samsung/idma.h b/sound/soc/samsung/idma.h
new file mode 100644
index 000000000000..48273216166e
--- /dev/null
+++ b/sound/soc/samsung/idma.h
@@ -0,0 +1,26 @@
+/*
+ * sound/soc/samsung/idma.h
+ *
+ * Copyright (c) 2011 Samsung Electronics Co., Ltd
+ *              http://www.samsung.com
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#ifndef __SND_SOC_SAMSUNG_IDMA_H_
+#define __SND_SOC_SAMSUNG_IDMA_H_
+
+extern void idma_reg_addr_init(void *regs, dma_addr_t addr);
+
+/* dma_state */
+#define LPAM_DMA_STOP   0
+#define LPAM_DMA_START  1
+
+#define MAX_IDMA_PERIOD (128 * 1024)
+#define MAX_IDMA_BUFFER (160 * 1024)
+
+#endif /* __SND_SOC_SAMSUNG_IDMA_H_ */
diff --git a/sound/soc/samsung/jive_wm8750.c b/sound/soc/samsung/jive_wm8750.c
index 3b53ad54bc33..14eb6ea69e7c 100644
--- a/sound/soc/samsung/jive_wm8750.c
+++ b/sound/soc/samsung/jive_wm8750.c
@@ -131,7 +131,7 @@ static struct snd_soc_dai_link jive_dai = {
         .cpu_dai_name   = "s3c2412-i2s",
         .codec_dai_name = "wm8750-hifi",
         .platform_name  = "samsung-audio",
-        .codec_name     = "wm8750-codec.0-0x1a",
+        .codec_name     = "wm8750-codec.0-001a",
         .init           = jive_wm8750_init,
         .ops            = &jive_ops,
 };
diff --git a/sound/soc/samsung/speyside_wm8962.c b/sound/soc/samsung/speyside_wm8962.c
index 8ac42bf82090..0b9eb5f7ec4c 100644
--- a/sound/soc/samsung/speyside_wm8962.c
+++ b/sound/soc/samsung/speyside_wm8962.c
@@ -37,7 +37,7 @@ static int speyside_wm8962_set_bias_level(struct snd_soc_card *card,
                                                      44100 * 256,
                                                      SND_SOC_CLOCK_IN);
                         if (ret < 0) {
-                                pr_err("Failed to set SYSCLK: %d\n");
+                                pr_err("Failed to set SYSCLK: %d\n", ret);
                                 return ret;
                         }
                 }
diff --git a/sound/soc/tegra/tegra_pcm.c b/sound/soc/tegra/tegra_pcm.c
index ff86e5e3db68..c7cfd96e991e 100644
--- a/sound/soc/tegra/tegra_pcm.c
+++ b/sound/soc/tegra/tegra_pcm.c
@@ -309,9 +309,14 @@ static int tegra_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, int stream)
 
 static void tegra_pcm_deallocate_dma_buffer(struct snd_pcm *pcm, int stream)
 {
-        struct snd_pcm_substream *substream = pcm->streams[stream].substream;
-        struct snd_dma_buffer *buf = &substream->dma_buffer;
+        struct snd_pcm_substream *substream;
+        struct snd_dma_buffer *buf;
+
+        substream = pcm->streams[stream].substream;
+        if (!substream)
+                return;
 
+        buf = &substream->dma_buffer;
         if (!buf->area)
                 return;
 
diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
index a42e9ac30f28..661373c2352a 100644
--- a/sound/soc/tegra/tegra_wm8903.c
+++ b/sound/soc/tegra/tegra_wm8903.c
@@ -56,6 +56,7 @@
 #define GPIO_HP_MUTE    BIT(1)
 #define GPIO_INT_MIC_EN BIT(2)
 #define GPIO_EXT_MIC_EN BIT(3)
+#define GPIO_HP_DET     BIT(4)
 
 struct tegra_wm8903 {
         struct tegra_asoc_utils_data util_data;
@@ -304,6 +305,7 @@ static int tegra_wm8903_init(struct snd_soc_pcm_runtime *rtd)
                 snd_soc_jack_add_gpios(&tegra_wm8903_hp_jack,
                                         1,
                                         &tegra_wm8903_hp_jack_gpio);
+                machine->gpio_requested |= GPIO_HP_DET;
         }
 
         snd_soc_jack_new(codec, "Mic Jack", SND_JACK_MICROPHONE,
@@ -429,10 +431,10 @@ static int __devexit tegra_wm8903_driver_remove(struct platform_device *pdev)
         struct tegra_wm8903 *machine = snd_soc_card_get_drvdata(card);
         struct tegra_wm8903_platform_data *pdata = machine->pdata;
 
-        snd_soc_unregister_card(card);
-
-        tegra_asoc_utils_fini(&machine->util_data);
-
+        if (machine->gpio_requested & GPIO_HP_DET)
+                snd_soc_jack_free_gpios(&tegra_wm8903_hp_jack,
+                                        1,
+                                        &tegra_wm8903_hp_jack_gpio);
         if (machine->gpio_requested & GPIO_EXT_MIC_EN)
                 gpio_free(pdata->gpio_ext_mic_en);
         if (machine->gpio_requested & GPIO_INT_MIC_EN)
@@ -441,6 +443,11 @@ static int __devexit tegra_wm8903_driver_remove(struct platform_device *pdev)
                 gpio_free(pdata->gpio_hp_mute);
         if (machine->gpio_requested & GPIO_SPKR_EN)
                 gpio_free(pdata->gpio_spkr_en);
+        machine->gpio_requested = 0;
+
+        snd_soc_unregister_card(card);
+
+        tegra_asoc_utils_fini(&machine->util_data);
 
         kfree(machine);
 
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index d0d493ca28ae..aa52b3e13bb5 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -614,6 +614,7 @@ static void read_completed(struct urb *urb)
         struct snd_usb_caiaqdev *dev;
         struct urb *out;
         int frame, len, send_it = 0, outframe = 0;
+        size_t offset = 0;
 
         if (urb->status || !info)
                 return;
@@ -634,7 +635,8 @@ static void read_completed(struct urb *urb)
                 len = urb->iso_frame_desc[outframe].actual_length;
                 out->iso_frame_desc[outframe].length = len;
                 out->iso_frame_desc[outframe].actual_length = 0;
-                out->iso_frame_desc[outframe].offset = BYTES_PER_FRAME * frame;
+                out->iso_frame_desc[outframe].offset = offset;
+                offset += len;
 
                 if (len > 0) {
                         spin_lock(&dev->spinlock);
@@ -650,7 +652,7 @@ static void read_completed(struct urb *urb)
         }
 
         if (send_it) {
-                out->number_of_packets = FRAMES_PER_URB;
+                out->number_of_packets = outframe;
                 out->transfer_flags = URB_ISO_ASAP;
                 usb_submit_urb(out, GFP_ATOMIC);
         }
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 4d4f86552a23..a42e3ef3832d 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1707,6 +1707,40 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                 }
         }
 },
+{
+        USB_DEVICE(0x0582, 0x0130),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                /* .vendor_name = "BOSS", */
+                /* .product_name = "MICRO BR-80", */
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_IGNORE_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 3,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = & (const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables  = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
 
 /* Guillemot devices */
 {
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 56d62d3fb167..3b8f7b80376b 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -181,9 +181,9 @@ strip-libs = $(filter-out -l%,$(1))
 
 $(OUTPUT)python/perf.so: $(PYRF_OBJS)
         $(QUIET_GEN)CFLAGS='$(BASIC_CFLAGS)' $(PYTHON_WORD) util/setup.py \
-          --quiet build_ext \
-          --build-lib='$(OUTPUT)python' \
-          --build-temp='$(OUTPUT)python/temp'
+          --quiet build_ext; \
+        mkdir -p $(OUTPUT)python && \
+        cp $(PYTHON_EXTBUILD_LIB)perf.so $(OUTPUT)python/
 #
 # No Perl scripts right now:
 #
@@ -509,9 +509,13 @@ else
 
   PYTHON_WORD := $(call shell-wordify,$(PYTHON))
 
-  python-clean := $(PYTHON_WORD) util/setup.py clean \
-    --build-lib='$(OUTPUT)python' \
-    --build-temp='$(OUTPUT)python/temp'
+  # python extension build directories
+  PYTHON_EXTBUILD     := $(OUTPUT)python_ext_build/
+  PYTHON_EXTBUILD_LIB := $(PYTHON_EXTBUILD)lib/
+  PYTHON_EXTBUILD_TMP := $(PYTHON_EXTBUILD)tmp/
+  export PYTHON_EXTBUILD_LIB PYTHON_EXTBUILD_TMP
+
+  python-clean := rm -rf $(PYTHON_EXTBUILD) $(OUTPUT)python/perf.so
 
   ifdef NO_LIBPYTHON
     $(call disable-python)
@@ -868,6 +872,9 @@ install: all
         $(INSTALL) scripts/python/*.py -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/python'
         $(INSTALL) scripts/python/bin/* -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/python/bin'
 
+install-python_ext:
+        $(PYTHON_WORD) util/setup.py --quiet install --root='/$(DESTDIR_SQ)'
+
 install-doc:
         $(MAKE) -C Documentation install
 
@@ -895,7 +902,7 @@ quick-install-html:
 ### Cleaning rules
 
 clean:
-        $(RM) $(OUTPUT){*.o,*/*.o,*/*/*.o,*/*/*/*.o,$(LIB_FILE),perf-archive}
+        $(RM) $(LIB_OBJS) $(BUILTIN_OBJS) $(LIB_FILE) $(OUTPUT)perf-archive $(OUTPUT)perf.o $(LANG_BINDINGS)
         $(RM) $(ALL_PROGRAMS) perf
         $(RM) *.spec *.pyc *.pyo */*.pyc */*.pyo $(OUTPUT)common-cmds.h TAGS tags cscope*
         $(MAKE) -C Documentation/ clean
diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
index 9ac05aafd9b2..899080ace267 100644
--- a/tools/perf/builtin-lock.c
+++ b/tools/perf/builtin-lock.c
@@ -942,10 +942,10 @@ static const char *record_args[] = {
         "-f",
         "-m", "1024",
         "-c", "1",
-        "-e", "lock:lock_acquire:r",
-        "-e", "lock:lock_acquired:r",
-        "-e", "lock:lock_contended:r",
-        "-e", "lock:lock_release:r",
+        "-e", "lock:lock_acquire",
+        "-e", "lock:lock_acquired",
+        "-e", "lock:lock_contended",
+        "-e", "lock:lock_release",
 };
 
 static int __cmd_record(int argc, const char **argv)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 80dc5b790e47..f6426b496f4a 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -30,8 +30,6 @@
 #include <sched.h>
 #include <sys/mman.h>
 
-#define FD(e, x, y) (*(int *)xyarray__entry(e->fd, x, y))
-
 enum write_mode_t {
         WRITE_FORCE,
         WRITE_APPEND
@@ -438,7 +436,6 @@ static void mmap_read_all(void)
 
 static int __cmd_record(int argc, const char **argv)
 {
-        int i;
         struct stat st;
         int flags;
         int err;
@@ -682,7 +679,6 @@ static int __cmd_record(int argc, const char **argv)
 
         for (;;) {
                 int hits = samples;
-                int thread;
 
                 mmap_read_all();
 
@@ -693,19 +689,8 @@ static int __cmd_record(int argc, const char **argv)
                         waking++;
                 }
 
-                if (done) {
-                        for (i = 0; i < evsel_list->cpus->nr; i++) {
-                                struct perf_evsel *pos;
-
-                                list_for_each_entry(pos, &evsel_list->entries, node) {
-                                        for (thread = 0;
-                                                thread < evsel_list->threads->nr;
-                                                thread++)
-                                                ioctl(FD(pos, i, thread),
-                                                        PERF_EVENT_IOC_DISABLE);
-                                }
-                        }
-                }
+                if (done)
+                        perf_evlist__disable(evsel_list);
         }
 
         if (quiet || signr == SIGUSR1)
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index f854efda7686..d7ff277bdb78 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -162,23 +162,22 @@ static int perf_session__setup_sample_type(struct perf_session *self)
 {
         if (!(self->sample_type & PERF_SAMPLE_CALLCHAIN)) {
                 if (sort__has_parent) {
-                        fprintf(stderr, "selected --sort parent, but no"
-                                        " callchain data. Did you call"
-                                        " perf record without -g?\n");
+                        ui__warning("Selected --sort parent, but no "
+                                    "callchain data. Did you call "
+                                    "'perf record' without -g?\n");
                         return -EINVAL;
                 }
                 if (symbol_conf.use_callchain) {
-                        fprintf(stderr, "selected -g but no callchain data."
-                                        " Did you call perf record without"
-                                        " -g?\n");
+                        ui__warning("Selected -g but no callchain data. Did "
+                                    "you call 'perf record' without -g?\n");
                         return -1;
                 }
         } else if (!dont_use_callchains && callchain_param.mode != CHAIN_NONE &&
                    !symbol_conf.use_callchain) {
                         symbol_conf.use_callchain = true;
                         if (callchain_register_param(&callchain_param) < 0) {
-                                fprintf(stderr, "Can't register callchain"
-                                                " params\n");
+                                ui__warning("Can't register callchain "
+                                            "params.\n");
                                 return -EINVAL;
                         }
         }
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index dcfe8873c9a1..5177964943e7 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -1637,23 +1637,29 @@ static struct perf_event_ops event_ops = {
         .ordered_samples        = true,
 };
 
-static int read_events(void)
+static void read_events(bool destroy, struct perf_session **psession)
 {
         int err = -EINVAL;
         struct perf_session *session = perf_session__new(input_name, O_RDONLY,
                                                          0, false, &event_ops);
         if (session == NULL)
-                return -ENOMEM;
+                die("No Memory");
 
         if (perf_session__has_traces(session, "record -R")) {
                 err = perf_session__process_events(session, &event_ops);
+                if (err)
+                        die("Failed to process events, error %d", err);
+
                 nr_events      = session->hists.stats.nr_events[0];
                 nr_lost_events = session->hists.stats.total_lost;
                 nr_lost_chunks = session->hists.stats.nr_events[PERF_RECORD_LOST];
         }
 
-        perf_session__delete(session);
-        return err;
+        if (destroy)
+                perf_session__delete(session);
+
+        if (psession)
+                *psession = session;
 }
 
 static void print_bad_events(void)
@@ -1689,9 +1695,10 @@ static void print_bad_events(void)
 static void __cmd_lat(void)
 {
         struct rb_node *next;
+        struct perf_session *session;
 
         setup_pager();
-        read_events();
+        read_events(false, &session);
         sort_lat();
 
         printf("\n ---------------------------------------------------------------------------------------------------------------\n");
@@ -1717,6 +1724,7 @@ static void __cmd_lat(void)
         print_bad_events();
         printf("\n");
 
+        perf_session__delete(session);
 }
 
 static struct trace_sched_handler map_ops  = {
@@ -1731,7 +1739,7 @@ static void __cmd_map(void)
         max_cpu = sysconf(_SC_NPROCESSORS_CONF);
 
         setup_pager();
-        read_events();
+        read_events(true, NULL);
         print_bad_events();
 }
 
@@ -1744,7 +1752,7 @@ static void __cmd_replay(void)
 
         test_calibrations();
 
-        read_events();
+        read_events(true, NULL);
 
         printf("nr_run_events:        %ld\n", nr_run_events);
         printf("nr_sleep_events:      %ld\n", nr_sleep_events);
@@ -1769,7 +1777,7 @@ static void __cmd_replay(void)
 
 
 static const char * const sched_usage[] = {
-        "perf sched [<options>] {record|latency|map|replay|trace}",
+        "perf sched [<options>] {record|latency|map|replay|script}",
         NULL
 };
 
diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
index e02d78cae70f..fe02903f7d0f 100644
--- a/tools/perf/util/config.c
+++ b/tools/perf/util/config.c
@@ -399,7 +399,6 @@ static int perf_config_global(void)
 int perf_config(config_fn_t fn, void *data)
 {
         int ret = 0, found = 0;
-        char *repo_config = NULL;
         const char *home = NULL;
 
         /* Setting $PERF_CONFIG makes perf read _only_ the given config file. */
@@ -414,19 +413,32 @@ int perf_config(config_fn_t fn, void *data)
         home = getenv("HOME");
         if (perf_config_global() && home) {
                 char *user_config = strdup(mkpath("%s/.perfconfig", home));
-                if (!access(user_config, R_OK)) {
-                        ret += perf_config_from_file(fn, user_config, data);
-                        found += 1;
+                struct stat st;
+
+                if (user_config == NULL) {
+                        warning("Not enough memory to process %s/.perfconfig, "
+                                "ignoring it.", home);
+                        goto out;
                 }
-                free(user_config);
-        }
 
-        repo_config = perf_pathdup("config");
-        if (!access(repo_config, R_OK)) {
-                ret += perf_config_from_file(fn, repo_config, data);
+                if (stat(user_config, &st) < 0)
+                        goto out_free;
+
+                if (st.st_uid && (st.st_uid != geteuid())) {
+                        warning("File %s not owned by current user or root, "
+                                "ignoring it.", user_config);
+                        goto out_free;
+                }
+
+                if (!st.st_size)
+                        goto out_free;
+
+                ret += perf_config_from_file(fn, user_config, data);
                 found += 1;
+out_free:
+                free(user_config);
         }
-        free(repo_config);
+out:
         if (found == 0)
                 return -1;
         return ret;
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index b021ea9265c3..e03e7bc8205e 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -91,6 +91,19 @@ int perf_evlist__add_default(struct perf_evlist *evlist)
         return 0;
 }
 
+void perf_evlist__disable(struct perf_evlist *evlist)
+{
+        int cpu, thread;
+        struct perf_evsel *pos;
+
+        for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
+                list_for_each_entry(pos, &evlist->entries, node) {
+                        for (thread = 0; thread < evlist->threads->nr; thread++)
+                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_DISABLE);
+                }
+        }
+}
+
 int perf_evlist__alloc_pollfd(struct perf_evlist *evlist)
 {
         int nfds = evlist->cpus->nr * evlist->threads->nr * evlist->nr_entries;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index b2b862374f37..ce85ae9ae57a 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -53,6 +53,8 @@ int perf_evlist__alloc_mmap(struct perf_evlist *evlist);
 int perf_evlist__mmap(struct perf_evlist *evlist, int pages, bool overwrite);
 void perf_evlist__munmap(struct perf_evlist *evlist);
 
+void perf_evlist__disable(struct perf_evlist *evlist);
+
 static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
                                          struct cpu_map *cpus,
                                          struct thread_map *threads)
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index cb2959a3fb43..d4f3101773db 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -189,8 +189,8 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
                           const char *name, bool is_kallsyms)
 {
         const size_t size = PATH_MAX;
-        char *realname, *filename = malloc(size),
-             *linkname = malloc(size), *targetname;
+        char *realname, *filename = zalloc(size),
+             *linkname = zalloc(size), *targetname;
         int len, err = -1;
 
         if (is_kallsyms) {
@@ -254,8 +254,8 @@ static int build_id_cache__add_b(const u8 *build_id, size_t build_id_size,
 int build_id_cache__remove_s(const char *sbuild_id, const char *debugdir)
 {
         const size_t size = PATH_MAX;
-        char *filename = malloc(size),
-             *linkname = malloc(size);
+        char *filename = zalloc(size),
+             *linkname = zalloc(size);
         int err = -1;
 
         if (filename == NULL || linkname == NULL)
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index b82d54fa2c56..1c7bfa5fe0a8 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -1820,11 +1820,15 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                 ret = -ENOMEM;
                 goto error;
         }
-        tev->point.module = strdup(module);
-        if (tev->point.module == NULL) {
-                ret = -ENOMEM;
-                goto error;
+
+        if (module) {
+                tev->point.module = strdup(module);
+                if (tev->point.module == NULL) {
+                        ret = -ENOMEM;
+                        goto error;
+                }
         }
+
         tev->point.offset = pev->point.offset;
         tev->point.retprobe = pev->point.retprobe;
         tev->nargs = pev->nargs;
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 8e0b5a39d8a7..cbc8f215d4b7 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -187,16 +187,119 @@ static PyTypeObject pyrf_throttle_event__type = {
         .tp_repr        = (reprfunc)pyrf_throttle_event__repr,
 };
 
+static char pyrf_lost_event__doc[] = PyDoc_STR("perf lost event object.");
+
+static PyMemberDef pyrf_lost_event__members[] = {
+        sample_members
+        member_def(lost_event, id, T_ULONGLONG, "event id"),
+        member_def(lost_event, lost, T_ULONGLONG, "number of lost events"),
+        { .name = NULL, },
+};
+
+static PyObject *pyrf_lost_event__repr(struct pyrf_event *pevent)
+{
+        PyObject *ret;
+        char *s;
+
+        if (asprintf(&s, "{ type: lost, id: %#" PRIx64 ", "
+                         "lost: %#" PRIx64 " }",
+                     pevent->event.lost.id, pevent->event.lost.lost) < 0) {
+                ret = PyErr_NoMemory();
+        } else {
+                ret = PyString_FromString(s);
+                free(s);
+        }
+        return ret;
+}
+
+static PyTypeObject pyrf_lost_event__type = {
+        PyVarObject_HEAD_INIT(NULL, 0)
+        .tp_name        = "perf.lost_event",
+        .tp_basicsize   = sizeof(struct pyrf_event),
+        .tp_flags       = Py_TPFLAGS_DEFAULT|Py_TPFLAGS_BASETYPE,
+        .tp_doc         = pyrf_lost_event__doc,
+        .tp_members     = pyrf_lost_event__members,
+        .tp_repr        = (reprfunc)pyrf_lost_event__repr,
+};
+
+static char pyrf_read_event__doc[] = PyDoc_STR("perf read event object.");
+
+static PyMemberDef pyrf_read_event__members[] = {
+        sample_members
+        member_def(read_event, pid, T_UINT, "event pid"),
+        member_def(read_event, tid, T_UINT, "event tid"),
+        { .name = NULL, },
+};
+
+static PyObject *pyrf_read_event__repr(struct pyrf_event *pevent)
+{
+        return PyString_FromFormat("{ type: read, pid: %u, tid: %u }",
+                                   pevent->event.read.pid,
+                                   pevent->event.read.tid);
+        /*
+         * FIXME: return the array of read values,
+         * making this method useful ;-)
+         */
+}
+
+static PyTypeObject pyrf_read_event__type = {
+        PyVarObject_HEAD_INIT(NULL, 0)
+        .tp_name        = "perf.read_event",
+        .tp_basicsize   = sizeof(struct pyrf_event),
+        .tp_flags       = Py_TPFLAGS_DEFAULT|Py_TPFLAGS_BASETYPE,
+        .tp_doc         = pyrf_read_event__doc,
+        .tp_members     = pyrf_read_event__members,
+        .tp_repr        = (reprfunc)pyrf_read_event__repr,
+};
+
+static char pyrf_sample_event__doc[] = PyDoc_STR("perf sample event object.");
+
+static PyMemberDef pyrf_sample_event__members[] = {
+        sample_members
+        member_def(perf_event_header, type, T_UINT, "event type"),
+        { .name = NULL, },
+};
+
+static PyObject *pyrf_sample_event__repr(struct pyrf_event *pevent)
+{
+        PyObject *ret;
+        char *s;
+
+        if (asprintf(&s, "{ type: sample }") < 0) {
+                ret = PyErr_NoMemory();
+        } else {
+                ret = PyString_FromString(s);
+                free(s);
+        }
+        return ret;
+}
+
+static PyTypeObject pyrf_sample_event__type = {
+        PyVarObject_HEAD_INIT(NULL, 0)
+        .tp_name        = "perf.sample_event",
+        .tp_basicsize   = sizeof(struct pyrf_event),
+        .tp_flags       = Py_TPFLAGS_DEFAULT|Py_TPFLAGS_BASETYPE,
+        .tp_doc         = pyrf_sample_event__doc,
+        .tp_members     = pyrf_sample_event__members,
+        .tp_repr        = (reprfunc)pyrf_sample_event__repr,
+};
+
 static int pyrf_event__setup_types(void)
 {
         int err;
         pyrf_mmap_event__type.tp_new =
         pyrf_task_event__type.tp_new =
         pyrf_comm_event__type.tp_new =
+        pyrf_lost_event__type.tp_new =
+        pyrf_read_event__type.tp_new =
+        pyrf_sample_event__type.tp_new =
         pyrf_throttle_event__type.tp_new = PyType_GenericNew;
         err = PyType_Ready(&pyrf_mmap_event__type);
         if (err < 0)
                 goto out;
+        err = PyType_Ready(&pyrf_lost_event__type);
+        if (err < 0)
+                goto out;
         err = PyType_Ready(&pyrf_task_event__type);
         if (err < 0)
                 goto out;
@@ -206,20 +309,26 @@ static int pyrf_event__setup_types(void)
         err = PyType_Ready(&pyrf_throttle_event__type);
         if (err < 0)
                 goto out;
+        err = PyType_Ready(&pyrf_read_event__type);
+        if (err < 0)
+                goto out;
+        err = PyType_Ready(&pyrf_sample_event__type);
+        if (err < 0)
+                goto out;
 out:
         return err;
 }
 
 static PyTypeObject *pyrf_event__type[] = {
         [PERF_RECORD_MMAP]       = &pyrf_mmap_event__type,
-        [PERF_RECORD_LOST]       = &pyrf_mmap_event__type,
+        [PERF_RECORD_LOST]       = &pyrf_lost_event__type,
         [PERF_RECORD_COMM]       = &pyrf_comm_event__type,
         [PERF_RECORD_EXIT]       = &pyrf_task_event__type,
         [PERF_RECORD_THROTTLE]   = &pyrf_throttle_event__type,
         [PERF_RECORD_UNTHROTTLE] = &pyrf_throttle_event__type,
         [PERF_RECORD_FORK]       = &pyrf_task_event__type,
-        [PERF_RECORD_READ]       = &pyrf_mmap_event__type,
-        [PERF_RECORD_SAMPLE]     = &pyrf_mmap_event__type,
+        [PERF_RECORD_READ]       = &pyrf_read_event__type,
+        [PERF_RECORD_SAMPLE]     = &pyrf_sample_event__type,
 };
 
 static PyObject *pyrf_event__new(union perf_event *event)
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index bbc982f5dd8b..95d370074928 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -3,9 +3,27 @@
 from distutils.core import setup, Extension
 from os import getenv
 
+from distutils.command.build_ext   import build_ext   as _build_ext
+from distutils.command.install_lib import install_lib as _install_lib
+
+class build_ext(_build_ext):
+    def finalize_options(self):
+        _build_ext.finalize_options(self)
+        self.build_lib  = build_lib
+        self.build_temp = build_tmp
+
+class install_lib(_install_lib):
+    def finalize_options(self):
+        _install_lib.finalize_options(self)
+        self.build_dir = build_lib
+
+
 cflags = ['-fno-strict-aliasing', '-Wno-write-strings']
 cflags += getenv('CFLAGS', '').split()
 
+build_lib = getenv('PYTHON_EXTBUILD_LIB')
+build_tmp = getenv('PYTHON_EXTBUILD_TMP')
+
 perf = Extension('perf',
                   sources = ['util/python.c', 'util/ctype.c', 'util/evlist.c',
                              'util/evsel.c', 'util/cpumap.c', 'util/thread_map.c',
@@ -21,4 +39,5 @@ setup(name='perf',
       author_email='acme@redhat.com',
       license='GPLv2',
       url='http://perf.wiki.kernel.org',
-      ext_modules=[perf])
+      ext_modules=[perf],
+      cmdclass={'build_ext': build_ext, 'install_lib': install_lib})
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index eec196329fd9..a8b53714542a 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1504,6 +1504,17 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
         dso->adjust_symbols = 0;
 
         if (strncmp(dso->name, "/tmp/perf-", 10) == 0) {
+                struct stat st;
+
+                if (stat(dso->name, &st) < 0)
+                        return -1;
+
+                if (st.st_uid && (st.st_uid != geteuid())) {
+                        pr_warning("File %s not owned by current user or root, "
+                                "ignoring it.\n", dso->name);
+                        return -1;
+                }
+
                 ret = dso__load_perf_map(dso, map, filter);
                 dso->symtab_type = ret > 0 ? SYMTAB__JAVA_JIT :
                                               SYMTAB__NOT_FOUND;