637 files changed, 8682 insertions, 4149 deletions
diff --git a/Documentation/ABI/testing/sysfs-block b/Documentation/ABI/testing/sysfs-block
index cbbd3e069945..5f3bedaf8e35 100644
--- a/Documentation/ABI/testing/sysfs-block
+++ b/Documentation/ABI/testing/sysfs-block
@@ -94,28 +94,37 @@ What:		/sys/block/<disk>/queue/physical_block_size
 Date:           May 2009
 Contact:        Martin K. Petersen <martin.petersen@oracle.com>
 Description:
-                This is the smallest unit the storage device can write
+                This is the smallest unit a physical storage device can
-                without resorting to read-modify-write operation.  It is
+                write atomically.  It is usually the same as the logical
-                usually the same as the logical block size but may be
+                block size but may be bigger.  One example is SATA
-                bigger.  One example is SATA drives with 4KB sectors
+                drives with 4KB sectors that expose a 512-byte logical
-                that expose a 512-byte logical block size to the
+                block size to the operating system.  For stacked block
-                operating system.
+                devices the physical_block_size variable contains the
+                maximum physical_block_size of the component devices.
 What:           /sys/block/<disk>/queue/minimum_io_size
 Date:           April 2009
 Contact:        Martin K. Petersen <martin.petersen@oracle.com>
 Description:
-                Storage devices may report a preferred minimum I/O size,
+                Storage devices may report a granularity or preferred
-                which is the smallest request the device can perform
+                minimum I/O size which is the smallest request the
-                without incurring a read-modify-write penalty.  For disk
+                device can perform without incurring a performance
-                drives this is often the physical block size.  For RAID
+                penalty.  For disk drives this is often the physical
-                arrays it is often the stripe chunk size.
+                block size.  For RAID arrays it is often the stripe
+                chunk size.  A properly aligned multiple of
+                minimum_io_size is the preferred request size for
+                workloads where a high number of I/O operations is
+                desired.
 What:           /sys/block/<disk>/queue/optimal_io_size
 Date:           April 2009
 Contact:        Martin K. Petersen <martin.petersen@oracle.com>
 Description:
                Storage devices may report an optimal I/O size, which is
-                the device's preferred unit of receiving I/O.  This is
+                the device's preferred unit for sustained I/O.  This is
-                rarely reported for disk drives.  For RAID devices it is
+                rarely reported for disk drives.  For RAID arrays it is
-                usually the stripe width or the internal block size.
+                usually the stripe width or the internal track size.  A
+                properly aligned multiple of optimal_io_size is the
+                preferred request size for workloads where sustained
+                throughput is desired.  If no optimal I/O size is
+                reported this file contains 0.
diff --git a/Documentation/DocBook/kernel-hacking.tmpl b/Documentation/DocBook/kernel-hacking.tmpl
index a50d6cd58573..992e67e6be7f 100644
--- a/Documentation/DocBook/kernel-hacking.tmpl
+++ b/Documentation/DocBook/kernel-hacking.tmpl
@@ -449,8 +449,8 @@ printk(KERN_INFO "i = %u\n", i);
   </para>
   <programlisting>
-__u32 ipaddress;
+__be32 ipaddress;
-printk(KERN_INFO "my ip: %d.%d.%d.%d\n", NIPQUAD(ipaddress));
+printk(KERN_INFO "my ip: %pI4\n", &amp;ipaddress);
   </programlisting>
   <para>
diff --git a/Documentation/arm/memory.txt b/Documentation/arm/memory.txt
index 43cb1004d35f..9d58c7c5eddd 100644
--- a/Documentation/arm/memory.txt
+++ b/Documentation/arm/memory.txt
@@ -21,6 +21,8 @@ ffff8000	ffffffff	copy_user_page / clear_user_page use.
                                For SA11xx and Xscale, this is used to
                                setup a minicache mapping.
+ffff4000        ffffffff        cache aliasing on ARMv6 and later CPUs.
 ffff1000        ffff7fff        Reserved.
                                Platforms must not use this address range.
diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index 7bb0d934b6d8..dbea4f95fc85 100644
--- a/Documentation/ioctl/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
@@ -139,6 +139,7 @@ Code	Seq#	Include File		Comments
 'm'     all     linux/synclink.h        conflict!
 'm'     00-1F   net/irda/irmod.h        conflict!
 'n'     00-7F   linux/ncp_fs.h
+'n'     80-8F   linux/nilfs2_fs.h       NILFS2
 'n'     E0-FF   video/matrox.h          matroxfb
 'o'     00-1F   fs/ocfs2/ocfs2_fs.h     OCFS2
 'o'     00-03   include/mtd/ubi-user.h  conflict! (OCFS2 and UBI overlaps)
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index dd1a6d4bb747..7936b801fe6a 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1115,6 +1115,10 @@ and is between 256 and 4096 characters. It is defined in the file
                        libata.dma=4      Compact Flash DMA only 
                        Combinations also work, so libata.dma=3 enables DMA
                        for disks and CDROMs, but not CFs.
+        
+        libata.ignore_hpa=      [LIBATA] Ignore HPA limit
+                        libata.ignore_hpa=0       keep BIOS limits (default)
+                        libata.ignore_hpa=1       ignore limits, using full disk
        libata.noacpi   [LIBATA] Disables use of ACPI in libata suspend/resume
                        when set.
diff --git a/Documentation/lockdep-design.txt b/Documentation/lockdep-design.txt
index e20d913d5914..abf768c681e2 100644
--- a/Documentation/lockdep-design.txt
+++ b/Documentation/lockdep-design.txt
@@ -30,9 +30,9 @@ State
 The validator tracks lock-class usage history into 4n + 1 separate state bits:
 - 'ever held in STATE context'
- 'ever head as readlock in STATE context'
+- 'ever held as readlock in STATE context'
- 'ever head with STATE enabled'
+- 'ever held with STATE enabled'
- 'ever head as readlock with STATE enabled'
+- 'ever held as readlock with STATE enabled'
 Where STATE can be either one of (kernel/lockdep_states.h)
 - hardirq
diff --git a/Documentation/video4linux/CARDLIST.em28xx b/Documentation/video4linux/CARDLIST.em28xx
index 68c236c01846..e352d754875c 100644
--- a/Documentation/video4linux/CARDLIST.em28xx
+++ b/Documentation/video4linux/CARDLIST.em28xx
@@ -1,5 +1,5 @@
  0 -> Unknown EM2800 video grabber             (em2800)        [eb1a:2800]
-  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2820,eb1a:2821,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
+  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2710,eb1a:2820,eb1a:2821,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
  2 -> Terratec Cinergy 250 USB                 (em2820/em2840) [0ccd:0036]
  3 -> Pinnacle PCTV USB 2                      (em2820/em2840) [2304:0208]
  4 -> Hauppauge WinTV USB 2                    (em2820/em2840) [2040:4200,2040:4201]
diff --git a/Documentation/video4linux/CARDLIST.saa7134 b/Documentation/video4linux/CARDLIST.saa7134
index 15562427e8a9..c913e5614195 100644
--- a/Documentation/video4linux/CARDLIST.saa7134
+++ b/Documentation/video4linux/CARDLIST.saa7134
@@ -153,8 +153,8 @@
 152 -> Asus Tiger Rev:1.00                      [1043:4857]
 153 -> Kworld Plus TV Analog Lite PCI           [17de:7128]
 154 -> Avermedia AVerTV GO 007 FM Plus          [1461:f31d]
-155 -> Hauppauge WinTV-HVR1120 ATSC/QAM-Hybrid  [0070:6706,0070:6708]
+155 -> Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid  [0070:6706,0070:6708]
-156 -> Hauppauge WinTV-HVR1110r3 DVB-T/Hybrid   [0070:6707,0070:6709,0070:670a]
+156 -> Hauppauge WinTV-HVR1120 DVB-T/Hybrid     [0070:6707,0070:6709,0070:670a]
 157 -> Avermedia AVerTV Studio 507UA            [1461:a11b]
 158 -> AVerMedia Cardbus TV/Radio (E501R)       [1461:b7e9]
 159 -> Beholder BeholdTV 505 RDS                [0000:505B]
diff --git a/MAINTAINERS b/MAINTAINERS
index b1114cfac6bf..2c4326c0de9a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2238,6 +2238,14 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 S:      Maintained
 F:      drivers/media/video/gspca/pac207.c
+GSPCA SN9C20X SUBDRIVER
+P:      Brian Johnson
+M:      brijohn@gmail.com
+L:      linux-media@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
+S:      Maintained
+F:      drivers/media/video/gspca/sn9c20x.c
 GSPCA T613 SUBDRIVER
 M:      Leandro Costantino <lcostantino@gmail.com>
 L:      linux-media@vger.kernel.org
diff --git a/Makefile b/Makefile
index 0d46615bffe5..abcfa85f8f82 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 31
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Man-Eating Seals of Antiquity
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/compressed/misc.c b/arch/arm/boot/compressed/misc.c
index 9e6e512f0117..17153b54613b 100644
--- a/arch/arm/boot/compressed/misc.c
+++ b/arch/arm/boot/compressed/misc.c
@@ -29,7 +29,6 @@ unsigned int __machine_arch_type;
 static void putstr(const char *ptr);
-#include <linux/compiler.h>
 #include <mach/uncompress.h>
 #ifdef CONFIG_DEBUG_ICEDCC
diff --git a/arch/arm/common/clkdev.c b/arch/arm/common/clkdev.c
index f37afd9422f3..aae5bc01acc8 100644
--- a/arch/arm/common/clkdev.c
+++ b/arch/arm/common/clkdev.c
@@ -17,6 +17,7 @@
 #include <linux/err.h>
 #include <linux/string.h>
 #include <linux/mutex.h>
+#include <linux/clk.h>
 #include <asm/clkdev.h>
 #include <mach/clkdev.h>
diff --git a/arch/arm/configs/mx27_defconfig b/arch/arm/configs/mx27_defconfig
index 083516cd0d7f..75263a83741c 100644
--- a/arch/arm/configs/mx27_defconfig
+++ b/arch/arm/configs/mx27_defconfig
@@ -1,15 +1,15 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc1
+# Linux kernel version: 2.6.31-rc4
-# Wed Apr  8 10:18:06 2009
+# Fri Jul 24 16:08:06 2009
 #
 CONFIG_ARM=y
+CONFIG_HAVE_PWM=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_MMU=y
-# CONFIG_NO_IOPORT is not set
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_HAVE_LATENCYTOP_SUPPORT=y
@@ -18,14 +18,13 @@ CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
-# CONFIG_ARCH_HAS_ILOG2_U32 is not set
-# CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_ARCH_MTD_XIP=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_VECTORS_BASE=0xffff0000
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 #
 # General setup
@@ -85,7 +84,12 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_AIO=y
+#
+# Performance Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
@@ -99,6 +103,12 @@ CONFIG_KPROBES=y
 CONFIG_KRETPROBES=y
 CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_CLK=y
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
 # CONFIG_SLOW_WORK is not set
 CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_SLABINFO=y
@@ -111,7 +121,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
@@ -138,13 +148,14 @@ CONFIG_FREEZER=y
 # CONFIG_ARCH_VERSATILE is not set
 # CONFIG_ARCH_AT91 is not set
 # CONFIG_ARCH_CLPS711X is not set
+# CONFIG_ARCH_GEMINI is not set
 # CONFIG_ARCH_EBSA110 is not set
 # CONFIG_ARCH_EP93XX is not set
-# CONFIG_ARCH_GEMINI is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
+CONFIG_ARCH_MXC=y
+# CONFIG_ARCH_STMP3XXX is not set
 # CONFIG_ARCH_NETX is not set
 # CONFIG_ARCH_H720X is not set
-# CONFIG_ARCH_IMX is not set
 # CONFIG_ARCH_IOP13XX is not set
 # CONFIG_ARCH_IOP32X is not set
 # CONFIG_ARCH_IOP33X is not set
@@ -153,25 +164,25 @@ CONFIG_FREEZER=y
 # CONFIG_ARCH_IXP4XX is not set
 # CONFIG_ARCH_L7200 is not set
 # CONFIG_ARCH_KIRKWOOD is not set
-# CONFIG_ARCH_KS8695 is not set
-# CONFIG_ARCH_NS9XXX is not set
 # CONFIG_ARCH_LOKI is not set
 # CONFIG_ARCH_MV78XX0 is not set
-CONFIG_ARCH_MXC=y
 # CONFIG_ARCH_ORION5X is not set
+# CONFIG_ARCH_MMP is not set
+# CONFIG_ARCH_KS8695 is not set
+# CONFIG_ARCH_NS9XXX is not set
+# CONFIG_ARCH_W90X900 is not set
 # CONFIG_ARCH_PNX4008 is not set
 # CONFIG_ARCH_PXA is not set
-# CONFIG_ARCH_MMP is not set
+# CONFIG_ARCH_MSM is not set
 # CONFIG_ARCH_RPC is not set
 # CONFIG_ARCH_SA1100 is not set
 # CONFIG_ARCH_S3C2410 is not set
 # CONFIG_ARCH_S3C64XX is not set
 # CONFIG_ARCH_SHARK is not set
 # CONFIG_ARCH_LH7A40X is not set
+# CONFIG_ARCH_U300 is not set
 # CONFIG_ARCH_DAVINCI is not set
 # CONFIG_ARCH_OMAP is not set
-# CONFIG_ARCH_MSM is not set
-# CONFIG_ARCH_W90X900 is not set
 #
 # Freescale MXC Implementations
@@ -188,6 +199,8 @@ CONFIG_MACH_MX27=y
 CONFIG_MACH_MX27ADS=y
 CONFIG_MACH_PCM038=y
 CONFIG_MACH_PCM970_BASEBOARD=y
+CONFIG_MACH_MX27_3DS=y
+CONFIG_MACH_MX27LITE=y
 CONFIG_MXC_IRQ_PRIOR=y
 CONFIG_MXC_PWM=y
@@ -213,7 +226,6 @@ CONFIG_ARM_THUMB=y
 # CONFIG_CPU_DCACHE_DISABLE is not set
 # CONFIG_CPU_DCACHE_WRITETHROUGH is not set
 # CONFIG_CPU_CACHE_ROUND_ROBIN is not set
-# CONFIG_OUTER_CACHE is not set
 CONFIG_COMMON_CLKDEV=y
 #
@@ -238,7 +250,6 @@ CONFIG_PREEMPT=y
 CONFIG_HZ=100
 CONFIG_AEABI=y
 CONFIG_OABI_COMPAT=y
-CONFIG_ARCH_FLATMEM_HAS_HOLES=y
 # CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
 # CONFIG_ARCH_SELECT_MEMORY_MODEL is not set
 # CONFIG_HIGHMEM is not set
@@ -253,10 +264,11 @@ CONFIG_SPLIT_PTLOCK_CPUS=4096
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_UACCESS_WITH_MEMCPY is not set
 #
 # Boot options
@@ -361,6 +373,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
@@ -474,7 +487,16 @@ CONFIG_MTD_PHYSMAP=y
 # CONFIG_MTD_DOC2000 is not set
 # CONFIG_MTD_DOC2001 is not set
 # CONFIG_MTD_DOC2001PLUS is not set
-# CONFIG_MTD_NAND is not set
+CONFIG_MTD_NAND=y
+# CONFIG_MTD_NAND_VERIFY_WRITE is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+# CONFIG_MTD_NAND_MUSEUM_IDS is not set
+# CONFIG_MTD_NAND_GPIO is not set
+CONFIG_MTD_NAND_IDS=y
+# CONFIG_MTD_NAND_DISKONCHIP is not set
+# CONFIG_MTD_NAND_NANDSIM is not set
+# CONFIG_MTD_NAND_PLATFORM is not set
+CONFIG_MTD_NAND_MXC=y
 # CONFIG_MTD_ONENAND is not set
 #
@@ -485,7 +507,15 @@ CONFIG_MTD_PHYSMAP=y
 #
 # UBI - Unsorted block images
 #
-# CONFIG_MTD_UBI is not set
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_UBI_BEB_RESERVE=1
+# CONFIG_MTD_UBI_GLUEBI is not set
+#
+# UBI debugging options
+#
+# CONFIG_MTD_UBI_DEBUG is not set
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
@@ -494,7 +524,21 @@ CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_RAM is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
-# CONFIG_MISC_DEVICES is not set
+# CONFIG_MG_DISK is not set
+CONFIG_MISC_DEVICES=y
+# CONFIG_ICS932S401 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_ISL29003 is not set
+# CONFIG_C2PORT is not set
+#
+# EEPROM support
+#
+CONFIG_EEPROM_AT24=y
+# CONFIG_EEPROM_AT25 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_MAX6875 is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
@@ -508,7 +552,6 @@ CONFIG_HAVE_IDE=y
 # CONFIG_ATA is not set
 # CONFIG_MD is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -534,6 +577,8 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
+# CONFIG_KS8851 is not set
 CONFIG_FEC=y
 # CONFIG_FEC2 is not set
 # CONFIG_NETDEV_1000 is not set
@@ -580,6 +625,11 @@ CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_TABLET is not set
 CONFIG_INPUT_TOUCHSCREEN=y
 # CONFIG_TOUCHSCREEN_ADS7846 is not set
+# CONFIG_TOUCHSCREEN_AD7877 is not set
+# CONFIG_TOUCHSCREEN_AD7879_I2C is not set
+# CONFIG_TOUCHSCREEN_AD7879_SPI is not set
+# CONFIG_TOUCHSCREEN_AD7879 is not set
+# CONFIG_TOUCHSCREEN_EETI is not set
 # CONFIG_TOUCHSCREEN_FUJITSU is not set
 # CONFIG_TOUCHSCREEN_GUNZE is not set
 # CONFIG_TOUCHSCREEN_ELO is not set
@@ -592,6 +642,7 @@ CONFIG_INPUT_TOUCHSCREEN=y
 # CONFIG_TOUCHSCREEN_TOUCHWIN is not set
 # CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
 # CONFIG_TOUCHSCREEN_TSC2007 is not set
+# CONFIG_TOUCHSCREEN_W90X900 is not set
 # CONFIG_INPUT_MISC is not set
 #
@@ -644,6 +695,7 @@ CONFIG_I2C_HELPER_AUTO=y
 #
 # I2C system bus drivers (mostly embedded / system-on-chip)
 #
+# CONFIG_I2C_DESIGNWARE is not set
 # CONFIG_I2C_GPIO is not set
 CONFIG_I2C_IMX=y
 # CONFIG_I2C_OCORES is not set
@@ -668,7 +720,6 @@ CONFIG_I2C_IMX=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_MAX6875 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
@@ -719,6 +770,7 @@ CONFIG_W1=y
 #
 # CONFIG_W1_MASTER_DS2482 is not set
 CONFIG_W1_MASTER_MXC=y
+# CONFIG_W1_MASTER_DS1WM is not set
 # CONFIG_W1_MASTER_GPIO is not set
 #
@@ -753,54 +805,16 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_TPS65010 is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
+# CONFIG_MFD_T7L66XB is not set
+# CONFIG_MFD_TC6387XB is not set
 # CONFIG_MFD_TC6393XB is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
 # CONFIG_MFD_PCF50633 is not set
+# CONFIG_AB3100_CORE is not set
-#
+# CONFIG_EZX_PCAP is not set
-# Multimedia devices
+# CONFIG_MEDIA_SUPPORT is not set
-#
-#
-# Multimedia core support
-#
-CONFIG_VIDEO_DEV=y
-CONFIG_VIDEO_V4L2_COMMON=y
-CONFIG_VIDEO_ALLOW_V4L1=y
-CONFIG_VIDEO_V4L1_COMPAT=y
-# CONFIG_DVB_CORE is not set
-CONFIG_VIDEO_MEDIA=y
-#
-# Multimedia drivers
-#
-# CONFIG_MEDIA_ATTACH is not set
-CONFIG_MEDIA_TUNER=y
-# CONFIG_MEDIA_TUNER_CUSTOMISE is not set
-CONFIG_MEDIA_TUNER_SIMPLE=y
-CONFIG_MEDIA_TUNER_TDA8290=y
-CONFIG_MEDIA_TUNER_TDA9887=y
-CONFIG_MEDIA_TUNER_TEA5761=y
-CONFIG_MEDIA_TUNER_TEA5767=y
-CONFIG_MEDIA_TUNER_MT20XX=y
-CONFIG_MEDIA_TUNER_XC2028=y
-CONFIG_MEDIA_TUNER_XC5000=y
-CONFIG_MEDIA_TUNER_MC44S803=y
-CONFIG_VIDEO_V4L2=y
-CONFIG_VIDEO_V4L1=y
-CONFIG_VIDEO_CAPTURE_DRIVERS=y
-# CONFIG_VIDEO_ADV_DEBUG is not set
-# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
-CONFIG_VIDEO_HELPER_CHIPS_AUTO=y
-# CONFIG_VIDEO_VIVI is not set
-# CONFIG_VIDEO_CPIA is not set
-# CONFIG_VIDEO_SAA5246A is not set
-# CONFIG_VIDEO_SAA5249 is not set
-# CONFIG_SOC_CAMERA is not set
-# CONFIG_RADIO_ADAPTERS is not set
-# CONFIG_DAB is not set
 #
 # Graphics support
@@ -917,6 +931,7 @@ CONFIG_RTC_DRV_PCF8563=y
 # CONFIG_RTC_DRV_S35390A is not set
 # CONFIG_RTC_DRV_FM3130 is not set
 # CONFIG_RTC_DRV_RX8581 is not set
+# CONFIG_RTC_DRV_RX8025 is not set
 #
 # SPI RTC drivers
@@ -962,12 +977,15 @@ CONFIG_RTC_DRV_PCF8563=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
@@ -1021,6 +1039,12 @@ CONFIG_JFFS2_ZLIB=y
 # CONFIG_JFFS2_LZO is not set
 CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
+CONFIG_UBIFS_FS=y
+# CONFIG_UBIFS_FS_XATTR is not set
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
+CONFIG_UBIFS_FS_LZO=y
+CONFIG_UBIFS_FS_ZLIB=y
+# CONFIG_UBIFS_FS_DEBUG is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -1119,25 +1143,11 @@ CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_NOP_TRACER=y
 CONFIG_HAVE_FUNCTION_TRACER=y
 CONFIG_RING_BUFFER=y
+CONFIG_EVENT_TRACING=y
+CONFIG_CONTEXT_SWITCH_TRACER=y
 CONFIG_TRACING=y
 CONFIG_TRACING_SUPPORT=y
+# CONFIG_FTRACE is not set
-#
-# Tracers
-#
-# CONFIG_FUNCTION_TRACER is not set
-# CONFIG_IRQSOFF_TRACER is not set
-# CONFIG_PREEMPT_TRACER is not set
-# CONFIG_SCHED_TRACER is not set
-# CONFIG_CONTEXT_SWITCH_TRACER is not set
-# CONFIG_EVENT_TRACER is not set
-# CONFIG_BOOT_TRACER is not set
-# CONFIG_TRACE_BRANCH_PROFILING is not set
-# CONFIG_STACK_TRACER is not set
-# CONFIG_KMEMTRACE is not set
-# CONFIG_WORKQUEUE_TRACER is not set
-# CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_FTRACE_STARTUP_TEST is not set
 # CONFIG_DYNAMIC_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
@@ -1151,16 +1161,104 @@ CONFIG_ARM_UNWIND=y
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITYFS is not set
 # CONFIG_SECURITY_FILE_CAPABILITIES is not set
-# CONFIG_CRYPTO is not set
+CONFIG_CRYPTO=y
+#
+# Crypto core or helper
+#
+# CONFIG_CRYPTO_FIPS is not set
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+# CONFIG_CRYPTO_MANAGER is not set
+# CONFIG_CRYPTO_MANAGER2 is not set
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+# CONFIG_CRYPTO_AUTHENC is not set
+# CONFIG_CRYPTO_TEST is not set
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+#
+# Block modes
+#
+# CONFIG_CRYPTO_CBC is not set
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+#
+# Hash modes
+#
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_XCBC is not set
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_MD4 is not set
+# CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_RMD128 is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RMD256 is not set
+# CONFIG_CRYPTO_RMD320 is not set
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_WP512 is not set
+#
+# Ciphers
+#
+# CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_DES is not set
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+#
+# Compression
+#
+CONFIG_CRYPTO_DEFLATE=y
+# CONFIG_CRYPTO_ZLIB is not set
+CONFIG_CRYPTO_LZO=y
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_HW=y
 CONFIG_BINARY_PRINTF=y
 #
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_RATIONAL=y
 CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
-# CONFIG_CRC16 is not set
+CONFIG_CRC16=y
 # CONFIG_CRC_T10DIF is not set
 # CONFIG_CRC_ITU_T is not set
 CONFIG_CRC32=y
@@ -1168,6 +1266,8 @@ CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAS_DMA=y
diff --git a/arch/arm/configs/mx3_defconfig b/arch/arm/configs/mx3_defconfig
index 20ada526f6de..a4f9a2a8149c 100644
--- a/arch/arm/configs/mx3_defconfig
+++ b/arch/arm/configs/mx3_defconfig
@@ -1,15 +1,15 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc1
+# Linux kernel version: 2.6.31-rc4
-# Wed Apr  8 11:06:37 2009
+# Tue Jul 28 14:11:34 2009
 #
 CONFIG_ARM=y
+CONFIG_HAVE_PWM=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_MMU=y
-# CONFIG_NO_IOPORT is not set
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_HAVE_LATENCYTOP_SUPPORT=y
@@ -18,14 +18,13 @@ CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
-# CONFIG_ARCH_HAS_ILOG2_U32 is not set
-# CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_ARCH_MTD_XIP=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_VECTORS_BASE=0xffff0000
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 #
 # General setup
@@ -86,7 +85,12 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_AIO=y
+#
+# Performance Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
@@ -97,6 +101,11 @@ CONFIG_HAVE_OPROFILE=y
 # CONFIG_KPROBES is not set
 CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_CLK=y
+#
+# GCOV-based kernel profiling
+#
 # CONFIG_SLOW_WORK is not set
 CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_SLABINFO=y
@@ -109,7 +118,7 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
@@ -136,13 +145,14 @@ CONFIG_FREEZER=y
 # CONFIG_ARCH_VERSATILE is not set
 # CONFIG_ARCH_AT91 is not set
 # CONFIG_ARCH_CLPS711X is not set
+# CONFIG_ARCH_GEMINI is not set
 # CONFIG_ARCH_EBSA110 is not set
 # CONFIG_ARCH_EP93XX is not set
-# CONFIG_ARCH_GEMINI is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
+CONFIG_ARCH_MXC=y
+# CONFIG_ARCH_STMP3XXX is not set
 # CONFIG_ARCH_NETX is not set
 # CONFIG_ARCH_H720X is not set
-# CONFIG_ARCH_IMX is not set
 # CONFIG_ARCH_IOP13XX is not set
 # CONFIG_ARCH_IOP32X is not set
 # CONFIG_ARCH_IOP33X is not set
@@ -151,25 +161,25 @@ CONFIG_FREEZER=y
 # CONFIG_ARCH_IXP4XX is not set
 # CONFIG_ARCH_L7200 is not set
 # CONFIG_ARCH_KIRKWOOD is not set
-# CONFIG_ARCH_KS8695 is not set
-# CONFIG_ARCH_NS9XXX is not set
 # CONFIG_ARCH_LOKI is not set
 # CONFIG_ARCH_MV78XX0 is not set
-CONFIG_ARCH_MXC=y
 # CONFIG_ARCH_ORION5X is not set
+# CONFIG_ARCH_MMP is not set
+# CONFIG_ARCH_KS8695 is not set
+# CONFIG_ARCH_NS9XXX is not set
+# CONFIG_ARCH_W90X900 is not set
 # CONFIG_ARCH_PNX4008 is not set
 # CONFIG_ARCH_PXA is not set
-# CONFIG_ARCH_MMP is not set
+# CONFIG_ARCH_MSM is not set
 # CONFIG_ARCH_RPC is not set
 # CONFIG_ARCH_SA1100 is not set
 # CONFIG_ARCH_S3C2410 is not set
 # CONFIG_ARCH_S3C64XX is not set
 # CONFIG_ARCH_SHARK is not set
 # CONFIG_ARCH_LH7A40X is not set
+# CONFIG_ARCH_U300 is not set
 # CONFIG_ARCH_DAVINCI is not set
 # CONFIG_ARCH_OMAP is not set
-# CONFIG_ARCH_MSM is not set
-# CONFIG_ARCH_W90X900 is not set
 #
 # Freescale MXC Implementations
@@ -178,6 +188,7 @@ CONFIG_ARCH_MXC=y
 # CONFIG_ARCH_MX2 is not set
 CONFIG_ARCH_MX3=y
 CONFIG_ARCH_MX31=y
+CONFIG_ARCH_MX35=y
 #
 # MX3 platforms:
@@ -185,12 +196,19 @@ CONFIG_ARCH_MX31=y
 CONFIG_MACH_MX31ADS=y
 CONFIG_MACH_MX31ADS_WM1133_EV1=y
 CONFIG_MACH_PCM037=y
+CONFIG_MACH_PCM037_EET=y
 CONFIG_MACH_MX31LITE=y
 CONFIG_MACH_MX31_3DS=y
 CONFIG_MACH_MX31MOBOARD=y
+CONFIG_MACH_MX31LILLY=y
 CONFIG_MACH_QONG=y
+CONFIG_MACH_PCM043=y
+CONFIG_MACH_ARMADILLO5X0=y
+CONFIG_MACH_MX35_3DS=y
 CONFIG_MXC_IRQ_PRIOR=y
 CONFIG_MXC_PWM=y
+CONFIG_ARCH_HAS_RNGA=y
+CONFIG_ARCH_MXC_IOMUX_V3=y
 #
 # Processor Type
@@ -218,6 +236,7 @@ CONFIG_ARM_THUMB=y
 # CONFIG_CPU_BPREDICT_DISABLE is not set
 CONFIG_OUTER_CACHE=y
 CONFIG_CACHE_L2X0=y
+# CONFIG_ARM_ERRATA_411920 is not set
 CONFIG_COMMON_CLKDEV=y
 #
@@ -242,7 +261,6 @@ CONFIG_PREEMPT=y
 CONFIG_HZ=100
 CONFIG_AEABI=y
 CONFIG_OABI_COMPAT=y
-CONFIG_ARCH_FLATMEM_HAS_HOLES=y
 # CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
 # CONFIG_ARCH_SELECT_MEMORY_MODEL is not set
 # CONFIG_HIGHMEM is not set
@@ -257,10 +275,11 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_UACCESS_WITH_MEMCPY is not set
 #
 # Boot options
@@ -362,6 +381,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
@@ -465,7 +485,16 @@ CONFIG_MTD_PHYSMAP=y
 # CONFIG_MTD_DOC2000 is not set
 # CONFIG_MTD_DOC2001 is not set
 # CONFIG_MTD_DOC2001PLUS is not set
-# CONFIG_MTD_NAND is not set
+CONFIG_MTD_NAND=y
+# CONFIG_MTD_NAND_VERIFY_WRITE is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+# CONFIG_MTD_NAND_MUSEUM_IDS is not set
+# CONFIG_MTD_NAND_GPIO is not set
+CONFIG_MTD_NAND_IDS=y
+# CONFIG_MTD_NAND_DISKONCHIP is not set
+# CONFIG_MTD_NAND_NANDSIM is not set
+# CONFIG_MTD_NAND_PLATFORM is not set
+CONFIG_MTD_NAND_MXC=y
 # CONFIG_MTD_ONENAND is not set
 #
@@ -476,10 +505,30 @@ CONFIG_MTD_PHYSMAP=y
 #
 # UBI - Unsorted block images
 #
-# CONFIG_MTD_UBI is not set
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_UBI_BEB_RESERVE=1
+# CONFIG_MTD_UBI_GLUEBI is not set
+#
+# UBI debugging options
+#
+# CONFIG_MTD_UBI_DEBUG is not set
 # CONFIG_PARPORT is not set
 # CONFIG_BLK_DEV is not set
-# CONFIG_MISC_DEVICES is not set
+CONFIG_MISC_DEVICES=y
+# CONFIG_ICS932S401 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_ISL29003 is not set
+# CONFIG_C2PORT is not set
+#
+# EEPROM support
+#
+CONFIG_EEPROM_AT24=y
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_MAX6875 is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
@@ -493,7 +542,6 @@ CONFIG_HAVE_IDE=y
 # CONFIG_ATA is not set
 # CONFIG_MD is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -528,7 +576,7 @@ CONFIG_MII=y
 # CONFIG_ETHOC is not set
 # CONFIG_SMC911X is not set
 CONFIG_SMSC911X=y
-# CONFIG_DNET is not set
+CONFIG_DNET=y
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
@@ -537,8 +585,10 @@ CONFIG_SMSC911X=y
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_B44 is not set
-CONFIG_CS89x0=y
+# CONFIG_CS89x0 is not set
-CONFIG_CS89x0_NONISA_IRQ=y
+# CONFIG_KS8842 is not set
+CONFIG_FEC=y
+# CONFIG_FEC2 is not set
 # CONFIG_NETDEV_1000 is not set
 # CONFIG_NETDEV_10000 is not set
@@ -609,6 +659,7 @@ CONFIG_I2C_HELPER_AUTO=y
 #
 # I2C system bus drivers (mostly embedded / system-on-chip)
 #
+# CONFIG_I2C_DESIGNWARE is not set
 # CONFIG_I2C_GPIO is not set
 CONFIG_I2C_IMX=y
 # CONFIG_I2C_OCORES is not set
@@ -633,7 +684,6 @@ CONFIG_I2C_IMX=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_MAX6875 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
@@ -669,6 +719,7 @@ CONFIG_W1=y
 #
 # CONFIG_W1_MASTER_DS2482 is not set
 CONFIG_W1_MASTER_MXC=y
+# CONFIG_W1_MASTER_DS1WM is not set
 # CONFIG_W1_MASTER_GPIO is not set
 #
@@ -703,6 +754,8 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_TPS65010 is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
+# CONFIG_MFD_T7L66XB is not set
+# CONFIG_MFD_TC6387XB is not set
 # CONFIG_MFD_TC6393XB is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
@@ -711,10 +764,8 @@ CONFIG_MFD_WM8350_CONFIG_MODE_0=y
 CONFIG_MFD_WM8352_CONFIG_MODE_0=y
 CONFIG_MFD_WM8350_I2C=y
 # CONFIG_MFD_PCF50633 is not set
+# CONFIG_AB3100_CORE is not set
-#
+CONFIG_MEDIA_SUPPORT=y
-# Multimedia devices
-#
 #
 # Multimedia core support
@@ -758,8 +809,10 @@ CONFIG_SOC_CAMERA_MT9T031=y
 CONFIG_SOC_CAMERA_MT9V022=y
 CONFIG_SOC_CAMERA_TW9910=y
 # CONFIG_SOC_CAMERA_PLATFORM is not set
-# CONFIG_SOC_CAMERA_OV772X is not set
+CONFIG_SOC_CAMERA_OV772X=y
+CONFIG_MX3_VIDEO=y
 CONFIG_VIDEO_MX3=y
+# CONFIG_VIDEO_SH_MOBILE_CEU is not set
 # CONFIG_RADIO_ADAPTERS is not set
 # CONFIG_DAB is not set
@@ -847,8 +900,11 @@ CONFIG_REGULATOR=y
 # CONFIG_REGULATOR_DEBUG is not set
 # CONFIG_REGULATOR_FIXED_VOLTAGE is not set
 # CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set
+# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set
 # CONFIG_REGULATOR_BQ24022 is not set
+# CONFIG_REGULATOR_MAX1586 is not set
 CONFIG_REGULATOR_WM8350=y
+# CONFIG_REGULATOR_LP3971 is not set
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
@@ -861,10 +917,12 @@ CONFIG_REGULATOR_WM8350=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 # CONFIG_DNOTIFY is not set
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -921,6 +979,12 @@ CONFIG_JFFS2_ZLIB=y
 # CONFIG_JFFS2_LZO is not set
 CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
+CONFIG_UBIFS_FS=y
+# CONFIG_UBIFS_FS_XATTR is not set
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
+CONFIG_UBIFS_FS_LZO=y
+CONFIG_UBIFS_FS_ZLIB=y
+# CONFIG_UBIFS_FS_DEBUG is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -937,6 +1001,7 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+# CONFIG_NFS_V4_1 is not set
 CONFIG_ROOT_NFS=y
 # CONFIG_NFSD is not set
 CONFIG_LOCKD=y
@@ -979,22 +1044,7 @@ CONFIG_FRAME_WARN=1024
 CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_HAVE_FUNCTION_TRACER=y
 CONFIG_TRACING_SUPPORT=y
+# CONFIG_FTRACE is not set
-#
-# Tracers
-#
-# CONFIG_FUNCTION_TRACER is not set
-# CONFIG_IRQSOFF_TRACER is not set
-# CONFIG_PREEMPT_TRACER is not set
-# CONFIG_SCHED_TRACER is not set
-# CONFIG_CONTEXT_SWITCH_TRACER is not set
-# CONFIG_EVENT_TRACER is not set
-# CONFIG_BOOT_TRACER is not set
-# CONFIG_TRACE_BRANCH_PROFILING is not set
-# CONFIG_STACK_TRACER is not set
-# CONFIG_KMEMTRACE is not set
-# CONFIG_WORKQUEUE_TRACER is not set
-# CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARM_UNWIND=y
@@ -1094,9 +1144,9 @@ CONFIG_CRYPTO_DES=y
 #
 # Compression
 #
-# CONFIG_CRYPTO_DEFLATE is not set
+CONFIG_CRYPTO_DEFLATE=y
 # CONFIG_CRYPTO_ZLIB is not set
-# CONFIG_CRYPTO_LZO is not set
+CONFIG_CRYPTO_LZO=y
 #
 # Random Number Generation
@@ -1109,9 +1159,10 @@ CONFIG_CRYPTO_HW=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_RATIONAL=y
 CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
-# CONFIG_CRC16 is not set
+CONFIG_CRC16=y
 # CONFIG_CRC_T10DIF is not set
 # CONFIG_CRC_ITU_T is not set
 CONFIG_CRC32=y
@@ -1119,6 +1170,8 @@ CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAS_DMA=y
diff --git a/arch/arm/configs/omap3_evm_defconfig b/arch/arm/configs/omap3_evm_defconfig
index 28be17fbc157..d5ff4776cd0a 100644
--- a/arch/arm/configs/omap3_evm_defconfig
+++ b/arch/arm/configs/omap3_evm_defconfig
@@ -1107,7 +1107,7 @@ CONFIG_USB_ZERO=m
 CONFIG_USB_OTG_UTILS=y
 # CONFIG_USB_GPIO_VBUS is not set
 # CONFIG_ISP1301_OMAP is not set
-CONFIG_TWL4030_USB=y
+# CONFIG_TWL4030_USB is not set
 # CONFIG_NOP_USB_XCEIV is not set
 CONFIG_MMC=y
 # CONFIG_MMC_DEBUG is not set
diff --git a/arch/arm/configs/rx51_defconfig b/arch/arm/configs/rx51_defconfig
index eb2cb31825c0..f238df66efd4 100644
--- a/arch/arm/configs/rx51_defconfig
+++ b/arch/arm/configs/rx51_defconfig
@@ -282,7 +282,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="init=/sbin/preinit ubi.mtd=rootfs root=ubi0:rootfs rootfstype=ubifs rootflags=bulk_read,no_chk_data_crc rw console=ttyMTD,log console=tty0"
+CONFIG_CMDLINE="init=/sbin/preinit ubi.mtd=rootfs root=ubi0:rootfs rootfstype=ubifs rootflags=bulk_read,no_chk_data_crc rw console=ttyMTD,log console=tty0 console=ttyS2,115200n8"
 # CONFIG_XIP_KERNEL is not set
 # CONFIG_KEXEC is not set
@@ -1354,7 +1354,7 @@ CONFIG_USB_OTG_UTILS=y
 # CONFIG_USB_GPIO_VBUS is not set
 # CONFIG_ISP1301_OMAP is not set
 CONFIG_TWL4030_USB=y
-CONFIG_MMC=m
+CONFIG_MMC=y
 # CONFIG_MMC_DEBUG is not set
 # CONFIG_MMC_UNSAFE_RESUME is not set
@@ -1449,7 +1449,8 @@ CONFIG_RTC_DRV_TWL4030=m
 # on-CPU RTC drivers
 #
 # CONFIG_DMADEVICES is not set
-# CONFIG_REGULATOR is not set
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_TWL4030=y
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
index 9e07fe507029..9ed2377fe8e5 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -159,8 +159,6 @@ static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
 #else /* ARM_ARCH_6 */
-#include <asm/system.h>
 #ifdef CONFIG_SMP
 #error SMP not supported on pre-ARMv6 CPUs
 #endif
diff --git a/arch/arm/include/asm/setup.h b/arch/arm/include/asm/setup.h
index ee1304f22f94..5ccce0a9b03c 100644
--- a/arch/arm/include/asm/setup.h
+++ b/arch/arm/include/asm/setup.h
@@ -201,7 +201,8 @@ static struct tagtable __tagtable_##fn __tag = { tag, fn }
 struct membank {
        unsigned long start;
        unsigned long size;
-        int           node;
+        unsigned short node;
+        unsigned short highmem;
 };
 struct meminfo {
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 366e5097a41a..8c3de1a350b5 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -148,7 +148,7 @@ trace:
        sub r0, r0, #MCOUNT_INSN_SIZE
        mov lr, pc
        mov pc, r2
-        mov lr, r1                              @ restore lr
+        ldr lr, [fp, #-4]                       @ restore lr
        ldmia sp!, {r0-r3, pc}
 #endif /* CONFIG_DYNAMIC_FTRACE */
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 93bb4247b7ed..f6bc5d442782 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -133,7 +133,7 @@ sys_sigaction(int sig, const struct old_sigaction __user *act,
 }
 #ifdef CONFIG_CRUNCH
-static int preserve_crunch_context(struct crunch_sigframe *frame)
+static int preserve_crunch_context(struct crunch_sigframe __user *frame)
 {
        char kbuf[sizeof(*frame) + 8];
        struct crunch_sigframe *kframe;
@@ -146,7 +146,7 @@ static int preserve_crunch_context(struct crunch_sigframe *frame)
        return __copy_to_user(frame, kframe, sizeof(*frame));
 }
-static int restore_crunch_context(struct crunch_sigframe *frame)
+static int restore_crunch_context(struct crunch_sigframe __user *frame)
 {
        char kbuf[sizeof(*frame) + 8];
        struct crunch_sigframe *kframe;
diff --git a/arch/arm/mach-davinci/board-dm355-evm.c b/arch/arm/mach-davinci/board-dm355-evm.c
index 5ac2f565d860..d6ab64ccd496 100644
--- a/arch/arm/mach-davinci/board-dm355-evm.c
+++ b/arch/arm/mach-davinci/board-dm355-evm.c
@@ -37,7 +37,6 @@
 #include <mach/serial.h>
 #include <mach/nand.h>
 #include <mach/mmc.h>
-#include <mach/common.h>
 #define DAVINCI_ASYNC_EMIF_CONTROL_BASE         0x01e10000
 #define DAVINCI_ASYNC_EMIF_DATA_CE0_BASE        0x02000000
diff --git a/arch/arm/mach-davinci/board-dm355-leopard.c b/arch/arm/mach-davinci/board-dm355-leopard.c
index 28c9008df4f4..84ad5d161a87 100644
--- a/arch/arm/mach-davinci/board-dm355-leopard.c
+++ b/arch/arm/mach-davinci/board-dm355-leopard.c
@@ -36,7 +36,6 @@
 #include <mach/serial.h>
 #include <mach/nand.h>
 #include <mach/mmc.h>
-#include <mach/common.h>
 #define DAVINCI_ASYNC_EMIF_CONTROL_BASE         0x01e10000
 #define DAVINCI_ASYNC_EMIF_DATA_CE0_BASE        0x02000000
diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c
index d9d40450bdc5..56c8cd01de9a 100644
--- a/arch/arm/mach-davinci/board-dm644x-evm.c
+++ b/arch/arm/mach-davinci/board-dm644x-evm.c
@@ -45,7 +45,6 @@
 #include <mach/nand.h>
 #include <mach/mmc.h>
 #include <mach/emac.h>
-#include <mach/common.h>
 #define DM644X_EVM_PHY_MASK             (0x2)
 #define DM644X_EVM_MDIO_FREQUENCY       (2200000) /* PHY bus frequency */
diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c
index e17de6352624..8657e72debc1 100644
--- a/arch/arm/mach-davinci/board-dm646x-evm.c
+++ b/arch/arm/mach-davinci/board-dm646x-evm.c
@@ -47,7 +47,6 @@
 #include <mach/i2c.h>
 #include <mach/mmc.h>
 #include <mach/emac.h>
-#include <mach/common.h>
 #define DM646X_EVM_PHY_MASK             (0x2)
 #define DM646X_EVM_MDIO_FREQUENCY       (2200000) /* PHY bus frequency */
diff --git a/arch/arm/mach-davinci/board-sffsdr.c b/arch/arm/mach-davinci/board-sffsdr.c
index 748a8e48541e..7acdfd8ac071 100644
--- a/arch/arm/mach-davinci/board-sffsdr.c
+++ b/arch/arm/mach-davinci/board-sffsdr.c
@@ -52,7 +52,6 @@
 #include <mach/serial.h>
 #include <mach/psc.h>
 #include <mach/mux.h>
-#include <mach/common.h>
 #define SFFSDR_PHY_MASK         (0x2)
 #define SFFSDR_MDIO_FREQUENCY   (2200000) /* PHY bus frequency */
diff --git a/arch/arm/mach-ep93xx/include/mach/ts72xx.h b/arch/arm/mach-ep93xx/include/mach/ts72xx.h
index 34ddec081c40..411734422c1d 100644
--- a/arch/arm/mach-ep93xx/include/mach/ts72xx.h
+++ b/arch/arm/mach-ep93xx/include/mach/ts72xx.h
@@ -41,9 +41,6 @@
 #define TS72XX_OPTIONS2_TS9420_BOOT     0x02
-#define TS72XX_NOR_PHYS_BASE            0x60000000
-#define TS72XX_NOR2_PHYS_BASE           0x62000000
 #define TS72XX_NAND1_DATA_PHYS_BASE     0x60000000
 #define TS72XX_NAND2_DATA_PHYS_BASE     0x70000000
 #define TS72XX_NAND_DATA_VIRT_BASE      0xfebfc000
diff --git a/arch/arm/mach-ep93xx/ts72xx.c b/arch/arm/mach-ep93xx/ts72xx.c
index 7ee024d34829..aaf1371412af 100644
--- a/arch/arm/mach-ep93xx/ts72xx.c
+++ b/arch/arm/mach-ep93xx/ts72xx.c
@@ -112,13 +112,16 @@ static void __init ts72xx_map_io(void)
        }
 }
+/*************************************************************************
+ * NOR flash (TS-7200 only)
+ *************************************************************************/
 static struct physmap_flash_data ts72xx_flash_data = {
-        .width          = 1,
+        .width          = 2,
 };
 static struct resource ts72xx_flash_resource = {
-        .start          = TS72XX_NOR_PHYS_BASE,
+        .start          = EP93XX_CS6_PHYS_BASE,
-        .end            = TS72XX_NOR_PHYS_BASE + SZ_16M - 1,
+        .end            = EP93XX_CS6_PHYS_BASE + SZ_16M - 1,
        .flags          = IORESOURCE_MEM,
 };
@@ -132,6 +135,12 @@ static struct platform_device ts72xx_flash = {
        .resource       = &ts72xx_flash_resource,
 };
+static void __init ts72xx_register_flash(void)
+{
+        if (board_is_ts7200())
+                platform_device_register(&ts72xx_flash);
+}
 static unsigned char ts72xx_rtc_readbyte(unsigned long addr)
 {
        __raw_writeb(addr, TS72XX_RTC_INDEX_VIRT_BASE);
@@ -165,8 +174,7 @@ static struct ep93xx_eth_data ts72xx_eth_data = {
 static void __init ts72xx_init_machine(void)
 {
        ep93xx_init_devices();
-        if (board_is_ts7200())
+        ts72xx_register_flash();
-                platform_device_register(&ts72xx_flash);
        platform_device_register(&ts72xx_rtc_device);
        ep93xx_register_eth(&ts72xx_eth_data, 1);
diff --git a/arch/arm/mach-ixp4xx/include/mach/io.h b/arch/arm/mach-ixp4xx/include/mach/io.h
index ce63048d45eb..8a947d42a6f1 100644
--- a/arch/arm/mach-ixp4xx/include/mach/io.h
+++ b/arch/arm/mach-ixp4xx/include/mach/io.h
@@ -17,7 +17,7 @@
 #include <mach/hardware.h>
-#define IO_SPACE_LIMIT 0xffff0000
+#define IO_SPACE_LIMIT 0x0000ffff
 extern int (*ixp4xx_pci_read)(u32 addr, u32 cmd, u32* data);
 extern int ixp4xx_pci_write(u32 addr, u32 cmd, u32 data);
diff --git a/arch/arm/mach-ks8695/include/mach/hardware.h b/arch/arm/mach-ks8695/include/mach/hardware.h
index 1d640d075b7e..e0f911d9e021 100644
--- a/arch/arm/mach-ks8695/include/mach/hardware.h
+++ b/arch/arm/mach-ks8695/include/mach/hardware.h
@@ -17,6 +17,11 @@
 #include <asm/sizes.h>
 /*
+ * Clocks are derived from MCLK, which is 25Mhz
+ */
+#define KS8695_CLOCK_RATE       25000000
+/*
 * Physical RAM address.
 */
 #define KS8695_SDRAM_PA         0x00000000
diff --git a/arch/arm/mach-ks8695/include/mach/timex.h b/arch/arm/mach-ks8695/include/mach/timex.h
index 4682e350369b..10f716371bd3 100644
--- a/arch/arm/mach-ks8695/include/mach/timex.h
+++ b/arch/arm/mach-ks8695/include/mach/timex.h
@@ -14,7 +14,8 @@
 #ifndef __ASM_ARCH_TIMEX_H
 #define __ASM_ARCH_TIMEX_H
-/* timers are derived from MCLK, which is 25MHz */
+#include <mach/hardware.h>
-#define CLOCK_TICK_RATE 25000000
+#define CLOCK_TICK_RATE         KS8695_CLOCK_RATE
 #endif
diff --git a/arch/arm/mach-ks8695/pci.c b/arch/arm/mach-ks8695/pci.c
index f5ebcc0fcab9..78499667eb7b 100644
--- a/arch/arm/mach-ks8695/pci.c
+++ b/arch/arm/mach-ks8695/pci.c
@@ -245,6 +245,9 @@ static int ks8695_pci_fault(unsigned long addr, unsigned int fsr, struct pt_regs
 static void __init ks8695_pci_preinit(void)
 {
+        /* make software reset to avoid freeze if PCI bus was messed up */
+        __raw_writel(0x80000000, KS8695_PCI_VA + KS8695_PBCS);
        /* stage 1 initialization, subid, subdevice = 0x0001 */
        __raw_writel(0x00010001, KS8695_PCI_VA + KS8695_CRCSID);
diff --git a/arch/arm/mach-mx3/mx31moboard-devboard.c b/arch/arm/mach-mx3/mx31moboard-devboard.c
index 4704405165a1..b48581e7dedd 100644
--- a/arch/arm/mach-mx3/mx31moboard-devboard.c
+++ b/arch/arm/mach-mx3/mx31moboard-devboard.c
@@ -63,7 +63,7 @@ static struct imxuart_platform_data uart_pdata = {
 static int devboard_sdhc2_get_ro(struct device *dev)
 {
-        return gpio_get_value(SDHC2_WP);
+        return !gpio_get_value(SDHC2_WP);
 }
 static int devboard_sdhc2_init(struct device *dev, irq_handler_t detect_irq,
diff --git a/arch/arm/mach-mx3/mx31moboard-marxbot.c b/arch/arm/mach-mx3/mx31moboard-marxbot.c
index 641c3d6153ae..901fb0166c0e 100644
--- a/arch/arm/mach-mx3/mx31moboard-marxbot.c
+++ b/arch/arm/mach-mx3/mx31moboard-marxbot.c
@@ -67,7 +67,7 @@ static unsigned int marxbot_pins[] = {
 static int marxbot_sdhc2_get_ro(struct device *dev)
 {
-        return gpio_get_value(SDHC2_WP);
+        return !gpio_get_value(SDHC2_WP);
 }
 static int marxbot_sdhc2_init(struct device *dev, irq_handler_t detect_irq,
diff --git a/arch/arm/mach-mx3/mx31moboard.c b/arch/arm/mach-mx3/mx31moboard.c
index a17f2e411609..2a2da4739ecf 100644
--- a/arch/arm/mach-mx3/mx31moboard.c
+++ b/arch/arm/mach-mx3/mx31moboard.c
@@ -94,7 +94,7 @@ static struct imxi2c_platform_data moboard_i2c1_pdata = {
 static int moboard_sdhc1_get_ro(struct device *dev)
 {
-        return gpio_get_value(SDHC1_WP);
+        return !gpio_get_value(SDHC1_WP);
 }
 static int moboard_sdhc1_init(struct device *dev, irq_handler_t detect_irq,
diff --git a/arch/arm/mach-mx3/pcm037_eet.c b/arch/arm/mach-mx3/pcm037_eet.c
index fe52fb1bb8b7..8d386000fc40 100644
--- a/arch/arm/mach-mx3/pcm037_eet.c
+++ b/arch/arm/mach-mx3/pcm037_eet.c
@@ -24,15 +24,6 @@
 #include "devices.h"
 static unsigned int pcm037_eet_pins[] = {
-        /* SPI #1 */
-        MX31_PIN_CSPI1_MISO__MISO,
-        MX31_PIN_CSPI1_MOSI__MOSI,
-        MX31_PIN_CSPI1_SCLK__SCLK,
-        MX31_PIN_CSPI1_SPI_RDY__SPI_RDY,
-        MX31_PIN_CSPI1_SS0__SS0,
-        MX31_PIN_CSPI1_SS1__SS1,
-        MX31_PIN_CSPI1_SS2__SS2,
        /* Reserve and hardwire GPIO 57 high - S6E63D6 chipselect */
        IOMUX_MODE(MX31_PIN_KEY_COL7, IOMUX_CONFIG_GPIO),
        /* GPIO keys */
diff --git a/arch/arm/mach-omap1/mcbsp.c b/arch/arm/mach-omap1/mcbsp.c
index a2d7814896be..505d98cfe508 100644
--- a/arch/arm/mach-omap1/mcbsp.c
+++ b/arch/arm/mach-omap1/mcbsp.c
@@ -19,7 +19,6 @@
 #include <mach/irqs.h>
 #include <mach/dma.h>
-#include <mach/irqs.h>
 #include <mach/mux.h>
 #include <mach/cpu.h>
 #include <mach/mcbsp.h>
diff --git a/arch/arm/mach-omap2/board-2430sdp.c b/arch/arm/mach-omap2/board-2430sdp.c
index 9c3fdcdf76c3..8ec2a132904d 100644
--- a/arch/arm/mach-omap2/board-2430sdp.c
+++ b/arch/arm/mach-omap2/board-2430sdp.c
@@ -141,7 +141,7 @@ static inline void board_smc91x_init(void)
 static void __init omap_2430sdp_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
        omap_init_irq();
        omap_gpio_init();
 }
diff --git a/arch/arm/mach-omap2/board-3430sdp.c b/arch/arm/mach-omap2/board-3430sdp.c
index 496a90e4ea7a..ac262cd74503 100644
--- a/arch/arm/mach-omap2/board-3430sdp.c
+++ b/arch/arm/mach-omap2/board-3430sdp.c
@@ -169,7 +169,7 @@ static struct platform_device *sdp3430_devices[] __initdata = {
 static void __init omap_3430sdp_init_irq(void)
 {
-        omap2_init_common_hw(hyb18m512160af6_sdrc_params);
+        omap2_init_common_hw(hyb18m512160af6_sdrc_params, NULL);
        omap_init_irq();
        omap_gpio_init();
 }
diff --git a/arch/arm/mach-omap2/board-4430sdp.c b/arch/arm/mach-omap2/board-4430sdp.c
index 57e477bd89c6..b0c7402248f7 100644
--- a/arch/arm/mach-omap2/board-4430sdp.c
+++ b/arch/arm/mach-omap2/board-4430sdp.c
@@ -59,7 +59,7 @@ static void __init gic_init_irq(void)
 static void __init omap_4430sdp_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
 #ifdef CONFIG_OMAP_32K_TIMER
        omap2_gp_clockevent_set_gptimer(1);
 #endif
diff --git a/arch/arm/mach-omap2/board-apollon.c b/arch/arm/mach-omap2/board-apollon.c
index 06dfba888b0c..dcfc20d03894 100644
--- a/arch/arm/mach-omap2/board-apollon.c
+++ b/arch/arm/mach-omap2/board-apollon.c
@@ -250,7 +250,7 @@ out:
 static void __init omap_apollon_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
        omap_init_irq();
        omap_gpio_init();
        apollon_init_smc91x();
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 3492162a65c3..fd00aa03690c 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -33,7 +33,7 @@
 static void __init omap_generic_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
        omap_init_irq();
 }
diff --git a/arch/arm/mach-omap2/board-h4.c b/arch/arm/mach-omap2/board-h4.c
index e7d017cdc438..7b1d61d5bb2c 100644
--- a/arch/arm/mach-omap2/board-h4.c
+++ b/arch/arm/mach-omap2/board-h4.c
@@ -270,7 +270,7 @@ static void __init h4_init_flash(void)
 static void __init omap_h4_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
        omap_init_irq();
        omap_gpio_init();
        h4_init_flash();
diff --git a/arch/arm/mach-omap2/board-ldp.c b/arch/arm/mach-omap2/board-ldp.c
index d8bc0a7dcb8d..ea383f88cb1b 100644
--- a/arch/arm/mach-omap2/board-ldp.c
+++ b/arch/arm/mach-omap2/board-ldp.c
@@ -270,7 +270,7 @@ static inline void __init ldp_init_smsc911x(void)
 static void __init omap_ldp_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
        omap_init_irq();
        omap_gpio_init();
        ldp_init_smsc911x();
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 991ac9c38032..e00ba128cece 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -282,7 +282,8 @@ static int __init omap3_beagle_i2c_init(void)
 static void __init omap3_beagle_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params,
+                             mt46h32m32lf6_sdrc_params);
        omap_init_irq();
 #ifdef CONFIG_OMAP_32K_TIMER
        omap2_gp_clockevent_set_gptimer(12);
@@ -408,6 +409,10 @@ static void __init omap3_beagle_init(void)
        usb_musb_init();
        omap3beagle_flash_init();
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
 }
 static void __init omap3_beagle_map_io(void)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index d3cc145814d0..c4b144647dc5 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -25,6 +25,7 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/ads7846.h>
 #include <linux/i2c/twl4030.h>
+#include <linux/usb/otg.h>
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -279,7 +280,7 @@ struct spi_board_info omap3evm_spi_board_info[] = {
 static void __init omap3_evm_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params, NULL);
        omap_init_irq();
        omap_gpio_init();
        omap3evm_init_smc911x();
@@ -307,6 +308,10 @@ static void __init omap3_evm_init(void)
                                ARRAY_SIZE(omap3evm_spi_board_info));
        omap_serial_init();
+#ifdef CONFIG_NOP_USB_XCEIV
+        /* OMAP3EVM uses ISP1504 phy and so register nop transceiver */
+        usb_nop_xceiv_register();
+#endif
        usb_musb_init();
        ads7846_dev_init();
 }
diff --git a/arch/arm/mach-omap2/board-omap3pandora.c b/arch/arm/mach-omap2/board-omap3pandora.c
index e32aa23ce962..864ee3d021f7 100644
--- a/arch/arm/mach-omap2/board-omap3pandora.c
+++ b/arch/arm/mach-omap2/board-omap3pandora.c
@@ -40,6 +40,7 @@
 #include <mach/mcspi.h>
 #include <mach/usb.h>
 #include <mach/keypad.h>
+#include <mach/mux.h>
 #include "sdram-micron-mt46h32m32lf-6.h"
 #include "mmc-twl4030.h"
@@ -310,7 +311,8 @@ static int __init omap3pandora_i2c_init(void)
 static void __init omap3pandora_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params,
+                             mt46h32m32lf6_sdrc_params);
        omap_init_irq();
        omap_gpio_init();
 }
@@ -397,6 +399,10 @@ static void __init omap3pandora_init(void)
        omap3pandora_ads7846_init();
        pandora_keys_gpio_init();
        usb_musb_init();
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
 }
 static void __init omap3pandora_map_io(void)
diff --git a/arch/arm/mach-omap2/board-overo.c b/arch/arm/mach-omap2/board-overo.c
index dff5528fbfb5..6bce23004aa4 100644
--- a/arch/arm/mach-omap2/board-overo.c
+++ b/arch/arm/mach-omap2/board-overo.c
@@ -44,6 +44,7 @@
 #include <mach/gpmc.h>
 #include <mach/hardware.h>
 #include <mach/nand.h>
+#include <mach/mux.h>
 #include <mach/usb.h>
 #include "sdram-micron-mt46h32m32lf-6.h"
@@ -51,6 +52,7 @@
 #define OVERO_GPIO_BT_XGATE     15
 #define OVERO_GPIO_W2W_NRESET   16
+#define OVERO_GPIO_PENDOWN      114
 #define OVERO_GPIO_BT_NRESET    164
 #define OVERO_GPIO_USBH_CPEN    168
 #define OVERO_GPIO_USBH_NRESET  183
@@ -146,7 +148,7 @@ static struct platform_device overo_smsc911x_device = {
        .name           = "smsc911x",
        .id             = -1,
        .num_resources  = ARRAY_SIZE(overo_smsc911x_resources),
-        .resource       = &overo_smsc911x_resources,
+        .resource       = overo_smsc911x_resources,
        .dev            = {
                .platform_data = &overo_smsc911x_config,
        },
@@ -360,7 +362,8 @@ static int __init overo_i2c_init(void)
 static void __init overo_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params,
+                             mt46h32m32lf6_sdrc_params);
        omap_init_irq();
        omap_gpio_init();
 }
@@ -395,6 +398,10 @@ static void __init overo_init(void)
        overo_ads7846_init();
        overo_init_smsc911x();
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
        if ((gpio_request(OVERO_GPIO_W2W_NRESET,
                          "OVERO_GPIO_W2W_NRESET") == 0) &&
            (gpio_direction_output(OVERO_GPIO_W2W_NRESET, 1) == 0)) {
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index 9a0bf6744a05..56d931a425f7 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -278,6 +278,10 @@ static struct twl4030_gpio_platform_data rx51_gpio_data = {
        .setup                  = rx51_twlgpio_setup,
 };
+static struct twl4030_usb_data rx51_usb_data = {
+        .usb_mode               = T2_USB_MODE_ULPI,
+};
 static struct twl4030_platform_data rx51_twldata = {
        .irq_base               = TWL4030_IRQ_BASE,
        .irq_end                = TWL4030_IRQ_END,
@@ -286,6 +290,7 @@ static struct twl4030_platform_data rx51_twldata = {
        .gpio                   = &rx51_gpio_data,
        .keypad                 = &rx51_kp_data,
        .madc                   = &rx51_madc_data,
+        .usb                    = &rx51_usb_data,
        .vaux1                  = &rx51_vaux1,
        .vaux2                  = &rx51_vaux2,
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index 374ff63c3eb2..1c9e07fe8266 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -61,7 +61,7 @@ static struct omap_board_config_kernel rx51_config[] = {
 static void __init rx51_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
        omap_init_irq();
        omap_gpio_init();
 }
@@ -75,6 +75,10 @@ static void __init rx51_init(void)
        omap_serial_init();
        usb_musb_init();
        rx51_peripherals_init();
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
 }
 static void __init rx51_map_io(void)
diff --git a/arch/arm/mach-omap2/board-zoom2.c b/arch/arm/mach-omap2/board-zoom2.c
index bcc0f7632dea..427b7b8b1237 100644
--- a/arch/arm/mach-omap2/board-zoom2.c
+++ b/arch/arm/mach-omap2/board-zoom2.c
@@ -25,7 +25,7 @@
 static void __init omap_zoom2_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
        omap_init_irq();
        omap_gpio_init();
 }
diff --git a/arch/arm/mach-omap2/clock.c b/arch/arm/mach-omap2/clock.c
index b0665f161c03..456e2ad5f621 100644
--- a/arch/arm/mach-omap2/clock.c
+++ b/arch/arm/mach-omap2/clock.c
@@ -27,6 +27,7 @@
 #include <mach/clock.h>
 #include <mach/clockdomain.h>
 #include <mach/cpu.h>
+#include <mach/prcm.h>
 #include <asm/div64.h>
 #include <mach/sdrc.h>
@@ -38,8 +39,6 @@
 #include "cm-regbits-24xx.h"
 #include "cm-regbits-34xx.h"
-#define MAX_CLOCK_ENABLE_WAIT           100000
 /* DPLL rate rounding: minimum DPLL multiplier, divider values */
 #define DPLL_MIN_MULTIPLIER             1
 #define DPLL_MIN_DIVIDER                1
@@ -274,83 +273,97 @@ unsigned long omap2_fixed_divisor_recalc(struct clk *clk)
 }
 /**
- * omap2_wait_clock_ready - wait for clock to enable
+ * omap2_clk_dflt_find_companion - find companion clock to @clk
- * @reg: physical address of clock IDLEST register
+ * @clk: struct clk * to find the companion clock of
- * @mask: value to mask against to determine if the clock is active
+ * @other_reg: void __iomem ** to return the companion clock CM_*CLKEN va in
- * @name: name of the clock (for printk)
+ * @other_bit: u8 ** to return the companion clock bit shift in
+ *
+ * Note: We don't need special code here for INVERT_ENABLE for the
+ * time being since INVERT_ENABLE only applies to clocks enabled by
+ * CM_CLKEN_PLL
 *
- * Returns 1 if the clock enabled in time, or 0 if it failed to enable
+ * Convert CM_ICLKEN* <-> CM_FCLKEN*.  This conversion assumes it's
- * in roughly MAX_CLOCK_ENABLE_WAIT microseconds.
+ * just a matter of XORing the bits.
+ *
+ * Some clocks don't have companion clocks.  For example, modules with
+ * only an interface clock (such as MAILBOXES) don't have a companion
+ * clock.  Right now, this code relies on the hardware exporting a bit
+ * in the correct companion register that indicates that the
+ * nonexistent 'companion clock' is active.  Future patches will
+ * associate this type of code with per-module data structures to
+ * avoid this issue, and remove the casts.  No return value.
 */
-int omap2_wait_clock_ready(void __iomem *reg, u32 mask, const char *name)
+void omap2_clk_dflt_find_companion(struct clk *clk, void __iomem **other_reg,
+                                   u8 *other_bit)
 {
-        int i = 0;
+        u32 r;
-        int ena = 0;
        /*
-         * 24xx uses 0 to indicate not ready, and 1 to indicate ready.
+         * Convert CM_ICLKEN* <-> CM_FCLKEN*.  This conversion assumes
-         * 34xx reverses this, just to keep us on our toes
+         * it's just a matter of XORing the bits.
         */
-        if (cpu_mask & (RATE_IN_242X | RATE_IN_243X))
+        r = ((__force u32)clk->enable_reg ^ (CM_FCLKEN ^ CM_ICLKEN));
-                ena = mask;
-        else if (cpu_mask & RATE_IN_343X)
-                ena = 0;
-        /* Wait for lock */
-        while (((__raw_readl(reg) & mask) != ena) &&
-               (i++ < MAX_CLOCK_ENABLE_WAIT)) {
-                udelay(1);
-        }
-        if (i <= MAX_CLOCK_ENABLE_WAIT)
-                pr_debug("Clock %s stable after %d loops\n", name, i);
-        else
-                printk(KERN_ERR "Clock %s didn't enable in %d tries\n",
-                       name, MAX_CLOCK_ENABLE_WAIT);
-        return (i < MAX_CLOCK_ENABLE_WAIT) ? 1 : 0;
-};
+        *other_reg = (__force void __iomem *)r;
+        *other_bit = clk->enable_bit;
+}
-/*
+/**
- * Note: We don't need special code here for INVERT_ENABLE
+ * omap2_clk_dflt_find_idlest - find CM_IDLEST reg va, bit shift for @clk
- * for the time being since INVERT_ENABLE only applies to clocks enabled by
+ * @clk: struct clk * to find IDLEST info for
- * CM_CLKEN_PLL
+ * @idlest_reg: void __iomem ** to return the CM_IDLEST va in
+ * @idlest_bit: u8 ** to return the CM_IDLEST bit shift in
+ *
+ * Return the CM_IDLEST register address and bit shift corresponding
+ * to the module that "owns" this clock.  This default code assumes
+ * that the CM_IDLEST bit shift is the CM_*CLKEN bit shift, and that
+ * the IDLEST register address ID corresponds to the CM_*CLKEN
+ * register address ID (e.g., that CM_FCLKEN2 corresponds to
+ * CM_IDLEST2).  This is not true for all modules.  No return value.
 */
-static void omap2_clk_wait_ready(struct clk *clk)
+void omap2_clk_dflt_find_idlest(struct clk *clk, void __iomem **idlest_reg,
+                                u8 *idlest_bit)
 {
-        void __iomem *reg, *other_reg, *st_reg;
+        u32 r;
-        u32 bit;
-        /*
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
-         * REVISIT: This code is pretty ugly.  It would be nice to generalize
+        *idlest_reg = (__force void __iomem *)r;
-         * it and pull it into struct clk itself somehow.
+        *idlest_bit = clk->enable_bit;
-         */
+}
-        reg = clk->enable_reg;
-        /*
+/**
-         * Convert CM_ICLKEN* <-> CM_FCLKEN*.  This conversion assumes
+ * omap2_module_wait_ready - wait for an OMAP module to leave IDLE
-         * it's just a matter of XORing the bits.
+ * @clk: struct clk * belonging to the module
-         */
+ *
-        other_reg = (void __iomem *)((u32)reg ^ (CM_FCLKEN ^ CM_ICLKEN));
+ * If the necessary clocks for the OMAP hardware IP block that
+ * corresponds to clock @clk are enabled, then wait for the module to
+ * indicate readiness (i.e., to leave IDLE).  This code does not
+ * belong in the clock code and will be moved in the medium term to
+ * module-dependent code.  No return value.
+ */
+static void omap2_module_wait_ready(struct clk *clk)
+{
+        void __iomem *companion_reg, *idlest_reg;
+        u8 other_bit, idlest_bit;
+        /* Not all modules have multiple clocks that their IDLEST depends on */
+        if (clk->ops->find_companion) {
+                clk->ops->find_companion(clk, &companion_reg, &other_bit);
+                if (!(__raw_readl(companion_reg) & (1 << other_bit)))
+                        return;
+        }
-        /* Check if both functional and interface clocks
+        clk->ops->find_idlest(clk, &idlest_reg, &idlest_bit);
-         * are running. */
-        bit = 1 << clk->enable_bit;
-        if (!(__raw_readl(other_reg) & bit))
-                return;
-        st_reg = (void __iomem *)(((u32)other_reg & ~0xf0) | 0x20); /* CM_IDLEST* */
-        omap2_wait_clock_ready(st_reg, bit, clk->name);
+        omap2_cm_wait_idlest(idlest_reg, (1 << idlest_bit), clk->name);
 }
-static int omap2_dflt_clk_enable(struct clk *clk)
+int omap2_dflt_clk_enable(struct clk *clk)
 {
        u32 v;
        if (unlikely(clk->enable_reg == NULL)) {
-                printk(KERN_ERR "clock.c: Enable for %s without enable code\n",
+                pr_err("clock.c: Enable for %s without enable code\n",
                       clk->name);
                return 0; /* REVISIT: -EINVAL */
        }
@@ -363,26 +376,13 @@ static int omap2_dflt_clk_enable(struct clk *clk)
        __raw_writel(v, clk->enable_reg);
        v = __raw_readl(clk->enable_reg); /* OCP barrier */
-        return 0;
+        if (clk->ops->find_idlest)
-}
+                omap2_module_wait_ready(clk);
-static int omap2_dflt_clk_enable_wait(struct clk *clk)
+        return 0;
-{
-        int ret;
-        if (!clk->enable_reg) {
-                printk(KERN_ERR "clock.c: Enable for %s without enable code\n",
-                       clk->name);
-                return 0; /* REVISIT: -EINVAL */
-        }
-        ret = omap2_dflt_clk_enable(clk);
-        if (ret == 0)
-                omap2_clk_wait_ready(clk);
-        return ret;
 }
-static void omap2_dflt_clk_disable(struct clk *clk)
+void omap2_dflt_clk_disable(struct clk *clk)
 {
        u32 v;
@@ -406,8 +406,10 @@ static void omap2_dflt_clk_disable(struct clk *clk)
 }
 const struct clkops clkops_omap2_dflt_wait = {
-        .enable         = omap2_dflt_clk_enable_wait,
+        .enable         = omap2_dflt_clk_enable,
        .disable        = omap2_dflt_clk_disable,
+        .find_companion = omap2_clk_dflt_find_companion,
+        .find_idlest    = omap2_clk_dflt_find_idlest,
 };
 const struct clkops clkops_omap2_dflt = {
diff --git a/arch/arm/mach-omap2/clock.h b/arch/arm/mach-omap2/clock.h
index 2679ddfa6424..9ae7540f8af2 100644
--- a/arch/arm/mach-omap2/clock.h
+++ b/arch/arm/mach-omap2/clock.h
@@ -65,6 +65,12 @@ int omap2_clksel_set_rate(struct clk *clk, unsigned long rate);
 u32 omap2_get_dpll_rate(struct clk *clk);
 int omap2_wait_clock_ready(void __iomem *reg, u32 cval, const char *name);
 void omap2_clk_prepare_for_reboot(void);
+int omap2_dflt_clk_enable(struct clk *clk);
+void omap2_dflt_clk_disable(struct clk *clk);
+void omap2_clk_dflt_find_companion(struct clk *clk, void __iomem **other_reg,
+                                   u8 *other_bit);
+void omap2_clk_dflt_find_idlest(struct clk *clk, void __iomem **idlest_reg,
+                                u8 *idlest_bit);
 extern const struct clkops clkops_omap2_dflt_wait;
 extern const struct clkops clkops_omap2_dflt;
diff --git a/arch/arm/mach-omap2/clock24xx.c b/arch/arm/mach-omap2/clock24xx.c
index 44de0271fc2f..bc5d3ac66611 100644
--- a/arch/arm/mach-omap2/clock24xx.c
+++ b/arch/arm/mach-omap2/clock24xx.c
@@ -30,6 +30,7 @@
 #include <mach/clock.h>
 #include <mach/sram.h>
+#include <mach/prcm.h>
 #include <asm/div64.h>
 #include <asm/clkdev.h>
@@ -43,6 +44,18 @@
 static const struct clkops clkops_oscck;
 static const struct clkops clkops_fixed;
+static void omap2430_clk_i2chs_find_idlest(struct clk *clk,
+                                           void __iomem **idlest_reg,
+                                           u8 *idlest_bit);
+/* 2430 I2CHS has non-standard IDLEST register */
+static const struct clkops clkops_omap2430_i2chs_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap2430_clk_i2chs_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
 #include "clock24xx.h"
 struct omap_clk {
@@ -240,6 +253,26 @@ static void __iomem *prcm_clksrc_ctrl;
 *-------------------------------------------------------------------------*/
 /**
+ * omap2430_clk_i2chs_find_idlest - return CM_IDLEST info for 2430 I2CHS
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * OMAP2430 I2CHS CM_IDLEST bits are in CM_IDLEST1_CORE, but the
+ * CM_*CLKEN bits are in CM_{I,F}CLKEN2_CORE.  This custom function
+ * passes back the correct CM_IDLEST register address for I2CHS
+ * modules.  No return value.
+ */
+static void omap2430_clk_i2chs_find_idlest(struct clk *clk,
+                                           void __iomem **idlest_reg,
+                                           u8 *idlest_bit)
+{
+        *idlest_reg = OMAP_CM_REGADDR(CORE_MOD, CM_IDLEST);
+        *idlest_bit = clk->enable_bit;
+}
+/**
 * omap2xxx_clk_get_core_rate - return the CORE_CLK rate
 * @clk: pointer to the combined dpll_ck + core_ck (currently "dpll_ck")
 *
@@ -325,8 +358,8 @@ static int omap2_clk_fixed_enable(struct clk *clk)
        else if (clk == &apll54_ck)
                cval = OMAP24XX_ST_54M_APLL;
-        omap2_wait_clock_ready(OMAP_CM_REGADDR(PLL_MOD, CM_IDLEST), cval,
+        omap2_cm_wait_idlest(OMAP_CM_REGADDR(PLL_MOD, CM_IDLEST), cval,
-                            clk->name);
+                             clk->name);
        /*
         * REVISIT: Should we return an error code if omap2_wait_clock_ready()
diff --git a/arch/arm/mach-omap2/clock24xx.h b/arch/arm/mach-omap2/clock24xx.h
index 458f00cdcbea..d19cf7a7d8db 100644
--- a/arch/arm/mach-omap2/clock24xx.h
+++ b/arch/arm/mach-omap2/clock24xx.h
@@ -2337,7 +2337,7 @@ static struct clk i2c2_fck = {
 static struct clk i2chs2_fck = {
        .name           = "i2c_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2430_i2chs_wait,
        .id             = 2,
        .parent         = &func_96m_ck,
        .clkdm_name     = "core_l4_clkdm",
@@ -2370,7 +2370,7 @@ static struct clk i2c1_fck = {
 static struct clk i2chs1_fck = {
        .name           = "i2c_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2430_i2chs_wait,
        .id             = 1,
        .parent         = &func_96m_ck,
        .clkdm_name     = "core_l4_clkdm",
diff --git a/arch/arm/mach-omap2/clock34xx.c b/arch/arm/mach-omap2/clock34xx.c
index 045da923e75b..cd7819cc0c9e 100644
--- a/arch/arm/mach-omap2/clock34xx.c
+++ b/arch/arm/mach-omap2/clock34xx.c
@@ -2,7 +2,7 @@
 * OMAP3-specific clock framework functions
 *
 * Copyright (C) 2007-2008 Texas Instruments, Inc.
- * Copyright (C) 2007-2008 Nokia Corporation
+ * Copyright (C) 2007-2009 Nokia Corporation
 *
 * Written by Paul Walmsley
 * Testing and integration fixes by Jouni Högander
@@ -41,6 +41,37 @@
 static const struct clkops clkops_noncore_dpll_ops;
+static void omap3430es2_clk_ssi_find_idlest(struct clk *clk,
+                                            void __iomem **idlest_reg,
+                                            u8 *idlest_bit);
+static void omap3430es2_clk_hsotgusb_find_idlest(struct clk *clk,
+                                            void __iomem **idlest_reg,
+                                            u8 *idlest_bit);
+static void omap3430es2_clk_dss_usbhost_find_idlest(struct clk *clk,
+                                                    void __iomem **idlest_reg,
+                                                    u8 *idlest_bit);
+static const struct clkops clkops_omap3430es2_ssi_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap3430es2_clk_ssi_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
+static const struct clkops clkops_omap3430es2_hsotgusb_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap3430es2_clk_hsotgusb_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
+static const struct clkops clkops_omap3430es2_dss_usbhost_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap3430es2_clk_dss_usbhost_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
 #include "clock34xx.h"
 struct omap_clk {
@@ -157,10 +188,13 @@ static struct omap_clk omap34xx_clks[] = {
        CLK(NULL,       "fshostusb_fck", &fshostusb_fck, CK_3430ES1),
        CLK(NULL,       "core_12m_fck", &core_12m_fck,  CK_343X),
        CLK("omap_hdq.0", "fck",        &hdq_fck,       CK_343X),
-        CLK(NULL,       "ssi_ssr_fck",  &ssi_ssr_fck,   CK_343X),
+        CLK(NULL,       "ssi_ssr_fck",  &ssi_ssr_fck_3430es1,   CK_3430ES1),
-        CLK(NULL,       "ssi_sst_fck",  &ssi_sst_fck,   CK_343X),
+        CLK(NULL,       "ssi_ssr_fck",  &ssi_ssr_fck_3430es2,   CK_3430ES2),
+        CLK(NULL,       "ssi_sst_fck",  &ssi_sst_fck_3430es1,   CK_3430ES1),
+        CLK(NULL,       "ssi_sst_fck",  &ssi_sst_fck_3430es2,   CK_3430ES2),
        CLK(NULL,       "core_l3_ick",  &core_l3_ick,   CK_343X),
-        CLK("musb_hdrc",        "ick",  &hsotgusb_ick,  CK_343X),
+        CLK("musb_hdrc",        "ick",  &hsotgusb_ick_3430es1,  CK_3430ES1),
+        CLK("musb_hdrc",        "ick",  &hsotgusb_ick_3430es2,  CK_3430ES2),
        CLK(NULL,       "sdrc_ick",     &sdrc_ick,      CK_343X),
        CLK(NULL,       "gpmc_fck",     &gpmc_fck,      CK_343X),
        CLK(NULL,       "security_l3_ick", &security_l3_ick, CK_343X),
@@ -193,18 +227,21 @@ static struct omap_clk omap34xx_clks[] = {
        CLK(NULL,       "mailboxes_ick", &mailboxes_ick, CK_343X),
        CLK(NULL,       "omapctrl_ick", &omapctrl_ick,  CK_343X),
        CLK(NULL,       "ssi_l4_ick",   &ssi_l4_ick,    CK_343X),
-        CLK(NULL,       "ssi_ick",      &ssi_ick,       CK_343X),
+        CLK(NULL,       "ssi_ick",      &ssi_ick_3430es1,       CK_3430ES1),
+        CLK(NULL,       "ssi_ick",      &ssi_ick_3430es2,       CK_3430ES2),
        CLK(NULL,       "usb_l4_ick",   &usb_l4_ick,    CK_3430ES1),
        CLK(NULL,       "security_l4_ick2", &security_l4_ick2, CK_343X),
        CLK(NULL,       "aes1_ick",     &aes1_ick,      CK_343X),
        CLK("omap_rng", "ick",          &rng_ick,       CK_343X),
        CLK(NULL,       "sha11_ick",    &sha11_ick,     CK_343X),
        CLK(NULL,       "des1_ick",     &des1_ick,      CK_343X),
-        CLK("omapfb",   "dss1_fck",     &dss1_alwon_fck, CK_343X),
+        CLK("omapfb",   "dss1_fck",     &dss1_alwon_fck_3430es1, CK_3430ES1),
+        CLK("omapfb",   "dss1_fck",     &dss1_alwon_fck_3430es2, CK_3430ES2),
        CLK("omapfb",   "tv_fck",       &dss_tv_fck,    CK_343X),
        CLK("omapfb",   "video_fck",    &dss_96m_fck,   CK_343X),
        CLK("omapfb",   "dss2_fck",     &dss2_alwon_fck, CK_343X),
-        CLK("omapfb",   "ick",          &dss_ick,       CK_343X),
+        CLK("omapfb",   "ick",          &dss_ick_3430es1,       CK_3430ES1),
+        CLK("omapfb",   "ick",          &dss_ick_3430es2,       CK_3430ES2),
        CLK(NULL,       "cam_mclk",     &cam_mclk,      CK_343X),
        CLK(NULL,       "cam_ick",      &cam_ick,       CK_343X),
        CLK(NULL,       "csi2_96m_fck", &csi2_96m_fck,  CK_343X),
@@ -301,6 +338,73 @@ static struct omap_clk omap34xx_clks[] = {
 #define SDRC_MPURATE_LOOPS              96
 /**
+ * omap3430es2_clk_ssi_find_idlest - return CM_IDLEST info for SSI
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * The OMAP3430ES2 SSI target CM_IDLEST bit is at a different shift
+ * from the CM_{I,F}CLKEN bit.  Pass back the correct info via
+ * @idlest_reg and @idlest_bit.  No return value.
+ */
+static void omap3430es2_clk_ssi_find_idlest(struct clk *clk,
+                                            void __iomem **idlest_reg,
+                                            u8 *idlest_bit)
+{
+        u32 r;
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
+        *idlest_reg = (__force void __iomem *)r;
+        *idlest_bit = OMAP3430ES2_ST_SSI_IDLE_SHIFT;
+}
+/**
+ * omap3430es2_clk_dss_usbhost_find_idlest - CM_IDLEST info for DSS, USBHOST
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * Some OMAP modules on OMAP3 ES2+ chips have both initiator and
+ * target IDLEST bits.  For our purposes, we are concerned with the
+ * target IDLEST bits, which exist at a different bit position than
+ * the *CLKEN bit position for these modules (DSS and USBHOST) (The
+ * default find_idlest code assumes that they are at the same
+ * position.)  No return value.
+ */
+static void omap3430es2_clk_dss_usbhost_find_idlest(struct clk *clk,
+                                                    void __iomem **idlest_reg,
+                                                    u8 *idlest_bit)
+{
+        u32 r;
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
+        *idlest_reg = (__force void __iomem *)r;
+        /* USBHOST_IDLE has same shift */
+        *idlest_bit = OMAP3430ES2_ST_DSS_IDLE_SHIFT;
+}
+/**
+ * omap3430es2_clk_hsotgusb_find_idlest - return CM_IDLEST info for HSOTGUSB
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * The OMAP3430ES2 HSOTGUSB target CM_IDLEST bit is at a different
+ * shift from the CM_{I,F}CLKEN bit.  Pass back the correct info via
+ * @idlest_reg and @idlest_bit.  No return value.
+ */
+static void omap3430es2_clk_hsotgusb_find_idlest(struct clk *clk,
+                                                 void __iomem **idlest_reg,
+                                                 u8 *idlest_bit)
+{
+        u32 r;
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
+        *idlest_reg = (__force void __iomem *)r;
+        *idlest_bit = OMAP3430ES2_ST_HSOTGUSB_IDLE_SHIFT;
+}
+/**
 * omap3_dpll_recalc - recalculate DPLL rate
 * @clk: DPLL struct clk
 *
@@ -725,7 +829,9 @@ static int omap3_core_dpll_m2_set_rate(struct clk *clk, unsigned long rate)
        u32 unlock_dll = 0;
        u32 c;
        unsigned long validrate, sdrcrate, mpurate;
-        struct omap_sdrc_params *sp;
+        struct omap_sdrc_params *sdrc_cs0;
+        struct omap_sdrc_params *sdrc_cs1;
+        int ret;
        if (!clk || !rate)
                return -EINVAL;
@@ -743,8 +849,8 @@ static int omap3_core_dpll_m2_set_rate(struct clk *clk, unsigned long rate)
        else
                sdrcrate >>= ((clk->rate / rate) >> 1);
-        sp = omap2_sdrc_get_params(sdrcrate);
+        ret = omap2_sdrc_get_params(sdrcrate, &sdrc_cs0, &sdrc_cs1);
-        if (!sp)
+        if (ret)
                return -EINVAL;
        if (sdrcrate < MIN_SDRC_DLL_LOCK_FREQ) {
@@ -765,12 +871,29 @@ static int omap3_core_dpll_m2_set_rate(struct clk *clk, unsigned long rate)
        pr_debug("clock: changing CORE DPLL rate from %lu to %lu\n", clk->rate,
                 validrate);
-        pr_debug("clock: SDRC timing params used: %08x %08x %08x\n",
+        pr_debug("clock: SDRC CS0 timing params used:"
-                 sp->rfr_ctrl, sp->actim_ctrla, sp->actim_ctrlb);
+                 " RFR %08x CTRLA %08x CTRLB %08x MR %08x\n",
+                 sdrc_cs0->rfr_ctrl, sdrc_cs0->actim_ctrla,
-        omap3_configure_core_dpll(sp->rfr_ctrl, sp->actim_ctrla,
+                 sdrc_cs0->actim_ctrlb, sdrc_cs0->mr);
-                                  sp->actim_ctrlb, new_div, unlock_dll, c,
+        if (sdrc_cs1)
-                                  sp->mr, rate > clk->rate);
+                pr_debug("clock: SDRC CS1 timing params used: "
+                 " RFR %08x CTRLA %08x CTRLB %08x MR %08x\n",
+                 sdrc_cs1->rfr_ctrl, sdrc_cs1->actim_ctrla,
+                 sdrc_cs1->actim_ctrlb, sdrc_cs1->mr);
+        if (sdrc_cs1)
+                omap3_configure_core_dpll(
+                                  new_div, unlock_dll, c, rate > clk->rate,
+                                  sdrc_cs0->rfr_ctrl, sdrc_cs0->actim_ctrla,
+                                  sdrc_cs0->actim_ctrlb, sdrc_cs0->mr,
+                                  sdrc_cs1->rfr_ctrl, sdrc_cs1->actim_ctrla,
+                                  sdrc_cs1->actim_ctrlb, sdrc_cs1->mr);
+        else
+                omap3_configure_core_dpll(
+                                  new_div, unlock_dll, c, rate > clk->rate,
+                                  sdrc_cs0->rfr_ctrl, sdrc_cs0->actim_ctrla,
+                                  sdrc_cs0->actim_ctrlb, sdrc_cs0->mr,
+                                  0, 0, 0, 0);
        return 0;
 }
diff --git a/arch/arm/mach-omap2/clock34xx.h b/arch/arm/mach-omap2/clock34xx.h
index e433aec4efdd..57cc2725b923 100644
--- a/arch/arm/mach-omap2/clock34xx.h
+++ b/arch/arm/mach-omap2/clock34xx.h
@@ -1568,7 +1568,7 @@ static const struct clksel ssi_ssr_clksel[] = {
        { .parent = NULL }
 };
-static struct clk ssi_ssr_fck = {
+static struct clk ssi_ssr_fck_3430es1 = {
        .name           = "ssi_ssr_fck",
        .ops            = &clkops_omap2_dflt,
        .init           = &omap2_init_clksel_parent,
@@ -1581,10 +1581,31 @@ static struct clk ssi_ssr_fck = {
        .recalc         = &omap2_clksel_recalc,
 };
-static struct clk ssi_sst_fck = {
+static struct clk ssi_ssr_fck_3430es2 = {
+        .name           = "ssi_ssr_fck",
+        .ops            = &clkops_omap3430es2_ssi_wait,
+        .init           = &omap2_init_clksel_parent,
+        .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_FCLKEN1),
+        .enable_bit     = OMAP3430_EN_SSI_SHIFT,
+        .clksel_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_CLKSEL),
+        .clksel_mask    = OMAP3430_CLKSEL_SSI_MASK,
+        .clksel         = ssi_ssr_clksel,
+        .clkdm_name     = "core_l4_clkdm",
+        .recalc         = &omap2_clksel_recalc,
+};
+static struct clk ssi_sst_fck_3430es1 = {
        .name           = "ssi_sst_fck",
        .ops            = &clkops_null,
-        .parent         = &ssi_ssr_fck,
+        .parent         = &ssi_ssr_fck_3430es1,
+        .fixed_div      = 2,
+        .recalc         = &omap2_fixed_divisor_recalc,
+};
+static struct clk ssi_sst_fck_3430es2 = {
+        .name           = "ssi_sst_fck",
+        .ops            = &clkops_null,
+        .parent         = &ssi_ssr_fck_3430es2,
        .fixed_div      = 2,
        .recalc         = &omap2_fixed_divisor_recalc,
 };
@@ -1606,9 +1627,19 @@ static struct clk core_l3_ick = {
        .recalc         = &followparent_recalc,
 };
-static struct clk hsotgusb_ick = {
+static struct clk hsotgusb_ick_3430es1 = {
        .name           = "hsotgusb_ick",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2_dflt,
+        .parent         = &core_l3_ick,
+        .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_ICLKEN1),
+        .enable_bit     = OMAP3430_EN_HSOTGUSB_SHIFT,
+        .clkdm_name     = "core_l3_clkdm",
+        .recalc         = &followparent_recalc,
+};
+static struct clk hsotgusb_ick_3430es2 = {
+        .name           = "hsotgusb_ick",
+        .ops            = &clkops_omap3430es2_hsotgusb_wait,
        .parent         = &core_l3_ick,
        .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_ICLKEN1),
        .enable_bit     = OMAP3430_EN_HSOTGUSB_SHIFT,
@@ -1947,7 +1978,7 @@ static struct clk ssi_l4_ick = {
        .recalc         = &followparent_recalc,
 };
-static struct clk ssi_ick = {
+static struct clk ssi_ick_3430es1 = {
        .name           = "ssi_ick",
        .ops            = &clkops_omap2_dflt,
        .parent         = &ssi_l4_ick,
@@ -1957,6 +1988,16 @@ static struct clk ssi_ick = {
        .recalc         = &followparent_recalc,
 };
+static struct clk ssi_ick_3430es2 = {
+        .name           = "ssi_ick",
+        .ops            = &clkops_omap3430es2_ssi_wait,
+        .parent         = &ssi_l4_ick,
+        .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_ICLKEN1),
+        .enable_bit     = OMAP3430_EN_SSI_SHIFT,
+        .clkdm_name     = "core_l4_clkdm",
+        .recalc         = &followparent_recalc,
+};
 /* REVISIT: Technically the TRM claims that this is CORE_CLK based,
 * but l4_ick makes more sense to me */
@@ -2024,7 +2065,7 @@ static struct clk des1_ick = {
 };
 /* DSS */
-static struct clk dss1_alwon_fck = {
+static struct clk dss1_alwon_fck_3430es1 = {
        .name           = "dss1_alwon_fck",
        .ops            = &clkops_omap2_dflt,
        .parent         = &dpll4_m4x2_ck,
@@ -2034,6 +2075,16 @@ static struct clk dss1_alwon_fck = {
        .recalc         = &followparent_recalc,
 };
+static struct clk dss1_alwon_fck_3430es2 = {
+        .name           = "dss1_alwon_fck",
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
+        .parent         = &dpll4_m4x2_ck,
+        .enable_reg     = OMAP_CM_REGADDR(OMAP3430_DSS_MOD, CM_FCLKEN),
+        .enable_bit     = OMAP3430_EN_DSS1_SHIFT,
+        .clkdm_name     = "dss_clkdm",
+        .recalc         = &followparent_recalc,
+};
 static struct clk dss_tv_fck = {
        .name           = "dss_tv_fck",
        .ops            = &clkops_omap2_dflt,
@@ -2067,7 +2118,7 @@ static struct clk dss2_alwon_fck = {
        .recalc         = &followparent_recalc,
 };
-static struct clk dss_ick = {
+static struct clk dss_ick_3430es1 = {
        /* Handles both L3 and L4 clocks */
        .name           = "dss_ick",
        .ops            = &clkops_omap2_dflt,
@@ -2079,6 +2130,18 @@ static struct clk dss_ick = {
        .recalc         = &followparent_recalc,
 };
+static struct clk dss_ick_3430es2 = {
+        /* Handles both L3 and L4 clocks */
+        .name           = "dss_ick",
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
+        .parent         = &l4_ick,
+        .init           = &omap2_init_clk_clkdm,
+        .enable_reg     = OMAP_CM_REGADDR(OMAP3430_DSS_MOD, CM_ICLKEN),
+        .enable_bit     = OMAP3430_CM_ICLKEN_DSS_EN_DSS_SHIFT,
+        .clkdm_name     = "dss_clkdm",
+        .recalc         = &followparent_recalc,
+};
 /* CAM */
 static struct clk cam_mclk = {
@@ -2118,7 +2181,7 @@ static struct clk csi2_96m_fck = {
 static struct clk usbhost_120m_fck = {
        .name           = "usbhost_120m_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2_dflt,
        .parent         = &dpll5_m2_ck,
        .init           = &omap2_init_clk_clkdm,
        .enable_reg     = OMAP_CM_REGADDR(OMAP3430ES2_USBHOST_MOD, CM_FCLKEN),
@@ -2129,7 +2192,7 @@ static struct clk usbhost_120m_fck = {
 static struct clk usbhost_48m_fck = {
        .name           = "usbhost_48m_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
        .parent         = &omap_48m_fck,
        .init           = &omap2_init_clk_clkdm,
        .enable_reg     = OMAP_CM_REGADDR(OMAP3430ES2_USBHOST_MOD, CM_FCLKEN),
@@ -2141,7 +2204,7 @@ static struct clk usbhost_48m_fck = {
 static struct clk usbhost_ick = {
        /* Handles both L3 and L4 clocks */
        .name           = "usbhost_ick",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
        .parent         = &l4_ick,
        .init           = &omap2_init_clk_clkdm,
        .enable_reg     = OMAP_CM_REGADDR(OMAP3430ES2_USBHOST_MOD, CM_ICLKEN),
diff --git a/arch/arm/mach-omap2/cm.h b/arch/arm/mach-omap2/cm.h
index 1d3c93bf86d3..f3c91a1ca391 100644
--- a/arch/arm/mach-omap2/cm.h
+++ b/arch/arm/mach-omap2/cm.h
@@ -29,9 +29,9 @@
 * These registers appear once per CM module.
 */
-#define OMAP3430_CM_REVISION            OMAP_CM_REGADDR(OCP_MOD, 0x0000)
+#define OMAP3430_CM_REVISION            OMAP34XX_CM_REGADDR(OCP_MOD, 0x0000)
-#define OMAP3430_CM_SYSCONFIG           OMAP_CM_REGADDR(OCP_MOD, 0x0010)
+#define OMAP3430_CM_SYSCONFIG           OMAP34XX_CM_REGADDR(OCP_MOD, 0x0010)
-#define OMAP3430_CM_POLCTRL             OMAP_CM_REGADDR(OCP_MOD, 0x009c)
+#define OMAP3430_CM_POLCTRL             OMAP34XX_CM_REGADDR(OCP_MOD, 0x009c)
 #define OMAP3_CM_CLKOUT_CTRL_OFFSET     0x0070
 #define OMAP3430_CM_CLKOUT_CTRL         OMAP_CM_REGADDR(OMAP3430_CCR_MOD, 0x0070)
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index 3a86b0f66031..e9b9bcb19b4e 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -276,14 +276,15 @@ static int __init _omap2_init_reprogram_sdrc(void)
        return v;
 }
-void __init omap2_init_common_hw(struct omap_sdrc_params *sp)
+void __init omap2_init_common_hw(struct omap_sdrc_params *sdrc_cs0,
+                                 struct omap_sdrc_params *sdrc_cs1)
 {
        omap2_mux_init();
 #ifndef CONFIG_ARCH_OMAP4 /* FIXME: Remove this once the clkdev is ready */
        pwrdm_init(powerdomains_omap);
        clkdm_init(clockdomains_omap, clkdm_pwrdm_autodeps);
        omap2_clk_init();
-        omap2_sdrc_init(sp);
+        omap2_sdrc_init(sdrc_cs0, sdrc_cs1);
        _omap2_init_reprogram_sdrc();
 #endif
        gpmc_init();
diff --git a/arch/arm/mach-omap2/mcbsp.c b/arch/arm/mach-omap2/mcbsp.c
index a5c0f0435cd6..99b6e1546311 100644
--- a/arch/arm/mach-omap2/mcbsp.c
+++ b/arch/arm/mach-omap2/mcbsp.c
@@ -19,7 +19,6 @@
 #include <mach/irqs.h>
 #include <mach/dma.h>
-#include <mach/irqs.h>
 #include <mach/mux.h>
 #include <mach/cpu.h>
 #include <mach/mcbsp.h>
diff --git a/arch/arm/mach-omap2/mmc-twl4030.c b/arch/arm/mach-omap2/mmc-twl4030.c
index 1541fd4c8d0f..3c04c2f1b23f 100644
--- a/arch/arm/mach-omap2/mmc-twl4030.c
+++ b/arch/arm/mach-omap2/mmc-twl4030.c
@@ -119,6 +119,7 @@ static int twl_mmc_late_init(struct device *dev)
                                if (i != 0)
                                        break;
                                ret = PTR_ERR(reg);
+                                hsmmc[i].vcc = NULL;
                                goto err;
                        }
                        hsmmc[i].vcc = reg;
@@ -165,8 +166,13 @@ done:
 static void twl_mmc_cleanup(struct device *dev)
 {
        struct omap_mmc_platform_data *mmc = dev->platform_data;
+        int i;
        gpio_free(mmc->slots[0].switch_pin);
+        for(i = 0; i < ARRAY_SIZE(hsmmc); i++) {
+                regulator_put(hsmmc[i].vcc);
+                regulator_put(hsmmc[i].vcc_aux);
+        }
 }
 #ifdef CONFIG_PM
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index 026c4fc883a7..43d6b92b65f2 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -486,6 +486,12 @@ MUX_CFG_34XX("H19_34XX_GPIO164_OUT", 0x19c,
                OMAP34XX_MUX_MODE4 | OMAP34XX_PIN_OUTPUT)
 MUX_CFG_34XX("J25_34XX_GPIO170", 0x1c6,
                OMAP34XX_MUX_MODE4 | OMAP34XX_PIN_INPUT)
+/* OMAP3 SDRC CKE signals to SDR/DDR ram chips */
+MUX_CFG_34XX("H16_34XX_SDRC_CKE0", 0x262,
+                OMAP34XX_MUX_MODE0 | OMAP34XX_PIN_OUTPUT)
+MUX_CFG_34XX("H17_34XX_SDRC_CKE1", 0x264,
+                OMAP34XX_MUX_MODE0 | OMAP34XX_PIN_OUTPUT)
 };
 #define OMAP34XX_PINS_SZ        ARRAY_SIZE(omap34xx_pins)
diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h
index f7b3baf76678..21201cd4117b 100644
--- a/arch/arm/mach-omap2/pm.h
+++ b/arch/arm/mach-omap2/pm.h
@@ -11,9 +11,6 @@
 #ifndef __ARCH_ARM_MACH_OMAP2_PM_H
 #define __ARCH_ARM_MACH_OMAP2_PM_H
-extern int omap2_pm_init(void);
-extern int omap3_pm_init(void);
 #ifdef CONFIG_PM_DEBUG
 extern void omap2_pm_dump(int mode, int resume, unsigned int us);
 extern int omap2_pm_debug;
diff --git a/arch/arm/mach-omap2/pm24xx.c b/arch/arm/mach-omap2/pm24xx.c
index db1025562fb0..528dbdc26e23 100644
--- a/arch/arm/mach-omap2/pm24xx.c
+++ b/arch/arm/mach-omap2/pm24xx.c
@@ -470,7 +470,7 @@ static void __init prcm_setup_regs(void)
                          WKUP_MOD, PM_WKEN);
 }
-int __init omap2_pm_init(void)
+static int __init omap2_pm_init(void)
 {
        u32 l;
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 841d4c5ed8be..488d595d8e4b 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -39,7 +39,9 @@
 struct power_state {
        struct powerdomain *pwrdm;
        u32 next_state;
+#ifdef CONFIG_SUSPEND
        u32 saved_state;
+#endif
        struct list_head node;
 };
@@ -293,6 +295,9 @@ out:
        local_irq_enable();
 }
+#ifdef CONFIG_SUSPEND
+static suspend_state_t suspend_state;
 static int omap3_pm_prepare(void)
 {
        disable_hlt();
@@ -321,7 +326,6 @@ static int omap3_pm_suspend(void)
 restore:
        /* Restore next_pwrsts */
        list_for_each_entry(pwrst, &pwrst_list, node) {
-                set_pwrdm_state(pwrst->pwrdm, pwrst->saved_state);
                state = pwrdm_read_prev_pwrst(pwrst->pwrdm);
                if (state > pwrst->next_state) {
                        printk(KERN_INFO "Powerdomain (%s) didn't enter "
@@ -329,6 +333,7 @@ restore:
                               pwrst->pwrdm->name, pwrst->next_state);
                        ret = -1;
                }
+                set_pwrdm_state(pwrst->pwrdm, pwrst->saved_state);
        }
        if (ret)
                printk(KERN_ERR "Could not enter target state in pm_suspend\n");
@@ -339,11 +344,11 @@ restore:
        return ret;
 }
-static int omap3_pm_enter(suspend_state_t state)
+static int omap3_pm_enter(suspend_state_t unused)
 {
        int ret = 0;
-        switch (state) {
+        switch (suspend_state) {
        case PM_SUSPEND_STANDBY:
        case PM_SUSPEND_MEM:
                ret = omap3_pm_suspend();
@@ -360,12 +365,30 @@ static void omap3_pm_finish(void)
        enable_hlt();
 }
+/* Hooks to enable / disable UART interrupts during suspend */
+static int omap3_pm_begin(suspend_state_t state)
+{
+        suspend_state = state;
+        omap_uart_enable_irqs(0);
+        return 0;
+}
+static void omap3_pm_end(void)
+{
+        suspend_state = PM_SUSPEND_ON;
+        omap_uart_enable_irqs(1);
+        return;
+}
 static struct platform_suspend_ops omap_pm_ops = {
+        .begin          = omap3_pm_begin,
+        .end            = omap3_pm_end,
        .prepare        = omap3_pm_prepare,
        .enter          = omap3_pm_enter,
        .finish         = omap3_pm_finish,
        .valid          = suspend_valid_only_mem,
 };
+#endif /* CONFIG_SUSPEND */
 /**
@@ -613,6 +636,24 @@ static void __init prcm_setup_regs(void)
        /* Clear any pending PRCM interrupts */
        prm_write_mod_reg(0, OCP_MOD, OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
+        /* Don't attach IVA interrupts */
+        prm_write_mod_reg(0, WKUP_MOD, OMAP3430_PM_IVAGRPSEL);
+        prm_write_mod_reg(0, CORE_MOD, OMAP3430_PM_IVAGRPSEL1);
+        prm_write_mod_reg(0, CORE_MOD, OMAP3430ES2_PM_IVAGRPSEL3);
+        prm_write_mod_reg(0, OMAP3430_PER_MOD, OMAP3430_PM_IVAGRPSEL);
+        /* Clear any pending 'reset' flags */
+        prm_write_mod_reg(0xffffffff, MPU_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, CORE_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_PER_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_EMU_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_NEON_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_DSS_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430ES2_USBHOST_MOD, RM_RSTST);
+        /* Clear any pending PRCM interrupts */
+        prm_write_mod_reg(0, OCP_MOD, OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
        omap3_iva_idle();
        omap3_d2d_idle();
 }
@@ -652,7 +693,7 @@ static int __init clkdms_setup(struct clockdomain *clkdm)
        return 0;
 }
-int __init omap3_pm_init(void)
+static int __init omap3_pm_init(void)
 {
        struct power_state *pwrst, *tmp;
        int ret;
@@ -692,7 +733,9 @@ int __init omap3_pm_init(void)
        _omap_sram_idle = omap_sram_push(omap34xx_cpu_suspend,
                                         omap34xx_cpu_suspend_sz);
+#ifdef CONFIG_SUSPEND
        suspend_set_ops(&omap_pm_ops);
+#endif /* CONFIG_SUSPEND */
        pm_idle = omap3_pm_idle;
diff --git a/arch/arm/mach-omap2/prcm.c b/arch/arm/mach-omap2/prcm.c
index f945156d5585..ced555a4cd1a 100644
--- a/arch/arm/mach-omap2/prcm.c
+++ b/arch/arm/mach-omap2/prcm.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/delay.h>
 #include <mach/common.h>
 #include <mach/prcm.h>
@@ -28,6 +29,8 @@
 static void __iomem *prm_base;
 static void __iomem *cm_base;
+#define MAX_MODULE_ENABLE_WAIT          100000
 u32 omap_prcm_get_reset_sources(void)
 {
        /* XXX This presumably needs modification for 34XX */
@@ -120,6 +123,46 @@ u32 cm_rmw_mod_reg_bits(u32 mask, u32 bits, s16 module, s16 idx)
 }
 EXPORT_SYMBOL(cm_rmw_mod_reg_bits);
+/**
+ * omap2_cm_wait_idlest - wait for IDLEST bit to indicate module readiness
+ * @reg: physical address of module IDLEST register
+ * @mask: value to mask against to determine if the module is active
+ * @name: name of the clock (for printk)
+ *
+ * Returns 1 if the module indicated readiness in time, or 0 if it
+ * failed to enable in roughly MAX_MODULE_ENABLE_WAIT microseconds.
+ */
+int omap2_cm_wait_idlest(void __iomem *reg, u32 mask, const char *name)
+{
+        int i = 0;
+        int ena = 0;
+        /*
+         * 24xx uses 0 to indicate not ready, and 1 to indicate ready.
+         * 34xx reverses this, just to keep us on our toes
+         */
+        if (cpu_is_omap24xx())
+                ena = mask;
+        else if (cpu_is_omap34xx())
+                ena = 0;
+        else
+                BUG();
+        /* Wait for lock */
+        while (((__raw_readl(reg) & mask) != ena) &&
+               (i++ < MAX_MODULE_ENABLE_WAIT))
+                udelay(1);
+        if (i < MAX_MODULE_ENABLE_WAIT)
+                pr_debug("cm: Module associated with clock %s ready after %d "
+                         "loops\n", name, i);
+        else
+                pr_err("cm: Module associated with clock %s didn't enable in "
+                       "%d tries\n", name, MAX_MODULE_ENABLE_WAIT);
+        return (i < MAX_MODULE_ENABLE_WAIT) ? 1 : 0;
+};
 void __init omap2_set_globals_prcm(struct omap_globals *omap2_globals)
 {
        prm_base = omap2_globals->prm;
diff --git a/arch/arm/mach-omap2/sdrc.c b/arch/arm/mach-omap2/sdrc.c
index 2045441e8385..9e3bd4fa7810 100644
--- a/arch/arm/mach-omap2/sdrc.c
+++ b/arch/arm/mach-omap2/sdrc.c
@@ -32,7 +32,7 @@
 #include <mach/sdrc.h>
 #include "sdrc.h"
-static struct omap_sdrc_params *sdrc_init_params;
+static struct omap_sdrc_params *sdrc_init_params_cs0, *sdrc_init_params_cs1;
 void __iomem *omap2_sdrc_base;
 void __iomem *omap2_sms_base;
@@ -45,33 +45,49 @@ void __iomem *omap2_sms_base;
 /**
 * omap2_sdrc_get_params - return SDRC register values for a given clock rate
 * @r: SDRC clock rate (in Hz)
+ * @sdrc_cs0: chip select 0 ram timings **
+ * @sdrc_cs1: chip select 1 ram timings **
 *
 * Return pre-calculated values for the SDRC_ACTIM_CTRLA,
- * SDRC_ACTIM_CTRLB, SDRC_RFR_CTRL, and SDRC_MR registers, for a given
+ *  SDRC_ACTIM_CTRLB, SDRC_RFR_CTRL and SDRC_MR registers in sdrc_cs[01]
- * SDRC clock rate 'r'.  These parameters control various timing
+ *  structs,for a given SDRC clock rate 'r'.
- * delays in the SDRAM controller that are expressed in terms of the
+ * These parameters control various timing delays in the SDRAM controller
- * number of SDRC clock cycles to wait; hence the clock rate
+ *  that are expressed in terms of the number of SDRC clock cycles to
- * dependency. Note that sdrc_init_params must be sorted rate
+ *  wait; hence the clock rate dependency.
- * descending.  Also assumes that both chip-selects use the same
+ *
- * timing parameters.  Returns a struct omap_sdrc_params * upon
+ * Supports 2 different timing parameters for both chip selects.
- * success, or NULL upon failure.
+ *
+ * Note 1: the sdrc_init_params_cs[01] must be sorted rate descending.
+ * Note 2: If sdrc_init_params_cs_1 is not NULL it must be of same size
+ *  as sdrc_init_params_cs_0.
+ *
+ * Fills in the struct omap_sdrc_params * for each chip select.
+ * Returns 0 upon success or -1 upon failure.
 */
-struct omap_sdrc_params *omap2_sdrc_get_params(unsigned long r)
+int omap2_sdrc_get_params(unsigned long r,
+                          struct omap_sdrc_params **sdrc_cs0,
+                          struct omap_sdrc_params **sdrc_cs1)
 {
-        struct omap_sdrc_params *sp;
+        struct omap_sdrc_params *sp0, *sp1;
-        if (!sdrc_init_params)
+        if (!sdrc_init_params_cs0)
-                return NULL;
+                return -1;
-        sp = sdrc_init_params;
+        sp0 = sdrc_init_params_cs0;
+        sp1 = sdrc_init_params_cs1;
-        while (sp->rate && sp->rate != r)
+        while (sp0->rate && sp0->rate != r) {
-                sp++;
+                sp0++;
+                if (sdrc_init_params_cs1)
+                        sp1++;
+        }
-        if (!sp->rate)
+        if (!sp0->rate)
-                return NULL;
+                return -1;
-        return sp;
+        *sdrc_cs0 = sp0;
+        *sdrc_cs1 = sp1;
+        return 0;
 }
@@ -83,13 +99,15 @@ void __init omap2_set_globals_sdrc(struct omap_globals *omap2_globals)
 /**
 * omap2_sdrc_init - initialize SMS, SDRC devices on boot
- * @sp: pointer to a null-terminated list of struct omap_sdrc_params
+ * @sdrc_cs[01]: pointers to a null-terminated list of struct omap_sdrc_params
+ *  Support for 2 chip selects timings
 *
 * Turn on smart idle modes for SDRAM scheduler and controller.
 * Program a known-good configuration for the SDRC to deal with buggy
 * bootloaders.
 */
-void __init omap2_sdrc_init(struct omap_sdrc_params *sp)
+void __init omap2_sdrc_init(struct omap_sdrc_params *sdrc_cs0,
+                            struct omap_sdrc_params *sdrc_cs1)
 {
        u32 l;
@@ -103,11 +121,15 @@ void __init omap2_sdrc_init(struct omap_sdrc_params *sp)
        l |= (0x2 << 3);
        sdrc_write_reg(l, SDRC_SYSCONFIG);
-        sdrc_init_params = sp;
+        sdrc_init_params_cs0 = sdrc_cs0;
+        sdrc_init_params_cs1 = sdrc_cs1;
        /* XXX Enable SRFRONIDLEREQ here also? */
+        /*
+         * PWDENA should not be set due to 34xx erratum 1.150 - PWDENA
+         * can cause random memory corruption
+         */
        l = (1 << SDRC_POWER_EXTCLKDIS_SHIFT) |
-                (1 << SDRC_POWER_PWDENA_SHIFT) |
                (1 << SDRC_POWER_PAGEPOLICY_SHIFT);
        sdrc_write_reg(l, SDRC_POWER);
 }
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index b094c15bfe47..a7421a50410b 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -54,6 +54,7 @@ struct omap_uart_state {
        struct plat_serial8250_port *p;
        struct list_head node;
+        struct platform_device pdev;
 #if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM)
        int context_valid;
@@ -68,10 +69,9 @@ struct omap_uart_state {
 #endif
 };
-static struct omap_uart_state omap_uart[OMAP_MAX_NR_PORTS];
 static LIST_HEAD(uart_list);
-static struct plat_serial8250_port serial_platform_data[] = {
+static struct plat_serial8250_port serial_platform_data0[] = {
        {
                .membase        = IO_ADDRESS(OMAP_UART1_BASE),
                .mapbase        = OMAP_UART1_BASE,
@@ -81,6 +81,12 @@ static struct plat_serial8250_port serial_platform_data[] = {
                .regshift       = 2,
                .uartclk        = OMAP24XX_BASE_BAUD * 16,
        }, {
+                .flags          = 0
+        }
+};
+static struct plat_serial8250_port serial_platform_data1[] = {
+        {
                .membase        = IO_ADDRESS(OMAP_UART2_BASE),
                .mapbase        = OMAP_UART2_BASE,
                .irq            = 73,
@@ -89,6 +95,12 @@ static struct plat_serial8250_port serial_platform_data[] = {
                .regshift       = 2,
                .uartclk        = OMAP24XX_BASE_BAUD * 16,
        }, {
+                .flags          = 0
+        }
+};
+static struct plat_serial8250_port serial_platform_data2[] = {
+        {
                .membase        = IO_ADDRESS(OMAP_UART3_BASE),
                .mapbase        = OMAP_UART3_BASE,
                .irq            = 74,
@@ -217,6 +229,40 @@ static inline void omap_uart_disable_clocks(struct omap_uart_state *uart)
        clk_disable(uart->fck);
 }
+static void omap_uart_enable_wakeup(struct omap_uart_state *uart)
+{
+        /* Set wake-enable bit */
+        if (uart->wk_en && uart->wk_mask) {
+                u32 v = __raw_readl(uart->wk_en);
+                v |= uart->wk_mask;
+                __raw_writel(v, uart->wk_en);
+        }
+        /* Ensure IOPAD wake-enables are set */
+        if (cpu_is_omap34xx() && uart->padconf) {
+                u16 v = omap_ctrl_readw(uart->padconf);
+                v |= OMAP3_PADCONF_WAKEUPENABLE0;
+                omap_ctrl_writew(v, uart->padconf);
+        }
+}
+static void omap_uart_disable_wakeup(struct omap_uart_state *uart)
+{
+        /* Clear wake-enable bit */
+        if (uart->wk_en && uart->wk_mask) {
+                u32 v = __raw_readl(uart->wk_en);
+                v &= ~uart->wk_mask;
+                __raw_writel(v, uart->wk_en);
+        }
+        /* Ensure IOPAD wake-enables are cleared */
+        if (cpu_is_omap34xx() && uart->padconf) {
+                u16 v = omap_ctrl_readw(uart->padconf);
+                v &= ~OMAP3_PADCONF_WAKEUPENABLE0;
+                omap_ctrl_writew(v, uart->padconf);
+        }
+}
 static void omap_uart_smart_idle_enable(struct omap_uart_state *uart,
                                          int enable)
 {
@@ -246,6 +292,11 @@ static void omap_uart_block_sleep(struct omap_uart_state *uart)
 static void omap_uart_allow_sleep(struct omap_uart_state *uart)
 {
+        if (device_may_wakeup(&uart->pdev.dev))
+                omap_uart_enable_wakeup(uart);
+        else
+                omap_uart_disable_wakeup(uart);
        if (!uart->clocked)
                return;
@@ -292,7 +343,6 @@ void omap_uart_resume_idle(int num)
                        /* Check for normal UART wakeup */
                        if (__raw_readl(uart->wk_st) & uart->wk_mask)
                                omap_uart_block_sleep(uart);
                        return;
                }
        }
@@ -346,16 +396,13 @@ static irqreturn_t omap_uart_interrupt(int irq, void *dev_id)
        return IRQ_NONE;
 }
-static u32 sleep_timeout = DEFAULT_TIMEOUT;
 static void omap_uart_idle_init(struct omap_uart_state *uart)
 {
-        u32 v;
        struct plat_serial8250_port *p = uart->p;
        int ret;
        uart->can_sleep = 0;
-        uart->timeout = sleep_timeout;
+        uart->timeout = DEFAULT_TIMEOUT;
        setup_timer(&uart->timer, omap_uart_idle_timer,
                    (unsigned long) uart);
        mod_timer(&uart->timer, jiffies + uart->timeout);
@@ -413,76 +460,101 @@ static void omap_uart_idle_init(struct omap_uart_state *uart)
                uart->padconf = 0;
        }
-        /* Set wake-enable bit */
-        if (uart->wk_en && uart->wk_mask) {
-                v = __raw_readl(uart->wk_en);
-                v |= uart->wk_mask;
-                __raw_writel(v, uart->wk_en);
-        }
-        /* Ensure IOPAD wake-enables are set */
-        if (cpu_is_omap34xx() && uart->padconf) {
-                u16 v;
-                v = omap_ctrl_readw(uart->padconf);
-                v |= OMAP3_PADCONF_WAKEUPENABLE0;
-                omap_ctrl_writew(v, uart->padconf);
-        }
        p->flags |= UPF_SHARE_IRQ;
        ret = request_irq(p->irq, omap_uart_interrupt, IRQF_SHARED,
                          "serial idle", (void *)uart);
        WARN_ON(ret);
 }
-static ssize_t sleep_timeout_show(struct kobject *kobj,
+void omap_uart_enable_irqs(int enable)
-                                  struct kobj_attribute *attr,
+{
+        int ret;
+        struct omap_uart_state *uart;
+        list_for_each_entry(uart, &uart_list, node) {
+                if (enable)
+                        ret = request_irq(uart->p->irq, omap_uart_interrupt,
+                                IRQF_SHARED, "serial idle", (void *)uart);
+                else
+                        free_irq(uart->p->irq, (void *)uart);
+        }
+}
+static ssize_t sleep_timeout_show(struct device *dev,
+                                  struct device_attribute *attr,
                                  char *buf)
 {
-        return sprintf(buf, "%u\n", sleep_timeout / HZ);
+        struct platform_device *pdev = container_of(dev,
+                                        struct platform_device, dev);
+        struct omap_uart_state *uart = container_of(pdev,
+                                        struct omap_uart_state, pdev);
+        return sprintf(buf, "%u\n", uart->timeout / HZ);
 }
-static ssize_t sleep_timeout_store(struct kobject *kobj,
+static ssize_t sleep_timeout_store(struct device *dev,
-                                   struct kobj_attribute *attr,
+                                   struct device_attribute *attr,
                                   const char *buf, size_t n)
 {
-        struct omap_uart_state *uart;
+        struct platform_device *pdev = container_of(dev,
+                                        struct platform_device, dev);
+        struct omap_uart_state *uart = container_of(pdev,
+                                        struct omap_uart_state, pdev);
        unsigned int value;
        if (sscanf(buf, "%u", &value) != 1) {
                printk(KERN_ERR "sleep_timeout_store: Invalid value\n");
                return -EINVAL;
        }
-        sleep_timeout = value * HZ;
-        list_for_each_entry(uart, &uart_list, node) {
+        uart->timeout = value * HZ;
-                uart->timeout = sleep_timeout;
+        if (uart->timeout)
-                if (uart->timeout)
+                mod_timer(&uart->timer, jiffies + uart->timeout);
-                        mod_timer(&uart->timer, jiffies + uart->timeout);
+        else
-                else
+                /* A zero value means disable timeout feature */
-                        /* A zero value means disable timeout feature */
+                omap_uart_block_sleep(uart);
-                        omap_uart_block_sleep(uart);
-        }
        return n;
 }
-static struct kobj_attribute sleep_timeout_attr =
+DEVICE_ATTR(sleep_timeout, 0644, sleep_timeout_show, sleep_timeout_store);
-        __ATTR(sleep_timeout, 0644, sleep_timeout_show, sleep_timeout_store);
+#define DEV_CREATE_FILE(dev, attr) WARN_ON(device_create_file(dev, attr))
 #else
 static inline void omap_uart_idle_init(struct omap_uart_state *uart) {}
+#define DEV_CREATE_FILE(dev, attr)
 #endif /* CONFIG_PM */
-static struct platform_device serial_device = {
+static struct omap_uart_state omap_uart[OMAP_MAX_NR_PORTS] = {
-        .name                   = "serial8250",
+        {
-        .id                     = PLAT8250_DEV_PLATFORM,
+                .pdev = {
-        .dev                    = {
+                        .name                   = "serial8250",
-                .platform_data  = serial_platform_data,
+                        .id                     = PLAT8250_DEV_PLATFORM,
+                        .dev                    = {
+                                .platform_data  = serial_platform_data0,
+                        },
+                },
+        }, {
+                .pdev = {
+                        .name                   = "serial8250",
+                        .id                     = PLAT8250_DEV_PLATFORM1,
+                        .dev                    = {
+                                .platform_data  = serial_platform_data1,
+                        },
+                },
+        }, {
+                .pdev = {
+                        .name                   = "serial8250",
+                        .id                     = PLAT8250_DEV_PLATFORM2,
+                        .dev                    = {
+                                .platform_data  = serial_platform_data2,
+                        },
+                },
        },
 };
 void __init omap_serial_init(void)
 {
-        int i, err;
+        int i;
        const struct omap_uart_config *info;
        char name[16];
@@ -496,14 +568,12 @@ void __init omap_serial_init(void)
        if (info == NULL)
                return;
-        if (cpu_is_omap44xx()) {
-                for (i = 0; i < OMAP_MAX_NR_PORTS; i++)
-                        serial_platform_data[i].irq += 32;
-        }
        for (i = 0; i < OMAP_MAX_NR_PORTS; i++) {
-                struct plat_serial8250_port *p = serial_platform_data + i;
                struct omap_uart_state *uart = &omap_uart[i];
+                struct platform_device *pdev = &uart->pdev;
+                struct device *dev = &pdev->dev;
+                struct plat_serial8250_port *p = dev->platform_data;
                if (!(info->enabled_uarts & (1 << i))) {
                        p->membase = NULL;
@@ -531,20 +601,21 @@ void __init omap_serial_init(void)
                uart->num = i;
                p->private_data = uart;
                uart->p = p;
-                list_add(&uart->node, &uart_list);
+                list_add_tail(&uart->node, &uart_list);
+                if (cpu_is_omap44xx())
+                        p->irq += 32;
                omap_uart_enable_clocks(uart);
                omap_uart_reset(uart);
                omap_uart_idle_init(uart);
-        }
-        err = platform_device_register(&serial_device);
-#ifdef CONFIG_PM
-        if (!err)
-                err = sysfs_create_file(&serial_device.dev.kobj,
-                                        &sleep_timeout_attr.attr);
-#endif
+                if (WARN_ON(platform_device_register(pdev)))
+                        continue;
+                if ((cpu_is_omap34xx() && uart->padconf) ||
+                    (uart->wk_en && uart->wk_mask)) {
+                        device_init_wakeup(dev, true);
+                        DEV_CREATE_FILE(dev, &dev_attr_sleep_timeout);
+                }
+        }
 }
diff --git a/arch/arm/mach-omap2/sram34xx.S b/arch/arm/mach-omap2/sram34xx.S
index f41f8d96ddba..82aa4a3d160c 100644
--- a/arch/arm/mach-omap2/sram34xx.S
+++ b/arch/arm/mach-omap2/sram34xx.S
@@ -36,7 +36,7 @@
        .text
-/* r4 parameters */
+/* r1 parameters */
 #define SDRC_NO_UNLOCK_DLL              0x0
 #define SDRC_UNLOCK_DLL                 0x1
@@ -58,7 +58,6 @@
 /* SDRC_POWER bit settings */
 #define SRFRONIDLEREQ_MASK              0x40
-#define PWDENA_MASK                     0x4
 /* CM_IDLEST1_CORE bit settings */
 #define ST_SDRC_MASK                    0x2
@@ -71,41 +70,72 @@
 /*
 * omap3_sram_configure_core_dpll - change DPLL3 M2 divider
- * r0 = new SDRC_RFR_CTRL register contents
+ *
- * r1 = new SDRC_ACTIM_CTRLA register contents
+ * Params passed in registers:
- * r2 = new SDRC_ACTIM_CTRLB register contents
+ *  r0 = new M2 divider setting (only 1 and 2 supported right now)
- * r3 = new M2 divider setting (only 1 and 2 supported right now)
+ *  r1 = unlock SDRC DLL? (1 = yes, 0 = no).  Only unlock DLL for
- * r4 = unlock SDRC DLL? (1 = yes, 0 = no).  Only unlock DLL for
 *      SDRC rates < 83MHz
- * r5 = number of MPU cycles to wait for SDRC to stabilize after
+ *  r2 = number of MPU cycles to wait for SDRC to stabilize after
 *      reprogramming the SDRC when switching to a slower MPU speed
- * r6 = new SDRC_MR_0 register value
+ *  r3 = increasing SDRC rate? (1 = yes, 0 = no)
- * r7 = increasing SDRC rate? (1 = yes, 0 = no)
+ *
+ * Params passed via the stack. The needed params will be copied in SRAM
+ *  before use by the code in SRAM (SDRAM is not accessible during SDRC
+ *  reconfiguration):
+ *  new SDRC_RFR_CTRL_0 register contents
+ *  new SDRC_ACTIM_CTRL_A_0 register contents
+ *  new SDRC_ACTIM_CTRL_B_0 register contents
+ *  new SDRC_MR_0 register value
+ *  new SDRC_RFR_CTRL_1 register contents
+ *  new SDRC_ACTIM_CTRL_A_1 register contents
+ *  new SDRC_ACTIM_CTRL_B_1 register contents
+ *  new SDRC_MR_1 register value
 *
+ * If the param SDRC_RFR_CTRL_1 is 0, the parameters
+ *  are not programmed into the SDRC CS1 registers
 */
 ENTRY(omap3_sram_configure_core_dpll)
        stmfd   sp!, {r1-r12, lr}       @ store regs to stack
-        ldr     r4, [sp, #52]           @ pull extra args off the stack
-        ldr     r5, [sp, #56]           @ load extra args from the stack
+                                        @ pull the extra args off the stack
-        ldr     r6, [sp, #60]           @ load extra args from the stack
+                                        @  and store them in SRAM
-        ldr     r7, [sp, #64]           @ load extra args from the stack
+        ldr     r4, [sp, #52]
+        str     r4, omap_sdrc_rfr_ctrl_0_val
+        ldr     r4, [sp, #56]
+        str     r4, omap_sdrc_actim_ctrl_a_0_val
+        ldr     r4, [sp, #60]
+        str     r4, omap_sdrc_actim_ctrl_b_0_val
+        ldr     r4, [sp, #64]
+        str     r4, omap_sdrc_mr_0_val
+        ldr     r4, [sp, #68]
+        str     r4, omap_sdrc_rfr_ctrl_1_val
+        cmp     r4, #0                  @ if SDRC_RFR_CTRL_1 is 0,
+        beq     skip_cs1_params         @  do not use cs1 params
+        ldr     r4, [sp, #72]
+        str     r4, omap_sdrc_actim_ctrl_a_1_val
+        ldr     r4, [sp, #76]
+        str     r4, omap_sdrc_actim_ctrl_b_1_val
+        ldr     r4, [sp, #80]
+        str     r4, omap_sdrc_mr_1_val
+skip_cs1_params:
        dsb                             @ flush buffered writes to interconnect
-        cmp     r7, #1                  @ if increasing SDRC clk rate,
+        cmp     r3, #1                  @ if increasing SDRC clk rate,
        bleq    configure_sdrc          @ program the SDRC regs early (for RFR)
-        cmp     r4, #SDRC_UNLOCK_DLL    @ set the intended DLL state
+        cmp     r1, #SDRC_UNLOCK_DLL    @ set the intended DLL state
        bleq    unlock_dll
        blne    lock_dll
        bl      sdram_in_selfrefresh    @ put SDRAM in self refresh, idle SDRC
        bl      configure_core_dpll     @ change the DPLL3 M2 divider
+        mov     r12, r2
+        bl      wait_clk_stable         @ wait for SDRC to stabilize
        bl      enable_sdrc             @ take SDRC out of idle
-        cmp     r4, #SDRC_UNLOCK_DLL    @ wait for DLL status to change
+        cmp     r1, #SDRC_UNLOCK_DLL    @ wait for DLL status to change
        bleq    wait_dll_unlock
        blne    wait_dll_lock
-        cmp     r7, #1                  @ if increasing SDRC clk rate,
+        cmp     r3, #1                  @ if increasing SDRC clk rate,
        beq     return_to_sdram         @ return to SDRAM code, otherwise,
        bl      configure_sdrc          @ reprogram SDRC regs now
-        mov     r12, r5
-        bl      wait_clk_stable         @ wait for SDRC to stabilize
 return_to_sdram:
        isb                             @ prevent speculative exec past here
        mov     r0, #0                  @ return value
@@ -113,7 +143,7 @@ return_to_sdram:
 unlock_dll:
        ldr     r11, omap3_sdrc_dlla_ctrl
        ldr     r12, [r11]
-        and     r12, r12, #FIXEDDELAY_MASK
+        bic     r12, r12, #FIXEDDELAY_MASK
        orr     r12, r12, #FIXEDDELAY_DEFAULT
        orr     r12, r12, #DLLIDLE_MASK
        str     r12, [r11]              @ (no OCP barrier needed)
@@ -129,7 +159,6 @@ sdram_in_selfrefresh:
        ldr     r12, [r11]              @ read the contents of SDRC_POWER
        mov     r9, r12                 @ keep a copy of SDRC_POWER bits
        orr     r12, r12, #SRFRONIDLEREQ_MASK   @ enable self refresh on idle
-        bic     r12, r12, #PWDENA_MASK  @ clear PWDENA
        str     r12, [r11]              @ write back to SDRC_POWER register
        ldr     r12, [r11]              @ posted-write barrier for SDRC
 idle_sdrc:
@@ -149,7 +178,7 @@ configure_core_dpll:
        ldr     r12, [r11]
        ldr     r10, core_m2_mask_val   @ modify m2 for core dpll
        and     r12, r12, r10
-        orr     r12, r12, r3, lsl #CORE_DPLL_CLKOUT_DIV_SHIFT
+        orr     r12, r12, r0, lsl #CORE_DPLL_CLKOUT_DIV_SHIFT
        str     r12, [r11]
        ldr     r12, [r11]              @ posted-write barrier for CM
        bx      lr
@@ -187,15 +216,34 @@ wait_dll_unlock:
        bne     wait_dll_unlock
        bx      lr
 configure_sdrc:
-        ldr     r11, omap3_sdrc_rfr_ctrl
+        ldr     r12, omap_sdrc_rfr_ctrl_0_val   @ fetch value from SRAM
-        str     r0, [r11]
+        ldr     r11, omap3_sdrc_rfr_ctrl_0      @ fetch addr from SRAM
-        ldr     r11, omap3_sdrc_actim_ctrla
+        str     r12, [r11]                      @ store
-        str     r1, [r11]
+        ldr     r12, omap_sdrc_actim_ctrl_a_0_val
-        ldr     r11, omap3_sdrc_actim_ctrlb
+        ldr     r11, omap3_sdrc_actim_ctrl_a_0
-        str     r2, [r11]
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_actim_ctrl_b_0_val
+        ldr     r11, omap3_sdrc_actim_ctrl_b_0
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_mr_0_val
        ldr     r11, omap3_sdrc_mr_0
-        str     r6, [r11]
+        str     r12, [r11]
-        ldr     r6, [r11]               @ posted-write barrier for SDRC
+        ldr     r12, omap_sdrc_rfr_ctrl_1_val
+        cmp     r12, #0                 @ if SDRC_RFR_CTRL_1 is 0,
+        beq     skip_cs1_prog           @  do not program cs1 params
+        ldr     r11, omap3_sdrc_rfr_ctrl_1
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_actim_ctrl_a_1_val
+        ldr     r11, omap3_sdrc_actim_ctrl_a_1
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_actim_ctrl_b_1_val
+        ldr     r11, omap3_sdrc_actim_ctrl_b_1
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_mr_1_val
+        ldr     r11, omap3_sdrc_mr_1
+        str     r12, [r11]
+skip_cs1_prog:
+        ldr     r12, [r11]              @ posted-write barrier for SDRC
        bx      lr
 omap3_sdrc_power:
@@ -206,14 +254,40 @@ omap3_cm_idlest1_core:
        .word OMAP34XX_CM_REGADDR(CORE_MOD, CM_IDLEST)
 omap3_cm_iclken1_core:
        .word OMAP34XX_CM_REGADDR(CORE_MOD, CM_ICLKEN1)
-omap3_sdrc_rfr_ctrl:
+omap3_sdrc_rfr_ctrl_0:
        .word OMAP34XX_SDRC_REGADDR(SDRC_RFR_CTRL_0)
-omap3_sdrc_actim_ctrla:
+omap3_sdrc_rfr_ctrl_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_RFR_CTRL_1)
+omap3_sdrc_actim_ctrl_a_0:
        .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_A_0)
-omap3_sdrc_actim_ctrlb:
+omap3_sdrc_actim_ctrl_a_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_A_1)
+omap3_sdrc_actim_ctrl_b_0:
        .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_B_0)
+omap3_sdrc_actim_ctrl_b_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_B_1)
 omap3_sdrc_mr_0:
        .word OMAP34XX_SDRC_REGADDR(SDRC_MR_0)
+omap3_sdrc_mr_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_MR_1)
+omap_sdrc_rfr_ctrl_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_rfr_ctrl_1_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_a_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_a_1_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_b_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_b_1_val:
+        .word 0xDEADBEEF
+omap_sdrc_mr_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_mr_1_val:
+        .word 0xDEADBEEF
 omap3_sdrc_dlla_status:
        .word OMAP34XX_SDRC_REGADDR(SDRC_DLLA_STATUS)
 omap3_sdrc_dlla_ctrl:
@@ -223,3 +297,4 @@ core_m2_mask_val:
 ENTRY(omap3_sram_configure_core_dpll_sz)
        .word   . - omap3_sram_configure_core_dpll
diff --git a/arch/arm/mach-omap2/usb-musb.c b/arch/arm/mach-omap2/usb-musb.c
index d85296dc896c..739e59e8025c 100644
--- a/arch/arm/mach-omap2/usb-musb.c
+++ b/arch/arm/mach-omap2/usb-musb.c
@@ -155,20 +155,6 @@ static struct platform_device musb_device = {
        .resource       = musb_resources,
 };
-#ifdef CONFIG_NOP_USB_XCEIV
-static u64 nop_xceiv_dmamask = DMA_BIT_MASK(32);
-static struct platform_device nop_xceiv_device = {
-        .name           = "nop_usb_xceiv",
-        .id             = -1,
-        .dev = {
-                .dma_mask               = &nop_xceiv_dmamask,
-                .coherent_dma_mask      = DMA_BIT_MASK(32),
-                .platform_data          = NULL,
-        },
-};
-#endif
 void __init usb_musb_init(void)
 {
        if (cpu_is_omap243x())
@@ -183,13 +169,6 @@ void __init usb_musb_init(void)
         */
        musb_plat.clock = "ick";
-#ifdef CONFIG_NOP_USB_XCEIV
-        if (platform_device_register(&nop_xceiv_device) < 0) {
-                printk(KERN_ERR "Unable to register NOP-XCEIV device\n");
-                return;
-        }
-#endif
        if (platform_device_register(&musb_device) < 0) {
                printk(KERN_ERR "Unable to register HS-USB (MUSB) device\n");
                return;
diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
index 63b10d9bb1d3..9cd09465a0e8 100644
--- a/arch/arm/mach-pxa/em-x270.c
+++ b/arch/arm/mach-pxa/em-x270.c
@@ -1141,12 +1141,16 @@ struct power_supply_info em_x270_psy_info = {
 static void em_x270_battery_low(void)
 {
+#if defined(CONFIG_APM_EMULATION)
        apm_queue_event(APM_LOW_BATTERY);
+#endif
 }
 static void em_x270_battery_critical(void)
 {
+#if defined(CONFIG_APM_EMULATION)
        apm_queue_event(APM_CRITICAL_SUSPEND);
+#endif
 }
 struct da9030_battery_info em_x270_batterty_info = {
diff --git a/arch/arm/mach-pxa/palmld.c b/arch/arm/mach-pxa/palmld.c
index ed70f281dd09..169fcc18154e 100644
--- a/arch/arm/mach-pxa/palmld.c
+++ b/arch/arm/mach-pxa/palmld.c
@@ -128,6 +128,10 @@ static unsigned long palmld_pin_config[] __initdata = {
        GPIO38_GPIO,    /* wifi ready */
        GPIO81_GPIO,    /* wifi reset */
+        /* FFUART */
+        GPIO34_FFUART_RXD,
+        GPIO39_FFUART_TXD,
        /* HDD */
        GPIO98_GPIO,    /* HDD reset */
        GPIO115_GPIO,   /* HDD power */
diff --git a/arch/arm/mach-pxa/palmt5.c b/arch/arm/mach-pxa/palmt5.c
index aae64a12a734..33f726ff55e5 100644
--- a/arch/arm/mach-pxa/palmt5.c
+++ b/arch/arm/mach-pxa/palmt5.c
@@ -111,6 +111,10 @@ static unsigned long palmt5_pin_config[] __initdata = {
        /* PWM */
        GPIO16_PWM0_OUT,
+        /* FFUART */
+        GPIO34_FFUART_RXD,
+        GPIO39_FFUART_TXD,
        /* MISC */
        GPIO10_GPIO,    /* hotsync button */
        GPIO90_GPIO,    /* power detect */
diff --git a/arch/arm/mach-pxa/palmtx.c b/arch/arm/mach-pxa/palmtx.c
index 6c15d84bde53..83d020879581 100644
--- a/arch/arm/mach-pxa/palmtx.c
+++ b/arch/arm/mach-pxa/palmtx.c
@@ -127,6 +127,10 @@ static unsigned long palmtx_pin_config[] __initdata = {
        GPIO76_LCD_PCLK,
        GPIO77_LCD_BIAS,
+        /* FFUART */
+        GPIO34_FFUART_RXD,
+        GPIO39_FFUART_TXD,
        /* MISC. */
        GPIO10_GPIO,    /* hotsync button */
        GPIO12_GPIO,    /* power detect */
diff --git a/arch/arm/mach-pxa/treo680.c b/arch/arm/mach-pxa/treo680.c
index a06f19edebb3..753ec4df17b9 100644
--- a/arch/arm/mach-pxa/treo680.c
+++ b/arch/arm/mach-pxa/treo680.c
@@ -409,7 +409,7 @@ err1:
 static void treo680_irda_shutdown(struct device *dev)
 {
-        gpio_free(GPIO_NR_TREO680_AMP_EN);
+        gpio_free(GPIO_NR_TREO680_IR_EN);
 }
 static struct pxaficp_platform_data treo680_ficp_info = {
diff --git a/arch/arm/mach-pxa/zylonite_pxa300.c b/arch/arm/mach-pxa/zylonite_pxa300.c
index cefd1c0a854a..84095440a878 100644
--- a/arch/arm/mach-pxa/zylonite_pxa300.c
+++ b/arch/arm/mach-pxa/zylonite_pxa300.c
@@ -197,10 +197,12 @@ static void __init zylonite_detect_lcd_panel(void)
        for (i = 0; i < NUM_LCD_DETECT_PINS; i++) {
                id = id << 1;
                gpio = mfp_to_gpio(lcd_detect_pins[i]);
+                gpio_request(gpio, "LCD_ID_PINS");
                gpio_direction_input(gpio);
                if (gpio_get_value(gpio))
                        id = id | 0x1;
+                gpio_free(gpio);
        }
        /* lcd id, flush out bit 1 */
diff --git a/arch/arm/mach-pxa/zylonite_pxa320.c b/arch/arm/mach-pxa/zylonite_pxa320.c
index cc5a22833605..60d08f23f5e4 100644
--- a/arch/arm/mach-pxa/zylonite_pxa320.c
+++ b/arch/arm/mach-pxa/zylonite_pxa320.c
@@ -176,10 +176,12 @@ static void __init zylonite_detect_lcd_panel(void)
        for (i = 0; i < NUM_LCD_DETECT_PINS; i++) {
                id = id << 1;
                gpio = mfp_to_gpio(lcd_detect_pins[i]);
+                gpio_request(gpio, "LCD_ID_PINS");
                gpio_direction_input(gpio);
                if (gpio_get_value(gpio))
                        id = id | 0x1;
+                gpio_free(gpio);
        }
        /* lcd id, flush out bit 1 */
diff --git a/arch/arm/mach-s3c2410/include/mach/gpio-core.h b/arch/arm/mach-s3c2410/include/mach/gpio-core.h
index 8fe192081d3a..f8b879a7973c 100644
--- a/arch/arm/mach-s3c2410/include/mach/gpio-core.h
+++ b/arch/arm/mach-s3c2410/include/mach/gpio-core.h
@@ -28,7 +28,7 @@ static inline struct s3c_gpio_chip *s3c_gpiolib_getchip(unsigned int pin)
                return NULL;
        chip = &s3c24xx_gpios[pin/32];
-        return (S3C2410_GPIO_OFFSET(pin) > chip->chip.ngpio) ? chip : NULL;
+        return (S3C2410_GPIO_OFFSET(pin) < chip->chip.ngpio) ? chip : NULL;
 }
 #endif /* __ASM_ARCH_GPIO_CORE_H */
diff --git a/arch/arm/mach-u300/core.c b/arch/arm/mach-u300/core.c
index 7936085dd758..2e9b8ccd8ec2 100644
--- a/arch/arm/mach-u300/core.c
+++ b/arch/arm/mach-u300/core.c
@@ -510,7 +510,7 @@ static struct db_chip db_chips[] __initdata = {
        }
 };
-static void u300_init_check_chip(void)
+static void __init u300_init_check_chip(void)
 {
        u16 val;
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 8277802ec859..3a7279c1ce5e 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -120,6 +120,32 @@ void show_mem(void)
        printk("%d pages swap cached\n", cached);
 }
+static void __init find_node_limits(int node, struct meminfo *mi,
+        unsigned long *min, unsigned long *max_low, unsigned long *max_high)
+{
+        int i;
+        *min = -1UL;
+        *max_low = *max_high = 0;
+        for_each_nodebank(i, mi, node) {
+                struct membank *bank = &mi->bank[i];
+                unsigned long start, end;
+                start = bank_pfn_start(bank);
+                end = bank_pfn_end(bank);
+                if (*min > start)
+                        *min = start;
+                if (*max_high < end)
+                        *max_high = end;
+                if (bank->highmem)
+                        continue;
+                if (*max_low < end)
+                        *max_low = end;
+        }
+}
 /*
 * FIXME: We really want to avoid allocating the bootmap bitmap
 * over the top of the initrd.  Hopefully, this is located towards
@@ -210,41 +236,25 @@ static inline void map_memory_bank(struct membank *bank)
 #endif
 }
-static unsigned long __init bootmem_init_node(int node, struct meminfo *mi)
+static void __init bootmem_init_node(int node, struct meminfo *mi,
+        unsigned long start_pfn, unsigned long end_pfn)
 {
-        unsigned long start_pfn, end_pfn, boot_pfn;
+        unsigned long boot_pfn;
        unsigned int boot_pages;
        pg_data_t *pgdat;
        int i;
-        start_pfn = -1UL;
-        end_pfn = 0;
        /*
-         * Calculate the pfn range, and map the memory banks for this node.
+         * Map the memory banks for this node.
         */
        for_each_nodebank(i, mi, node) {
                struct membank *bank = &mi->bank[i];
-                unsigned long start, end;
-                start = bank_pfn_start(bank);
+                if (!bank->highmem)
-                end = bank_pfn_end(bank);
+                        map_memory_bank(bank);
-                if (start_pfn > start)
-                        start_pfn = start;
-                if (end_pfn < end)
-                        end_pfn = end;
-                map_memory_bank(bank);
        }
        /*
-         * If there is no memory in this node, ignore it.
-         */
-        if (end_pfn == 0)
-                return end_pfn;
-        /*
         * Allocate the bootmem bitmap page.
         */
        boot_pages = bootmem_bootmap_pages(end_pfn - start_pfn);
@@ -260,7 +270,8 @@ static unsigned long __init bootmem_init_node(int node, struct meminfo *mi)
        for_each_nodebank(i, mi, node) {
                struct membank *bank = &mi->bank[i];
-                free_bootmem_node(pgdat, bank_phys_start(bank), bank_phys_size(bank));
+                if (!bank->highmem)
+                        free_bootmem_node(pgdat, bank_phys_start(bank), bank_phys_size(bank));
                memory_present(node, bank_pfn_start(bank), bank_pfn_end(bank));
        }
@@ -269,8 +280,6 @@ static unsigned long __init bootmem_init_node(int node, struct meminfo *mi)
         */
        reserve_bootmem_node(pgdat, boot_pfn << PAGE_SHIFT,
                             boot_pages << PAGE_SHIFT, BOOTMEM_DEFAULT);
-        return end_pfn;
 }
 static void __init bootmem_reserve_initrd(int node)
@@ -297,33 +306,39 @@ static void __init bootmem_reserve_initrd(int node)
 static void __init bootmem_free_node(int node, struct meminfo *mi)
 {
        unsigned long zone_size[MAX_NR_ZONES], zhole_size[MAX_NR_ZONES];
-        unsigned long start_pfn, end_pfn;
+        unsigned long min, max_low, max_high;
-        pg_data_t *pgdat = NODE_DATA(node);
        int i;
-        start_pfn = pgdat->bdata->node_min_pfn;
+        find_node_limits(node, mi, &min, &max_low, &max_high);
-        end_pfn = pgdat->bdata->node_low_pfn;
        /*
         * initialise the zones within this node.
         */
        memset(zone_size, 0, sizeof(zone_size));
-        memset(zhole_size, 0, sizeof(zhole_size));
        /*
         * The size of this node has already been determined.  If we need
         * to do anything fancy with the allocation of this memory to the
         * zones, now is the time to do it.
         */
-        zone_size[0] = end_pfn - start_pfn;
+        zone_size[0] = max_low - min;
+#ifdef CONFIG_HIGHMEM
+        zone_size[ZONE_HIGHMEM] = max_high - max_low;
+#endif
        /*
         * For each bank in this node, calculate the size of the holes.
         *  holes = node_size - sum(bank_sizes_in_node)
         */
-        zhole_size[0] = zone_size[0];
+        memcpy(zhole_size, zone_size, sizeof(zhole_size));
-        for_each_nodebank(i, mi, node)
+        for_each_nodebank(i, mi, node) {
-                zhole_size[0] -= bank_pfn_size(&mi->bank[i]);
+                int idx = 0;
+#ifdef CONFIG_HIGHMEM
+                if (mi->bank[i].highmem)
+                        idx = ZONE_HIGHMEM;
+#endif
+                zhole_size[idx] -= bank_pfn_size(&mi->bank[i]);
+        }
        /*
         * Adjust the sizes according to any special requirements for
@@ -331,13 +346,13 @@ static void __init bootmem_free_node(int node, struct meminfo *mi)
         */
        arch_adjust_zones(node, zone_size, zhole_size);
-        free_area_init_node(node, zone_size, start_pfn, zhole_size);
+        free_area_init_node(node, zone_size, min, zhole_size);
 }
 void __init bootmem_init(void)
 {
        struct meminfo *mi = &meminfo;
-        unsigned long memend_pfn = 0;
+        unsigned long min, max_low, max_high;
        int node, initrd_node;
        /*
@@ -345,11 +360,29 @@ void __init bootmem_init(void)
         */
        initrd_node = check_initrd(mi);
+        max_low = max_high = 0;
        /*
         * Run through each node initialising the bootmem allocator.
         */
        for_each_node(node) {
-                unsigned long end_pfn = bootmem_init_node(node, mi);
+                unsigned long node_low, node_high;
+                find_node_limits(node, mi, &min, &node_low, &node_high);
+                if (node_low > max_low)
+                        max_low = node_low;
+                if (node_high > max_high)
+                        max_high = node_high;
+                /*
+                 * If there is no memory in this node, ignore it.
+                 * (We can't have nodes which have no lowmem)
+                 */
+                if (node_low == 0)
+                        continue;
+                bootmem_init_node(node, mi, min, node_low);
                /*
                 * Reserve any special node zero regions.
@@ -362,12 +395,6 @@ void __init bootmem_init(void)
                 */
                if (node == initrd_node)
                        bootmem_reserve_initrd(node);
-                /*
-                 * Remember the highest memory PFN.
-                 */
-                if (end_pfn > memend_pfn)
-                        memend_pfn = end_pfn;
        }
        /*
@@ -383,7 +410,7 @@ void __init bootmem_init(void)
        for_each_node(node)
                bootmem_free_node(node, mi);
-        high_memory = __va((memend_pfn << PAGE_SHIFT) - 1) + 1;
+        high_memory = __va((max_low << PAGE_SHIFT) - 1) + 1;
        /*
         * This doesn't seem to be used by the Linux memory manager any
@@ -393,7 +420,8 @@ void __init bootmem_init(void)
         * Note: max_low_pfn and max_pfn reflect the number of _pages_ in
         * the system, not the maximum PFN.
         */
-        max_pfn = max_low_pfn = memend_pfn - PHYS_PFN_OFFSET;
+        max_low_pfn = max_low - PHYS_PFN_OFFSET;
+        max_pfn = max_high - PHYS_PFN_OFFSET;
 }
 static inline int free_area(unsigned long pfn, unsigned long end, char *s)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4722582b17b8..4426ee67ceca 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -687,13 +687,19 @@ __early_param("vmalloc=", early_vmalloc);
 static void __init sanity_check_meminfo(void)
 {
-        int i, j;
+        int i, j, highmem = 0;
        for (i = 0, j = 0; i < meminfo.nr_banks; i++) {
                struct membank *bank = &meminfo.bank[j];
                *bank = meminfo.bank[i];
 #ifdef CONFIG_HIGHMEM
+                if (__va(bank->start) > VMALLOC_MIN ||
+                    __va(bank->start) < (void *)PAGE_OFFSET)
+                        highmem = 1;
+                bank->highmem = highmem;
                /*
                 * Split those memory banks which are partially overlapping
                 * the vmalloc area greatly simplifying things later.
@@ -714,6 +720,7 @@ static void __init sanity_check_meminfo(void)
                                i++;
                                bank[1].size -= VMALLOC_MIN - __va(bank->start);
                                bank[1].start = __pa(VMALLOC_MIN - 1) + 1;
+                                bank[1].highmem = highmem = 1;
                                j++;
                        }
                        bank->size = VMALLOC_MIN - __va(bank->start);
diff --git a/arch/arm/plat-omap/cpu-omap.c b/arch/arm/plat-omap/cpu-omap.c
index 843e8af64066..1868c0d8f9b5 100644
--- a/arch/arm/plat-omap/cpu-omap.c
+++ b/arch/arm/plat-omap/cpu-omap.c
@@ -78,10 +78,10 @@ static int omap_target(struct cpufreq_policy *policy,
        /* Ensure desired rate is within allowed range.  Some govenors
         * (ondemand) will just pass target_freq=0 to get the minimum. */
-        if (target_freq < policy->cpuinfo.min_freq)
+        if (target_freq < policy->min)
-                target_freq = policy->cpuinfo.min_freq;
+                target_freq = policy->min;
-        if (target_freq > policy->cpuinfo.max_freq)
+        if (target_freq > policy->max)
-                target_freq = policy->cpuinfo.max_freq;
+                target_freq = policy->max;
        freqs.old = omap_getspeed(0);
        freqs.new = clk_round_rate(mpu_clk, target_freq * 1000) / 1000;
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index 7677a4a1cef2..e3ac94f09006 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -946,7 +946,9 @@ void omap_start_dma(int lch)
                        cur_lch = next_lch;
                } while (next_lch != -1);
-        } else if (cpu_class_is_omap2()) {
+        } else if (cpu_is_omap242x() ||
+                (cpu_is_omap243x() &&  omap_type() <= OMAP2430_REV_ES1_0)) {
                /* Errata: Need to write lch even if not using chaining */
                dma_write(lch, CLNK_CTRL(lch));
        }
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index 26b387c12423..9298bc0ab171 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -476,14 +476,12 @@ static void _set_gpio_dataout(struct gpio_bank *bank, int gpio, int enable)
        __raw_writel(l, reg);
 }
-static int __omap_get_gpio_datain(int gpio)
+static int _get_gpio_datain(struct gpio_bank *bank, int gpio)
 {
-        struct gpio_bank *bank;
        void __iomem *reg;
        if (check_gpio(gpio) < 0)
                return -EINVAL;
-        bank = get_gpio_bank(gpio);
        reg = bank->base;
        switch (bank->method) {
 #ifdef CONFIG_ARCH_OMAP1
@@ -524,6 +522,53 @@ static int __omap_get_gpio_datain(int gpio)
                        & (1 << get_gpio_index(gpio))) != 0;
 }
+static int _get_gpio_dataout(struct gpio_bank *bank, int gpio)
+{
+        void __iomem *reg;
+        if (check_gpio(gpio) < 0)
+                return -EINVAL;
+        reg = bank->base;
+        switch (bank->method) {
+#ifdef CONFIG_ARCH_OMAP1
+        case METHOD_MPUIO:
+                reg += OMAP_MPUIO_OUTPUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP15XX
+        case METHOD_GPIO_1510:
+                reg += OMAP1510_GPIO_DATA_OUTPUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP16XX
+        case METHOD_GPIO_1610:
+                reg += OMAP1610_GPIO_DATAOUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP730
+        case METHOD_GPIO_730:
+                reg += OMAP730_GPIO_DATA_OUTPUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP850
+        case METHOD_GPIO_850:
+                reg += OMAP850_GPIO_DATA_OUTPUT;
+                break;
+#endif
+#if defined(CONFIG_ARCH_OMAP24XX) || defined(CONFIG_ARCH_OMAP34XX) || \
+                defined(CONFIG_ARCH_OMAP4)
+        case METHOD_GPIO_24XX:
+                reg += OMAP24XX_GPIO_DATAOUT;
+                break;
+#endif
+        default:
+                return -EINVAL;
+        }
+        return (__raw_readl(reg) & (1 << get_gpio_index(gpio))) != 0;
+}
 #define MOD_REG_BIT(reg, bit_mask, set) \
 do {    \
        int l = __raw_readl(base + reg); \
@@ -1189,6 +1234,7 @@ static void gpio_mask_irq(unsigned int irq)
        struct gpio_bank *bank = get_irq_chip_data(irq);
        _set_gpio_irqenable(bank, gpio, 0);
+        _set_gpio_triggering(bank, get_gpio_index(gpio), IRQ_TYPE_NONE);
 }
 static void gpio_unmask_irq(unsigned int irq)
@@ -1196,6 +1242,11 @@ static void gpio_unmask_irq(unsigned int irq)
        unsigned int gpio = irq - IH_GPIO_BASE;
        struct gpio_bank *bank = get_irq_chip_data(irq);
        unsigned int irq_mask = 1 << get_gpio_index(gpio);
+        struct irq_desc *desc = irq_to_desc(irq);
+        u32 trigger = desc->status & IRQ_TYPE_SENSE_MASK;
+        if (trigger)
+                _set_gpio_triggering(bank, get_gpio_index(gpio), trigger);
        /* For level-triggered GPIOs, the clearing must be done after
         * the HW source is cleared, thus after the handler has run */
@@ -1350,9 +1401,49 @@ static int gpio_input(struct gpio_chip *chip, unsigned offset)
        return 0;
 }
+static int gpio_is_input(struct gpio_bank *bank, int mask)
+{
+        void __iomem *reg = bank->base;
+        switch (bank->method) {
+        case METHOD_MPUIO:
+                reg += OMAP_MPUIO_IO_CNTL;
+                break;
+        case METHOD_GPIO_1510:
+                reg += OMAP1510_GPIO_DIR_CONTROL;
+                break;
+        case METHOD_GPIO_1610:
+                reg += OMAP1610_GPIO_DIRECTION;
+                break;
+        case METHOD_GPIO_730:
+                reg += OMAP730_GPIO_DIR_CONTROL;
+                break;
+        case METHOD_GPIO_850:
+                reg += OMAP850_GPIO_DIR_CONTROL;
+                break;
+        case METHOD_GPIO_24XX:
+                reg += OMAP24XX_GPIO_OE;
+                break;
+        }
+        return __raw_readl(reg) & mask;
+}
 static int gpio_get(struct gpio_chip *chip, unsigned offset)
 {
-        return __omap_get_gpio_datain(chip->base + offset);
+        struct gpio_bank *bank;
+        void __iomem *reg;
+        int gpio;
+        u32 mask;
+        gpio = chip->base + offset;
+        bank = get_gpio_bank(gpio);
+        reg = bank->base;
+        mask = 1 << get_gpio_index(gpio);
+        if (gpio_is_input(bank, mask))
+                return _get_gpio_datain(bank, gpio);
+        else
+                return _get_gpio_dataout(bank, gpio);
 }
 static int gpio_output(struct gpio_chip *chip, unsigned offset, int value)
@@ -1886,34 +1977,6 @@ arch_initcall(omap_gpio_sysinit);
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
-static int gpio_is_input(struct gpio_bank *bank, int mask)
-{
-        void __iomem *reg = bank->base;
-        switch (bank->method) {
-        case METHOD_MPUIO:
-                reg += OMAP_MPUIO_IO_CNTL;
-                break;
-        case METHOD_GPIO_1510:
-                reg += OMAP1510_GPIO_DIR_CONTROL;
-                break;
-        case METHOD_GPIO_1610:
-                reg += OMAP1610_GPIO_DIRECTION;
-                break;
-        case METHOD_GPIO_730:
-                reg += OMAP730_GPIO_DIR_CONTROL;
-                break;
-        case METHOD_GPIO_850:
-                reg += OMAP850_GPIO_DIR_CONTROL;
-                break;
-        case METHOD_GPIO_24XX:
-                reg += OMAP24XX_GPIO_OE;
-                break;
-        }
-        return __raw_readl(reg) & mask;
-}
 static int dbg_gpio_show(struct seq_file *s, void *unused)
 {
        unsigned        i, j, gpio;
diff --git a/arch/arm/plat-omap/include/mach/clock.h b/arch/arm/plat-omap/include/mach/clock.h
index f9f65e1ba3f1..4b8b0d65cbf2 100644
--- a/arch/arm/plat-omap/include/mach/clock.h
+++ b/arch/arm/plat-omap/include/mach/clock.h
@@ -20,6 +20,8 @@ struct clockdomain;
 struct clkops {
        int                     (*enable)(struct clk *);
        void                    (*disable)(struct clk *);
+        void                    (*find_idlest)(struct clk *, void __iomem **, u8 *);
+        void                    (*find_companion)(struct clk *, void __iomem **, u8 *);
 };
 #if defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3) || \
diff --git a/arch/arm/plat-omap/include/mach/cpu.h b/arch/arm/plat-omap/include/mach/cpu.h
index 285eaa3a8275..11e73d9e8928 100644
--- a/arch/arm/plat-omap/include/mach/cpu.h
+++ b/arch/arm/plat-omap/include/mach/cpu.h
@@ -378,9 +378,6 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define cpu_class_is_omap2()    (cpu_is_omap24xx() || cpu_is_omap34xx() || \
                                cpu_is_omap44xx())
-#if defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3) || \
-                        defined(CONFIG_ARCH_OMAP4)
 /* Various silicon revisions for omap2 */
 #define OMAP242X_CLASS          0x24200024
 #define OMAP2420_REV_ES1_0      0x24200024
@@ -436,5 +433,3 @@ IS_OMAP_TYPE(3430, 0x3430)
 int omap_chip_is(struct omap_chip_id oci);
 void omap2_check_revision(void);
-#endif    /* defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3) */
diff --git a/arch/arm/plat-omap/include/mach/io.h b/arch/arm/plat-omap/include/mach/io.h
index 73f483d56ca6..21fb0efdda86 100644
--- a/arch/arm/plat-omap/include/mach/io.h
+++ b/arch/arm/plat-omap/include/mach/io.h
@@ -228,7 +228,8 @@ extern void omap1_map_common_io(void);
 extern void omap1_init_common_hw(void);
 extern void omap2_map_common_io(void);
-extern void omap2_init_common_hw(struct omap_sdrc_params *sp);
+extern void omap2_init_common_hw(struct omap_sdrc_params *sdrc_cs0,
+                                 struct omap_sdrc_params *sdrc_cs1);
 #define __arch_ioremap(p,s,t)   omap_ioremap(p,s,t)
 #define __arch_iounmap(v)       omap_iounmap(v)
diff --git a/arch/arm/plat-omap/include/mach/mux.h b/arch/arm/plat-omap/include/mach/mux.h
index 85a621705766..80281c458baf 100644
--- a/arch/arm/plat-omap/include/mach/mux.h
+++ b/arch/arm/plat-omap/include/mach/mux.h
@@ -853,6 +853,10 @@ enum omap34xx_index {
        AE5_34XX_GPIO143,
        H19_34XX_GPIO164_OUT,
        J25_34XX_GPIO170,
+        /* OMAP3 SDRC CKE signals to SDR/DDR ram chips */
+        H16_34XX_SDRC_CKE0,
+        H17_34XX_SDRC_CKE1,
 };
 struct omap_mux_cfg {
diff --git a/arch/arm/plat-omap/include/mach/prcm.h b/arch/arm/plat-omap/include/mach/prcm.h
index 24ac3c715912..cda2a70397b4 100644
--- a/arch/arm/plat-omap/include/mach/prcm.h
+++ b/arch/arm/plat-omap/include/mach/prcm.h
@@ -25,6 +25,7 @@
 u32 omap_prcm_get_reset_sources(void);
 void omap_prcm_arch_reset(char mode);
+int omap2_cm_wait_idlest(void __iomem *reg, u32 mask, const char *name);
 #endif
diff --git a/arch/arm/plat-omap/include/mach/sdrc.h b/arch/arm/plat-omap/include/mach/sdrc.h
index adc73522491f..0be18e4ff182 100644
--- a/arch/arm/plat-omap/include/mach/sdrc.h
+++ b/arch/arm/plat-omap/include/mach/sdrc.h
@@ -30,6 +30,10 @@
 #define SDRC_ACTIM_CTRL_A_0     0x09c
 #define SDRC_ACTIM_CTRL_B_0     0x0a0
 #define SDRC_RFR_CTRL_0         0x0a4
+#define SDRC_MR_1               0x0B4
+#define SDRC_ACTIM_CTRL_A_1     0x0C4
+#define SDRC_ACTIM_CTRL_B_1     0x0C8
+#define SDRC_RFR_CTRL_1         0x0D4
 /*
 * These values represent the number of memory clock cycles between
@@ -102,8 +106,11 @@ struct omap_sdrc_params {
        u32 mr;
 };
-void __init omap2_sdrc_init(struct omap_sdrc_params *sp);
+void __init omap2_sdrc_init(struct omap_sdrc_params *sdrc_cs0,
-struct omap_sdrc_params *omap2_sdrc_get_params(unsigned long r);
+                            struct omap_sdrc_params *sdrc_cs1);
+int omap2_sdrc_get_params(unsigned long r,
+                          struct omap_sdrc_params **sdrc_cs0,
+                          struct omap_sdrc_params **sdrc_cs1);
 #ifdef CONFIG_ARCH_OMAP2
diff --git a/arch/arm/plat-omap/include/mach/serial.h b/arch/arm/plat-omap/include/mach/serial.h
index 13abd02d1527..def0529c75eb 100644
--- a/arch/arm/plat-omap/include/mach/serial.h
+++ b/arch/arm/plat-omap/include/mach/serial.h
@@ -59,6 +59,7 @@ extern void omap_uart_check_wakeup(void);
 extern void omap_uart_prepare_suspend(void);
 extern void omap_uart_prepare_idle(int num);
 extern void omap_uart_resume_idle(int num);
+extern void omap_uart_enable_irqs(int enable);
 #endif
 #endif
diff --git a/arch/arm/plat-omap/include/mach/sram.h b/arch/arm/plat-omap/include/mach/sram.h
index 4d53cc59d7a3..8974e3fc2691 100644
--- a/arch/arm/plat-omap/include/mach/sram.h
+++ b/arch/arm/plat-omap/include/mach/sram.h
@@ -21,11 +21,12 @@ extern void omap2_sram_reprogram_sdrc(u32 perf_level, u32 dll_val,
                                      u32 mem_type);
 extern u32 omap2_set_prcm(u32 dpll_ctrl_val, u32 sdrc_rfr_val, int bypass);
-extern u32 omap3_configure_core_dpll(u32 sdrc_rfr_ctrl,
+extern u32 omap3_configure_core_dpll(
-                                     u32 sdrc_actim_ctrla,
+                        u32 m2, u32 unlock_dll, u32 f, u32 inc,
-                                     u32 sdrc_actim_ctrlb, u32 m2,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
-                                     u32 unlock_dll, u32 f, u32 sdrc_mr,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
-                                     u32 inc);
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1);
 /* Do not use these */
 extern void omap1_sram_reprogram_clock(u32 ckctl, u32 dpllctl);
@@ -59,12 +60,12 @@ extern void omap243x_sram_reprogram_sdrc(u32 perf_level, u32 dll_val,
                                                u32 mem_type);
 extern unsigned long omap243x_sram_reprogram_sdrc_sz;
+extern u32 omap3_sram_configure_core_dpll(
-extern u32 omap3_sram_configure_core_dpll(u32 sdrc_rfr_ctrl,
+                        u32 m2, u32 unlock_dll, u32 f, u32 inc,
-                                          u32 sdrc_actim_ctrla,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
-                                          u32 sdrc_actim_ctrlb, u32 m2,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
-                                          u32 unlock_dll, u32 f, u32 sdrc_mr,
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
-                                          u32 inc);
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1);
 extern unsigned long omap3_sram_configure_core_dpll_sz;
 #endif
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 4ea73804d21e..5eae7876979c 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -44,9 +44,9 @@
 #define OMAP2_SRAM_VA           0xe3000000
 #define OMAP2_SRAM_PUB_VA       (OMAP2_SRAM_VA + 0x800)
 #define OMAP3_SRAM_PA           0x40200000
-#define OMAP3_SRAM_VA           0xd7000000
+#define OMAP3_SRAM_VA           0xe3000000
 #define OMAP3_SRAM_PUB_PA       0x40208000
-#define OMAP3_SRAM_PUB_VA       0xd7008000
+#define OMAP3_SRAM_PUB_VA       (OMAP3_SRAM_VA + 0x8000)
 #define OMAP4_SRAM_PA           0x40200000              /*0x402f0000*/
 #define OMAP4_SRAM_VA           0xd7000000              /*0xd70f0000*/
@@ -373,20 +373,26 @@ static inline int omap243x_sram_init(void)
 #ifdef CONFIG_ARCH_OMAP3
-static u32 (*_omap3_sram_configure_core_dpll)(u32 sdrc_rfr_ctrl,
+static u32 (*_omap3_sram_configure_core_dpll)(
-                                              u32 sdrc_actim_ctrla,
+                        u32 m2, u32 unlock_dll, u32 f, u32 inc,
-                                              u32 sdrc_actim_ctrlb,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
-                                              u32 m2, u32 unlock_dll,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
-                                              u32 f, u32 sdrc_mr, u32 inc);
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
-u32 omap3_configure_core_dpll(u32 sdrc_rfr_ctrl, u32 sdrc_actim_ctrla,
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1);
-                              u32 sdrc_actim_ctrlb, u32 m2, u32 unlock_dll,
-                              u32 f, u32 sdrc_mr, u32 inc)
+u32 omap3_configure_core_dpll(u32 m2, u32 unlock_dll, u32 f, u32 inc,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1)
 {
        BUG_ON(!_omap3_sram_configure_core_dpll);
-        return _omap3_sram_configure_core_dpll(sdrc_rfr_ctrl,
+        return _omap3_sram_configure_core_dpll(
-                                               sdrc_actim_ctrla,
+                        m2, unlock_dll, f, inc,
-                                               sdrc_actim_ctrlb, m2,
+                        sdrc_rfr_ctrl_0, sdrc_actim_ctrl_a_0,
-                                               unlock_dll, f, sdrc_mr, inc);
+                        sdrc_actim_ctrl_b_0, sdrc_mr_0,
+                        sdrc_rfr_ctrl_1, sdrc_actim_ctrl_a_1,
+                        sdrc_actim_ctrl_b_1, sdrc_mr_1);
 }
 /* REVISIT: Should this be same as omap34xx_sram_init() after off-idle? */
diff --git a/arch/arm/plat-s3c24xx/clock-dclk.c b/arch/arm/plat-s3c24xx/clock-dclk.c
index 5b75a797b5ab..0afb217a775e 100644
--- a/arch/arm/plat-s3c24xx/clock-dclk.c
+++ b/arch/arm/plat-s3c24xx/clock-dclk.c
@@ -129,7 +129,7 @@ static int s3c24xx_clkout_setparent(struct clk *clk, struct clk *parent)
        /* calculate the MISCCR setting for the clock */
-        if (parent == &clk_xtal)
+        if (parent == &clk_mpll)
                source = S3C2410_MISCCR_CLK0_MPLL;
        else if (parent == &clk_upll)
                source = S3C2410_MISCCR_CLK0_UPLL;
diff --git a/arch/arm/plat-s3c24xx/pwm.c b/arch/arm/plat-s3c24xx/pwm.c
index 0120b760315b..82a6d4de02a3 100644
--- a/arch/arm/plat-s3c24xx/pwm.c
+++ b/arch/arm/plat-s3c24xx/pwm.c
@@ -246,6 +246,10 @@ int pwm_config(struct pwm_device *pwm, int duty_ns, int period_ns)
        tcmp = duty_ns / tin_ns;
        tcmp = tcnt - tcmp;
+        /* the pwm hw only checks the compare register after a decrement,
+           so the pin never toggles if tcmp = tcnt */
+        if (tcmp == tcnt)
+                tcmp--;
        pwm_dbg(pwm, "tin_ns=%lu, tcmp=%ld/%lu\n", tin_ns, tcmp, tcnt);
diff --git a/arch/arm/plat-s3c64xx/pm.c b/arch/arm/plat-s3c64xx/pm.c
index 07a6516a4f3c..47632fc7eb66 100644
--- a/arch/arm/plat-s3c64xx/pm.c
+++ b/arch/arm/plat-s3c64xx/pm.c
@@ -117,8 +117,6 @@ void s3c_pm_save_core(void)
 * this.
 */
-#include <plat/regs-gpio.h>
 static void s3c64xx_cpu_suspend(void)
 {
        unsigned long tmp;
diff --git a/arch/arm/plat-s3c64xx/s3c6400-clock.c b/arch/arm/plat-s3c64xx/s3c6400-clock.c
index 1debc1f9f987..febac1950d8e 100644
--- a/arch/arm/plat-s3c64xx/s3c6400-clock.c
+++ b/arch/arm/plat-s3c64xx/s3c6400-clock.c
@@ -153,7 +153,7 @@ static unsigned long s3c64xx_clk_arm_round_rate(struct clk *clk,
        u32 div;
        if (parent < rate)
-                return rate;
+                return parent;
        div = (parent / rate) - 1;
        if (div > armclk_mask)
@@ -175,7 +175,7 @@ static int s3c64xx_clk_arm_set_rate(struct clk *clk, unsigned long rate)
        div = clk_get_rate(clk->parent) / rate;
        val = __raw_readl(S3C_CLK_DIV0);
-        val &= armclk_mask;
+        val &= ~armclk_mask;
        val |= (div - 1);
        __raw_writel(val, S3C_CLK_DIV0);
diff --git a/arch/arm/plat-stmp3xxx/pinmux.c b/arch/arm/plat-stmp3xxx/pinmux.c
index d41200382208..6d6b1a468eda 100644
--- a/arch/arm/plat-stmp3xxx/pinmux.c
+++ b/arch/arm/plat-stmp3xxx/pinmux.c
@@ -22,7 +22,6 @@
 #include <linux/sysdev.h>
 #include <linux/string.h>
 #include <linux/bitops.h>
-#include <linux/sysdev.h>
 #include <linux/irq.h>
 #include <mach/hardware.h>
diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
index 58a7e46affda..e7cbaa02cd0b 100644
--- a/arch/ia64/Makefile
+++ b/arch/ia64/Makefile
@@ -41,11 +41,6 @@ $(error Sorry, you need a newer version of the assember, one that is built from
                ftp://ftp.hpl.hp.com/pub/linux-ia64/gas-030124.tar.gz)
 endif
-ifeq ($(call cc-version),0304)
-        cflags-$(CONFIG_ITANIUM)        += -mtune=merced
-        cflags-$(CONFIG_MCKINLEY)       += -mtune=mckinley
-endif
 KBUILD_CFLAGS += $(cflags-y)
 head-y := arch/ia64/kernel/head.o arch/ia64/kernel/init_task.o
diff --git a/arch/ia64/include/asm/bitops.h b/arch/ia64/include/asm/bitops.h
index e2ca80037335..57a2787bc9fb 100644
--- a/arch/ia64/include/asm/bitops.h
+++ b/arch/ia64/include/asm/bitops.h
@@ -286,7 +286,7 @@ __test_and_clear_bit(int nr, volatile void * addr)
 {
        __u32 *p = (__u32 *) addr + (nr >> 5);
        __u32 m = 1 << (nr & 31);
-        int oldbitset = *p & m;
+        int oldbitset = (*p & m) != 0;
        *p &= ~m;
        return oldbitset;
diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
index 0a9cc73d35c7..8840a690d1e7 100644
--- a/arch/ia64/include/asm/pgtable.h
+++ b/arch/ia64/include/asm/pgtable.h
@@ -155,7 +155,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/mmu_context.h>
-#include <asm/processor.h>
 /*
 * Next come the mappings that determine how mmap() protection bits
diff --git a/arch/ia64/kernel/ia64_ksyms.c b/arch/ia64/kernel/ia64_ksyms.c
index 2d311864e359..8ebccb589e1c 100644
--- a/arch/ia64/kernel/ia64_ksyms.c
+++ b/arch/ia64/kernel/ia64_ksyms.c
@@ -21,6 +21,7 @@ EXPORT_SYMBOL(csum_ipv6_magic);
 #include <asm/page.h>
 EXPORT_SYMBOL(clear_page);
+EXPORT_SYMBOL(copy_page);
 #ifdef CONFIG_VIRTUAL_MEM_MAP
 #include <linux/bootmem.h>
@@ -60,9 +61,6 @@ EXPORT_SYMBOL(__udivdi3);
 EXPORT_SYMBOL(__moddi3);
 EXPORT_SYMBOL(__umoddi3);
-#include <asm/page.h>
-EXPORT_SYMBOL(copy_page);
 #if defined(CONFIG_MD_RAID456) || defined(CONFIG_MD_RAID456_MODULE)
 extern void xor_ia64_2(void);
 extern void xor_ia64_3(void);
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index c48b03f2b61d..dab4d393908c 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -1072,6 +1072,10 @@ iosapic_init (unsigned long phys_addr, unsigned int gsi_base)
        }
        addr = ioremap(phys_addr, 0);
+        if (addr == NULL) {
+                spin_unlock_irqrestore(&iosapic_lock, flags);
+                return -ENOMEM;
+        }
        ver = iosapic_version(addr);
        if ((err = iosapic_check_gsi_range(gsi_base, ver))) {
                iounmap(addr);
diff --git a/arch/ia64/kernel/pci-dma.c b/arch/ia64/kernel/pci-dma.c
index 05695962fe44..f6b1ff0aea76 100644
--- a/arch/ia64/kernel/pci-dma.c
+++ b/arch/ia64/kernel/pci-dma.c
@@ -69,11 +69,6 @@ iommu_dma_init(void)
 int iommu_dma_supported(struct device *dev, u64 mask)
 {
-        struct dma_map_ops *ops = platform_dma_get_ops(dev);
-        if (ops->dma_supported)
-                return ops->dma_supported(dev, mask);
        /* Copied from i386. Doesn't make much sense, because it will
           only work for pci_alloc_coherent.
           The caller just has to use GFP_DMA in this case. */
diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
index bc80dff1df7a..8f060352e129 100644
--- a/arch/ia64/kernel/topology.c
+++ b/arch/ia64/kernel/topology.c
@@ -372,6 +372,10 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
        retval = kobject_init_and_add(&all_cpu_cache_info[cpu].kobj,
                                      &cache_ktype_percpu_entry, &sys_dev->kobj,
                                      "%s", "cache");
+        if (unlikely(retval < 0)) {
+                cpu_cache_sysfs_exit(cpu);
+                return retval;
+        }
        for (i = 0; i < all_cpu_cache_info[cpu].num_cache_leaves; i++) {
                this_object = LEAF_KOBJECT_PTR(cpu,i);
@@ -385,7 +389,7 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
                        }
                        kobject_put(&all_cpu_cache_info[cpu].kobj);
                        cpu_cache_sysfs_exit(cpu);
-                        break;
+                        return retval;
                }
                kobject_uevent(&(this_object->kobj), KOBJ_ADD);
        }
diff --git a/arch/ia64/kvm/mmio.c b/arch/ia64/kvm/mmio.c
index 21f63fffc379..9bf55afd08d0 100644
--- a/arch/ia64/kvm/mmio.c
+++ b/arch/ia64/kvm/mmio.c
@@ -247,7 +247,8 @@ void emulate_io_inst(struct kvm_vcpu *vcpu, u64 padr, u64 ma)
                vcpu_get_fpreg(vcpu, inst.M9.f2, &v);
                /* Write high word. FIXME: this is a kludge!  */
                v.u.bits[1] &= 0x3ffff;
-                mmio_access(vcpu, padr + 8, &v.u.bits[1], 8, ma, IOREQ_WRITE);
+                mmio_access(vcpu, padr + 8, (u64 *)&v.u.bits[1], 8,
+                            ma, IOREQ_WRITE);
                data = v.u.bits[0];
                size = 3;
        } else if (inst.M10.major == 7 && inst.M10.x6 == 0x3B) {
@@ -265,7 +266,8 @@ void emulate_io_inst(struct kvm_vcpu *vcpu, u64 padr, u64 ma)
                /* Write high word.FIXME: this is a kludge!  */
                v.u.bits[1] &= 0x3ffff;
-                mmio_access(vcpu, padr + 8, &v.u.bits[1], 8, ma, IOREQ_WRITE);
+                mmio_access(vcpu, padr + 8, (u64 *)&v.u.bits[1],
+                            8, ma, IOREQ_WRITE);
                data = v.u.bits[0];
                size = 3;
        } else if (inst.M10.major == 7 && inst.M10.x6 == 0x31) {
diff --git a/arch/ia64/kvm/vcpu.c b/arch/ia64/kvm/vcpu.c
index 46b02cbcc874..cc406d064a09 100644
--- a/arch/ia64/kvm/vcpu.c
+++ b/arch/ia64/kvm/vcpu.c
@@ -461,7 +461,7 @@ void setreg(unsigned long regnum, unsigned long val,
 u64 vcpu_get_gr(struct kvm_vcpu *vcpu, unsigned long reg)
 {
        struct kvm_pt_regs *regs = vcpu_regs(vcpu);
-        u64 val;
+        unsigned long val;
        if (!reg)
                return 0;
@@ -469,7 +469,7 @@ u64 vcpu_get_gr(struct kvm_vcpu *vcpu, unsigned long reg)
        return val;
 }
-void vcpu_set_gr(struct kvm_vcpu *vcpu, u64 reg, u64 value, int nat)
+void vcpu_set_gr(struct kvm_vcpu *vcpu, unsigned long reg, u64 value, int nat)
 {
        struct kvm_pt_regs *regs = vcpu_regs(vcpu);
        long sof = (regs->cr_ifs) & 0x7f;
@@ -1072,7 +1072,7 @@ void kvm_ttag(struct kvm_vcpu *vcpu, INST64 inst)
        vcpu_set_gr(vcpu, inst.M46.r1, tag, 0);
 }
-int vcpu_tpa(struct kvm_vcpu *vcpu, u64 vadr, u64 *padr)
+int vcpu_tpa(struct kvm_vcpu *vcpu, u64 vadr, unsigned long *padr)
 {
        struct thash_data *data;
        union ia64_isr visr, pt_isr;
diff --git a/arch/ia64/kvm/vcpu.h b/arch/ia64/kvm/vcpu.h
index 042af92ced83..360724d3ae69 100644
--- a/arch/ia64/kvm/vcpu.h
+++ b/arch/ia64/kvm/vcpu.h
@@ -686,14 +686,15 @@ static inline int highest_inservice_irq(struct kvm_vcpu *vcpu)
        return highest_bits((int *)&(VMX(vcpu, insvc[0])));
 }
-extern void vcpu_get_fpreg(struct kvm_vcpu *vcpu, u64 reg,
+extern void vcpu_get_fpreg(struct kvm_vcpu *vcpu, unsigned long reg,
                                        struct ia64_fpreg *val);
-extern void vcpu_set_fpreg(struct kvm_vcpu *vcpu, u64 reg,
+extern void vcpu_set_fpreg(struct kvm_vcpu *vcpu, unsigned long reg,
                                        struct ia64_fpreg *val);
-extern u64 vcpu_get_gr(struct kvm_vcpu *vcpu, u64 reg);
+extern u64 vcpu_get_gr(struct kvm_vcpu *vcpu, unsigned long reg);
-extern void vcpu_set_gr(struct kvm_vcpu *vcpu, u64 reg, u64 val, int nat);
+extern void vcpu_set_gr(struct kvm_vcpu *vcpu, unsigned long reg,
-extern u64 vcpu_get_psr(struct kvm_vcpu *vcpu);
+                        u64 val, int nat);
-extern void vcpu_set_psr(struct kvm_vcpu *vcpu, u64 val);
+extern unsigned long vcpu_get_psr(struct kvm_vcpu *vcpu);
+extern void vcpu_set_psr(struct kvm_vcpu *vcpu, unsigned long val);
 extern u64 vcpu_thash(struct kvm_vcpu *vcpu, u64 vadr);
 extern void vcpu_bsw0(struct kvm_vcpu *vcpu);
 extern void thash_vhpt_insert(struct kvm_vcpu *v, u64 pte,
diff --git a/arch/mips/alchemy/mtx-1/platform.c b/arch/mips/alchemy/mtx-1/platform.c
index 8b5914d1241f..e30e42add697 100644
--- a/arch/mips/alchemy/mtx-1/platform.c
+++ b/arch/mips/alchemy/mtx-1/platform.c
@@ -1,7 +1,7 @@
 /*
 * MTX-1 platform devices registration
 *
- * Copyright (C) 2007, Florian Fainelli <florian@openwrt.org>
+ * Copyright (C) 2007-2009, Florian Fainelli <florian@openwrt.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -142,7 +142,17 @@ static struct __initdata platform_device * mtx1_devs[] = {
 static int __init mtx1_register_devices(void)
 {
-        gpio_direction_input(207);
+        int rc;
+        rc = gpio_request(mtx1_gpio_button[0].gpio,
+                                        mtx1_gpio_button[0].desc);
+        if (rc < 0) {
+                printk(KERN_INFO "mtx1: failed to request %d\n",
+                                        mtx1_gpio_button[0].gpio);
+                goto out;
+        }
+        gpio_direction_input(mtx1_gpio_button[0].gpio);
+out:
        return platform_add_devices(mtx1_devs, ARRAY_SIZE(mtx1_devs));
 }
diff --git a/arch/mips/ar7/Makefile b/arch/mips/ar7/Makefile
index 7435e44b3964..26bc5da18997 100644
--- a/arch/mips/ar7/Makefile
+++ b/arch/mips/ar7/Makefile
@@ -8,3 +8,4 @@ obj-y := \
        platform.o \
        gpio.o \
        clock.o
+EXTRA_CFLAGS += -Werror
diff --git a/arch/mips/ar7/clock.c b/arch/mips/ar7/clock.c
index 27dc6663f2fa..cc65c8eb391b 100644
--- a/arch/mips/ar7/clock.c
+++ b/arch/mips/ar7/clock.c
@@ -264,19 +264,6 @@ static void __init tnetd7300_init_clocks(void)
        iounmap(bootcr);
 }
-static int tnetd7200_get_clock(int base, struct tnetd7200_clock *clock,
-        u32 *bootcr, u32 bus_clock)
-{
-        int divisor = ((readl(&clock->prediv) & 0x1f) + 1) *
-                ((readl(&clock->postdiv) & 0x1f) + 1);
-        if (*bootcr & BOOT_PLL_BYPASS)
-                return base / divisor;
-        return base * ((readl(&clock->mul) & 0xf) + 1) / divisor;
-}
 static void tnetd7200_set_clock(int base, struct tnetd7200_clock *clock,
        int prediv, int postdiv, int postdiv2, int mul, u32 frequency)
 {
diff --git a/arch/mips/ar7/memory.c b/arch/mips/ar7/memory.c
index 46fed44825a6..696c723dc6d4 100644
--- a/arch/mips/ar7/memory.c
+++ b/arch/mips/ar7/memory.c
@@ -52,7 +52,7 @@ static int __init memsize(void)
                size <<= 1;
        } while (size < (64 << 20));
-        writel(tmpaddr, &addr);
+        writel((u32)tmpaddr, &addr);
        return size;
 }
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 542244961780..2ecab6155932 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -28,7 +28,6 @@
 #include <linux/serial_8250.h>
 #include <linux/ioport.h>
 #include <linux/io.h>
-#include <linux/version.h>
 #include <linux/vlynq.h>
 #include <linux/leds.h>
 #include <linux/string.h>
@@ -243,13 +242,13 @@ static struct platform_device physmap_flash = {
        .num_resources = 1,
 };
-static u64 cpmac_dma_mask = DMA_32BIT_MASK;
+static u64 cpmac_dma_mask = DMA_BIT_MASK(32);
 static struct platform_device cpmac_low = {
        .id = 0,
        .name = "cpmac",
        .dev = {
                .dma_mask = &cpmac_dma_mask,
-                .coherent_dma_mask = DMA_32BIT_MASK,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                .platform_data = &cpmac_low_data,
        },
        .resource = cpmac_low_res,
@@ -261,7 +260,7 @@ static struct platform_device cpmac_high = {
        .name = "cpmac",
        .dev = {
                .dma_mask = &cpmac_dma_mask,
-                .coherent_dma_mask = DMA_32BIT_MASK,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                .platform_data = &cpmac_high_data,
        },
        .resource = cpmac_high_res,
@@ -481,6 +480,7 @@ static void __init detect_leds(void)
 static int __init ar7_register_devices(void)
 {
        int res;
+#ifdef CONFIG_SERIAL_8250
        static struct uart_port uart_port[2];
        memset(uart_port, 0, sizeof(struct uart_port) * 2);
@@ -512,7 +512,7 @@ static int __init ar7_register_devices(void)
                if (res)
                        return res;
        }
+#endif /* CONFIG_SERIAL_8250 */
        res = platform_device_register(&physmap_flash);
        if (res)
                return res;
diff --git a/arch/mips/ar7/prom.c b/arch/mips/ar7/prom.c
index a320bceb2f9d..5ad6f1db6567 100644
--- a/arch/mips/ar7/prom.c
+++ b/arch/mips/ar7/prom.c
@@ -144,7 +144,7 @@ static char * __init lookup_psp_var_map(u8 num)
 {
        int i;
-        for (i = 0; i < sizeof(psp_var_map); i++)
+        for (i = 0; i < ARRAY_SIZE(psp_var_map); i++)
                if (psp_var_map[i].num == num)
                        return psp_var_map[i].value;
diff --git a/arch/mips/ar7/setup.c b/arch/mips/ar7/setup.c
index 6ebb5f16d967..39f6b5b96463 100644
--- a/arch/mips/ar7/setup.c
+++ b/arch/mips/ar7/setup.c
@@ -15,7 +15,6 @@
 *  with this program; if not, write to the Free Software Foundation, Inc.,
 *  59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
 */
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/pm.h>
diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c
index 0b891a9c6253..32d51a31dc48 100644
--- a/arch/mips/cavium-octeon/smp.c
+++ b/arch/mips/cavium-octeon/smp.c
@@ -194,11 +194,11 @@ static void octeon_init_secondary(void)
 void octeon_prepare_cpus(unsigned int max_cpus)
 {
        cvmx_write_csr(CVMX_CIU_MBOX_CLRX(cvmx_get_core_num()), 0xffffffff);
-        if (request_irq(OCTEON_IRQ_MBOX0, mailbox_interrupt, IRQF_SHARED,
+        if (request_irq(OCTEON_IRQ_MBOX0, mailbox_interrupt, IRQF_DISABLED,
                        "mailbox0", mailbox_interrupt)) {
                panic("Cannot request_irq(OCTEON_IRQ_MBOX0)\n");
        }
-        if (request_irq(OCTEON_IRQ_MBOX1, mailbox_interrupt, IRQF_SHARED,
+        if (request_irq(OCTEON_IRQ_MBOX1, mailbox_interrupt, IRQF_DISABLED,
                        "mailbox1", mailbox_interrupt)) {
                panic("Cannot request_irq(OCTEON_IRQ_MBOX1)\n");
        }
diff --git a/arch/mips/dec/ecc-berr.c b/arch/mips/dec/ecc-berr.c
index 6a17c9b508ea..7abce661b90f 100644
--- a/arch/mips/dec/ecc-berr.c
+++ b/arch/mips/dec/ecc-berr.c
@@ -1,6 +1,4 @@
 /*
- *      linux/arch/mips/dec/ecc-berr.c
- *
 *      Bus error event handling code for systems equipped with ECC
 *      handling logic, i.e. DECstation/DECsystem 5000/200 (KN02),
 *      5000/240 (KN03), 5000/260 (KN05) and DECsystem 5900 (KN03),
diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
index 00cecdcc75f2..82c852818781 100644
--- a/arch/mips/dec/int-handler.S
+++ b/arch/mips/dec/int-handler.S
@@ -1,6 +1,4 @@
 /*
- * arch/mips/dec/int-handler.S
- *
 * Copyright (C) 1995, 1996, 1997 Paul M. Antoine and Harald Koerfgen
 * Copyright (C) 2000, 2001, 2002, 2003, 2005  Maciej W. Rozycki
 *
diff --git a/arch/mips/dec/ioasic-irq.c b/arch/mips/dec/ioasic-irq.c
index 3acb133668dc..cb41954fc321 100644
--- a/arch/mips/dec/ioasic-irq.c
+++ b/arch/mips/dec/ioasic-irq.c
@@ -1,6 +1,4 @@
 /*
- *      linux/arch/mips/dec/ioasic-irq.c
- *
 *      DEC I/O ASIC interrupts.
 *
 *      Copyright (c) 2002, 2003  Maciej W. Rozycki
diff --git a/arch/mips/dec/kn01-berr.c b/arch/mips/dec/kn01-berr.c
index d3b8002bf1e7..b0dc6d53edd6 100644
--- a/arch/mips/dec/kn01-berr.c
+++ b/arch/mips/dec/kn01-berr.c
@@ -1,6 +1,4 @@
 /*
- *      linux/arch/mips/dec/kn01-berr.c
- *
 *      Bus error event handling code for DECstation/DECsystem 3100
 *      and 2100 (KN01) systems equipped with parity error detection
 *      logic.
diff --git a/arch/mips/dec/kn02-irq.c b/arch/mips/dec/kn02-irq.c
index 02439dc0ba83..ed90a8deabcc 100644
--- a/arch/mips/dec/kn02-irq.c
+++ b/arch/mips/dec/kn02-irq.c
@@ -1,6 +1,4 @@
 /*
- *      linux/arch/mips/dec/kn02-irq.c
- *
 *      DECstation 5000/200 (KN02) Control and Status Register
 *      interrupts.
 *
diff --git a/arch/mips/dec/kn02xa-berr.c b/arch/mips/dec/kn02xa-berr.c
index 5f04545c3606..07ca5405d48d 100644
--- a/arch/mips/dec/kn02xa-berr.c
+++ b/arch/mips/dec/kn02xa-berr.c
@@ -1,6 +1,4 @@
 /*
- *      linux/arch/mips/dec/kn02xa-berr.c
- *
 *      Bus error event handling code for 5000-series systems equipped
 *      with parity error detection logic, i.e. DECstation/DECsystem
 *      5000/120, /125, /133 (KN02-BA), 5000/150 (KN04-BA) and Personal
diff --git a/arch/mips/dec/prom/call_o32.S b/arch/mips/dec/prom/call_o32.S
index e523454bda3a..8c8498159e43 100644
--- a/arch/mips/dec/prom/call_o32.S
+++ b/arch/mips/dec/prom/call_o32.S
@@ -1,6 +1,4 @@
 /*
- *      arch/mips/dec/prom/call_o32.S
- *
 *      O32 interface for the 64 (or N32) ABI.
 *
 *      Copyright (C) 2002  Maciej W. Rozycki
diff --git a/arch/mips/dec/prom/console.c b/arch/mips/dec/prom/console.c
index 078e1a12421d..caa6e047caf1 100644
--- a/arch/mips/dec/prom/console.c
+++ b/arch/mips/dec/prom/console.c
@@ -1,6 +1,4 @@
 /*
- *      arch/mips/dec/prom/console.c
- *
 *      DECstation PROM-based early console support.
 *
 *      Copyright (C) 2004, 2007  Maciej W. Rozycki
diff --git a/arch/mips/dec/time.c b/arch/mips/dec/time.c
index 1359c03ded51..463136e6685a 100644
--- a/arch/mips/dec/time.c
+++ b/arch/mips/dec/time.c
@@ -1,6 +1,4 @@
 /*
- *  linux/arch/mips/dec/time.c
- *
 *  Copyright (C) 1991, 1992, 1995  Linus Torvalds
 *  Copyright (C) 2000, 2003  Maciej W. Rozycki
 *
diff --git a/arch/mips/emma/common/Makefile b/arch/mips/emma/common/Makefile
index c392d28c1ef1..f27d84d1904f 100644
--- a/arch/mips/emma/common/Makefile
+++ b/arch/mips/emma/common/Makefile
@@ -1,7 +1,4 @@
 #
-#  arch/mips/emma2rh/common/Makefile
-#       Makefile for the common code of NEC EMMA2RH based board.
-#
 #  Copyright (C) NEC Electronics Corporation 2005-2006
 #
 #  This program is free software; you can redistribute it and/or modify
diff --git a/arch/mips/emma/common/prom.c b/arch/mips/emma/common/prom.c
index 120f53fbdb45..708f08761406 100644
--- a/arch/mips/emma/common/prom.c
+++ b/arch/mips/emma/common/prom.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/emma2rh/common/prom.c
- *      This file is prom file.
- *
 *  Copyright (C) NEC Electronics Corporation 2004-2006
 *
 *  This file is based on the arch/mips/ddb5xxx/common/prom.c
diff --git a/arch/mips/emma/markeins/Makefile b/arch/mips/emma/markeins/Makefile
index 16e0017ba919..f8ba2508fa2b 100644
--- a/arch/mips/emma/markeins/Makefile
+++ b/arch/mips/emma/markeins/Makefile
@@ -1,7 +1,4 @@
 #
-#  arch/mips/emma2rh/markeins/Makefile
-#       Makefile for the common code of NEC EMMA2RH based board.
-#
 #  Copyright (C) NEC Electronics Corporation 2005-2006
 #
 #  This program is free software; you can redistribute it and/or modify
diff --git a/arch/mips/emma/markeins/irq.c b/arch/mips/emma/markeins/irq.c
index 43828ae796ec..9504b7ee0b7c 100644
--- a/arch/mips/emma/markeins/irq.c
+++ b/arch/mips/emma/markeins/irq.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/emma2rh/markeins/irq.c
- *      This file defines the irq handler for EMMA2RH.
- *
 *  Copyright (C) NEC Electronics Corporation 2004-2006
 *
 *  This file is based on the arch/mips/ddb5xxx/ddb5477/irq.c
diff --git a/arch/mips/emma/markeins/led.c b/arch/mips/emma/markeins/led.c
index 377a181b6561..49755896857f 100644
--- a/arch/mips/emma/markeins/led.c
+++ b/arch/mips/emma/markeins/led.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/emma2rh/markeins/led.c
- *      This file defines the led display for Mark-eins.
- *
 *  Copyright (C) NEC Electronics Corporation 2004-2006
 *
 *  This program is free software; you can redistribute it and/or modify
diff --git a/arch/mips/emma/markeins/platform.c b/arch/mips/emma/markeins/platform.c
index 80ae12ef87db..b05b08b92a34 100644
--- a/arch/mips/emma/markeins/platform.c
+++ b/arch/mips/emma/markeins/platform.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/emma2rh/markeins/platofrm.c
- *      This file sets up platform devices for EMMA2RH Mark-eins.
- *
 *  Copyright(C) MontaVista Software Inc, 2006
 *
 *  Author: dmitry pervushin <dpervushin@ru.mvista.com>
diff --git a/arch/mips/emma/markeins/setup.c b/arch/mips/emma/markeins/setup.c
index 67f456500084..335dc8c1a1bb 100644
--- a/arch/mips/emma/markeins/setup.c
+++ b/arch/mips/emma/markeins/setup.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/emma2rh/markeins/setup.c
- *      This file is setup for EMMA2RH Mark-eins.
- *
 *  Copyright (C) NEC Electronics Corporation 2004-2006
 *
 *  This file is based on the arch/mips/ddb5xxx/ddb5477/setup.c.
diff --git a/arch/mips/fw/lib/call_o32.S b/arch/mips/fw/lib/call_o32.S
index bdf7d1d4081a..e0a68713b3c3 100644
--- a/arch/mips/fw/lib/call_o32.S
+++ b/arch/mips/fw/lib/call_o32.S
@@ -1,6 +1,4 @@
 /*
- *      arch/mips/dec/prom/call_o32.S
- *
 *      O32 interface for the 64 (or N32) ABI.
 *
 *      Copyright (C) 2002  Maciej W. Rozycki
diff --git a/arch/mips/include/asm/emma/emma2rh.h b/arch/mips/include/asm/emma/emma2rh.h
index 30aea91de626..2afb2fe11b30 100644
--- a/arch/mips/include/asm/emma/emma2rh.h
+++ b/arch/mips/include/asm/emma/emma2rh.h
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/include/asm/emma/emma2rh.h
- *      This file is EMMA2RH common header.
- *
 *  Copyright (C) NEC Electronics Corporation 2005-2006
 *
 *  This file based on include/asm-mips/ddb5xxx/ddb5xxx.h
diff --git a/arch/mips/include/asm/emma/markeins.h b/arch/mips/include/asm/emma/markeins.h
index 973b0628490d..2618bf230248 100644
--- a/arch/mips/include/asm/emma/markeins.h
+++ b/arch/mips/include/asm/emma/markeins.h
@@ -1,7 +1,4 @@
 /*
- *  include/asm-mips/emma2rh/markeins.h
- *      This file is EMMA2RH board depended header.
- *
 *  Copyright (C) NEC Electronics Corporation 2005-2006
 *
 *  This file based on include/asm-mips/ddb5xxx/ddb5xxx.h
diff --git a/arch/mips/include/asm/gic.h b/arch/mips/include/asm/gic.h
index 10292e37c1f7..a8f57341f123 100644
--- a/arch/mips/include/asm/gic.h
+++ b/arch/mips/include/asm/gic.h
@@ -20,7 +20,7 @@
 #define GIC_TRIG_EDGE                   1
 #define GIC_TRIG_LEVEL                  0
-#if CONFIG_SMP
+#ifdef CONFIG_SMP
 #define GIC_NUM_INTRS                   (24 + NR_CPUS * 2)
 #else
 #define GIC_NUM_INTRS                   32
diff --git a/arch/mips/include/asm/pmc-sierra/msp71xx/war.h b/arch/mips/include/asm/pmc-sierra/msp71xx/war.h
index 0bf48fc1892b..9e2ee429c529 100644
--- a/arch/mips/include/asm/pmc-sierra/msp71xx/war.h
+++ b/arch/mips/include/asm/pmc-sierra/msp71xx/war.h
@@ -23,6 +23,8 @@
 #if defined(CONFIG_PMC_MSP7120_EVAL) || defined(CONFIG_PMC_MSP7120_GW) || \
        defined(CONFIG_PMC_MSP7120_FPGA)
 #define MIPS34K_MISSED_ITLB_WAR         1
+#else
+#define MIPS34K_MISSED_ITLB_WAR         0
 #endif
 #endif /* __ASM_MIPS_PMC_SIERRA_WAR_H */
diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
index 0f926aa0cb47..087a8884ef06 100644
--- a/arch/mips/include/asm/processor.h
+++ b/arch/mips/include/asm/processor.h
@@ -311,8 +311,9 @@ extern void start_thread(struct pt_regs * regs, unsigned long pc, unsigned long
 unsigned long get_wchan(struct task_struct *p);
-#define __KSTK_TOS(tsk) ((unsigned long)task_stack_page(tsk) + THREAD_SIZE - 32)
+#define __KSTK_TOS(tsk) ((unsigned long)task_stack_page(tsk) + \
-#define task_pt_regs(tsk) ((struct pt_regs *)__KSTK_TOS(tsk) - 1)
+                         THREAD_SIZE - 32 - sizeof(struct pt_regs))
+#define task_pt_regs(tsk) ((struct pt_regs *)__KSTK_TOS(tsk))
 #define KSTK_EIP(tsk) (task_pt_regs(tsk)->cp0_epc)
 #define KSTK_ESP(tsk) (task_pt_regs(tsk)->regs[29])
 #define KSTK_STATUS(tsk) (task_pt_regs(tsk)->cp0_status)
diff --git a/arch/mips/include/asm/unistd.h b/arch/mips/include/asm/unistd.h
index b70c49fdda26..e753a777949b 100644
--- a/arch/mips/include/asm/unistd.h
+++ b/arch/mips/include/asm/unistd.h
@@ -354,16 +354,17 @@
 #define __NR_pwritev                    (__NR_Linux + 331)
 #define __NR_rt_tgsigqueueinfo          (__NR_Linux + 332)
 #define __NR_perf_counter_open          (__NR_Linux + 333)
+#define __NR_accept4                    (__NR_Linux + 334)
 /*
 * Offset of the last Linux o32 flavoured syscall
 */
-#define __NR_Linux_syscalls             333
+#define __NR_Linux_syscalls             334
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         333
+#define __NR_O32_Linux_syscalls         334
 #if _MIPS_SIM == _MIPS_SIM_ABI64
@@ -664,16 +665,17 @@
 #define __NR_pwritev                    (__NR_Linux + 290)
 #define __NR_rt_tgsigqueueinfo          (__NR_Linux + 291)
 #define __NR_perf_counter_open          (__NR_Linux + 292)
+#define __NR_accept4                    (__NR_Linux + 293)
 /*
 * Offset of the last Linux 64-bit flavoured syscall
 */
-#define __NR_Linux_syscalls             292
+#define __NR_Linux_syscalls             293
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          292
+#define __NR_64_Linux_syscalls          293
 #if _MIPS_SIM == _MIPS_SIM_NABI32
@@ -978,16 +980,17 @@
 #define __NR_pwritev                    (__NR_Linux + 294)
 #define __NR_rt_tgsigqueueinfo          (__NR_Linux + 295)
 #define __NR_perf_counter_open          (__NR_Linux + 296)
+#define __NR_accept4                    (__NR_Linux + 297)
 /*
 * Offset of the last N32 flavoured syscall
 */
-#define __NR_Linux_syscalls             296
+#define __NR_Linux_syscalls             297
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         296
+#define __NR_N32_Linux_syscalls         297
 #ifdef __KERNEL__
diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
index f0fd636723be..0d64d0f46418 100644
--- a/arch/mips/jazz/jazzdma.c
+++ b/arch/mips/jazz/jazzdma.c
@@ -190,7 +190,7 @@ int vdma_free(unsigned long laddr)
                return -1;
        }
-        while (pgtbl[i].owner == laddr && i < VDMA_PGTBL_ENTRIES) {
+        while (i < VDMA_PGTBL_ENTRIES && pgtbl[i].owner == laddr) {
                pgtbl[i].owner = VDMA_PAGE_EMPTY;
                i++;
        }
diff --git a/arch/mips/kernel/head.S b/arch/mips/kernel/head.S
index 492a0a8d70fb..531ce7b16124 100644
--- a/arch/mips/kernel/head.S
+++ b/arch/mips/kernel/head.S
@@ -188,7 +188,8 @@ NESTED(kernel_entry, 16, sp)			# kernel entry point
        MTC0            zero, CP0_CONTEXT       # clear context register
        PTR_LA          $28, init_thread_union
-        PTR_LI          sp, _THREAD_SIZE - 32
+        /* Set the SP after an empty pt_regs.  */
+        PTR_LI          sp, _THREAD_SIZE - 32 - PT_SIZE
        PTR_ADDU        sp, $28
        set_saved_sp    sp, t0, t1
        PTR_SUBU        sp, 4 * SZREG           # init stack pointer
diff --git a/arch/mips/kernel/irq_txx9.c b/arch/mips/kernel/irq_txx9.c
index a4d1462c27f7..9b78029bea70 100644
--- a/arch/mips/kernel/irq_txx9.c
+++ b/arch/mips/kernel/irq_txx9.c
@@ -1,6 +1,4 @@
 /*
- * linux/arch/mips/kernel/irq_txx9.c
- *
 * Based on linux/arch/mips/jmr3927/rbhma3100/irq.c,
 *          linux/arch/mips/tx4927/common/tx4927_irq.c,
 *          linux/arch/mips/tx4938/common/irq.c
diff --git a/arch/mips/kernel/module.c b/arch/mips/kernel/module.c
index 3e9100dcc12d..6f51dda87fce 100644
--- a/arch/mips/kernel/module.c
+++ b/arch/mips/kernel/module.c
@@ -98,7 +98,8 @@ static int apply_r_mips_32_rela(struct module *me, u32 *location, Elf_Addr v)
 static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
 {
        if (v % 4) {
-                printk(KERN_ERR "module %s: dangerous relocation\n", me->name);
+                pr_err("module %s: dangerous R_MIPS_26 REL relocation\n",
+                       me->name);
                return -ENOEXEC;
        }
@@ -118,7 +119,8 @@ static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
 static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
 {
        if (v % 4) {
-                printk(KERN_ERR "module %s: dangerous relocation\n", me->name);
+                pr_err("module %s: dangerous R_MIPS_26 RELArelocation\n",
+                       me->name);
                return -ENOEXEC;
        }
@@ -222,7 +224,7 @@ static int apply_r_mips_lo16_rel(struct module *me, u32 *location, Elf_Addr v)
        return 0;
 out_danger:
-        printk(KERN_ERR "module %s: dangerous " "relocation\n", me->name);
+        pr_err("module %s: dangerous R_MIPS_LO16 REL relocation\n", me->name);
        return -ENOEXEC;
 }
@@ -301,7 +303,7 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strtab,
                /* This is the symbol it is referring to */
                sym = (Elf_Sym *)sechdrs[symindex].sh_addr
                        + ELF_MIPS_R_SYM(rel[i]);
-                if (!sym->st_value) {
+                if (IS_ERR_VALUE(sym->st_value)) {
                        /* Ignore unresolved weak symbol */
                        if (ELF_ST_BIND(sym->st_info) == STB_WEAK)
                                continue;
@@ -341,7 +343,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
                /* This is the symbol it is referring to */
                sym = (Elf_Sym *)sechdrs[symindex].sh_addr
                        + ELF_MIPS_R_SYM(rel[i]);
-                if (!sym->st_value) {
+                if (IS_ERR_VALUE(sym->st_value)) {
                        /* Ignore unresolved weak symbol */
                        if (ELF_ST_BIND(sym->st_info) == STB_WEAK)
                                continue;
diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
index e0a4ac18fa07..26109c4d5170 100644
--- a/arch/mips/kernel/proc.c
+++ b/arch/mips/kernel/proc.c
@@ -1,6 +1,4 @@
 /*
- *  linux/arch/mips/kernel/proc.c
- *
 *  Copyright (C) 1995, 1996, 2001  Ralf Baechle
 *  Copyright (C) 2001, 2004  MIPS Technologies, Inc.
 *  Copyright (C) 2004  Maciej W. Rozycki
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index c09d681b7181..f3d73e1831c1 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -115,7 +115,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
 {
        struct thread_info *ti = task_thread_info(p);
        struct pt_regs *childregs;
-        long childksp;
+        unsigned long childksp;
        p->set_child_tid = p->clear_child_tid = NULL;
        childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
@@ -132,6 +132,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
        /* set up new TSS. */
        childregs = (struct pt_regs *) childksp - 1;
+        /*  Put the stack after the struct pt_regs.  */
+        childksp = (unsigned long) childregs;
        *childregs = *regs;
        childregs->regs[7] = 0; /* Clear error flag */
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 20a86e08fd58..b57082123536 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -654,6 +654,7 @@ einval:	li	v0, -ENOSYS
        sys     sys_pwritev             6
        sys     sys_rt_tgsigqueueinfo   4
        sys     sys_perf_counter_open   5
+        sys     sys_accept4             4
        .endm
        /* We pre-compute the number of _instruction_ bytes needed to
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index b046130d4c5d..3d866f24e064 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -491,4 +491,5 @@ sys_call_table:
        PTR     sys_pwritev                     /* 5390 */
        PTR     sys_rt_tgsigqueueinfo
        PTR     sys_perf_counter_open
+        PTR     sys_accept4
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 15874f9812cc..e855b118a079 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -417,4 +417,5 @@ EXPORT(sysn32_call_table)
        PTR     sys_pwritev
        PTR     compat_sys_rt_tgsigqueueinfo    /* 5295 */
        PTR     sys_perf_counter_open
+        PTR     sys_accept4
        .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 781e0f1e9533..0c49f1a660be 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -537,4 +537,5 @@ sys_call_table:
        PTR     compat_sys_pwritev
        PTR     compat_sys_rt_tgsigqueueinfo
        PTR     sys_perf_counter_open
+        PTR     sys_accept4
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index 8a0626cbb108..c16bb6d6c25c 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -465,11 +465,8 @@ void smtc_prepare_cpus(int cpus)
        smtc_configure_tlb();
        for (tc = 0, vpe = 0 ; (vpe < nvpe) && (tc < ntc) ; vpe++) {
-                /*
+                if (tcpervpe[vpe] == 0)
-                 * Set the MVP bits.
+                        continue;
-                 */
-                settc(tc);
-                write_vpe_c0_vpeconf0(read_vpe_c0_vpeconf0() | VPECONF0_MVP);
                if (vpe != 0)
                        printk(", ");
                printk("VPE %d: TC", vpe);
@@ -488,6 +485,12 @@ void smtc_prepare_cpus(int cpus)
                }
                if (vpe != 0) {
                        /*
+                         * Allow this VPE to control others.
+                         */
+                        write_vpe_c0_vpeconf0(read_vpe_c0_vpeconf0() |
+                                              VPECONF0_MVP);
+                        /*
                         * Clear any stale software interrupts from VPE's Cause
                         */
                        write_vpe_c0_cause(0);
diff --git a/arch/mips/kernel/stacktrace.c b/arch/mips/kernel/stacktrace.c
index 58f5cd76c8c3..d52ff77baf3f 100644
--- a/arch/mips/kernel/stacktrace.c
+++ b/arch/mips/kernel/stacktrace.c
@@ -1,6 +1,4 @@
 /*
- * arch/mips/kernel/stacktrace.c
- *
 * Stack trace management functions
 *
 *  Copyright (C) 2006 Atsushi Nemoto <anemo@mba.ocn.ne.jp>
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 07b9ec2c6e3d..9a1ab7e87fd4 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -73,7 +73,7 @@ static int major;
 static const int minor = 1;     /* fixed for now  */
 #ifdef CONFIG_MIPS_APSP_KSPD
- static struct kspd_notifications kspd_events;
+static struct kspd_notifications kspd_events;
 static int kspd_events_reqd = 0;
 #endif
@@ -155,10 +155,9 @@ struct {
 };
 static void release_progmem(void *ptr);
-extern void save_gp_address(unsigned int secbase, unsigned int rel);
 /* get the vpe associated with this minor */
-struct vpe *get_vpe(int minor)
+static struct vpe *get_vpe(int minor)
 {
        struct vpe *v;
@@ -174,7 +173,7 @@ struct vpe *get_vpe(int minor)
 }
 /* get the vpe associated with this minor */
-struct tc *get_tc(int index)
+static struct tc *get_tc(int index)
 {
        struct tc *t;
@@ -186,20 +185,8 @@ struct tc *get_tc(int index)
        return NULL;
 }
-struct tc *get_tc_unused(void)
-{
-        struct tc *t;
-        list_for_each_entry(t, &vpecontrol.tc_list, list) {
-                if (t->state == TC_STATE_UNUSED)
-                        return t;
-        }
-        return NULL;
-}
 /* allocate a vpe and associate it with this minor (or index) */
-struct vpe *alloc_vpe(int minor)
+static struct vpe *alloc_vpe(int minor)
 {
        struct vpe *v;
@@ -216,7 +203,7 @@ struct vpe *alloc_vpe(int minor)
 }
 /* allocate a tc. At startup only tc0 is running, all other can be halted. */
-struct tc *alloc_tc(int index)
+static struct tc *alloc_tc(int index)
 {
        struct tc *tc;
@@ -232,7 +219,7 @@ out:
 }
 /* clean up and free everything */
-void release_vpe(struct vpe *v)
+static void release_vpe(struct vpe *v)
 {
        list_del(&v->list);
        if (v->load_addr)
@@ -240,7 +227,7 @@ void release_vpe(struct vpe *v)
        kfree(v);
 }
-void dump_mtregs(void)
+static void dump_mtregs(void)
 {
        unsigned long val;
@@ -327,7 +314,8 @@ static void layout_sections(struct module *mod, const Elf_Ehdr * hdr,
                            || (s->sh_flags & masks[m][1])
                            || s->sh_entsize != ~0UL)
                                continue;
-                        s->sh_entsize = get_offset(&mod->core_size, s);
+                        s->sh_entsize =
+                                get_offset((unsigned long *)&mod->core_size, s);
                }
                if (m == 0)
@@ -461,16 +449,15 @@ static int apply_r_mips_lo16(struct module *me, uint32_t *location,
 {
        unsigned long insnlo = *location;
        Elf32_Addr val, vallo;
+        struct mips_hi16 *l, *next;
        /* Sign extend the addend we extract from the lo insn.  */
        vallo = ((insnlo & 0xffff) ^ 0x8000) - 0x8000;
        if (mips_hi16_list != NULL) {
-                struct mips_hi16 *l;
                l = mips_hi16_list;
                while (l != NULL) {
-                        struct mips_hi16 *next;
                        unsigned long insn;
                        /*
@@ -480,7 +467,7 @@ static int apply_r_mips_lo16(struct module *me, uint32_t *location,
                                printk(KERN_DEBUG "VPE loader: "
                                       "apply_r_mips_lo16/hi16: \t"
                                       "inconsistent value information\n");
-                                return -ENOEXEC;
+                                goto out_free;
                        }
                        /*
@@ -518,6 +505,16 @@ static int apply_r_mips_lo16(struct module *me, uint32_t *location,
        *location = insnlo;
        return 0;
+out_free:
+        while (l != NULL) {
+                next = l->next;
+                kfree(l);
+                l = next;
+        }
+        mips_hi16_list = NULL;
+        return -ENOEXEC;
 }
 static int (*reloc_handlers[]) (struct module *me, uint32_t *location,
@@ -541,7 +538,7 @@ static char *rstrs[] = {
        [R_MIPS_PC16] = "MIPS_PC16"
 };
-int apply_relocations(Elf32_Shdr *sechdrs,
+static int apply_relocations(Elf32_Shdr *sechdrs,
                      const char *strtab,
                      unsigned int symindex,
                      unsigned int relsec,
@@ -586,7 +583,7 @@ int apply_relocations(Elf32_Shdr *sechdrs,
        return 0;
 }
-void save_gp_address(unsigned int secbase, unsigned int rel)
+static inline void save_gp_address(unsigned int secbase, unsigned int rel)
 {
        gp_addr = secbase + rel;
        gp_offs = gp_addr - (secbase & 0xffff0000);
diff --git a/arch/mips/mipssim/sim_time.c b/arch/mips/mipssim/sim_time.c
index 0cea932f1241..5492c42f7650 100644
--- a/arch/mips/mipssim/sim_time.c
+++ b/arch/mips/mipssim/sim_time.c
@@ -89,13 +89,13 @@ unsigned __cpuinit get_c0_compare_int(void)
        if (cpu_has_veic) {
                set_vi_handler(MSC01E_INT_CPUCTR, mips_timer_dispatch);
                mips_cpu_timer_irq = MSC01E_INT_BASE + MSC01E_INT_CPUCTR;
-        } else {
-#endif
+                return mips_cpu_timer_irq;
-               {
-                if (cpu_has_vint)
-                        set_vi_handler(cp0_compare_irq, mips_timer_dispatch);
-                mips_cpu_timer_irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq;
        }
+#endif
+        if (cpu_has_vint)
+                set_vi_handler(cp0_compare_irq, mips_timer_dispatch);
+        mips_cpu_timer_irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq;
        return mips_cpu_timer_irq;
 }
diff --git a/arch/mips/mm/c-octeon.c b/arch/mips/mm/c-octeon.c
index b165cdcb2818..10ab69f7183f 100644
--- a/arch/mips/mm/c-octeon.c
+++ b/arch/mips/mm/c-octeon.c
@@ -289,7 +289,7 @@ static void  cache_parity_error_octeon(int non_recoverable)
 }
 /**
- * Called when the the exception is not recoverable
+ * Called when the the exception is recoverable
 */
 asmlinkage void cache_parity_error_octeon_recoverable(void)
@@ -298,7 +298,7 @@ asmlinkage void cache_parity_error_octeon_recoverable(void)
 }
 /**
- * Called when the the exception is recoverable
+ * Called when the the exception is not recoverable
 */
 asmlinkage void cache_parity_error_octeon_non_recoverable(void)
diff --git a/arch/mips/mm/extable.c b/arch/mips/mm/extable.c
index 297fb9f390dc..9d25d2ba4b9e 100644
--- a/arch/mips/mm/extable.c
+++ b/arch/mips/mm/extable.c
@@ -1,5 +1,9 @@
 /*
- * linux/arch/mips/mm/extable.c
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 1997, 99, 2001 - 2004 Ralf Baechle <ralf@linux-mips.org>
 */
 #include <linux/module.h>
 #include <linux/spinlock.h>
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index 6751ce9ede9e..f956ecbb8136 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -171,6 +171,7 @@ out_of_memory:
         * We ran out of memory, call the OOM killer, and return the userspace
         * (which will retry the fault, or kill us if we got oom-killed).
         */
+        up_read(&mm->mmap_sem);
        pagefault_out_of_memory();
        return;
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index a8756f82c31b..3e0a9b35ba5c 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -331,6 +331,7 @@ static struct irqaction irq_call = {
        .flags          = IRQF_DISABLED|IRQF_PERCPU,
        .name           = "IPI_call"
 };
+#endif /* CONFIG_MIPS_MT_SMP */
 static int gic_resched_int_base;
 static int gic_call_int_base;
@@ -346,7 +347,6 @@ unsigned int plat_ipi_resched_int_xlate(unsigned int cpu)
 {
        return GIC_RESCHED_INT(cpu);
 }
-#endif /* CONFIG_MIPS_MT_SMP */
 static struct irqaction i8259irq = {
        .handler = no_action,
diff --git a/arch/mips/nxp/pnx8550/common/time.c b/arch/mips/nxp/pnx8550/common/time.c
index 8df43e9e4d90..18b192784877 100644
--- a/arch/mips/nxp/pnx8550/common/time.c
+++ b/arch/mips/nxp/pnx8550/common/time.c
@@ -138,7 +138,7 @@ __init void plat_time_init(void)
         * HZ timer interrupts per second.
         */
        mips_hpt_frequency = 27UL * ((1000000UL * n)/(m * pow2p));
-        cpj = (mips_hpt_frequency + HZ / 2) / HZ;
+        cpj = DIV_ROUND_CLOSEST(mips_hpt_frequency, HZ);
        write_c0_count(0);
        timer_ack();
diff --git a/arch/mips/pci/fixup-emma2rh.c b/arch/mips/pci/fixup-emma2rh.c
index fba5aad00d51..0d9ccf4dfc5a 100644
--- a/arch/mips/pci/fixup-emma2rh.c
+++ b/arch/mips/pci/fixup-emma2rh.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/pci/fixup-emma2rh.c
- *      This file defines the PCI configration.
- *
 *  Copyright (C) NEC Electronics Corporation 2004-2006
 *
 *  This file is based on the arch/mips/ddb5xxx/ddb5477/pci.c
diff --git a/arch/mips/pci/fixup-sb1250.c b/arch/mips/pci/fixup-sb1250.c
index 0ad39e53f7b1..f0bb9146e6c0 100644
--- a/arch/mips/pci/fixup-sb1250.c
+++ b/arch/mips/pci/fixup-sb1250.c
@@ -1,6 +1,4 @@
 /*
- *      arch/mips/pci/fixup-sb1250.c
- *
 *      Copyright (C) 2004, 2006  MIPS Technologies, Inc.  All rights reserved.
 *          Author:     Maciej W. Rozycki <macro@mips.com>
 *
diff --git a/arch/mips/pci/ops-emma2rh.c b/arch/mips/pci/ops-emma2rh.c
index 5947a70b0b7f..710aef5c070e 100644
--- a/arch/mips/pci/ops-emma2rh.c
+++ b/arch/mips/pci/ops-emma2rh.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/pci/ops-emma2rh.c
- *      This file defines the PCI operation for EMMA2RH.
- *
 *  Copyright (C) NEC Electronics Corporation 2004-2006
 *
 *  This file is based on the arch/mips/pci/ops-vr41xx.c
diff --git a/arch/mips/pci/pci-emma2rh.c b/arch/mips/pci/pci-emma2rh.c
index 2df4190232cd..773e34ff4d1c 100644
--- a/arch/mips/pci/pci-emma2rh.c
+++ b/arch/mips/pci/pci-emma2rh.c
@@ -1,7 +1,4 @@
 /*
- *  arch/mips/pci/pci-emma2rh.c
- *      This file defines the PCI configration.
- *
 *  Copyright (C) NEC Electronics Corporation 2004-2006
 *
 *  This file is based on the arch/mips/ddb5xxx/ddb5477/pci.c
diff --git a/arch/mips/pci/pci-tx4927.c b/arch/mips/pci/pci-tx4927.c
index aaa900596792..a5807406a7f1 100644
--- a/arch/mips/pci/pci-tx4927.c
+++ b/arch/mips/pci/pci-tx4927.c
@@ -1,6 +1,4 @@
 /*
- * linux/arch/mips/pci/pci-tx4927.c
- *
 * Based on linux/arch/mips/txx9/rbtx4938/setup.c,
 *          and RBTX49xx patch from CELF patch archive.
 *
diff --git a/arch/mips/pci/pci-tx4938.c b/arch/mips/pci/pci-tx4938.c
index 1ea257bc3b8f..20e45f30b2ef 100644
--- a/arch/mips/pci/pci-tx4938.c
+++ b/arch/mips/pci/pci-tx4938.c
@@ -1,6 +1,4 @@
 /*
- * linux/arch/mips/pci/pci-tx4938.c
- *
 * Based on linux/arch/mips/txx9/rbtx4938/setup.c,
 *          and RBTX49xx patch from CELF patch archive.
 *
diff --git a/arch/mips/pci/pci-tx4939.c b/arch/mips/pci/pci-tx4939.c
index 5fecf1cdc325..9ef840693baf 100644
--- a/arch/mips/pci/pci-tx4939.c
+++ b/arch/mips/pci/pci-tx4939.c
@@ -1,6 +1,4 @@
 /*
- * linux/arch/mips/pci/pci-tx4939.c
- *
 * Based on linux/arch/mips/txx9/rbtx4939/setup.c,
 *          and RBTX49xx patch from CELF patch archive.
 *
diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
index 75262247f3e4..6aa5c542d52d 100644
--- a/arch/mips/pci/pcie-octeon.c
+++ b/arch/mips/pci/pcie-octeon.c
@@ -1040,19 +1040,29 @@ static inline int octeon_pcie_read_config(int pcie_port, struct pci_bus *bus,
        int bus_number = bus->number;
        /*
-         * We need to force the bus number to be zero on the root
+         * For the top level bus make sure our hardware bus number
-         * bus. Linux numbers the 2nd root bus to start after all
+         * matches the software one.
-         * buses on root 0.
         */
-        if (bus->parent == NULL)
+        if (bus->parent == NULL) {
-                bus_number = 0;
+                union cvmx_pciercx_cfg006 pciercx_cfg006;
+                pciercx_cfg006.u32 = cvmx_pcie_cfgx_read(pcie_port,
+                        CVMX_PCIERCX_CFG006(pcie_port));
+                if (pciercx_cfg006.s.pbnum != bus_number) {
+                        pciercx_cfg006.s.pbnum = bus_number;
+                        pciercx_cfg006.s.sbnum = bus_number;
+                        pciercx_cfg006.s.subbnum = bus_number;
+                        cvmx_pcie_cfgx_write(pcie_port,
+                                CVMX_PCIERCX_CFG006(pcie_port),
+                                pciercx_cfg006.u32);
+                }
+        }
        /*
         * PCIe only has a single device connected to Octeon. It is
         * always device ID 0. Don't bother doing reads for other
         * device IDs on the first segment.
         */
-        if ((bus_number == 0) && (devfn >> 3 != 0))
+        if ((bus->parent == NULL) && (devfn >> 3 != 0))
                return PCIBIOS_FUNC_NOT_SUPPORTED;
        /*
@@ -1070,7 +1080,7 @@ static inline int octeon_pcie_read_config(int pcie_port, struct pci_bus *bus,
                 * bridge only respondes to device ID 0, function
                 * 0-1
                 */
-                if ((bus_number == 0) && (devfn >= 2))
+                if ((bus->parent == NULL) && (devfn >= 2))
                        return PCIBIOS_FUNC_NOT_SUPPORTED;
                /*
                 * The PCI-X slots are device ID 2,3. Choose one of
@@ -1167,13 +1177,6 @@ static inline int octeon_pcie_write_config(int pcie_port, struct pci_bus *bus,
                                           int size, u32 val)
 {
        int bus_number = bus->number;
-        /*
-         * We need to force the bus number to be zero on the root
-         * bus. Linux numbers the 2nd root bus to start after all
-         * busses on root 0.
-         */
-        if (bus->parent == NULL)
-                bus_number = 0;
        switch (size) {
        case 4:
diff --git a/arch/mips/pmc-sierra/msp71xx/gpio.c b/arch/mips/pmc-sierra/msp71xx/gpio.c
index 69848c5813e2..aaccbe524386 100644
--- a/arch/mips/pmc-sierra/msp71xx/gpio.c
+++ b/arch/mips/pmc-sierra/msp71xx/gpio.c
@@ -1,6 +1,4 @@
 /*
- * @file /arch/mips/pmc-sierra/msp71xx/gpio.c
- *
 * Generic PMC MSP71xx GPIO handling. These base gpio are controlled by two
 * types of registers. The data register sets the output level when in output
 * mode and when in input mode will contain the value at the input. The config
diff --git a/arch/mips/pmc-sierra/msp71xx/gpio_extended.c b/arch/mips/pmc-sierra/msp71xx/gpio_extended.c
index fc6dbc6cf1c0..2a99f360fae4 100644
--- a/arch/mips/pmc-sierra/msp71xx/gpio_extended.c
+++ b/arch/mips/pmc-sierra/msp71xx/gpio_extended.c
@@ -1,6 +1,4 @@
 /*
- * @file /arch/mips/pmc-sierra/msp71xx/gpio_extended.c
- *
 * Generic PMC MSP71xx EXTENDED (EXD) GPIO handling. The extended gpio is
 * a set of hardware registers that have no need for explicit locking as
 * it is handled by unique method of writing individual set/clr bits.
diff --git a/arch/mips/pmc-sierra/msp71xx/msp_irq_slp.c b/arch/mips/pmc-sierra/msp71xx/msp_irq_slp.c
index f5f1b8d2bb9a..61f390232346 100644
--- a/arch/mips/pmc-sierra/msp71xx/msp_irq_slp.c
+++ b/arch/mips/pmc-sierra/msp71xx/msp_irq_slp.c
@@ -45,13 +45,6 @@ static inline void mask_msp_slp_irq(unsigned int irq)
 */
 static inline void ack_msp_slp_irq(unsigned int irq)
 {
-        mask_slp_irq(irq);
-        /*
-         * only really necessary for 18, 16-14 and sometimes 3:0 (since
-         * these can be edge sensitive) but it doesn't hurt  for the others.
-         */
        /* check for PER interrupt range */
        if (irq < MSP_PER_INTBASE)
                *SLP_INT_STS_REG = (1 << (irq - MSP_SLP_INTBASE));
@@ -62,8 +55,7 @@ static inline void ack_msp_slp_irq(unsigned int irq)
 static struct irq_chip msp_slp_irq_controller = {
        .name = "MSP_SLP",
        .ack = ack_msp_slp_irq,
-        .mask = ack_msp_slp_irq,
+        .mask = mask_msp_slp_irq,
-        .mask_ack = ack_msp_slp_irq,
        .unmask = unmask_msp_slp_irq,
 };
@@ -79,7 +71,7 @@ void __init msp_slp_irq_init(void)
        /* initialize all the IRQ descriptors */
        for (i = MSP_SLP_INTBASE; i < MSP_PER_INTBASE + 32; i++)
-                set_irq_chip_and_handler(i, &msp_slp_irq_controller
+                set_irq_chip_and_handler(i, &msp_slp_irq_controller,
                                         handle_level_irq);
 }
diff --git a/arch/mips/pmc-sierra/yosemite/atmel_read_eeprom.c b/arch/mips/pmc-sierra/yosemite/atmel_read_eeprom.c
index caf5e9a0acc7..fc990cb31941 100644
--- a/arch/mips/pmc-sierra/yosemite/atmel_read_eeprom.c
+++ b/arch/mips/pmc-sierra/yosemite/atmel_read_eeprom.c
@@ -1,6 +1,4 @@
 /*
- *  arch/mips/pmc-sierra/yosemite/atmel_read_eeprom.c
- *
 *  Copyright (C) 2003 PMC-Sierra Inc.
 *  Author: Manish Lachwani (lachwani@pmc-sierra.com)
 *
diff --git a/arch/mips/sibyte/swarm/swarm-i2c.c b/arch/mips/sibyte/swarm/swarm-i2c.c
index 4282ac9d01d2..062505054d42 100644
--- a/arch/mips/sibyte/swarm/swarm-i2c.c
+++ b/arch/mips/sibyte/swarm/swarm-i2c.c
@@ -1,6 +1,4 @@
 /*
- *      arch/mips/sibyte/swarm/swarm-i2c.c
- *
 *      Broadcom BCM91250A (SWARM), etc. I2C platform setup.
 *
 *      Copyright (c) 2008  Maciej W. Rozycki
diff --git a/arch/mips/txx9/generic/mem_tx4927.c b/arch/mips/txx9/generic/mem_tx4927.c
index ef6ea6e97873..70f9626f8227 100644
--- a/arch/mips/txx9/generic/mem_tx4927.c
+++ b/arch/mips/txx9/generic/mem_tx4927.c
@@ -1,6 +1,4 @@
 /*
- * linux/arch/mips/txx9/generic/mem_tx4927.c
- *
 * common tx4927 memory interface
 *
 * Author: MontaVista Software, Inc.
diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
index 3b7d77d61ce0..a205e2ba8e7b 100644
--- a/arch/mips/txx9/generic/setup.c
+++ b/arch/mips/txx9/generic/setup.c
@@ -1,6 +1,4 @@
 /*
- * linux/arch/mips/txx9/generic/setup.c
- *
 * Based on linux/arch/mips/txx9/rbtx4938/setup.c,
 *          and RBTX49xx patch from CELF patch archive.
 *
diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c
index c033ffe71cdf..b0c241ecf603 100644
--- a/arch/mips/txx9/rbtx4939/setup.c
+++ b/arch/mips/txx9/rbtx4939/setup.c
@@ -512,10 +512,10 @@ static void __init rbtx4939_setup(void)
        rbtx4939_ebusc_setup();
        /* always enable ATA0 */
        txx9_set64(&tx4939_ccfgptr->pcfg, TX4939_PCFG_ATA0MODE);
-        rbtx4939_update_ioc_pen();
        if (txx9_master_clock == 0)
                txx9_master_clock = 20000000;
        tx4939_setup();
+        rbtx4939_update_ioc_pen();
 #ifdef HAVE_RBTX4939_IOSWAB
        ioswabw = rbtx4939_ioswabw;
        __mem_ioswabw = rbtx4939_mem_ioswabw;
diff --git a/arch/mn10300/include/asm/pci.h b/arch/mn10300/include/asm/pci.h
index 35d2ed6396f6..19aecc90f7a4 100644
--- a/arch/mn10300/include/asm/pci.h
+++ b/arch/mn10300/include/asm/pci.h
@@ -59,7 +59,6 @@ void pcibios_penalize_isa_irq(int irq);
 #include <linux/slab.h>
 #include <asm/scatterlist.h>
 #include <linux/string.h>
-#include <linux/mm.h>
 #include <asm/io.h>
 struct pci_dev;
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index ae3e70cd1e14..e552e547cb93 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -553,7 +553,7 @@
         * on most of those machines only handles cache transactions.
         */
        extrd,u,*=      \pte,_PAGE_NO_CACHE_BIT+32,1,%r0
-        depi            1,12,1,\prot
+        depdi           1,12,1,\prot
        /* Drop prot bits and convert to page addr for iitlbt and idtlbt */
        convert_for_tlb_insert20 \pte
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index ef5caf2e6ed0..61ee0eec4e69 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -86,8 +86,12 @@
 * the bottom of the table, which has a maximum signed displacement of
 * 0x3fff; however, since we're only going forward, this becomes
 * 0x1fff, and thus, since each GOT entry is 8 bytes long we can have
- * at most 1023 entries */
+ * at most 1023 entries.
-#define MAX_GOTS        1023
+ * To overcome this 14bit displacement with some kernel modules, we'll
+ * use instead the unusal 16bit displacement method (see reassemble_16a)
+ * which gives us a maximum positive displacement of 0x7fff, and as such
+ * allows us to allocate up to 4095 GOT entries. */
+#define MAX_GOTS        4095
 /* three functions to determine where in the module core
 * or init pieces the location is */
@@ -145,12 +149,40 @@ struct stub_entry {
 /* The reassemble_* functions prepare an immediate value for
   insertion into an opcode. pa-risc uses all sorts of weird bitfields
   in the instruction to hold the value.  */
+static inline int sign_unext(int x, int len)
+{
+        int len_ones;
+        len_ones = (1 << len) - 1;
+        return x & len_ones;
+}
+static inline int low_sign_unext(int x, int len)
+{
+        int sign, temp;
+        sign = (x >> (len-1)) & 1;
+        temp = sign_unext(x, len-1);
+        return (temp << 1) | sign;
+}
 static inline int reassemble_14(int as14)
 {
        return (((as14 & 0x1fff) << 1) |
                ((as14 & 0x2000) >> 13));
 }
+static inline int reassemble_16a(int as16)
+{
+        int s, t;
+        /* Unusual 16-bit encoding, for wide mode only.  */
+        t = (as16 << 1) & 0xffff;
+        s = (as16 & 0x8000);
+        return (t ^ s ^ (s >> 1)) | (s >> 15);
+}
 static inline int reassemble_17(int as17)
 {
        return (((as17 & 0x10000) >> 16) |
@@ -407,6 +439,7 @@ static Elf_Addr get_stub(struct module *me, unsigned long value, long addend,
        enum elf_stub_type stub_type, Elf_Addr loc0, unsigned int targetsec)
 {
        struct stub_entry *stub;
+        int __maybe_unused d;
        /* initialize stub_offset to point in front of the section */
        if (!me->arch.section[targetsec].stub_offset) {
@@ -460,12 +493,19 @@ static Elf_Addr get_stub(struct module *me, unsigned long value, long addend,
 */
        switch (stub_type) {
        case ELF_STUB_GOT:
-                stub->insns[0] = 0x537b0000;    /* ldd 0(%dp),%dp       */
+                d = get_got(me, value, addend);
+                if (d <= 15) {
+                        /* Format 5 */
+                        stub->insns[0] = 0x0f6010db; /* ldd 0(%dp),%dp  */
+                        stub->insns[0] |= low_sign_unext(d, 5) << 16;
+                } else {
+                        /* Format 3 */
+                        stub->insns[0] = 0x537b0000; /* ldd 0(%dp),%dp  */
+                        stub->insns[0] |= reassemble_16a(d);
+                }
                stub->insns[1] = 0x53610020;    /* ldd 10(%dp),%r1      */
                stub->insns[2] = 0xe820d000;    /* bve (%r1)            */
                stub->insns[3] = 0x537b0030;    /* ldd 18(%dp),%dp      */
-                stub->insns[0] |= reassemble_14(get_got(me, value, addend) & 0x3fff);
                break;
        case ELF_STUB_MILLI:
                stub->insns[0] = 0x20200000;    /* ldil 0,%r1           */
diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
index dfdf13c9fefd..fddc3ed715fa 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -34,7 +34,7 @@
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 /* We don't currently support large pages. */
-#define KVM_PAGES_PER_HPAGE (1<<31)
+#define KVM_PAGES_PER_HPAGE (1UL << 31)
 struct kvm;
 struct kvm_run;
diff --git a/arch/powerpc/kernel/dma.c b/arch/powerpc/kernel/dma.c
index 20a60d661ba8..ccf129d47d84 100644
--- a/arch/powerpc/kernel/dma.c
+++ b/arch/powerpc/kernel/dma.c
@@ -7,6 +7,7 @@
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
+#include <linux/lmb.h>
 #include <asm/bug.h>
 #include <asm/abs_addr.h>
@@ -90,11 +91,10 @@ static void dma_direct_unmap_sg(struct device *dev, struct scatterlist *sg,
 static int dma_direct_dma_supported(struct device *dev, u64 mask)
 {
 #ifdef CONFIG_PPC64
-        /* Could be improved to check for memory though it better be
+        /* Could be improved so platforms can set the limit in case
-         * done via some global so platforms can set the limit in case
         * they have limited DMA windows
         */
-        return mask >= DMA_BIT_MASK(32);
+        return mask >= (lmb_end_of_DRAM() - 1);
 #else
        return 1;
 #endif
diff --git a/arch/powerpc/kernel/mpc7450-pmu.c b/arch/powerpc/kernel/mpc7450-pmu.c
index c244133c67a6..cc466d039af6 100644
--- a/arch/powerpc/kernel/mpc7450-pmu.c
+++ b/arch/powerpc/kernel/mpc7450-pmu.c
@@ -407,7 +407,8 @@ struct power_pmu mpc7450_pmu = {
 static int init_mpc7450_pmu(void)
 {
-        if (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc/7450"))
+        if (!cur_cpu_spec->oprofile_cpu_type ||
+            strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc/7450"))
                return -ENODEV;
        return register_power_pmu(&mpc7450_pmu);
diff --git a/arch/powerpc/kernel/perf_counter.c b/arch/powerpc/kernel/perf_counter.c
index 809fdf94b95f..70e1f57f7dd8 100644
--- a/arch/powerpc/kernel/perf_counter.c
+++ b/arch/powerpc/kernel/perf_counter.c
@@ -518,6 +518,8 @@ void hw_perf_disable(void)
        struct cpu_hw_counters *cpuhw;
        unsigned long flags;
+        if (!ppmu)
+                return;
        local_irq_save(flags);
        cpuhw = &__get_cpu_var(cpu_hw_counters);
@@ -572,6 +574,8 @@ void hw_perf_enable(void)
        int n_lim;
        int idx;
+        if (!ppmu)
+                return;
        local_irq_save(flags);
        cpuhw = &__get_cpu_var(cpu_hw_counters);
        if (!cpuhw->disabled) {
@@ -737,6 +741,8 @@ int hw_perf_group_sched_in(struct perf_counter *group_leader,
        long i, n, n0;
        struct perf_counter *sub;
+        if (!ppmu)
+                return 0;
        cpuhw = &__get_cpu_var(cpu_hw_counters);
        n0 = cpuhw->n_counters;
        n = collect_events(group_leader, ppmu->n_counter - n0,
@@ -1281,6 +1287,8 @@ void hw_perf_counter_setup(int cpu)
 {
        struct cpu_hw_counters *cpuhw = &per_cpu(cpu_hw_counters, cpu);
+        if (!ppmu)
+                return;
        memset(cpuhw, 0, sizeof(*cpuhw));
        cpuhw->mmcr[0] = MMCR0_FC;
 }
diff --git a/arch/powerpc/kernel/power4-pmu.c b/arch/powerpc/kernel/power4-pmu.c
index db90b0c5c27b..3c90a3d9173e 100644
--- a/arch/powerpc/kernel/power4-pmu.c
+++ b/arch/powerpc/kernel/power4-pmu.c
@@ -606,7 +606,8 @@ static struct power_pmu power4_pmu = {
 static int init_power4_pmu(void)
 {
-        if (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power4"))
+        if (!cur_cpu_spec->oprofile_cpu_type ||
+            strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power4"))
                return -ENODEV;
        return register_power_pmu(&power4_pmu);
diff --git a/arch/powerpc/kernel/power5+-pmu.c b/arch/powerpc/kernel/power5+-pmu.c
index f4adca8e98a4..31918af3e355 100644
--- a/arch/powerpc/kernel/power5+-pmu.c
+++ b/arch/powerpc/kernel/power5+-pmu.c
@@ -678,8 +678,9 @@ static struct power_pmu power5p_pmu = {
 static int init_power5p_pmu(void)
 {
-        if (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power5+")
+        if (!cur_cpu_spec->oprofile_cpu_type ||
-            && strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power5++"))
+            (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power5+")
+             && strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power5++")))
                return -ENODEV;
        return register_power_pmu(&power5p_pmu);
diff --git a/arch/powerpc/kernel/power5-pmu.c b/arch/powerpc/kernel/power5-pmu.c
index 29b2c6c0e83a..867f6f663963 100644
--- a/arch/powerpc/kernel/power5-pmu.c
+++ b/arch/powerpc/kernel/power5-pmu.c
@@ -618,7 +618,8 @@ static struct power_pmu power5_pmu = {
 static int init_power5_pmu(void)
 {
-        if (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power5"))
+        if (!cur_cpu_spec->oprofile_cpu_type ||
+            strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power5"))
                return -ENODEV;
        return register_power_pmu(&power5_pmu);
diff --git a/arch/powerpc/kernel/power6-pmu.c b/arch/powerpc/kernel/power6-pmu.c
index 09ae5bf5bda7..fa21890531da 100644
--- a/arch/powerpc/kernel/power6-pmu.c
+++ b/arch/powerpc/kernel/power6-pmu.c
@@ -537,7 +537,8 @@ static struct power_pmu power6_pmu = {
 static int init_power6_pmu(void)
 {
-        if (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power6"))
+        if (!cur_cpu_spec->oprofile_cpu_type ||
+            strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power6"))
                return -ENODEV;
        return register_power_pmu(&power6_pmu);
diff --git a/arch/powerpc/kernel/power7-pmu.c b/arch/powerpc/kernel/power7-pmu.c
index 5a9f5cbd40a4..388cf57ad827 100644
--- a/arch/powerpc/kernel/power7-pmu.c
+++ b/arch/powerpc/kernel/power7-pmu.c
@@ -366,7 +366,8 @@ static struct power_pmu power7_pmu = {
 static int init_power7_pmu(void)
 {
-        if (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power7"))
+        if (!cur_cpu_spec->oprofile_cpu_type ||
+            strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/power7"))
                return -ENODEV;
        return register_power_pmu(&power7_pmu);
diff --git a/arch/powerpc/kernel/ppc970-pmu.c b/arch/powerpc/kernel/ppc970-pmu.c
index 833097ac45dc..75dccb71a043 100644
--- a/arch/powerpc/kernel/ppc970-pmu.c
+++ b/arch/powerpc/kernel/ppc970-pmu.c
@@ -488,8 +488,9 @@ static struct power_pmu ppc970_pmu = {
 static int init_ppc970_pmu(void)
 {
-        if (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/970")
+        if (!cur_cpu_spec->oprofile_cpu_type ||
-            && strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/970MP"))
+            (strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/970")
+             && strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc64/970MP")))
                return -ENODEV;
        return register_power_pmu(&ppc970_pmu);
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 8d15314381e0..cae14c499511 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -208,6 +208,9 @@ static noinline __init void detect_machine_type(void)
                machine_flags |= MACHINE_FLAG_KVM;
        else
                machine_flags |= MACHINE_FLAG_VM;
+        /* Store machine flags for setting up lowcore early */
+        S390_lowcore.machine_flags = machine_flags;
 }
 static __init void early_pgm_check_handler(void)
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index f04f5301b1b4..4d613415c435 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -386,7 +386,7 @@ no_timer:
        }
        __unset_cpu_idle(vcpu);
        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(&vcpu->wq, &wait);
+        remove_wait_queue(&vcpu->arch.local_int.wq, &wait);
        spin_unlock_bh(&vcpu->arch.local_int.lock);
        spin_unlock(&vcpu->arch.local_int.float_int->lock);
        hrtimer_try_to_cancel(&vcpu->arch.ckc_timer);
diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
index 36678835034d..0ef81d6776e9 100644
--- a/arch/s390/kvm/sigp.c
+++ b/arch/s390/kvm/sigp.c
@@ -169,7 +169,7 @@ static int __sigp_set_prefix(struct kvm_vcpu *vcpu, u16 cpu_addr, u32 address,
                             unsigned long *reg)
 {
        struct kvm_s390_float_interrupt *fi = &vcpu->kvm->arch.float_int;
-        struct kvm_s390_local_interrupt *li;
+        struct kvm_s390_local_interrupt *li = NULL;
        struct kvm_s390_interrupt_info *inti;
        int rc;
        u8 tmp;
@@ -189,9 +189,10 @@ static int __sigp_set_prefix(struct kvm_vcpu *vcpu, u16 cpu_addr, u32 address,
                return 2; /* busy */
        spin_lock(&fi->lock);
-        li = fi->local_int[cpu_addr];
+        if (cpu_addr < KVM_MAX_VCPUS)
+                li = fi->local_int[cpu_addr];
-        if ((cpu_addr >= KVM_MAX_VCPUS) || (li == NULL)) {
+        if (li == NULL) {
                rc = 1; /* incorrect state */
                *reg &= SIGP_STAT_INCORRECT_STATE;
                kfree(inti);
diff --git a/arch/sh/boards/board-ap325rxa.c b/arch/sh/boards/board-ap325rxa.c
index 7ffd1b4315bd..b9c88cc519e2 100644
--- a/arch/sh/boards/board-ap325rxa.c
+++ b/arch/sh/boards/board-ap325rxa.c
@@ -547,7 +547,7 @@ static int __init ap325rxa_devices_setup(void)
        return platform_add_devices(ap325rxa_devices,
                                ARRAY_SIZE(ap325rxa_devices));
 }
-device_initcall(ap325rxa_devices_setup);
+arch_initcall(ap325rxa_devices_setup);
 /* Return the board specific boot mode pin configuration */
 static int ap325rxa_mode_pins(void)
diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
index f70f4644deb4..f9b2e4df35b9 100644
--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -608,7 +608,7 @@ static int __init migor_devices_setup(void)
        return platform_add_devices(migor_devices, ARRAY_SIZE(migor_devices));
 }
-__initcall(migor_devices_setup);
+arch_initcall(migor_devices_setup);
 /* Return the board specific boot mode pin configuration */
 static int migor_mode_pins(void)
diff --git a/arch/sh/kernel/cpu/sh2/setup-sh7619.c b/arch/sh/kernel/cpu/sh2/setup-sh7619.c
index 13798733f2db..8555c05e8667 100644
--- a/arch/sh/kernel/cpu/sh2/setup-sh7619.c
+++ b/arch/sh/kernel/cpu/sh2/setup-sh7619.c
@@ -187,7 +187,7 @@ static int __init sh7619_devices_setup(void)
        return platform_add_devices(sh7619_devices,
                                    ARRAY_SIZE(sh7619_devices));
 }
-__initcall(sh7619_devices_setup);
+arch_initcall(sh7619_devices_setup);
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-mxg.c b/arch/sh/kernel/cpu/sh2a/setup-mxg.c
index 869c2da4820b..b67376445315 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-mxg.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-mxg.c
@@ -238,7 +238,7 @@ static int __init mxg_devices_setup(void)
        return platform_add_devices(mxg_devices,
                                    ARRAY_SIZE(mxg_devices));
 }
-__initcall(mxg_devices_setup);
+arch_initcall(mxg_devices_setup);
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-sh7201.c b/arch/sh/kernel/cpu/sh2a/setup-sh7201.c
index d8febe128066..fbde5b75deb9 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-sh7201.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-sh7201.c
@@ -357,7 +357,7 @@ static int __init sh7201_devices_setup(void)
        return platform_add_devices(sh7201_devices,
                                    ARRAY_SIZE(sh7201_devices));
 }
-__initcall(sh7201_devices_setup);
+arch_initcall(sh7201_devices_setup);
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-sh7203.c b/arch/sh/kernel/cpu/sh2a/setup-sh7203.c
index 62e3039d2398..d3fd536c9a84 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-sh7203.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-sh7203.c
@@ -367,7 +367,7 @@ static int __init sh7203_devices_setup(void)
        return platform_add_devices(sh7203_devices,
                                    ARRAY_SIZE(sh7203_devices));
 }
-__initcall(sh7203_devices_setup);
+arch_initcall(sh7203_devices_setup);
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-sh7206.c b/arch/sh/kernel/cpu/sh2a/setup-sh7206.c
index 3e6f3d7a58be..a9ccc5e8d9e9 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-sh7206.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-sh7206.c
@@ -338,7 +338,7 @@ static int __init sh7206_devices_setup(void)
        return platform_add_devices(sh7206_devices,
                                    ARRAY_SIZE(sh7206_devices));
 }
-__initcall(sh7206_devices_setup);
+arch_initcall(sh7206_devices_setup);
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh7705.c b/arch/sh/kernel/cpu/sh3/setup-sh7705.c
index 88f742fed9ed..c23105983878 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh7705.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh7705.c
@@ -222,7 +222,7 @@ static int __init sh7705_devices_setup(void)
        return platform_add_devices(sh7705_devices,
                                    ARRAY_SIZE(sh7705_devices));
 }
-__initcall(sh7705_devices_setup);
+arch_initcall(sh7705_devices_setup);
 static struct platform_device *sh7705_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
index c56306798584..347ab35d0697 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
@@ -250,7 +250,7 @@ static int __init sh770x_devices_setup(void)
        return platform_add_devices(sh770x_devices,
                ARRAY_SIZE(sh770x_devices));
 }
-__initcall(sh770x_devices_setup);
+arch_initcall(sh770x_devices_setup);
 static struct platform_device *sh770x_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh7710.c b/arch/sh/kernel/cpu/sh3/setup-sh7710.c
index efa76c8148f4..717e90ae1097 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh7710.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh7710.c
@@ -226,7 +226,7 @@ static int __init sh7710_devices_setup(void)
        return platform_add_devices(sh7710_devices,
                                    ARRAY_SIZE(sh7710_devices));
 }
-__initcall(sh7710_devices_setup);
+arch_initcall(sh7710_devices_setup);
 static struct platform_device *sh7710_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh7720.c b/arch/sh/kernel/cpu/sh3/setup-sh7720.c
index 5b2107798edb..74d8baaf8e96 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh7720.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh7720.c
@@ -388,7 +388,7 @@ static int __init sh7720_devices_setup(void)
        return platform_add_devices(sh7720_devices,
                                    ARRAY_SIZE(sh7720_devices));
 }
-__initcall(sh7720_devices_setup);
+arch_initcall(sh7720_devices_setup);
 static struct platform_device *sh7720_early_devices[] __initdata = {
        &cmt0_device,
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh4-202.c b/arch/sh/kernel/cpu/sh4/setup-sh4-202.c
index 6d088d123591..de4827df19aa 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh4-202.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh4-202.c
@@ -138,7 +138,7 @@ static int __init sh4202_devices_setup(void)
        return platform_add_devices(sh4202_devices,
                                    ARRAY_SIZE(sh4202_devices));
 }
-__initcall(sh4202_devices_setup);
+arch_initcall(sh4202_devices_setup);
 static struct platform_device *sh4202_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7750.c b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
index 851672d15cf4..1b8b122e8f3d 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7750.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
@@ -239,7 +239,7 @@ static int __init sh7750_devices_setup(void)
        return platform_add_devices(sh7750_devices,
                                    ARRAY_SIZE(sh7750_devices));
 }
-__initcall(sh7750_devices_setup);
+arch_initcall(sh7750_devices_setup);
 static struct platform_device *sh7750_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7760.c b/arch/sh/kernel/cpu/sh4/setup-sh7760.c
index 5b822519bd90..7fbb7be9284c 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7760.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7760.c
@@ -265,7 +265,7 @@ static int __init sh7760_devices_setup(void)
        return platform_add_devices(sh7760_devices,
                                    ARRAY_SIZE(sh7760_devices));
 }
-__initcall(sh7760_devices_setup);
+arch_initcall(sh7760_devices_setup);
 static struct platform_device *sh7760_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7343.c b/arch/sh/kernel/cpu/sh4a/setup-sh7343.c
index 6307e087c864..ac4d5672ec1a 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7343.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7343.c
@@ -325,7 +325,7 @@ static int __init sh7343_devices_setup(void)
        return platform_add_devices(sh7343_devices,
                                    ARRAY_SIZE(sh7343_devices));
 }
-__initcall(sh7343_devices_setup);
+arch_initcall(sh7343_devices_setup);
 static struct platform_device *sh7343_early_devices[] __initdata = {
        &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7366.c b/arch/sh/kernel/cpu/sh4a/setup-sh7366.c
index c18f7d09281b..1a956b1beccc 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7366.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7366.c
@@ -318,7 +318,7 @@ static int __init sh7366_devices_setup(void)
        return platform_add_devices(sh7366_devices,
                                    ARRAY_SIZE(sh7366_devices));
 }
-__initcall(sh7366_devices_setup);
+arch_initcall(sh7366_devices_setup);
 static struct platform_device *sh7366_early_devices[] __initdata = {
        &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
index ea524a2da3e4..cda76ebf87c3 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
@@ -359,7 +359,7 @@ static int __init sh7722_devices_setup(void)
        return platform_add_devices(sh7722_devices,
                                    ARRAY_SIZE(sh7722_devices));
 }
-__initcall(sh7722_devices_setup);
+arch_initcall(sh7722_devices_setup);
 static struct platform_device *sh7722_early_devices[] __initdata = {
        &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
index e1bb80b2a27b..b45dace9539f 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
@@ -473,7 +473,7 @@ static int __init sh7723_devices_setup(void)
        return platform_add_devices(sh7723_devices,
                                    ARRAY_SIZE(sh7723_devices));
 }
-__initcall(sh7723_devices_setup);
+arch_initcall(sh7723_devices_setup);
 static struct platform_device *sh7723_early_devices[] __initdata = {
        &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7724.c b/arch/sh/kernel/cpu/sh4a/setup-sh7724.c
index e5ac9eb11c63..a04edaab9a29 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7724.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7724.c
@@ -508,7 +508,7 @@ static int __init sh7724_devices_setup(void)
        return platform_add_devices(sh7724_devices,
                                    ARRAY_SIZE(sh7724_devices));
 }
-device_initcall(sh7724_devices_setup);
+arch_initcall(sh7724_devices_setup);
 static struct platform_device *sh7724_early_devices[] __initdata = {
        &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
index f1e0c0d36da7..4659fff6b842 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
@@ -314,7 +314,7 @@ static int __init sh7763_devices_setup(void)
        return platform_add_devices(sh7763_devices,
                                    ARRAY_SIZE(sh7763_devices));
 }
-__initcall(sh7763_devices_setup);
+arch_initcall(sh7763_devices_setup);
 static struct platform_device *sh7763_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7770.c b/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
index 1e86209db284..eead08d89d32 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
@@ -368,7 +368,7 @@ static int __init sh7770_devices_setup(void)
        return platform_add_devices(sh7770_devices,
                                    ARRAY_SIZE(sh7770_devices));
 }
-__initcall(sh7770_devices_setup);
+arch_initcall(sh7770_devices_setup);
 static struct platform_device *sh7770_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7780.c b/arch/sh/kernel/cpu/sh4a/setup-sh7780.c
index 715e05b431e5..2c901f446959 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7780.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7780.c
@@ -256,7 +256,7 @@ static int __init sh7780_devices_setup(void)
        return platform_add_devices(sh7780_devices,
                                    ARRAY_SIZE(sh7780_devices));
 }
-__initcall(sh7780_devices_setup);
+arch_initcall(sh7780_devices_setup);
 static struct platform_device *sh7780_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7785.c b/arch/sh/kernel/cpu/sh4a/setup-sh7785.c
index af561402570b..7f6c718b6c36 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7785.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7785.c
@@ -263,7 +263,7 @@ static int __init sh7785_devices_setup(void)
        return platform_add_devices(sh7785_devices,
                                    ARRAY_SIZE(sh7785_devices));
 }
-__initcall(sh7785_devices_setup);
+arch_initcall(sh7785_devices_setup);
 static struct platform_device *sh7785_early_devices[] __initdata = {
        &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7786.c b/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
index b70049470a0b..0104a8ec5369 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
@@ -547,7 +547,7 @@ static int __init sh7786_devices_setup(void)
        return platform_add_devices(sh7786_devices,
                                    ARRAY_SIZE(sh7786_devices));
 }
-device_initcall(sh7786_devices_setup);
+arch_initcall(sh7786_devices_setup);
 void __init plat_early_device_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh4a/setup-shx3.c b/arch/sh/kernel/cpu/sh4a/setup-shx3.c
index 53c65fd9ccef..07f078961c71 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-shx3.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-shx3.c
@@ -256,7 +256,7 @@ static int __init shx3_devices_setup(void)
        return platform_add_devices(shx3_devices,
                                    ARRAY_SIZE(shx3_devices));
 }
-__initcall(shx3_devices_setup);
+arch_initcall(shx3_devices_setup);
 void __init plat_early_device_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh5/setup-sh5.c b/arch/sh/kernel/cpu/sh5/setup-sh5.c
index f5ff1ac57fc2..6a0f82f70032 100644
--- a/arch/sh/kernel/cpu/sh5/setup-sh5.c
+++ b/arch/sh/kernel/cpu/sh5/setup-sh5.c
@@ -186,7 +186,7 @@ static int __init sh5_devices_setup(void)
        return platform_add_devices(sh5_devices,
                                    ARRAY_SIZE(sh5_devices));
 }
-__initcall(sh5_devices_setup);
+arch_initcall(sh5_devices_setup);
 void __init plat_early_device_setup(void)
 {
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 738bdc6b0f8b..13ffa5df37d7 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -24,6 +24,7 @@ config X86
        select HAVE_UNSTABLE_SCHED_CLOCK
        select HAVE_IDE
        select HAVE_OPROFILE
+        select HAVE_PERF_COUNTERS if (!M386 && !M486)
        select HAVE_IOREMAP_PROT
        select HAVE_KPROBES
        select ARCH_WANT_OPTIONAL_GPIOLIB
@@ -742,7 +743,6 @@ config X86_UP_IOAPIC
 config X86_LOCAL_APIC
        def_bool y
        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
-        select HAVE_PERF_COUNTERS if (!M386 && !M486)
 config X86_IO_APIC
        def_bool y
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index edc90f23e708..8406ed7f9926 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -33,7 +33,7 @@ extern unsigned long asmlinkage efi_call_phys(void *, ...);
 #define efi_call_virt6(f, a1, a2, a3, a4, a5, a6)       \
        efi_call_virt(f, a1, a2, a3, a4, a5, a6)
-#define efi_ioremap(addr, size)                 ioremap_cache(addr, size)
+#define efi_ioremap(addr, size, type)           ioremap_cache(addr, size)
 #else /* !CONFIG_X86_32 */
@@ -84,7 +84,8 @@ extern u64 efi_call6(void *fp, u64 arg1, u64 arg2, u64 arg3,
        efi_call6((void *)(efi.systab->runtime->f), (u64)(a1), (u64)(a2), \
                  (u64)(a3), (u64)(a4), (u64)(a5), (u64)(a6))
-extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size);
+extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
+                                 u32 type);
 #endif /* CONFIG_X86_32 */
diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
index 2bdab21f0898..c6ccbe7e81ad 100644
--- a/arch/x86/include/asm/irqflags.h
+++ b/arch/x86/include/asm/irqflags.h
@@ -12,9 +12,15 @@ static inline unsigned long native_save_fl(void)
 {
        unsigned long flags;
+        /*
+         * Note: this needs to be "=r" not "=rm", because we have the
+         * stack offset from what gcc expects at the time the "pop" is
+         * executed, and so a memory reference with respect to the stack
+         * would end up using the wrong address.
+         */
        asm volatile("# __raw_save_flags\n\t"
                     "pushf ; pop %0"
-                     : "=g" (flags)
+                     : "=r" (flags)
                     : /* no input */
                     : "memory");
diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
index 341070f7ad5c..77a68505419a 100644
--- a/arch/x86/include/asm/uv/uv_hub.h
+++ b/arch/x86/include/asm/uv/uv_hub.h
@@ -175,7 +175,7 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __uv_hub_info);
 #define UV_GLOBAL_MMR32_PNODE_BITS(p)   ((p) << (UV_GLOBAL_MMR32_PNODE_SHIFT))
 #define UV_GLOBAL_MMR64_PNODE_BITS(p)                                   \
-        ((unsigned long)(UV_PNODE_TO_GNODE(p)) << UV_GLOBAL_MMR64_PNODE_SHIFT)
+        (((unsigned long)(p)) << UV_GLOBAL_MMR64_PNODE_SHIFT)
 #define UV_APIC_PNODE_SHIFT     6
@@ -327,6 +327,7 @@ struct uv_blade_info {
        unsigned short  nr_possible_cpus;
        unsigned short  nr_online_cpus;
        unsigned short  pnode;
+        short           memory_nid;
 };
 extern struct uv_blade_info *uv_blade_info;
 extern short *uv_node_to_blade;
@@ -363,6 +364,12 @@ static inline int uv_blade_to_pnode(int bid)
        return uv_blade_info[bid].pnode;
 }
+/* Nid of memory node on blade. -1 if no blade-local memory */
+static inline int uv_blade_to_memory_nid(int bid)
+{
+        return uv_blade_info[bid].memory_nid;
+}
 /* Determine the number of possible cpus on a blade */
 static inline int uv_blade_nr_possible_cpus(int bid)
 {
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 2284a4812b68..d2ed6c5ddc80 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -3793,6 +3793,9 @@ int arch_enable_uv_irq(char *irq_name, unsigned int irq, int cpu, int mmr_blade,
        mmr_pnode = uv_blade_to_pnode(mmr_blade);
        uv_write_global_mmr64(mmr_pnode, mmr_offset, mmr_value);
+        if (cfg->move_in_progress)
+                send_cleanup_vector(cfg);
        return irq;
 }
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index 8e4cbb255c38..a5371ec36776 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -17,11 +17,13 @@ static int x2apic_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
        return x2apic_enabled();
 }
-/* Start with all IRQs pointing to boot CPU.  IRQ balancing will shift them. */
+/*
+ * need to use more than cpu 0, because we need more vectors when
+ * MSI-X are used.
+ */
 static const struct cpumask *x2apic_target_cpus(void)
 {
-        return cpumask_of(0);
+        return cpu_online_mask;
 }
 /*
@@ -170,7 +172,7 @@ static unsigned long set_apic_id(unsigned int id)
 static int x2apic_cluster_phys_pkg_id(int initial_apicid, int index_msb)
 {
-        return current_cpu_data.initial_apicid >> index_msb;
+        return initial_apicid >> index_msb;
 }
 static void x2apic_send_IPI_self(int vector)
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index a284359627e7..a8989aadc99a 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -27,11 +27,13 @@ static int x2apic_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
                return 0;
 }
-/* Start with all IRQs pointing to boot CPU.  IRQ balancing will shift them. */
+/*
+ * need to use more than cpu 0, because we need more vectors when
+ * MSI-X are used.
+ */
 static const struct cpumask *x2apic_target_cpus(void)
 {
-        return cpumask_of(0);
+        return cpu_online_mask;
 }
 static void x2apic_vector_allocation_domain(int cpu, struct cpumask *retmask)
@@ -162,7 +164,7 @@ static unsigned long set_apic_id(unsigned int id)
 static int x2apic_phys_pkg_id(int initial_apicid, int index_msb)
 {
-        return current_cpu_data.initial_apicid >> index_msb;
+        return initial_apicid >> index_msb;
 }
 static void x2apic_send_IPI_self(int vector)
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 096d19aea2f7..832e908adcb5 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -261,7 +261,7 @@ struct apic apic_x2apic_uv_x = {
        .apic_id_registered             = uv_apic_id_registered,
        .irq_delivery_mode              = dest_Fixed,
-        .irq_dest_mode                  = 1, /* logical */
+        .irq_dest_mode                  = 0, /* physical */
        .target_cpus                    = uv_target_cpus,
        .disable_esr                    = 0,
@@ -362,12 +362,6 @@ static __init void get_lowmem_redirect(unsigned long *base, unsigned long *size)
        BUG();
 }
-static __init void map_low_mmrs(void)
-{
-        init_extra_mapping_uc(UV_GLOBAL_MMR32_BASE, UV_GLOBAL_MMR32_SIZE);
-        init_extra_mapping_uc(UV_LOCAL_MMR_BASE, UV_LOCAL_MMR_SIZE);
-}
 enum map_type {map_wb, map_uc};
 static __init void map_high(char *id, unsigned long base, int shift,
@@ -395,26 +389,6 @@ static __init void map_gru_high(int max_pnode)
                map_high("GRU", gru.s.base, shift, max_pnode, map_wb);
 }
-static __init void map_config_high(int max_pnode)
-{
-        union uvh_rh_gam_cfg_overlay_config_mmr_u cfg;
-        int shift = UVH_RH_GAM_CFG_OVERLAY_CONFIG_MMR_BASE_SHFT;
-        cfg.v = uv_read_local_mmr(UVH_RH_GAM_CFG_OVERLAY_CONFIG_MMR);
-        if (cfg.s.enable)
-                map_high("CONFIG", cfg.s.base, shift, max_pnode, map_uc);
-}
-static __init void map_mmr_high(int max_pnode)
-{
-        union uvh_rh_gam_mmr_overlay_config_mmr_u mmr;
-        int shift = UVH_RH_GAM_MMR_OVERLAY_CONFIG_MMR_BASE_SHFT;
-        mmr.v = uv_read_local_mmr(UVH_RH_GAM_MMR_OVERLAY_CONFIG_MMR);
-        if (mmr.s.enable)
-                map_high("MMR", mmr.s.base, shift, max_pnode, map_uc);
-}
 static __init void map_mmioh_high(int max_pnode)
 {
        union uvh_rh_gam_mmioh_overlay_config_mmr_u mmioh;
@@ -566,8 +540,6 @@ void __init uv_system_init(void)
        unsigned long mmr_base, present, paddr;
        unsigned short pnode_mask;
-        map_low_mmrs();
        m_n_config.v = uv_read_local_mmr(UVH_SI_ADDR_MAP_CONFIG);
        m_val = m_n_config.s.m_skt;
        n_val = m_n_config.s.n_skt;
@@ -591,6 +563,8 @@ void __init uv_system_init(void)
        bytes = sizeof(struct uv_blade_info) * uv_num_possible_blades();
        uv_blade_info = kmalloc(bytes, GFP_KERNEL);
        BUG_ON(!uv_blade_info);
+        for (blade = 0; blade < uv_num_possible_blades(); blade++)
+                uv_blade_info[blade].memory_nid = -1;
        get_lowmem_redirect(&lowmem_redir_base, &lowmem_redir_size);
@@ -629,6 +603,9 @@ void __init uv_system_init(void)
                lcpu = uv_blade_info[blade].nr_possible_cpus;
                uv_blade_info[blade].nr_possible_cpus++;
+                /* Any node on the blade, else will contain -1. */
+                uv_blade_info[blade].memory_nid = nid;
                uv_cpu_hub_info(cpu)->lowmem_remap_base = lowmem_redir_base;
                uv_cpu_hub_info(cpu)->lowmem_remap_top = lowmem_redir_size;
                uv_cpu_hub_info(cpu)->m_val = m_val;
@@ -662,11 +639,10 @@ void __init uv_system_init(void)
                pnode = (paddr >> m_val) & pnode_mask;
                blade = boot_pnode_to_blade(pnode);
                uv_node_to_blade[nid] = blade;
+                max_pnode = max(pnode, max_pnode);
        }
        map_gru_high(max_pnode);
-        map_mmr_high(max_pnode);
-        map_config_high(max_pnode);
        map_mmioh_high(max_pnode);
        uv_cpu_init();
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 79302e9a33a4..442b5508893f 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -811,7 +811,7 @@ static int apm_do_idle(void)
        u8 ret = 0;
        int idled = 0;
        int polling;
-        int err;
+        int err = 0;
        polling = !!(current_thread_info()->status & TS_POLLING);
        if (polling) {
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index e2485b03f1cf..63fddcd082cd 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -400,6 +400,13 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
                level = cpuid_eax(1);
                if((level >= 0x0f48 && level < 0x0f50) || level >= 0x0f58)
                        set_cpu_cap(c, X86_FEATURE_REP_GOOD);
+                /*
+                 * Some BIOSes incorrectly force this feature, but only K8
+                 * revision D (model = 0x14) and later actually support it.
+                 */
+                if (c->x86_model < 0x14)
+                        clear_cpu_cap(c, X86_FEATURE_LAHF_LM);
        }
        if (c->x86 == 0x10 || c->x86 == 0x11)
                set_cpu_cap(c, X86_FEATURE_REP_GOOD);
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index f1961c07af9a..5ce60a88027b 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -59,7 +59,30 @@ void __init setup_cpu_local_masks(void)
        alloc_bootmem_cpumask_var(&cpu_sibling_setup_mask);
 }
-static const struct cpu_dev *this_cpu __cpuinitdata;
+static void __cpuinit default_init(struct cpuinfo_x86 *c)
+{
+#ifdef CONFIG_X86_64
+        display_cacheinfo(c);
+#else
+        /* Not much we can do here... */
+        /* Check if at least it has cpuid */
+        if (c->cpuid_level == -1) {
+                /* No cpuid. It must be an ancient CPU */
+                if (c->x86 == 4)
+                        strcpy(c->x86_model_id, "486");
+                else if (c->x86 == 3)
+                        strcpy(c->x86_model_id, "386");
+        }
+#endif
+}
+static const struct cpu_dev __cpuinitconst default_cpu = {
+        .c_init         = default_init,
+        .c_vendor       = "Unknown",
+        .c_x86_vendor   = X86_VENDOR_UNKNOWN,
+};
+static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
 DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
 #ifdef CONFIG_X86_64
@@ -332,29 +355,6 @@ void switch_to_new_gdt(int cpu)
 static const struct cpu_dev *__cpuinitdata cpu_devs[X86_VENDOR_NUM] = {};
-static void __cpuinit default_init(struct cpuinfo_x86 *c)
-{
-#ifdef CONFIG_X86_64
-        display_cacheinfo(c);
-#else
-        /* Not much we can do here... */
-        /* Check if at least it has cpuid */
-        if (c->cpuid_level == -1) {
-                /* No cpuid. It must be an ancient CPU */
-                if (c->x86 == 4)
-                        strcpy(c->x86_model_id, "486");
-                else if (c->x86 == 3)
-                        strcpy(c->x86_model_id, "386");
-        }
-#endif
-}
-static const struct cpu_dev __cpuinitconst default_cpu = {
-        .c_init = default_init,
-        .c_vendor = "Unknown",
-        .c_x86_vendor = X86_VENDOR_UNKNOWN,
-};
 static void __cpuinit get_model_name(struct cpuinfo_x86 *c)
 {
        unsigned int *v;
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index bff8dd191dd5..8bc64cfbe936 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -36,6 +36,7 @@
 static DEFINE_PER_CPU(__u64, next_check) = INITIAL_JIFFIES;
 static DEFINE_PER_CPU(unsigned long, thermal_throttle_count);
+static DEFINE_PER_CPU(bool, thermal_throttle_active);
 static atomic_t therm_throt_en          = ATOMIC_INIT(0);
@@ -96,24 +97,27 @@ static int therm_throt_process(int curr)
 {
        unsigned int cpu = smp_processor_id();
        __u64 tmp_jiffs = get_jiffies_64();
+        bool was_throttled = __get_cpu_var(thermal_throttle_active);
+        bool is_throttled = __get_cpu_var(thermal_throttle_active) = curr;
-        if (curr)
+        if (is_throttled)
                __get_cpu_var(thermal_throttle_count)++;
-        if (time_before64(tmp_jiffs, __get_cpu_var(next_check)))
+        if (!(was_throttled ^ is_throttled) &&
+            time_before64(tmp_jiffs, __get_cpu_var(next_check)))
                return 0;
        __get_cpu_var(next_check) = tmp_jiffs + CHECK_INTERVAL;
        /* if we just entered the thermal event */
-        if (curr) {
+        if (is_throttled) {
                printk(KERN_CRIT "CPU%d: Temperature above threshold, "
-                       "cpu clock throttled (total events = %lu)\n", cpu,
+                       "cpu clock throttled (total events = %lu)\n",
-                       __get_cpu_var(thermal_throttle_count));
+                       cpu, __get_cpu_var(thermal_throttle_count));
                add_taint(TAINT_MACHINE_CHECK);
-        } else {
+        } else if (was_throttled) {
-                printk(KERN_CRIT "CPU%d: Temperature/speed normal\n", cpu);
+                printk(KERN_INFO "CPU%d: Temperature/speed normal\n", cpu);
        }
        return 1;
diff --git a/arch/x86/kernel/cpu/perf_counter.c b/arch/x86/kernel/cpu/perf_counter.c
index a7aa8f900954..900332b800f8 100644
--- a/arch/x86/kernel/cpu/perf_counter.c
+++ b/arch/x86/kernel/cpu/perf_counter.c
@@ -55,6 +55,7 @@ struct x86_pmu {
        int             num_counters_fixed;
        int             counter_bits;
        u64             counter_mask;
+        int             apic;
        u64             max_period;
        u64             intel_ctrl;
 };
@@ -72,8 +73,8 @@ static const u64 p6_perfmon_event_map[] =
 {
  [PERF_COUNT_HW_CPU_CYCLES]            = 0x0079,
  [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
-  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0000,
+  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0f2e,
-  [PERF_COUNT_HW_CACHE_MISSES]          = 0x0000,
+  [PERF_COUNT_HW_CACHE_MISSES]          = 0x012e,
  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,
  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,
  [PERF_COUNT_HW_BUS_CYCLES]            = 0x0062,
@@ -613,6 +614,7 @@ static DEFINE_MUTEX(pmc_reserve_mutex);
 static bool reserve_pmc_hardware(void)
 {
+#ifdef CONFIG_X86_LOCAL_APIC
        int i;
        if (nmi_watchdog == NMI_LOCAL_APIC)
@@ -627,9 +629,11 @@ static bool reserve_pmc_hardware(void)
                if (!reserve_evntsel_nmi(x86_pmu.eventsel + i))
                        goto eventsel_fail;
        }
+#endif
        return true;
+#ifdef CONFIG_X86_LOCAL_APIC
 eventsel_fail:
        for (i--; i >= 0; i--)
                release_evntsel_nmi(x86_pmu.eventsel + i);
@@ -644,10 +648,12 @@ perfctr_fail:
                enable_lapic_nmi_watchdog();
        return false;
+#endif
 }
 static void release_pmc_hardware(void)
 {
+#ifdef CONFIG_X86_LOCAL_APIC
        int i;
        for (i = 0; i < x86_pmu.num_counters; i++) {
@@ -657,6 +663,7 @@ static void release_pmc_hardware(void)
        if (nmi_watchdog == NMI_LOCAL_APIC)
                enable_lapic_nmi_watchdog();
+#endif
 }
 static void hw_perf_counter_destroy(struct perf_counter *counter)
@@ -748,6 +755,15 @@ static int __hw_perf_counter_init(struct perf_counter *counter)
                hwc->sample_period = x86_pmu.max_period;
                hwc->last_period = hwc->sample_period;
                atomic64_set(&hwc->period_left, hwc->sample_period);
+        } else {
+                /*
+                 * If we have a PMU initialized but no APIC
+                 * interrupts, we cannot sample hardware
+                 * counters (user-space has to fall back and
+                 * sample via a hrtimer based software counter):
+                 */
+                if (!x86_pmu.apic)
+                        return -EOPNOTSUPP;
        }
        counter->destroy = hw_perf_counter_destroy;
@@ -1449,18 +1465,22 @@ void smp_perf_pending_interrupt(struct pt_regs *regs)
 void set_perf_counter_pending(void)
 {
+#ifdef CONFIG_X86_LOCAL_APIC
        apic->send_IPI_self(LOCAL_PENDING_VECTOR);
+#endif
 }
 void perf_counters_lapic_init(void)
 {
-        if (!x86_pmu_initialized())
+#ifdef CONFIG_X86_LOCAL_APIC
+        if (!x86_pmu.apic || !x86_pmu_initialized())
                return;
        /*
         * Always use NMI for PMU
         */
        apic_write(APIC_LVTPC, APIC_DM_NMI);
+#endif
 }
 static int __kprobes
@@ -1484,7 +1504,9 @@ perf_counter_nmi_handler(struct notifier_block *self,
        regs = args->regs;
+#ifdef CONFIG_X86_LOCAL_APIC
        apic_write(APIC_LVTPC, APIC_DM_NMI);
+#endif
        /*
         * Can't rely on the handled return value to say it was our NMI, two
         * counters could trigger 'simultaneously' raising two back-to-back NMIs.
@@ -1515,6 +1537,7 @@ static struct x86_pmu p6_pmu = {
        .event_map              = p6_pmu_event_map,
        .raw_event              = p6_pmu_raw_event,
        .max_events             = ARRAY_SIZE(p6_perfmon_event_map),
+        .apic                   = 1,
        .max_period             = (1ULL << 31) - 1,
        .version                = 0,
        .num_counters           = 2,
@@ -1541,6 +1564,7 @@ static struct x86_pmu intel_pmu = {
        .event_map              = intel_pmu_event_map,
        .raw_event              = intel_pmu_raw_event,
        .max_events             = ARRAY_SIZE(intel_perfmon_event_map),
+        .apic                   = 1,
        /*
         * Intel PMCs cannot be accessed sanely above 32 bit width,
         * so we install an artificial 1<<31 period regardless of
@@ -1564,6 +1588,7 @@ static struct x86_pmu amd_pmu = {
        .num_counters           = 4,
        .counter_bits           = 48,
        .counter_mask           = (1ULL << 48) - 1,
+        .apic                   = 1,
        /* use highest bit to detect overflow */
        .max_period             = (1ULL << 47) - 1,
 };
@@ -1589,13 +1614,14 @@ static int p6_pmu_init(void)
                return -ENODEV;
        }
+        x86_pmu = p6_pmu;
        if (!cpu_has_apic) {
-                pr_info("no Local APIC, try rebooting with lapic");
+                pr_info("no APIC, boot with the \"lapic\" boot parameter to force-enable it.\n");
-                return -ENODEV;
+                pr_info("no hardware sampling interrupt available.\n");
+                x86_pmu.apic = 0;
        }
-        x86_pmu                         = p6_pmu;
        return 0;
 }
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index 96f7ac0bbf01..fe26ba3e3451 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -354,7 +354,7 @@ void __init efi_init(void)
         */
        c16 = tmp = early_ioremap(efi.systab->fw_vendor, 2);
        if (c16) {
-                for (i = 0; i < sizeof(vendor) && *c16; ++i)
+                for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i)
                        vendor[i] = *c16++;
                vendor[i] = '\0';
        } else
@@ -512,7 +512,7 @@ void __init efi_enter_virtual_mode(void)
                        && end_pfn <= max_pfn_mapped))
                        va = __va(md->phys_addr);
                else
-                        va = efi_ioremap(md->phys_addr, size);
+                        va = efi_ioremap(md->phys_addr, size, md->type);
                md->virt_addr = (u64) (unsigned long) va;
diff --git a/arch/x86/kernel/efi_64.c b/arch/x86/kernel/efi_64.c
index 22c3b7828c50..ac0621a7ac3d 100644
--- a/arch/x86/kernel/efi_64.c
+++ b/arch/x86/kernel/efi_64.c
@@ -98,10 +98,14 @@ void __init efi_call_phys_epilog(void)
        early_runtime_code_mapping_set_exec(0);
 }
-void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size)
+void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
+                                 u32 type)
 {
        unsigned long last_map_pfn;
+        if (type == EFI_MEMORY_MAPPED_IO)
+                return ioremap(phys_addr, size);
        last_map_pfn = init_memory_mapping(phys_addr, phys_addr + size);
        if ((last_map_pfn << PAGE_SHIFT) < phys_addr + size)
                return NULL;
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 8663afb56535..0d98a01cbdb2 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -602,7 +602,11 @@ ignore_int:
 #endif
        iret
-.section .cpuinit.data,"wa"
+#ifndef CONFIG_HOTPLUG_CPU
+        __CPUINITDATA
+#else
+        __REFDATA
+#endif
 .align 4
 ENTRY(initial_code)
        .long i386_start_kernel
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 508e982dd072..a06e8d101844 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -3,6 +3,7 @@
 #include <linux/init.h>
 #include <linux/pm.h>
 #include <linux/efi.h>
+#include <linux/dmi.h>
 #include <acpi/reboot.h>
 #include <asm/io.h>
 #include <asm/apic.h>
@@ -17,7 +18,6 @@
 #include <asm/cpu.h>
 #ifdef CONFIG_X86_32
-# include <linux/dmi.h>
 # include <linux/ctype.h>
 # include <linux/mc146818rtc.h>
 #else
@@ -404,6 +404,46 @@ EXPORT_SYMBOL(machine_real_restart);
 #endif /* CONFIG_X86_32 */
+/*
+ * Some Apple MacBook and MacBookPro's needs reboot=p to be able to reboot
+ */
+static int __init set_pci_reboot(const struct dmi_system_id *d)
+{
+        if (reboot_type != BOOT_CF9) {
+                reboot_type = BOOT_CF9;
+                printk(KERN_INFO "%s series board detected. "
+                       "Selecting PCI-method for reboots.\n", d->ident);
+        }
+        return 0;
+}
+static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
+        {       /* Handle problems with rebooting on Apple MacBook5 */
+                .callback = set_pci_reboot,
+                .ident = "Apple MacBook5",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBook5"),
+                },
+        },
+        {       /* Handle problems with rebooting on Apple MacBookPro5 */
+                .callback = set_pci_reboot,
+                .ident = "Apple MacBookPro5",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5"),
+                },
+        },
+        { }
+};
+static int __init pci_reboot_init(void)
+{
+        dmi_check_system(pci_reboot_dmi_table);
+        return 0;
+}
+core_initcall(pci_reboot_init);
 static inline void kb_wait(void)
 {
        int i;
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 6e1a368d21d4..71f4368b357e 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -275,15 +275,20 @@ static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin)
 * use the TSC value at the transitions to calculate a pretty
 * good value for the TSC frequencty.
 */
+static inline int pit_verify_msb(unsigned char val)
+{
+        /* Ignore LSB */
+        inb(0x42);
+        return inb(0x42) == val;
+}
 static inline int pit_expect_msb(unsigned char val, u64 *tscp, unsigned long *deltap)
 {
        int count;
        u64 tsc = 0;
        for (count = 0; count < 50000; count++) {
-                /* Ignore LSB */
+                if (!pit_verify_msb(val))
-                inb(0x42);
-                if (inb(0x42) != val)
                        break;
                tsc = get_cycles();
        }
@@ -336,8 +341,7 @@ static unsigned long quick_pit_calibrate(void)
         * to do that is to just read back the 16-bit counter
         * once from the PIT.
         */
-        inb(0x42);
+        pit_verify_msb(0);
-        inb(0x42);
        if (pit_expect_msb(0xff, &tsc, &d1)) {
                for (i = 1; i <= MAX_QUICK_PIT_ITERATIONS; i++) {
@@ -348,8 +352,19 @@ static unsigned long quick_pit_calibrate(void)
                         * Iterate until the error is less than 500 ppm
                         */
                        delta -= tsc;
-                        if (d1+d2 < delta >> 11)
+                        if (d1+d2 >= delta >> 11)
-                                goto success;
+                                continue;
+                        /*
+                         * Check the PIT one more time to verify that
+                         * all TSC reads were stable wrt the PIT.
+                         *
+                         * This also guarantees serialization of the
+                         * last cycle read ('d2') in pit_expect_msb.
+                         */
+                        if (!pit_verify_msb(0xfe - i))
+                                break;
+                        goto success;
                }
        }
        printk("Fast TSC calibration failed\n");
diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
index b263423fbe2a..95a7289e4b0c 100644
--- a/arch/x86/kernel/vmi_32.c
+++ b/arch/x86/kernel/vmi_32.c
@@ -441,7 +441,7 @@ vmi_startup_ipi_hook(int phys_apicid, unsigned long start_eip,
        ap.ds = __USER_DS;
        ap.es = __USER_DS;
        ap.fs = __KERNEL_PERCPU;
-        ap.gs = 0;
+        ap.gs = __KERNEL_STACK_CANARY;
        ap.eflags = 0;
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 59f31d2dd435..78d185d797de 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -393,8 +393,8 @@ SECTIONS
 #ifdef CONFIG_X86_32
-ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
+. = ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
-        "kernel image bigger than KERNEL_IMAGE_SIZE")
+           "kernel image bigger than KERNEL_IMAGE_SIZE");
 #else
 /*
 * Per-cpu symbols which need to be offset from __per_cpu_load
@@ -407,12 +407,12 @@ INIT_PER_CPU(irq_stack_union);
 /*
 * Build-time check on the image size:
 */
-ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
+. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-        "kernel image bigger than KERNEL_IMAGE_SIZE")
+           "kernel image bigger than KERNEL_IMAGE_SIZE");
 #ifdef CONFIG_SMP
-ASSERT((per_cpu__irq_stack_union == 0),
+. = ASSERT((per_cpu__irq_stack_union == 0),
-        "irq_stack_union is not at start of per-cpu area");
+           "irq_stack_union is not at start of per-cpu area");
 #endif
 #endif /* CONFIG_X86_32 */
@@ -420,7 +420,7 @@ ASSERT((per_cpu__irq_stack_union == 0),
 #ifdef CONFIG_KEXEC
 #include <asm/kexec.h>
-ASSERT(kexec_control_code_size <= KEXEC_CONTROL_CODE_MAX_SIZE,
+. = ASSERT(kexec_control_code_size <= KEXEC_CONTROL_CODE_MAX_SIZE,
-       "kexec control code size is too big")
+           "kexec control code size is too big");
 #endif
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 4d6f0d293ee2..21f68e00524f 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -104,6 +104,9 @@ static s64 __kpit_elapsed(struct kvm *kvm)
        ktime_t remaining;
        struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state;
+        if (!ps->pit_timer.period)
+                return 0;
        /*
         * The Counter does not stop when it reaches zero. In
         * Modes 0, 1, 4, and 5 the Counter ``wraps around'' to
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 7030b5f911bf..0ef5bb2b4043 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -489,16 +489,20 @@ static unsigned long *gfn_to_rmap(struct kvm *kvm, gfn_t gfn, int lpage)
 *
 * If rmapp bit zero is one, (then rmap & ~1) points to a struct kvm_rmap_desc
 * containing more mappings.
+ *
+ * Returns the number of rmap entries before the spte was added or zero if
+ * the spte was not added.
+ *
 */
-static void rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn, int lpage)
+static int rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn, int lpage)
 {
        struct kvm_mmu_page *sp;
        struct kvm_rmap_desc *desc;
        unsigned long *rmapp;
-        int i;
+        int i, count = 0;
        if (!is_rmap_pte(*spte))
-                return;
+                return count;
        gfn = unalias_gfn(vcpu->kvm, gfn);
        sp = page_header(__pa(spte));
        sp->gfns[spte - sp->spt] = gfn;
@@ -515,8 +519,10 @@ static void rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn, int lpage)
        } else {
                rmap_printk("rmap_add: %p %llx many->many\n", spte, *spte);
                desc = (struct kvm_rmap_desc *)(*rmapp & ~1ul);
-                while (desc->shadow_ptes[RMAP_EXT-1] && desc->more)
+                while (desc->shadow_ptes[RMAP_EXT-1] && desc->more) {
                        desc = desc->more;
+                        count += RMAP_EXT;
+                }
                if (desc->shadow_ptes[RMAP_EXT-1]) {
                        desc->more = mmu_alloc_rmap_desc(vcpu);
                        desc = desc->more;
@@ -525,6 +531,7 @@ static void rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn, int lpage)
                        ;
                desc->shadow_ptes[i] = spte;
        }
+        return count;
 }
 static void rmap_desc_remove_entry(unsigned long *rmapp,
@@ -754,6 +761,19 @@ static int kvm_age_rmapp(struct kvm *kvm, unsigned long *rmapp)
        return young;
 }
+#define RMAP_RECYCLE_THRESHOLD 1000
+static void rmap_recycle(struct kvm_vcpu *vcpu, gfn_t gfn, int lpage)
+{
+        unsigned long *rmapp;
+        gfn = unalias_gfn(vcpu->kvm, gfn);
+        rmapp = gfn_to_rmap(vcpu->kvm, gfn, lpage);
+        kvm_unmap_rmapp(vcpu->kvm, rmapp);
+        kvm_flush_remote_tlbs(vcpu->kvm);
+}
 int kvm_age_hva(struct kvm *kvm, unsigned long hva)
 {
        return kvm_handle_hva(kvm, hva, kvm_age_rmapp);
@@ -1407,24 +1427,25 @@ static int kvm_mmu_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp)
 */
 void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages)
 {
+        int used_pages;
+        used_pages = kvm->arch.n_alloc_mmu_pages - kvm->arch.n_free_mmu_pages;
+        used_pages = max(0, used_pages);
        /*
         * If we set the number of mmu pages to be smaller be than the
         * number of actived pages , we must to free some mmu pages before we
         * change the value
         */
-        if ((kvm->arch.n_alloc_mmu_pages - kvm->arch.n_free_mmu_pages) >
+        if (used_pages > kvm_nr_mmu_pages) {
-            kvm_nr_mmu_pages) {
+                while (used_pages > kvm_nr_mmu_pages) {
-                int n_used_mmu_pages = kvm->arch.n_alloc_mmu_pages
-                                       - kvm->arch.n_free_mmu_pages;
-                while (n_used_mmu_pages > kvm_nr_mmu_pages) {
                        struct kvm_mmu_page *page;
                        page = container_of(kvm->arch.active_mmu_pages.prev,
                                            struct kvm_mmu_page, link);
                        kvm_mmu_zap_page(kvm, page);
-                        n_used_mmu_pages--;
+                        used_pages--;
                }
                kvm->arch.n_free_mmu_pages = 0;
        }
@@ -1740,6 +1761,7 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *shadow_pte,
 {
        int was_rmapped = 0;
        int was_writeble = is_writeble_pte(*shadow_pte);
+        int rmap_count;
        pgprintk("%s: spte %llx access %x write_fault %d"
                 " user_fault %d gfn %lx\n",
@@ -1781,9 +1803,11 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *shadow_pte,
        page_header_update_slot(vcpu->kvm, shadow_pte, gfn);
        if (!was_rmapped) {
-                rmap_add(vcpu, shadow_pte, gfn, largepage);
+                rmap_count = rmap_add(vcpu, shadow_pte, gfn, largepage);
                if (!is_rmap_pte(*shadow_pte))
                        kvm_release_pfn_clean(pfn);
+                if (rmap_count > RMAP_RECYCLE_THRESHOLD)
+                        rmap_recycle(vcpu, gfn, largepage);
        } else {
                if (was_writeble)
                        kvm_release_pfn_dirty(pfn);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 71510e07e69e..b1f658ad2f06 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -711,6 +711,7 @@ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                svm->vmcb->control.tsc_offset += delta;
                vcpu->cpu = cpu;
                kvm_migrate_timers(vcpu);
+                svm->asid_generation = 0;
        }
        for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
@@ -1031,7 +1032,6 @@ static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *svm_data)
                svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
        }
-        svm->vcpu.cpu = svm_data->cpu;
        svm->asid_generation = svm_data->asid_generation;
        svm->vmcb->control.asid = svm_data->next_asid++;
 }
@@ -2300,8 +2300,8 @@ static void pre_svm_run(struct vcpu_svm *svm)
        struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
        svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
-        if (svm->vcpu.cpu != cpu ||
+        /* FIXME: handle wraparound of asid_generation */
-            svm->asid_generation != svm_data->asid_generation)
+        if (svm->asid_generation != svm_data->asid_generation)
                new_asid(svm, svm_data);
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 356a0ce85c68..29f912927a58 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3157,8 +3157,8 @@ static void handle_invalid_guest_state(struct kvm_vcpu *vcpu,
        struct vcpu_vmx *vmx = to_vmx(vcpu);
        enum emulation_result err = EMULATE_DONE;
-        preempt_enable();
        local_irq_enable();
+        preempt_enable();
        while (!guest_state_valid(vcpu)) {
                err = emulate_instruction(vcpu, kvm_run, 0, 0, 0);
@@ -3168,7 +3168,7 @@ static void handle_invalid_guest_state(struct kvm_vcpu *vcpu,
                if (err != EMULATE_DONE) {
                        kvm_report_emulation_failure(vcpu, "emulation failure");
-                        return;
+                        break;
                }
                if (signal_pending(current))
@@ -3177,8 +3177,8 @@ static void handle_invalid_guest_state(struct kvm_vcpu *vcpu,
                        schedule();
        }
-        local_irq_disable();
        preempt_disable();
+        local_irq_disable();
        vmx->invalid_state_emulation_result = err;
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index fe5474aec41a..3d4529011828 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -704,11 +704,48 @@ static bool msr_mtrr_valid(unsigned msr)
        return false;
 }
+static bool valid_pat_type(unsigned t)
+{
+        return t < 8 && (1 << t) & 0xf3; /* 0, 1, 4, 5, 6, 7 */
+}
+static bool valid_mtrr_type(unsigned t)
+{
+        return t < 8 && (1 << t) & 0x73; /* 0, 1, 4, 5, 6 */
+}
+static bool mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+{
+        int i;
+        if (!msr_mtrr_valid(msr))
+                return false;
+        if (msr == MSR_IA32_CR_PAT) {
+                for (i = 0; i < 8; i++)
+                        if (!valid_pat_type((data >> (i * 8)) & 0xff))
+                                return false;
+                return true;
+        } else if (msr == MSR_MTRRdefType) {
+                if (data & ~0xcff)
+                        return false;
+                return valid_mtrr_type(data & 0xff);
+        } else if (msr >= MSR_MTRRfix64K_00000 && msr <= MSR_MTRRfix4K_F8000) {
+                for (i = 0; i < 8 ; i++)
+                        if (!valid_mtrr_type((data >> (i * 8)) & 0xff))
+                                return false;
+                return true;
+        }
+        /* variable MTRRs */
+        return valid_mtrr_type(data & 0xff);
+}
 static int set_msr_mtrr(struct kvm_vcpu *vcpu, u32 msr, u64 data)
 {
        u64 *p = (u64 *)&vcpu->arch.mtrr_state.fixed_ranges;
-        if (!msr_mtrr_valid(msr))
+        if (!mtrr_valid(vcpu, msr, data))
                return 1;
        if (msr == MSR_MTRRdefType) {
@@ -1079,14 +1116,13 @@ long kvm_arch_dev_ioctl(struct file *filp,
                if (copy_to_user(user_msr_list, &msr_list, sizeof msr_list))
                        goto out;
                r = -E2BIG;
-                if (n < num_msrs_to_save)
+                if (n < msr_list.nmsrs)
                        goto out;
                r = -EFAULT;
                if (copy_to_user(user_msr_list->indices, &msrs_to_save,
                                 num_msrs_to_save * sizeof(u32)))
                        goto out;
-                if (copy_to_user(user_msr_list->indices
+                if (copy_to_user(user_msr_list->indices + num_msrs_to_save,
-                                 + num_msrs_to_save * sizeof(u32),
                                 &emulated_msrs,
                                 ARRAY_SIZE(emulated_msrs) * sizeof(u32)))
                        goto out;
diff --git a/arch/x86/lib/msr.c b/arch/x86/lib/msr.c
index 1440b9c0547e..caa24aca8115 100644
--- a/arch/x86/lib/msr.c
+++ b/arch/x86/lib/msr.c
@@ -89,16 +89,13 @@ void rdmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs)
        rv.msrs   = msrs;
        rv.msr_no = msr_no;
-        preempt_disable();
+        this_cpu = get_cpu();
-        /*
-         * FIXME: handle the CPU we're executing on separately for now until
+        if (cpumask_test_cpu(this_cpu, mask))
-         * smp_call_function_many has been fixed to not skip it.
+                __rdmsr_on_cpu(&rv);
-         */
-        this_cpu = raw_smp_processor_id();
-        smp_call_function_single(this_cpu, __rdmsr_on_cpu, &rv, 1);
        smp_call_function_many(mask, __rdmsr_on_cpu, &rv, 1);
-        preempt_enable();
+        put_cpu();
 }
 EXPORT_SYMBOL(rdmsr_on_cpus);
@@ -121,16 +118,13 @@ void wrmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs)
        rv.msrs   = msrs;
        rv.msr_no = msr_no;
-        preempt_disable();
+        this_cpu = get_cpu();
-        /*
-         * FIXME: handle the CPU we're executing on separately for now until
+        if (cpumask_test_cpu(this_cpu, mask))
-         * smp_call_function_many has been fixed to not skip it.
+                __wrmsr_on_cpu(&rv);
-         */
-        this_cpu = raw_smp_processor_id();
-        smp_call_function_single(this_cpu, __wrmsr_on_cpu, &rv, 1);
        smp_call_function_many(mask, __wrmsr_on_cpu, &rv, 1);
-        preempt_enable();
+        put_cpu();
 }
 EXPORT_SYMBOL(wrmsr_on_cpus);
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 1b734d7a8966..7e600c1962db 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -591,9 +591,12 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
        unsigned int level;
        pte_t *kpte, old_pte;
-        if (cpa->flags & CPA_PAGES_ARRAY)
+        if (cpa->flags & CPA_PAGES_ARRAY) {
-                address = (unsigned long)page_address(cpa->pages[cpa->curpage]);
+                struct page *page = cpa->pages[cpa->curpage];
-        else if (cpa->flags & CPA_ARRAY)
+                if (unlikely(PageHighMem(page)))
+                        return 0;
+                address = (unsigned long)page_address(page);
+        } else if (cpa->flags & CPA_ARRAY)
                address = cpa->vaddr[cpa->curpage];
        else
                address = *cpa->vaddr;
@@ -697,9 +700,12 @@ static int cpa_process_alias(struct cpa_data *cpa)
         * No need to redo, when the primary call touched the direct
         * mapping already:
         */
-        if (cpa->flags & CPA_PAGES_ARRAY)
+        if (cpa->flags & CPA_PAGES_ARRAY) {
-                vaddr = (unsigned long)page_address(cpa->pages[cpa->curpage]);
+                struct page *page = cpa->pages[cpa->curpage];
-        else if (cpa->flags & CPA_ARRAY)
+                if (unlikely(PageHighMem(page)))
+                        return 0;
+                vaddr = (unsigned long)page_address(page);
+        } else if (cpa->flags & CPA_ARRAY)
                vaddr = cpa->vaddr[cpa->curpage];
        else
                vaddr = *cpa->vaddr;
@@ -997,12 +1003,15 @@ EXPORT_SYMBOL(set_memory_array_uc);
 int _set_memory_wc(unsigned long addr, int numpages)
 {
        int ret;
+        unsigned long addr_copy = addr;
        ret = change_page_attr_set(&addr, numpages,
                                    __pgprot(_PAGE_CACHE_UC_MINUS), 0);
        if (!ret) {
-                ret = change_page_attr_set(&addr, numpages,
+                ret = change_page_attr_set_clr(&addr_copy, numpages,
-                                    __pgprot(_PAGE_CACHE_WC), 0);
+                                               __pgprot(_PAGE_CACHE_WC),
+                                               __pgprot(_PAGE_CACHE_MASK),
+                                               0, 0, NULL);
        }
        return ret;
 }
@@ -1119,7 +1128,9 @@ int set_pages_array_uc(struct page **pages, int addrinarray)
        int free_idx;
        for (i = 0; i < addrinarray; i++) {
-                start = (unsigned long)page_address(pages[i]);
+                if (PageHighMem(pages[i]))
+                        continue;
+                start = page_to_pfn(pages[i]) << PAGE_SHIFT;
                end = start + PAGE_SIZE;
                if (reserve_memtype(start, end, _PAGE_CACHE_UC_MINUS, NULL))
                        goto err_out;
@@ -1132,7 +1143,9 @@ int set_pages_array_uc(struct page **pages, int addrinarray)
 err_out:
        free_idx = i;
        for (i = 0; i < free_idx; i++) {
-                start = (unsigned long)page_address(pages[i]);
+                if (PageHighMem(pages[i]))
+                        continue;
+                start = page_to_pfn(pages[i]) << PAGE_SHIFT;
                end = start + PAGE_SIZE;
                free_memtype(start, end);
        }
@@ -1161,7 +1174,9 @@ int set_pages_array_wb(struct page **pages, int addrinarray)
                return retval;
        for (i = 0; i < addrinarray; i++) {
-                start = (unsigned long)page_address(pages[i]);
+                if (PageHighMem(pages[i]))
+                        continue;
+                start = page_to_pfn(pages[i]) << PAGE_SHIFT;
                end = start + PAGE_SIZE;
                free_memtype(start, end);
        }
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index af8f9650058c..ed34f5e35999 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -329,7 +329,6 @@ void __init reserve_top_address(unsigned long reserve)
        printk(KERN_INFO "Reserving virtual address space above 0x%08x\n",
               (int)-reserve);
        __FIXADDR_TOP = -reserve - PAGE_SIZE;
-        __VMALLOC_RESERVE += reserve;
 #endif
 }
diff --git a/block/Kconfig b/block/Kconfig
index 95a86adc33a1..9be0b56eaee1 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -48,9 +48,9 @@ config LBDAF
          If unsure, say Y.
 config BLK_DEV_BSG
-        bool "Block layer SG support v4 (EXPERIMENTAL)"
+        bool "Block layer SG support v4"
-        depends on EXPERIMENTAL
+        default y
-        ---help---
+        help
          Saying Y here will enable generic SG (SCSI generic) v4 support
          for any block device.
@@ -60,7 +60,10 @@ config BLK_DEV_BSG
          protocols (e.g. Task Management Functions and SMP in Serial
          Attached SCSI).
-          If unsure, say N.
+          This option is required by recent UDEV versions to properly
+          access device serial numbers, etc.
+          If unsure, say Y.
 config BLK_DEV_INTEGRITY
        bool "Block layer data integrity support"
diff --git a/block/blk-settings.c b/block/blk-settings.c
index 8a3ea3bba10d..476d87065073 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -7,6 +7,7 @@
 #include <linux/bio.h>
 #include <linux/blkdev.h>
 #include <linux/bootmem.h>      /* for max_pfn/max_low_pfn */
+#include <linux/gcd.h>
 #include "blk.h"
@@ -384,8 +385,8 @@ void blk_queue_alignment_offset(struct request_queue *q, unsigned int offset)
 EXPORT_SYMBOL(blk_queue_alignment_offset);
 /**
- * blk_queue_io_min - set minimum request size for the queue
+ * blk_limits_io_min - set minimum request size for a device
- * @q:  the request queue for the device
+ * @limits: the queue limits
 * @min:  smallest I/O size in bytes
 *
 * Description:
@@ -394,15 +395,35 @@ EXPORT_SYMBOL(blk_queue_alignment_offset);
 *   smallest I/O the device can perform without incurring a performance
 *   penalty.
 */
-void blk_queue_io_min(struct request_queue *q, unsigned int min)
+void blk_limits_io_min(struct queue_limits *limits, unsigned int min)
 {
-        q->limits.io_min = min;
+        limits->io_min = min;
-        if (q->limits.io_min < q->limits.logical_block_size)
+        if (limits->io_min < limits->logical_block_size)
-                q->limits.io_min = q->limits.logical_block_size;
+                limits->io_min = limits->logical_block_size;
-        if (q->limits.io_min < q->limits.physical_block_size)
+        if (limits->io_min < limits->physical_block_size)
-                q->limits.io_min = q->limits.physical_block_size;
+                limits->io_min = limits->physical_block_size;
+}
+EXPORT_SYMBOL(blk_limits_io_min);
+/**
+ * blk_queue_io_min - set minimum request size for the queue
+ * @q:  the request queue for the device
+ * @min:  smallest I/O size in bytes
+ *
+ * Description:
+ *   Storage devices may report a granularity or preferred minimum I/O
+ *   size which is the smallest request the device can perform without
+ *   incurring a performance penalty.  For disk drives this is often the
+ *   physical block size.  For RAID arrays it is often the stripe chunk
+ *   size.  A properly aligned multiple of minimum_io_size is the
+ *   preferred request size for workloads where a high number of I/O
+ *   operations is desired.
+ */
+void blk_queue_io_min(struct request_queue *q, unsigned int min)
+{
+        blk_limits_io_min(&q->limits, min);
 }
 EXPORT_SYMBOL(blk_queue_io_min);
@@ -412,8 +433,12 @@ EXPORT_SYMBOL(blk_queue_io_min);
 * @opt:  optimal request size in bytes
 *
 * Description:
- *   Drivers can call this function to set the preferred I/O request
+ *   Storage devices may report an optimal I/O size, which is the
- *   size for devices that report such a value.
+ *   device's preferred unit for sustained I/O.  This is rarely reported
+ *   for disk drives.  For RAID arrays it is usually the stripe width or
+ *   the internal track size.  A properly aligned multiple of
+ *   optimal_io_size is the preferred request size for workloads where
+ *   sustained throughput is desired.
 */
 void blk_queue_io_opt(struct request_queue *q, unsigned int opt)
 {
@@ -433,27 +458,7 @@ EXPORT_SYMBOL(blk_queue_io_opt);
 **/
 void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b)
 {
-        /* zero is "infinity" */
+        blk_stack_limits(&t->limits, &b->limits, 0);
-        t->limits.max_sectors = min_not_zero(queue_max_sectors(t),
-                                             queue_max_sectors(b));
-        t->limits.max_hw_sectors = min_not_zero(queue_max_hw_sectors(t),
-                                                queue_max_hw_sectors(b));
-        t->limits.seg_boundary_mask = min_not_zero(queue_segment_boundary(t),
-                                                   queue_segment_boundary(b));
-        t->limits.max_phys_segments = min_not_zero(queue_max_phys_segments(t),
-                                                   queue_max_phys_segments(b));
-        t->limits.max_hw_segments = min_not_zero(queue_max_hw_segments(t),
-                                                 queue_max_hw_segments(b));
-        t->limits.max_segment_size = min_not_zero(queue_max_segment_size(t),
-                                                  queue_max_segment_size(b));
-        t->limits.logical_block_size = max(queue_logical_block_size(t),
-                                           queue_logical_block_size(b));
        if (!t->queue_lock)
                WARN_ON_ONCE(1);
@@ -523,6 +528,16 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
                return -1;
        }
+        /* Find lcm() of optimal I/O size */
+        if (t->io_opt && b->io_opt)
+                t->io_opt = (t->io_opt * b->io_opt) / gcd(t->io_opt, b->io_opt);
+        else if (b->io_opt)
+                t->io_opt = b->io_opt;
+        /* Verify that optimal I/O size is a multiple of io_min */
+        if (t->io_min && t->io_opt % t->io_min)
+                return -1;
        return 0;
 }
 EXPORT_SYMBOL(blk_stack_limits);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 958c1fa41900..fe3eba5d6b3e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -219,6 +219,8 @@ enum {
        AHCI_HFLAG_SECT255              = (1 << 8), /* max 255 sectors */
        AHCI_HFLAG_YES_NCQ              = (1 << 9), /* force NCQ cap on */
        AHCI_HFLAG_NO_SUSPEND           = (1 << 10), /* don't suspend */
+        AHCI_HFLAG_SRST_TOUT_IS_OFFLINE = (1 << 11), /* treat SRST timeout as
+                                                        link offline */
        /* ap->flags bits */
@@ -1663,6 +1665,7 @@ static int ahci_do_softreset(struct ata_link *link, unsigned int *class,
                             int (*check_ready)(struct ata_link *link))
 {
        struct ata_port *ap = link->ap;
+        struct ahci_host_priv *hpriv = ap->host->private_data;
        const char *reason = NULL;
        unsigned long now, msecs;
        struct ata_taskfile tf;
@@ -1701,12 +1704,21 @@ static int ahci_do_softreset(struct ata_link *link, unsigned int *class,
        /* wait for link to become ready */
        rc = ata_wait_after_reset(link, deadline, check_ready);
-        /* link occupied, -ENODEV too is an error */
+        if (rc == -EBUSY && hpriv->flags & AHCI_HFLAG_SRST_TOUT_IS_OFFLINE) {
-        if (rc) {
+                /*
+                 * Workaround for cases where link online status can't
+                 * be trusted.  Treat device readiness timeout as link
+                 * offline.
+                 */
+                ata_link_printk(link, KERN_INFO,
+                                "device not ready, treating as offline\n");
+                *class = ATA_DEV_NONE;
+        } else if (rc) {
+                /* link occupied, -ENODEV too is an error */
                reason = "device not ready";
                goto fail;
-        }
+        } else
-        *class = ahci_dev_classify(ap);
+                *class = ahci_dev_classify(ap);
        DPRINTK("EXIT, class=%u\n", *class);
        return 0;
@@ -1773,7 +1785,8 @@ static int ahci_sb600_softreset(struct ata_link *link, unsigned int *class,
                irq_sts = readl(port_mmio + PORT_IRQ_STAT);
                if (irq_sts & PORT_IRQ_BAD_PMP) {
                        ata_link_printk(link, KERN_WARNING,
-                                        "failed due to HW bug, retry pmp=0\n");
+                                        "applying SB600 PMP SRST workaround "
+                                        "and retrying\n");
                        rc = ahci_do_softreset(link, class, 0, deadline,
                                               ahci_check_ready);
                }
@@ -2726,6 +2739,56 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
        return !ver || strcmp(ver, dmi->driver_data) < 0;
 }
+static bool ahci_broken_online(struct pci_dev *pdev)
+{
+#define ENCODE_BUSDEVFN(bus, slot, func)                        \
+        (void *)(unsigned long)(((bus) << 8) | PCI_DEVFN((slot), (func)))
+        static const struct dmi_system_id sysids[] = {
+                /*
+                 * There are several gigabyte boards which use
+                 * SIMG5723s configured as hardware RAID.  Certain
+                 * 5723 firmware revisions shipped there keep the link
+                 * online but fail to answer properly to SRST or
+                 * IDENTIFY when no device is attached downstream
+                 * causing libata to retry quite a few times leading
+                 * to excessive detection delay.
+                 *
+                 * As these firmwares respond to the second reset try
+                 * with invalid device signature, considering unknown
+                 * sig as offline works around the problem acceptably.
+                 */
+                {
+                        .ident = "EP45-DQ6",
+                        .matches = {
+                                DMI_MATCH(DMI_BOARD_VENDOR,
+                                          "Gigabyte Technology Co., Ltd."),
+                                DMI_MATCH(DMI_BOARD_NAME, "EP45-DQ6"),
+                        },
+                        .driver_data = ENCODE_BUSDEVFN(0x0a, 0x00, 0),
+                },
+                {
+                        .ident = "EP45-DS5",
+                        .matches = {
+                                DMI_MATCH(DMI_BOARD_VENDOR,
+                                          "Gigabyte Technology Co., Ltd."),
+                                DMI_MATCH(DMI_BOARD_NAME, "EP45-DS5"),
+                        },
+                        .driver_data = ENCODE_BUSDEVFN(0x03, 0x00, 0),
+                },
+                { }     /* terminate list */
+        };
+#undef ENCODE_BUSDEVFN
+        const struct dmi_system_id *dmi = dmi_first_match(sysids);
+        unsigned int val;
+        if (!dmi)
+                return false;
+        val = (unsigned long)dmi->driver_data;
+        return pdev->bus->number == (val >> 8) && pdev->devfn == (val & 0xff);
+}
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        static int printed_version;
@@ -2841,6 +2904,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                           "BIOS update required for suspend/resume\n");
        }
+        if (ahci_broken_online(pdev)) {
+                hpriv->flags |= AHCI_HFLAG_SRST_TOUT_IS_OFFLINE;
+                dev_info(&pdev->dev,
+                         "online status unreliable, applying workaround\n");
+        }
        /* CAP.NP sometimes indicate the index of the last enabled
         * port, at other times, that of the last possible port, so
         * determining the maximum port number requires looking at
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 8ac98ff16d7d..072ba5ea138f 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4302,6 +4302,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "WDC WD2500JD-00HBB0", "WD-WMAL71490727", ATA_HORKAGE_BROKEN_HPA },
        { "MAXTOR 6L080L4",     "A93.0500",     ATA_HORKAGE_BROKEN_HPA },
+        /* this one allows HPA unlocking but fails IOs on the area */
+        { "OCZ-VERTEX",             "1.30",     ATA_HORKAGE_BROKEN_HPA },
        /* Devices which report 1 sector over size HPA */
        { "ST340823A",          NULL,           ATA_HORKAGE_HPA_SIZE, },
        { "ST320413A",          NULL,           ATA_HORKAGE_HPA_SIZE, },
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index 5702affcb325..41c94b1ae493 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -250,7 +250,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
                ata_port_desc(ap, "no IRQ, using PIO polling");
        }
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL);
        if (!info) {
                dev_err(dev, "failed to allocate memory for private data\n");
@@ -275,7 +275,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
        if (!info->ide_addr) {
                dev_err(dev, "failed to map IO base\n");
                ret = -ENOMEM;
-                goto err_ide_ioremap;
+                goto err_put;
        }
        info->alt_addr = devm_ioremap(dev,
@@ -284,7 +284,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
        if (!info->alt_addr) {
                dev_err(dev, "failed to map CTL base\n");
                ret = -ENOMEM;
-                goto err_alt_ioremap;
+                goto err_put;
        }
        ap->ioaddr.cmd_addr = info->ide_addr;
@@ -303,13 +303,8 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
                        irq ? ata_sff_interrupt : NULL,
                        irq_flags, &pata_at91_sht);
-err_alt_ioremap:
+err_put:
-        devm_iounmap(dev, info->ide_addr);
-err_ide_ioremap:
        clk_put(info->mck);
-        kfree(info);
        return ret;
 }
@@ -317,7 +312,6 @@ static int __devexit pata_at91_remove(struct platform_device *pdev)
 {
        struct ata_host *host = dev_get_drvdata(&pdev->dev);
        struct at91_ide_info *info;
-        struct device *dev = &pdev->dev;
        if (!host)
                return 0;
@@ -328,11 +322,8 @@ static int __devexit pata_at91_remove(struct platform_device *pdev)
        if (!info)
                return 0;
-        devm_iounmap(dev, info->ide_addr);
-        devm_iounmap(dev, info->alt_addr);
        clk_put(info->mck);
-        kfree(info);
        return 0;
 }
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index bec0b8ade66d..45915566e4e9 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -1,6 +1,7 @@
 /*
 * pata_atiixp.c        - ATI PATA for new ATA layer
 *                        (C) 2005 Red Hat Inc
+ *                        (C) 2009 Bartlomiej Zolnierkiewicz
 *
 * Based on
 *
@@ -61,20 +62,19 @@ static void atiixp_set_pio_timing(struct ata_port *ap, struct ata_device *adev,
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
        int dn = 2 * ap->port_no + adev->devno;
-        /* Check this is correct - the order is odd in both drivers */
        int timing_shift = (16 * ap->port_no) + 8 * (adev->devno ^ 1);
-        u16 pio_mode_data, pio_timing_data;
+        u32 pio_timing_data;
+        u16 pio_mode_data;
        pci_read_config_word(pdev, ATIIXP_IDE_PIO_MODE, &pio_mode_data);
        pio_mode_data &= ~(0x7 << (4 * dn));
        pio_mode_data |= pio << (4 * dn);
        pci_write_config_word(pdev, ATIIXP_IDE_PIO_MODE, pio_mode_data);
-        pci_read_config_word(pdev, ATIIXP_IDE_PIO_TIMING, &pio_timing_data);
+        pci_read_config_dword(pdev, ATIIXP_IDE_PIO_TIMING, &pio_timing_data);
        pio_timing_data &= ~(0xFF << timing_shift);
        pio_timing_data |= (pio_timings[pio] << timing_shift);
-        pci_write_config_word(pdev, ATIIXP_IDE_PIO_TIMING, pio_timing_data);
+        pci_write_config_dword(pdev, ATIIXP_IDE_PIO_TIMING, pio_timing_data);
 }
 /**
@@ -119,16 +119,17 @@ static void atiixp_set_dmamode(struct ata_port *ap, struct ata_device *adev)
                udma_mode_data |= dma << (4 * dn);
                pci_write_config_word(pdev, ATIIXP_IDE_UDMA_MODE, udma_mode_data);
        } else {
-                u16 mwdma_timing_data;
-                /* Check this is correct - the order is odd in both drivers */
                int timing_shift = (16 * ap->port_no) + 8 * (adev->devno ^ 1);
+                u32 mwdma_timing_data;
                dma -= XFER_MW_DMA_0;
-                pci_read_config_word(pdev, ATIIXP_IDE_MWDMA_TIMING, &mwdma_timing_data);
+                pci_read_config_dword(pdev, ATIIXP_IDE_MWDMA_TIMING,
+                                      &mwdma_timing_data);
                mwdma_timing_data &= ~(0xFF << timing_shift);
                mwdma_timing_data |= (mwdma_timings[dma] << timing_shift);
-                pci_write_config_word(pdev, ATIIXP_IDE_MWDMA_TIMING, mwdma_timing_data);
+                pci_write_config_dword(pdev, ATIIXP_IDE_MWDMA_TIMING,
+                                       mwdma_timing_data);
        }
        /*
         *      We must now look at the PIO mode situation. We may need to
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index b2d11f300c39..86a40582999c 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -602,6 +602,7 @@ MODULE_VERSION(DRV_VERSION);
 static int adma_enabled;
 static int swncq_enabled = 1;
+static int msi_enabled;
 static void nv_adma_register_mode(struct ata_port *ap)
 {
@@ -2459,6 +2460,11 @@ static int nv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        } else if (type == SWNCQ)
                nv_swncq_host_init(host);
+        if (msi_enabled) {
+                dev_printk(KERN_NOTICE, &pdev->dev, "Using MSI\n");
+                pci_enable_msi(pdev);
+        }
        pci_set_master(pdev);
        return ata_host_activate(host, pdev->irq, ipriv->irq_handler,
                                 IRQF_SHARED, ipriv->sht);
@@ -2558,4 +2564,6 @@ module_param_named(adma, adma_enabled, bool, 0444);
 MODULE_PARM_DESC(adma, "Enable use of ADMA (Default: false)");
 module_param_named(swncq, swncq_enabled, bool, 0444);
 MODULE_PARM_DESC(swncq, "Enable use of SWNCQ (Default: true)");
+module_param_named(msi, msi_enabled, bool, 0444);
+MODULE_PARM_DESC(msi, "Enable use of MSI (Default: false)");
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 81cb01bfc356..456594bd97bc 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -483,9 +483,6 @@ int platform_driver_register(struct platform_driver *drv)
                drv->driver.remove = platform_drv_remove;
        if (drv->shutdown)
                drv->driver.shutdown = platform_drv_shutdown;
-        if (drv->suspend || drv->resume)
-                pr_warning("Platform driver '%s' needs updating - please use "
-                        "dev_pm_ops\n", drv->driver.name);
        return driver_register(&drv->driver);
 }
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index f4bb43fb8016..e077701ae3d9 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -225,7 +225,7 @@ static const struct agp_bridge_driver parisc_agp_driver = {
        .configure              = parisc_agp_configure,
        .fetch_size             = parisc_agp_fetch_size,
        .tlb_flush              = parisc_agp_tlbflush,
-        .mask_memory            = parisc_agp_mask_memory,
+        .mask_memory            = parisc_agp_page_mask_memory,
        .masks                  = parisc_agp_masks,
        .agp_enable             = parisc_agp_enable,
        .cache_flush            = global_cache_flush,
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 6e6942c45f5b..d083c73d784a 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -144,6 +144,8 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf,
 static int pty_write_room(struct tty_struct *tty)
 {
+        if (tty->stopped)
+                return 0;
        return pty_space(tty->link);
 }
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index acd76b767d4c..1733d3439ad2 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -48,6 +48,41 @@ static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
 /* Line disc dispatch table */
 static struct tty_ldisc_ops *tty_ldiscs[NR_LDISCS];
+static inline struct tty_ldisc *get_ldisc(struct tty_ldisc *ld)
+{
+        if (ld)
+                atomic_inc(&ld->users);
+        return ld;
+}
+static void put_ldisc(struct tty_ldisc *ld)
+{
+        unsigned long flags;
+        if (WARN_ON_ONCE(!ld))
+                return;
+        /*
+         * If this is the last user, free the ldisc, and
+         * release the ldisc ops.
+         *
+         * We really want an "atomic_dec_and_lock_irqsave()",
+         * but we don't have it, so this does it by hand.
+         */
+        local_irq_save(flags);
+        if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
+                struct tty_ldisc_ops *ldo = ld->ops;
+                ldo->refcount--;
+                module_put(ldo->owner);
+                spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+                kfree(ld);
+                return;
+        }
+        local_irq_restore(flags);
+}
 /**
 *      tty_register_ldisc      -       install a line discipline
 *      @disc: ldisc number
@@ -142,7 +177,7 @@ static struct tty_ldisc *tty_ldisc_try_get(int disc)
                        /* lock it */
                        ldops->refcount++;
                        ld->ops = ldops;
-                        ld->refcount = 0;
+                        atomic_set(&ld->users, 1);
                        err = 0;
                }
        }
@@ -181,35 +216,6 @@ static struct tty_ldisc *tty_ldisc_get(int disc)
        return ld;
 }
-/**
- *      tty_ldisc_put           -       drop ldisc reference
- *      @ld: ldisc
- *
- *      Drop a reference to a line discipline. Manage refcounts and
- *      module usage counts. Free the ldisc once the recount hits zero.
- *
- *      Locking:
- *              takes tty_ldisc_lock to guard against ldisc races
- */
-static void tty_ldisc_put(struct tty_ldisc *ld)
-{
-        unsigned long flags;
-        int disc = ld->ops->num;
-        struct tty_ldisc_ops *ldo;
-        BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        ldo = tty_ldiscs[disc];
-        BUG_ON(ldo->refcount == 0);
-        ldo->refcount--;
-        module_put(ldo->owner);
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        WARN_ON(ld->refcount);
-        kfree(ld);
-}
 static void *tty_ldiscs_seq_start(struct seq_file *m, loff_t *pos)
 {
        return (*pos < NR_LDISCS) ? pos : NULL;
@@ -234,7 +240,7 @@ static int tty_ldiscs_seq_show(struct seq_file *m, void *v)
        if (IS_ERR(ld))
                return 0;
        seq_printf(m, "%-10s %2d\n", ld->ops->name ? ld->ops->name : "???", i);
-        tty_ldisc_put(ld);
+        put_ldisc(ld);
        return 0;
 }
@@ -288,20 +294,17 @@ static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
 *      Locking: takes tty_ldisc_lock
 */
-static int tty_ldisc_try(struct tty_struct *tty)
+static struct tty_ldisc *tty_ldisc_try(struct tty_struct *tty)
 {
        unsigned long flags;
        struct tty_ldisc *ld;
-        int ret = 0;
        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        ld = tty->ldisc;
+        ld = NULL;
-        if (test_bit(TTY_LDISC, &tty->flags)) {
+        if (test_bit(TTY_LDISC, &tty->flags))
-                ld->refcount++;
+                ld = get_ldisc(tty->ldisc);
-                ret = 1;
-        }
        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        return ret;
+        return ld;
 }
 /**
@@ -322,10 +325,11 @@ static int tty_ldisc_try(struct tty_struct *tty)
 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
 {
+        struct tty_ldisc *ld;
        /* wait_event is a macro */
-        wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
+        wait_event(tty_ldisc_wait, (ld = tty_ldisc_try(tty)) != NULL);
-        WARN_ON(tty->ldisc->refcount == 0);
+        return ld;
-        return tty->ldisc;
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
@@ -342,9 +346,7 @@ EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
 {
-        if (tty_ldisc_try(tty))
+        return tty_ldisc_try(tty);
-                return tty->ldisc;
-        return NULL;
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
@@ -360,21 +362,15 @@ EXPORT_SYMBOL_GPL(tty_ldisc_ref);
 void tty_ldisc_deref(struct tty_ldisc *ld)
 {
-        unsigned long flags;
+        put_ldisc(ld);
-        BUG_ON(ld == NULL);
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        if (ld->refcount == 0)
-                printk(KERN_ERR "tty_ldisc_deref: no references.\n");
-        else
-                ld->refcount--;
-        if (ld->refcount == 0)
-                wake_up(&tty_ldisc_wait);
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
+static inline void tty_ldisc_put(struct tty_ldisc *ld)
+{
+        put_ldisc(ld);
+}
 /**
 *      tty_ldisc_enable        -       allow ldisc use
 *      @tty: terminal to activate ldisc on
@@ -523,31 +519,6 @@ static int tty_ldisc_halt(struct tty_struct *tty)
 }
 /**
- *      tty_ldisc_wait_idle     -       wait for the ldisc to become idle
- *      @tty: tty to wait for
- *
- *      Wait for the line discipline to become idle. The discipline must
- *      have been halted for this to guarantee it remains idle.
- *
- *      tty_ldisc_lock protects the ref counts currently.
- */
-static int tty_ldisc_wait_idle(struct tty_struct *tty)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        while (tty->ldisc->refcount) {
-                spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-                if (wait_event_timeout(tty_ldisc_wait,
-                                tty->ldisc->refcount == 0, 5 * HZ) == 0)
-                        return -EBUSY;
-                spin_lock_irqsave(&tty_ldisc_lock, flags);
-        }
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        return 0;
-}
-/**
 *      tty_set_ldisc           -       set line discipline
 *      @tty: the terminal to set
 *      @ldisc: the line discipline
@@ -642,14 +613,6 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
        flush_scheduled_work();
-        /* Let any existing reference holders finish */
-        retval = tty_ldisc_wait_idle(tty);
-        if (retval < 0) {
-                clear_bit(TTY_LDISC_CHANGING, &tty->flags);
-                tty_ldisc_put(new_ldisc);
-                return retval;
-        }
        mutex_lock(&tty->ldisc_mutex);
        if (test_bit(TTY_HUPPED, &tty->flags)) {
                /* We were raced by the hangup method. It will have stomped
@@ -795,7 +758,6 @@ void tty_ldisc_hangup(struct tty_struct *tty)
                if (tty->ldisc) {       /* Not yet closed */
                        /* Switch back to N_TTY */
                        tty_ldisc_halt(tty);
-                        tty_ldisc_wait_idle(tty);
                        tty_ldisc_reinit(tty);
                        /* At this point we have a closed ldisc and we want to
                           reopen it. We could defer this to the next open but
@@ -860,14 +822,6 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
        tty_ldisc_halt(tty);
        flush_scheduled_work();
-        /*
-         * Wait for any short term users (we know they are just driver
-         * side waiters as the file is closing so user count on the file
-         * side is zero.
-         */
-        tty_ldisc_wait_idle(tty);
        mutex_lock(&tty->ldisc_mutex);
        /*
         * Now kill off the ldisc
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b90eda8b3440..fd69086d08d5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -858,6 +858,8 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
                /* Check for existing affected CPUs.
                 * They may not be aware of it due to CPU Hotplug.
+                 * cpufreq_cpu_put is called when the device is removed
+                 * in __cpufreq_remove_dev()
                 */
                managed_policy = cpufreq_cpu_get(j);
                if (unlikely(managed_policy)) {
@@ -884,7 +886,7 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
                        ret = sysfs_create_link(&sys_dev->kobj,
                                                &managed_policy->kobj,
                                                "cpufreq");
-                        if (!ret)
+                        if (ret)
                                cpufreq_cpu_put(managed_policy);
                        /*
                         * Success. We only needed to be added to the mask.
@@ -924,6 +926,8 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
        spin_lock_irqsave(&cpufreq_driver_lock, flags);
        for_each_cpu(j, policy->cpus) {
+                if (!cpu_online(j))
+                        continue;
                per_cpu(cpufreq_cpu_data, j) = policy;
                per_cpu(policy_cpu, j) = policy->cpu;
        }
@@ -1244,13 +1248,22 @@ EXPORT_SYMBOL(cpufreq_get);
 static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 {
-        int cpu = sysdev->id;
        int ret = 0;
+#ifdef __powerpc__
+        int cpu = sysdev->id;
        unsigned int cur_freq = 0;
        struct cpufreq_policy *cpu_policy;
        dprintk("suspending cpu %u\n", cpu);
+        /*
+         * This whole bogosity is here because Powerbooks are made of fail.
+         * No sane platform should need any of the code below to be run.
+         * (it's entirely the wrong thing to do, as driver->get may
+         *  reenable interrupts on some architectures).
+         */
        if (!cpu_online(cpu))
                return 0;
@@ -1309,6 +1322,7 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 out:
        cpufreq_cpu_put(cpu_policy);
+#endif  /* __powerpc__ */
        return ret;
 }
@@ -1322,12 +1336,18 @@ out:
 */
 static int cpufreq_resume(struct sys_device *sysdev)
 {
-        int cpu = sysdev->id;
        int ret = 0;
+#ifdef __powerpc__
+        int cpu = sysdev->id;
        struct cpufreq_policy *cpu_policy;
        dprintk("resuming cpu %u\n", cpu);
+        /* As with the ->suspend method, all the code below is
+         * only necessary because Powerbooks suck.
+         * See commit 42d4dc3f4e1e for jokes. */
        if (!cpu_online(cpu))
                return 0;
@@ -1391,6 +1411,7 @@ out:
        schedule_work(&cpu_policy->update);
 fail:
        cpufreq_cpu_put(cpu_policy);
+#endif  /* __powerpc__ */
        return ret;
 }
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 57490502b21c..bdea7e2f94ba 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -63,6 +63,7 @@ struct cpu_dbs_info_s {
        unsigned int down_skip;
        unsigned int requested_freq;
        int cpu;
+        unsigned int enable:1;
        /*
         * percpu mutex that serializes governor limit change with
         * do_dbs_timer invocation. We do not want do_dbs_timer to run
@@ -141,6 +142,9 @@ dbs_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
        struct cpufreq_policy *policy;
+        if (!this_dbs_info->enable)
+                return 0;
        policy = this_dbs_info->cur_policy;
        /*
@@ -497,6 +501,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
        int delay = usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
        delay -= jiffies % delay;
+        dbs_info->enable = 1;
        INIT_DELAYED_WORK_DEFERRABLE(&dbs_info->work, do_dbs_timer);
        queue_delayed_work_on(dbs_info->cpu, kconservative_wq, &dbs_info->work,
                                delay);
@@ -504,6 +509,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
+        dbs_info->enable = 0;
        cancel_delayed_work_sync(&dbs_info->work);
 }
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 24964c1d0af9..e2a10bcba7a1 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -868,6 +868,8 @@ static void amd64_read_dbam_reg(struct amd64_pvt *pvt)
                        goto err_reg;
        }
+        return;
 err_reg:
        debugf0("Error reading F2x%03x.\n", reg);
 }
@@ -2634,6 +2636,8 @@ static void amd64_read_mc_registers(struct amd64_pvt *pvt)
        amd64_dump_misc_regs(pvt);
+        return;
 err_reg:
        debugf0("Reading an MC register failed\n");
@@ -2977,6 +2981,9 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
                        "ECC is enabled by BIOS, Proceeding "
                        "with EDAC module initialization\n");
+                /* Signal good ECC status */
+                ret = 0;
                /* CLEAR the override, since BIOS controlled it */
                ecc_enable_override = 0;
        }
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 8fab7890a363..33be210d6723 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1461,7 +1461,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
                goto out;
        }
-        if (crtc_req->count_connectors > 0 && !mode && !fb) {
+        if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
                DRM_DEBUG("Count connectors is %d but no mode or fb set\n",
                          crtc_req->count_connectors);
                ret = -EINVAL;
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 3da9cfa31848..6aaa2cb23365 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -706,8 +706,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
        struct drm_encoder **save_encoders, *new_encoder;
        struct drm_framebuffer *old_fb = NULL;
        bool save_enabled;
-        bool mode_changed = false;
+        bool mode_changed = false; /* if true do a full mode set */
-        bool fb_changed = false;
+        bool fb_changed = false; /* if true and !mode_changed just do a flip */
        struct drm_connector *connector;
        int count = 0, ro, fail = 0;
        struct drm_crtc_helper_funcs *crtc_funcs;
@@ -758,6 +758,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                if (set->crtc->fb == NULL) {
                        DRM_DEBUG("crtc has no fb, full mode set\n");
                        mode_changed = true;
+                } else if (set->fb == NULL) {
+                        mode_changed = true;
                } else if ((set->fb->bits_per_pixel !=
                         set->crtc->fb->bits_per_pixel) ||
                         set->fb->depth != set->crtc->fb->depth)
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index b4a3dbcebe9b..f85aaf21e783 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -566,7 +566,7 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
        ret = drm_vblank_get(dev, crtc);
        if (ret) {
-                DRM_ERROR("failed to acquire vblank counter, %d\n", ret);
+                DRM_DEBUG("failed to acquire vblank counter, %d\n", ret);
                return ret;
        }
        seq = drm_vblank_count(dev, crtc);
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 54f492a488a9..7914097b09c6 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -566,6 +566,8 @@ void drm_mode_connector_list_update(struct drm_connector *connector)
                                found_it = 1;
                                /* if equal delete the probed mode */
                                mode->status = pmode->status;
+                                /* Merge type bits together */
+                                mode->type |= pmode->type;
                                list_del(&pmode->head);
                                drm_mode_destroy(connector->dev, pmode);
                                break;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 8c4783180bf6..50d1f782768c 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1186,6 +1186,13 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (ret)
                goto out_iomapfree;
+        dev_priv->wq = create_workqueue("i915");
+        if (dev_priv->wq == NULL) {
+                DRM_ERROR("Failed to create our workqueue.\n");
+                ret = -ENOMEM;
+                goto out_iomapfree;
+        }
        /* enable GEM by default */
        dev_priv->has_gem = 1;
@@ -1211,7 +1218,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (!I915_NEED_GFX_HWS(dev)) {
                ret = i915_init_phys_hws(dev);
                if (ret != 0)
-                        goto out_iomapfree;
+                        goto out_workqueue_free;
        }
        i915_get_mem_freq(dev);
@@ -1245,7 +1252,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                ret = i915_load_modeset_init(dev, prealloc_size, agp_size);
                if (ret < 0) {
                        DRM_ERROR("failed to init modeset\n");
-                        goto out_rmmap;
+                        goto out_workqueue_free;
                }
        }
@@ -1256,6 +1263,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        return 0;
+out_workqueue_free:
+        destroy_workqueue(dev_priv->wq);
 out_iomapfree:
        io_mapping_free(dev_priv->mm.gtt_mapping);
 out_rmmap:
@@ -1269,6 +1278,8 @@ int i915_driver_unload(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        destroy_workqueue(dev_priv->wq);
        io_mapping_free(dev_priv->mm.gtt_mapping);
        if (dev_priv->mm.gtt_mtrr >= 0) {
                mtrr_del(dev_priv->mm.gtt_mtrr, dev->agp->base,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index d08752875885..7537f57d8a87 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -219,6 +219,7 @@ typedef struct drm_i915_private {
        unsigned int lvds_vbt:1;
        unsigned int int_crt_support:1;
        unsigned int lvds_use_ssc:1;
+        unsigned int edp_support:1;
        int lvds_ssc_freq;
        struct drm_i915_fence_reg fence_regs[16]; /* assume 965 */
@@ -229,6 +230,8 @@ typedef struct drm_i915_private {
        spinlock_t error_lock;
        struct drm_i915_error_state *first_error;
+        struct work_struct error_work;
+        struct workqueue_struct *wq;
        /* Register state */
        u8 saveLBB;
@@ -888,6 +891,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
                                                      IS_I915GM(dev)))
 #define SUPPORTS_INTEGRATED_HDMI(dev)   (IS_G4X(dev) || IS_IGDNG(dev))
 #define SUPPORTS_INTEGRATED_DP(dev)     (IS_G4X(dev) || IS_IGDNG(dev))
+#define SUPPORTS_EDP(dev)               (IS_IGDNG_M(dev))
 #define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_I965G(dev))
 /* dsparb controlled by hw only */
 #define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev))
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 5bf420378b6d..140bee142fc2 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1570,7 +1570,7 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
        }
        if (was_empty && !dev_priv->mm.suspended)
-                schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
+                queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work, HZ);
        return seqno;
 }
@@ -1719,7 +1719,7 @@ i915_gem_retire_work_handler(struct work_struct *work)
        i915_gem_retire_requests(dev);
        if (!dev_priv->mm.suspended &&
            !list_empty(&dev_priv->mm.request_list))
-                schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
+                queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work, HZ);
        mutex_unlock(&dev->struct_mutex);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_debugfs.c b/drivers/gpu/drm/i915/i915_gem_debugfs.c
index 9a44bfcb8139..cb3b97405fbf 100644
--- a/drivers/gpu/drm/i915/i915_gem_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_gem_debugfs.c
@@ -343,6 +343,8 @@ static int i915_error_state(struct seq_file *m, void *unused)
        error = dev_priv->first_error;
+        seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec,
+                   error->time.tv_usec);
        seq_printf(m, "EIR: 0x%08x\n", error->eir);
        seq_printf(m, "  PGTBL_ER: 0x%08x\n", error->pgtbl_er);
        seq_printf(m, "  INSTPM: 0x%08x\n", error->instpm);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 7ba23a69a0c0..7ebc84c2881e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -190,7 +190,7 @@ u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
        low_frame = pipe ? PIPEBFRAMEPIXEL : PIPEAFRAMEPIXEL;
        if (!i915_pipe_enabled(dev, pipe)) {
-                DRM_ERROR("trying to get vblank count for disabled pipe %d\n", pipe);
+                DRM_DEBUG("trying to get vblank count for disabled pipe %d\n", pipe);
                return 0;
        }
@@ -219,7 +219,7 @@ u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
        int reg = pipe ? PIPEB_FRMCOUNT_GM45 : PIPEA_FRMCOUNT_GM45;
        if (!i915_pipe_enabled(dev, pipe)) {
-                DRM_ERROR("trying to get vblank count for disabled pipe %d\n", pipe);
+                DRM_DEBUG("trying to get vblank count for disabled pipe %d\n", pipe);
                return 0;
        }
@@ -290,6 +290,35 @@ irqreturn_t igdng_irq_handler(struct drm_device *dev)
        return ret;
 }
+/**
+ * i915_error_work_func - do process context error handling work
+ * @work: work struct
+ *
+ * Fire an error uevent so userspace can see that a hang or error
+ * was detected.
+ */
+static void i915_error_work_func(struct work_struct *work)
+{
+        drm_i915_private_t *dev_priv = container_of(work, drm_i915_private_t,
+                                                    error_work);
+        struct drm_device *dev = dev_priv->dev;
+        char *event_string = "ERROR=1";
+        char *envp[] = { event_string, NULL };
+        DRM_DEBUG("generating error event\n");
+        kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, envp);
+}
+/**
+ * i915_capture_error_state - capture an error record for later analysis
+ * @dev: drm device
+ *
+ * Should be called when an error is detected (either a hang or an error
+ * interrupt) to capture error state from the time of the error.  Fills
+ * out a structure which becomes available in debugfs for user level tools
+ * to pick up.
+ */
 static void i915_capture_error_state(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -325,12 +354,137 @@ static void i915_capture_error_state(struct drm_device *dev)
                error->acthd = I915_READ(ACTHD_I965);
        }
+        do_gettimeofday(&error->time);
        dev_priv->first_error = error;
 out:
        spin_unlock_irqrestore(&dev_priv->error_lock, flags);
 }
+/**
+ * i915_handle_error - handle an error interrupt
+ * @dev: drm device
+ *
+ * Do some basic checking of regsiter state at error interrupt time and
+ * dump it to the syslog.  Also call i915_capture_error_state() to make
+ * sure we get a record and make it available in debugfs.  Fire a uevent
+ * so userspace knows something bad happened (should trigger collection
+ * of a ring dump etc.).
+ */
+static void i915_handle_error(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 eir = I915_READ(EIR);
+        u32 pipea_stats = I915_READ(PIPEASTAT);
+        u32 pipeb_stats = I915_READ(PIPEBSTAT);
+        i915_capture_error_state(dev);
+        printk(KERN_ERR "render error detected, EIR: 0x%08x\n",
+               eir);
+        if (IS_G4X(dev)) {
+                if (eir & (GM45_ERROR_MEM_PRIV | GM45_ERROR_CP_PRIV)) {
+                        u32 ipeir = I915_READ(IPEIR_I965);
+                        printk(KERN_ERR "  IPEIR: 0x%08x\n",
+                               I915_READ(IPEIR_I965));
+                        printk(KERN_ERR "  IPEHR: 0x%08x\n",
+                               I915_READ(IPEHR_I965));
+                        printk(KERN_ERR "  INSTDONE: 0x%08x\n",
+                               I915_READ(INSTDONE_I965));
+                        printk(KERN_ERR "  INSTPS: 0x%08x\n",
+                               I915_READ(INSTPS));
+                        printk(KERN_ERR "  INSTDONE1: 0x%08x\n",
+                               I915_READ(INSTDONE1));
+                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
+                               I915_READ(ACTHD_I965));
+                        I915_WRITE(IPEIR_I965, ipeir);
+                        (void)I915_READ(IPEIR_I965);
+                }
+                if (eir & GM45_ERROR_PAGE_TABLE) {
+                        u32 pgtbl_err = I915_READ(PGTBL_ER);
+                        printk(KERN_ERR "page table error\n");
+                        printk(KERN_ERR "  PGTBL_ER: 0x%08x\n",
+                               pgtbl_err);
+                        I915_WRITE(PGTBL_ER, pgtbl_err);
+                        (void)I915_READ(PGTBL_ER);
+                }
+        }
+        if (IS_I9XX(dev)) {
+                if (eir & I915_ERROR_PAGE_TABLE) {
+                        u32 pgtbl_err = I915_READ(PGTBL_ER);
+                        printk(KERN_ERR "page table error\n");
+                        printk(KERN_ERR "  PGTBL_ER: 0x%08x\n",
+                               pgtbl_err);
+                        I915_WRITE(PGTBL_ER, pgtbl_err);
+                        (void)I915_READ(PGTBL_ER);
+                }
+        }
+        if (eir & I915_ERROR_MEMORY_REFRESH) {
+                printk(KERN_ERR "memory refresh error\n");
+                printk(KERN_ERR "PIPEASTAT: 0x%08x\n",
+                       pipea_stats);
+                printk(KERN_ERR "PIPEBSTAT: 0x%08x\n",
+                       pipeb_stats);
+                /* pipestat has already been acked */
+        }
+        if (eir & I915_ERROR_INSTRUCTION) {
+                printk(KERN_ERR "instruction error\n");
+                printk(KERN_ERR "  INSTPM: 0x%08x\n",
+                       I915_READ(INSTPM));
+                if (!IS_I965G(dev)) {
+                        u32 ipeir = I915_READ(IPEIR);
+                        printk(KERN_ERR "  IPEIR: 0x%08x\n",
+                               I915_READ(IPEIR));
+                        printk(KERN_ERR "  IPEHR: 0x%08x\n",
+                               I915_READ(IPEHR));
+                        printk(KERN_ERR "  INSTDONE: 0x%08x\n",
+                               I915_READ(INSTDONE));
+                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
+                               I915_READ(ACTHD));
+                        I915_WRITE(IPEIR, ipeir);
+                        (void)I915_READ(IPEIR);
+                } else {
+                        u32 ipeir = I915_READ(IPEIR_I965);
+                        printk(KERN_ERR "  IPEIR: 0x%08x\n",
+                               I915_READ(IPEIR_I965));
+                        printk(KERN_ERR "  IPEHR: 0x%08x\n",
+                               I915_READ(IPEHR_I965));
+                        printk(KERN_ERR "  INSTDONE: 0x%08x\n",
+                               I915_READ(INSTDONE_I965));
+                        printk(KERN_ERR "  INSTPS: 0x%08x\n",
+                               I915_READ(INSTPS));
+                        printk(KERN_ERR "  INSTDONE1: 0x%08x\n",
+                               I915_READ(INSTDONE1));
+                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
+                               I915_READ(ACTHD_I965));
+                        I915_WRITE(IPEIR_I965, ipeir);
+                        (void)I915_READ(IPEIR_I965);
+                }
+        }
+        I915_WRITE(EIR, eir);
+        (void)I915_READ(EIR);
+        eir = I915_READ(EIR);
+        if (eir) {
+                /*
+                 * some errors might have become stuck,
+                 * mask them.
+                 */
+                DRM_ERROR("EIR stuck: 0x%08x, masking\n", eir);
+                I915_WRITE(EMR, I915_READ(EMR) | eir);
+                I915_WRITE(IIR, I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT);
+        }
+        queue_work(dev_priv->wq, &dev_priv->error_work);
+}
 irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 {
        struct drm_device *dev = (struct drm_device *) arg;
@@ -372,6 +526,9 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                pipea_stats = I915_READ(PIPEASTAT);
                pipeb_stats = I915_READ(PIPEBSTAT);
+                if (iir & I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT)
+                        i915_handle_error(dev);
                /*
                 * Clear the PIPE(A|B)STAT regs before the IIR
                 */
@@ -403,86 +560,13 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                        DRM_DEBUG("hotplug event received, stat 0x%08x\n",
                                  hotplug_status);
                        if (hotplug_status & dev_priv->hotplug_supported_mask)
-                                schedule_work(&dev_priv->hotplug_work);
+                                queue_work(dev_priv->wq,
+                                           &dev_priv->hotplug_work);
                        I915_WRITE(PORT_HOTPLUG_STAT, hotplug_status);
                        I915_READ(PORT_HOTPLUG_STAT);
                }
-                if (iir & I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT) {
-                        u32 eir = I915_READ(EIR);
-                        i915_capture_error_state(dev);
-                        printk(KERN_ERR "render error detected, EIR: 0x%08x\n",
-                               eir);
-                        if (eir & I915_ERROR_PAGE_TABLE) {
-                                u32 pgtbl_err = I915_READ(PGTBL_ER);
-                                printk(KERN_ERR "page table error\n");
-                                printk(KERN_ERR "  PGTBL_ER: 0x%08x\n",
-                                       pgtbl_err);
-                                I915_WRITE(PGTBL_ER, pgtbl_err);
-                                (void)I915_READ(PGTBL_ER);
-                        }
-                        if (eir & I915_ERROR_MEMORY_REFRESH) {
-                                printk(KERN_ERR "memory refresh error\n");
-                                printk(KERN_ERR "PIPEASTAT: 0x%08x\n",
-                                       pipea_stats);
-                                printk(KERN_ERR "PIPEBSTAT: 0x%08x\n",
-                                       pipeb_stats);
-                                /* pipestat has already been acked */
-                        }
-                        if (eir & I915_ERROR_INSTRUCTION) {
-                                printk(KERN_ERR "instruction error\n");
-                                printk(KERN_ERR "  INSTPM: 0x%08x\n",
-                                       I915_READ(INSTPM));
-                                if (!IS_I965G(dev)) {
-                                        u32 ipeir = I915_READ(IPEIR);
-                                        printk(KERN_ERR "  IPEIR: 0x%08x\n",
-                                               I915_READ(IPEIR));
-                                        printk(KERN_ERR "  IPEHR: 0x%08x\n",
-                                                   I915_READ(IPEHR));
-                                        printk(KERN_ERR "  INSTDONE: 0x%08x\n",
-                                                   I915_READ(INSTDONE));
-                                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
-                                                   I915_READ(ACTHD));
-                                        I915_WRITE(IPEIR, ipeir);
-                                        (void)I915_READ(IPEIR);
-                                } else {
-                                        u32 ipeir = I915_READ(IPEIR_I965);
-                                        printk(KERN_ERR "  IPEIR: 0x%08x\n",
-                                               I915_READ(IPEIR_I965));
-                                        printk(KERN_ERR "  IPEHR: 0x%08x\n",
-                                               I915_READ(IPEHR_I965));
-                                        printk(KERN_ERR "  INSTDONE: 0x%08x\n",
-                                               I915_READ(INSTDONE_I965));
-                                        printk(KERN_ERR "  INSTPS: 0x%08x\n",
-                                               I915_READ(INSTPS));
-                                        printk(KERN_ERR "  INSTDONE1: 0x%08x\n",
-                                               I915_READ(INSTDONE1));
-                                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
-                                               I915_READ(ACTHD_I965));
-                                        I915_WRITE(IPEIR_I965, ipeir);
-                                        (void)I915_READ(IPEIR_I965);
-                                }
-                        }
-                        I915_WRITE(EIR, eir);
-                        (void)I915_READ(EIR);
-                        eir = I915_READ(EIR);
-                        if (eir) {
-                                /*
-                                 * some errors might have become stuck,
-                                 * mask them.
-                                 */
-                                DRM_ERROR("EIR stuck: 0x%08x, masking\n", eir);
-                                I915_WRITE(EMR, I915_READ(EMR) | eir);
-                                I915_WRITE(IIR, I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT);
-                        }
-                }
                I915_WRITE(IIR, iir);
                new_iir = I915_READ(IIR); /* Flush posted writes */
@@ -830,6 +914,7 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
        atomic_set(&dev_priv->irq_received, 0);
        INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
+        INIT_WORK(&dev_priv->error_work, i915_error_work_func);
        if (IS_IGDNG(dev)) {
                igdng_irq_preinstall(dev);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 6c0858484094..2955083aa471 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1395,6 +1395,7 @@
 #define TV_V_CHROMA_42          0x684a8
 /* Display Port */
+#define DP_A                            0x64000 /* eDP */
 #define DP_B                            0x64100
 #define DP_C                            0x64200
 #define DP_D                            0x64300
@@ -1437,13 +1438,22 @@
 /* Mystic DPCD version 1.1 special mode */
 #define   DP_ENHANCED_FRAMING           (1 << 18)
+/* eDP */
+#define   DP_PLL_FREQ_270MHZ            (0 << 16)
+#define   DP_PLL_FREQ_160MHZ            (1 << 16)
+#define   DP_PLL_FREQ_MASK              (3 << 16)
 /** locked once port is enabled */
 #define   DP_PORT_REVERSAL              (1 << 15)
+/* eDP */
+#define   DP_PLL_ENABLE                 (1 << 14)
 /** sends the clock on lane 15 of the PEG for debug */
 #define   DP_CLOCK_OUTPUT_ENABLE        (1 << 13)
 #define   DP_SCRAMBLING_DISABLE         (1 << 12)
+#define   DP_SCRAMBLING_DISABLE_IGDNG   (1 << 7)
 /** limit RGB values to avoid confusing TVs */
 #define   DP_COLOR_RANGE_16_235         (1 << 8)
@@ -1463,6 +1473,13 @@
 * is 20 bytes in each direction, hence the 5 fixed
 * data registers
 */
+#define DPA_AUX_CH_CTL                  0x64010
+#define DPA_AUX_CH_DATA1                0x64014
+#define DPA_AUX_CH_DATA2                0x64018
+#define DPA_AUX_CH_DATA3                0x6401c
+#define DPA_AUX_CH_DATA4                0x64020
+#define DPA_AUX_CH_DATA5                0x64024
 #define DPB_AUX_CH_CTL                  0x64110
 #define DPB_AUX_CH_DATA1                0x64114
 #define DPB_AUX_CH_DATA2                0x64118
@@ -1618,7 +1635,7 @@
 #define I830_FIFO_LINE_SIZE     32
 #define I945_FIFO_SIZE          127 /* 945 & 965 */
 #define I915_FIFO_SIZE          95
-#define I855GM_FIFO_SIZE        255
+#define I855GM_FIFO_SIZE        127 /* In cachelines */
 #define I830_FIFO_SIZE          95
 #define I915_MAX_WM             0x3f
@@ -1848,6 +1865,8 @@
 #define PFA_CTL_1               0x68080
 #define PFB_CTL_1               0x68880
 #define  PF_ENABLE              (1<<31)
+#define PFA_WIN_SZ              0x68074
+#define PFB_WIN_SZ              0x68874
 /* legacy palette */
 #define LGC_PALETTE_A           0x4a000
@@ -2208,4 +2227,28 @@
 #define PCH_PP_OFF_DELAYS       0xc720c
 #define PCH_PP_DIVISOR          0xc7210
+#define PCH_DP_B                0xe4100
+#define PCH_DPB_AUX_CH_CTL      0xe4110
+#define PCH_DPB_AUX_CH_DATA1    0xe4114
+#define PCH_DPB_AUX_CH_DATA2    0xe4118
+#define PCH_DPB_AUX_CH_DATA3    0xe411c
+#define PCH_DPB_AUX_CH_DATA4    0xe4120
+#define PCH_DPB_AUX_CH_DATA5    0xe4124
+#define PCH_DP_C                0xe4200
+#define PCH_DPC_AUX_CH_CTL      0xe4210
+#define PCH_DPC_AUX_CH_DATA1    0xe4214
+#define PCH_DPC_AUX_CH_DATA2    0xe4218
+#define PCH_DPC_AUX_CH_DATA3    0xe421c
+#define PCH_DPC_AUX_CH_DATA4    0xe4220
+#define PCH_DPC_AUX_CH_DATA5    0xe4224
+#define PCH_DP_D                0xe4300
+#define PCH_DPD_AUX_CH_CTL      0xe4310
+#define PCH_DPD_AUX_CH_DATA1    0xe4314
+#define PCH_DPD_AUX_CH_DATA2    0xe4318
+#define PCH_DPD_AUX_CH_DATA3    0xe431c
+#define PCH_DPD_AUX_CH_DATA4    0xe4320
+#define PCH_DPD_AUX_CH_DATA5    0xe4324
 #endif /* _I915_REG_H_ */
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 9e1d16e5c3ea..1d04e1904ac6 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -598,7 +598,7 @@ int i915_restore_state(struct drm_device *dev)
        for (i = 0; i < 16; i++) {
                I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
-                I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);
+                I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i]);
        }
        for (i = 0; i < 3; i++)
                I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 7cc447191028..300aee3296c2 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -97,14 +97,13 @@ static void
 parse_lfp_panel_data(struct drm_i915_private *dev_priv,
                            struct bdb_header *bdb)
 {
-        struct drm_device *dev = dev_priv->dev;
        struct bdb_lvds_options *lvds_options;
        struct bdb_lvds_lfp_data *lvds_lfp_data;
        struct bdb_lvds_lfp_data_ptrs *lvds_lfp_data_ptrs;
        struct bdb_lvds_lfp_data_entry *entry;
        struct lvds_dvo_timing *dvo_timing;
        struct drm_display_mode *panel_fixed_mode;
-        int lfp_data_size;
+        int lfp_data_size, dvo_timing_offset;
        /* Defaults if we can't find VBT info */
        dev_priv->lvds_dither = 0;
@@ -133,14 +132,16 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv,
        entry = (struct bdb_lvds_lfp_data_entry *)
                ((uint8_t *)lvds_lfp_data->data + (lfp_data_size *
                                                   lvds_options->panel_type));
+        dvo_timing_offset = lvds_lfp_data_ptrs->ptr[0].dvo_timing_offset -
+                lvds_lfp_data_ptrs->ptr[0].fp_timing_offset;
-        /* On IGDNG mobile, LVDS data block removes panel fitting registers.
+        /*
-           So dec 2 dword from dvo_timing offset */
+         * the size of fp_timing varies on the different platform.
-        if (IS_IGDNG(dev))
+         * So calculate the DVO timing relative offset in LVDS data
-                dvo_timing = (struct lvds_dvo_timing *)
+         * entry to get the DVO timing entry
-                                        ((u8 *)&entry->dvo_timing - 8);
+         */
-        else
+        dvo_timing = (struct lvds_dvo_timing *)
-                dvo_timing = &entry->dvo_timing;
+                        ((unsigned char *)entry + dvo_timing_offset);
        panel_fixed_mode = kzalloc(sizeof(*panel_fixed_mode), GFP_KERNEL);
@@ -295,6 +296,25 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
        }
        return;
 }
+static void
+parse_driver_features(struct drm_i915_private *dev_priv,
+                       struct bdb_header *bdb)
+{
+        struct drm_device *dev = dev_priv->dev;
+        struct bdb_driver_features *driver;
+        /* set default for chips without eDP */
+        if (!SUPPORTS_EDP(dev)) {
+                dev_priv->edp_support = 0;
+                return;
+        }
+        driver = find_section(bdb, BDB_DRIVER_FEATURES);
+        if (driver && driver->lvds_config == BDB_DRIVER_FEATURE_EDP)
+                dev_priv->edp_support = 1;
+}
 /**
 * intel_init_bios - initialize VBIOS settings & find VBT
 * @dev: DRM device
@@ -345,6 +365,8 @@ intel_init_bios(struct drm_device *dev)
        parse_lfp_panel_data(dev_priv, bdb);
        parse_sdvo_panel_data(dev_priv, bdb);
        parse_sdvo_device_mapping(dev_priv, bdb);
+        parse_driver_features(dev_priv, bdb);
        pci_unmap_rom(pdev, bios);
        return 0;
diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
index fe72e1c225d8..0f8e5f69ac7a 100644
--- a/drivers/gpu/drm/i915/intel_bios.h
+++ b/drivers/gpu/drm/i915/intel_bios.h
@@ -381,6 +381,51 @@ struct bdb_sdvo_lvds_options {
 } __attribute__((packed));
+#define BDB_DRIVER_FEATURE_NO_LVDS              0
+#define BDB_DRIVER_FEATURE_INT_LVDS             1
+#define BDB_DRIVER_FEATURE_SDVO_LVDS            2
+#define BDB_DRIVER_FEATURE_EDP                  3
+struct bdb_driver_features {
+        u8 boot_dev_algorithm:1;
+        u8 block_display_switch:1;
+        u8 allow_display_switch:1;
+        u8 hotplug_dvo:1;
+        u8 dual_view_zoom:1;
+        u8 int15h_hook:1;
+        u8 sprite_in_clone:1;
+        u8 primary_lfp_id:1;
+        u16 boot_mode_x;
+        u16 boot_mode_y;
+        u8 boot_mode_bpp;
+        u8 boot_mode_refresh;
+        u16 enable_lfp_primary:1;
+        u16 selective_mode_pruning:1;
+        u16 dual_frequency:1;
+        u16 render_clock_freq:1; /* 0: high freq; 1: low freq */
+        u16 nt_clone_support:1;
+        u16 power_scheme_ui:1; /* 0: CUI; 1: 3rd party */
+        u16 sprite_display_assign:1; /* 0: secondary; 1: primary */
+        u16 cui_aspect_scaling:1;
+        u16 preserve_aspect_ratio:1;
+        u16 sdvo_device_power_down:1;
+        u16 crt_hotplug:1;
+        u16 lvds_config:2;
+        u16 tv_hotplug:1;
+        u16 hdmi_config:2;
+        u8 static_display:1;
+        u8 reserved2:7;
+        u16 legacy_crt_max_x;
+        u16 legacy_crt_max_y;
+        u8 legacy_crt_max_refresh;
+        u8 hdmi_termination;
+        u8 custom_vbt_version;
+} __attribute__((packed));
 bool intel_init_bios(struct drm_device *dev);
 /*
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index d6a1a6e5539a..4cf8e2e88a40 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -156,6 +156,9 @@ static bool intel_igdng_crt_detect_hotplug(struct drm_connector *connector)
        temp = adpa = I915_READ(PCH_ADPA);
+        adpa &= ~ADPA_DAC_ENABLE;
+        I915_WRITE(PCH_ADPA, adpa);
        adpa &= ~ADPA_CRT_HOTPLUG_MASK;
        adpa |= (ADPA_CRT_HOTPLUG_PERIOD_128 |
@@ -169,13 +172,14 @@ static bool intel_igdng_crt_detect_hotplug(struct drm_connector *connector)
        DRM_DEBUG("pch crt adpa 0x%x", adpa);
        I915_WRITE(PCH_ADPA, adpa);
-        /* This might not be needed as not specified in spec...*/
+        while ((I915_READ(PCH_ADPA) & ADPA_CRT_HOTPLUG_FORCE_TRIGGER) != 0)
-        udelay(1000);
+                ;
        /* Check the status to see if both blue and green are on now */
        adpa = I915_READ(PCH_ADPA);
-        if ((adpa & ADPA_CRT_HOTPLUG_MONITOR_MASK) ==
+        adpa &= ADPA_CRT_HOTPLUG_MONITOR_MASK;
-                        ADPA_CRT_HOTPLUG_MONITOR_COLOR)
+        if ((adpa == ADPA_CRT_HOTPLUG_MONITOR_COLOR) ||
+                (adpa == ADPA_CRT_HOTPLUG_MONITOR_MONO))
                ret = true;
        else
                ret = false;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 508838ee31e0..d6fce2133413 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -34,6 +34,8 @@
 #include "drm_crtc_helper.h"
+#define HAS_eDP (intel_pipe_has_type(crtc, INTEL_OUTPUT_EDP))
 bool intel_pipe_has_type (struct drm_crtc *crtc, int type);
 static void intel_update_watermarks(struct drm_device *dev);
@@ -88,7 +90,7 @@ struct intel_limit {
 #define I8XX_P2_SLOW                  4
 #define I8XX_P2_FAST                  2
 #define I8XX_P2_LVDS_SLOW             14
-#define I8XX_P2_LVDS_FAST             14 /* No fast option */
+#define I8XX_P2_LVDS_FAST             7
 #define I8XX_P2_SLOW_LIMIT       165000
 #define I9XX_DOT_MIN              20000
@@ -268,6 +270,9 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 static bool
 intel_find_pll_g4x_dp(const intel_limit_t *, struct drm_crtc *crtc,
                      int target, int refclk, intel_clock_t *best_clock);
+static bool
+intel_find_pll_igdng_dp(const intel_limit_t *, struct drm_crtc *crtc,
+                      int target, int refclk, intel_clock_t *best_clock);
 static const intel_limit_t intel_limits_i8xx_dvo = {
        .dot = { .min = I8XX_DOT_MIN,           .max = I8XX_DOT_MAX },
@@ -598,6 +603,23 @@ bool intel_pipe_has_type (struct drm_crtc *crtc, int type)
    return false;
 }
+struct drm_connector *
+intel_pipe_get_output (struct drm_crtc *crtc)
+{
+    struct drm_device *dev = crtc->dev;
+    struct drm_mode_config *mode_config = &dev->mode_config;
+    struct drm_connector *l_entry, *ret = NULL;
+    list_for_each_entry(l_entry, &mode_config->connector_list, head) {
+            if (l_entry->encoder &&
+                l_entry->encoder->crtc == crtc) {
+                    ret = l_entry;
+                    break;
+            }
+    }
+    return ret;
+}
 #define INTELPllInvalid(s)   do { /* DRM_DEBUG(s); */ return false; } while (0)
 /**
 * Returns whether the given set of divisors are valid for a given refclk with
@@ -645,7 +667,7 @@ intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
        int err = target;
        if (IS_I9XX(dev) && intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS) &&
-            (I915_READ(LVDS) & LVDS_PORT_EN) != 0) {
+            (I915_READ(LVDS)) != 0) {
                /*
                 * For LVDS, if the panel is on, just rely on its current
                 * settings for dual-channel.  We haven't figured out how to
@@ -752,6 +774,30 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 }
 static bool
+intel_find_pll_igdng_dp(const intel_limit_t *limit, struct drm_crtc *crtc,
+                      int target, int refclk, intel_clock_t *best_clock)
+{
+        struct drm_device *dev = crtc->dev;
+        intel_clock_t clock;
+        if (target < 200000) {
+                clock.n = 1;
+                clock.p1 = 2;
+                clock.p2 = 10;
+                clock.m1 = 12;
+                clock.m2 = 9;
+        } else {
+                clock.n = 2;
+                clock.p1 = 1;
+                clock.p2 = 10;
+                clock.m1 = 14;
+                clock.m2 = 8;
+        }
+        intel_clock(dev, refclk, &clock);
+        memcpy(best_clock, &clock, sizeof(intel_clock_t));
+        return true;
+}
+static bool
 intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
                        int target, int refclk, intel_clock_t *best_clock)
 {
@@ -763,6 +809,14 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
        int err_most = 47;
        found = false;
+        /* eDP has only 2 clock choice, no n/m/p setting */
+        if (HAS_eDP)
+                return true;
+        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_DISPLAYPORT))
+                return intel_find_pll_igdng_dp(limit, crtc, target,
+                                               refclk, best_clock);
        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
                if ((I915_READ(LVDS) & LVDS_CLKB_POWER_MASK) ==
                    LVDS_CLKB_POWER_UP)
@@ -998,6 +1052,90 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
        return 0;
 }
+/* Disable the VGA plane that we never use */
+static void i915_disable_vga (struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u8 sr1;
+        u32 vga_reg;
+        if (IS_IGDNG(dev))
+                vga_reg = CPU_VGACNTRL;
+        else
+                vga_reg = VGACNTRL;
+        if (I915_READ(vga_reg) & VGA_DISP_DISABLE)
+                return;
+        I915_WRITE8(VGA_SR_INDEX, 1);
+        sr1 = I915_READ8(VGA_SR_DATA);
+        I915_WRITE8(VGA_SR_DATA, sr1 | (1 << 5));
+        udelay(100);
+        I915_WRITE(vga_reg, VGA_DISP_DISABLE);
+}
+static void igdng_disable_pll_edp (struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 dpa_ctl;
+        DRM_DEBUG("\n");
+        dpa_ctl = I915_READ(DP_A);
+        dpa_ctl &= ~DP_PLL_ENABLE;
+        I915_WRITE(DP_A, dpa_ctl);
+}
+static void igdng_enable_pll_edp (struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 dpa_ctl;
+        dpa_ctl = I915_READ(DP_A);
+        dpa_ctl |= DP_PLL_ENABLE;
+        I915_WRITE(DP_A, dpa_ctl);
+        udelay(200);
+}
+static void igdng_set_pll_edp (struct drm_crtc *crtc, int clock)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 dpa_ctl;
+        DRM_DEBUG("eDP PLL enable for clock %d\n", clock);
+        dpa_ctl = I915_READ(DP_A);
+        dpa_ctl &= ~DP_PLL_FREQ_MASK;
+        if (clock < 200000) {
+                u32 temp;
+                dpa_ctl |= DP_PLL_FREQ_160MHZ;
+                /* workaround for 160Mhz:
+                   1) program 0x4600c bits 15:0 = 0x8124
+                   2) program 0x46010 bit 0 = 1
+                   3) program 0x46034 bit 24 = 1
+                   4) program 0x64000 bit 14 = 1
+                   */
+                temp = I915_READ(0x4600c);
+                temp &= 0xffff0000;
+                I915_WRITE(0x4600c, temp | 0x8124);
+                temp = I915_READ(0x46010);
+                I915_WRITE(0x46010, temp | 1);
+                temp = I915_READ(0x46034);
+                I915_WRITE(0x46034, temp | (1 << 24));
+        } else {
+                dpa_ctl |= DP_PLL_FREQ_270MHZ;
+        }
+        I915_WRITE(DP_A, dpa_ctl);
+        udelay(500);
+}
 static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 {
        struct drm_device *dev = crtc->dev;
@@ -1015,6 +1153,7 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
        int fdi_rx_imr_reg = (pipe == 0) ? FDI_RXA_IMR : FDI_RXB_IMR;
        int transconf_reg = (pipe == 0) ? TRANSACONF : TRANSBCONF;
        int pf_ctl_reg = (pipe == 0) ? PFA_CTL_1 : PFB_CTL_1;
+        int pf_win_size = (pipe == 0) ? PFA_WIN_SZ : PFB_WIN_SZ;
        int cpu_htot_reg = (pipe == 0) ? HTOTAL_A : HTOTAL_B;
        int cpu_hblank_reg = (pipe == 0) ? HBLANK_A : HBLANK_B;
        int cpu_hsync_reg = (pipe == 0) ? HSYNC_A : HSYNC_B;
@@ -1028,7 +1167,7 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
        int trans_vblank_reg = (pipe == 0) ? TRANS_VBLANK_A : TRANS_VBLANK_B;
        int trans_vsync_reg = (pipe == 0) ? TRANS_VSYNC_A : TRANS_VSYNC_B;
        u32 temp;
-        int tries = 5, j;
+        int tries = 5, j, n;
        /* XXX: When our outputs are all unaware of DPMS modes other than off
         * and on, we should map those modes to DRM_MODE_DPMS_OFF in the CRTC.
@@ -1038,27 +1177,32 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
        case DRM_MODE_DPMS_STANDBY:
        case DRM_MODE_DPMS_SUSPEND:
                DRM_DEBUG("crtc %d dpms on\n", pipe);
-                /* enable PCH DPLL */
+                if (HAS_eDP) {
-                temp = I915_READ(pch_dpll_reg);
+                        /* enable eDP PLL */
-                if ((temp & DPLL_VCO_ENABLE) == 0) {
+                        igdng_enable_pll_edp(crtc);
-                        I915_WRITE(pch_dpll_reg, temp | DPLL_VCO_ENABLE);
+                } else {
-                        I915_READ(pch_dpll_reg);
+                        /* enable PCH DPLL */
-                }
+                        temp = I915_READ(pch_dpll_reg);
+                        if ((temp & DPLL_VCO_ENABLE) == 0) {
-                /* enable PCH FDI RX PLL, wait warmup plus DMI latency */
+                                I915_WRITE(pch_dpll_reg, temp | DPLL_VCO_ENABLE);
-                temp = I915_READ(fdi_rx_reg);
+                                I915_READ(pch_dpll_reg);
-                I915_WRITE(fdi_rx_reg, temp | FDI_RX_PLL_ENABLE |
+                        }
-                                FDI_SEL_PCDCLK |
-                                FDI_DP_PORT_WIDTH_X4); /* default 4 lanes */
-                I915_READ(fdi_rx_reg);
-                udelay(200);
-                /* Enable CPU FDI TX PLL, always on for IGDNG */
+                        /* enable PCH FDI RX PLL, wait warmup plus DMI latency */
-                temp = I915_READ(fdi_tx_reg);
+                        temp = I915_READ(fdi_rx_reg);
-                if ((temp & FDI_TX_PLL_ENABLE) == 0) {
+                        I915_WRITE(fdi_rx_reg, temp | FDI_RX_PLL_ENABLE |
-                        I915_WRITE(fdi_tx_reg, temp | FDI_TX_PLL_ENABLE);
+                                        FDI_SEL_PCDCLK |
-                        I915_READ(fdi_tx_reg);
+                                        FDI_DP_PORT_WIDTH_X4); /* default 4 lanes */
-                        udelay(100);
+                        I915_READ(fdi_rx_reg);
+                        udelay(200);
+                        /* Enable CPU FDI TX PLL, always on for IGDNG */
+                        temp = I915_READ(fdi_tx_reg);
+                        if ((temp & FDI_TX_PLL_ENABLE) == 0) {
+                                I915_WRITE(fdi_tx_reg, temp | FDI_TX_PLL_ENABLE);
+                                I915_READ(fdi_tx_reg);
+                                udelay(100);
+                        }
                }
                /* Enable CPU pipe */
@@ -1077,122 +1221,126 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_WRITE(dspbase_reg, I915_READ(dspbase_reg));
                }
-                /* enable CPU FDI TX and PCH FDI RX */
+                if (!HAS_eDP) {
-                temp = I915_READ(fdi_tx_reg);
+                        /* enable CPU FDI TX and PCH FDI RX */
-                temp |= FDI_TX_ENABLE;
+                        temp = I915_READ(fdi_tx_reg);
-                temp |= FDI_DP_PORT_WIDTH_X4; /* default */
+                        temp |= FDI_TX_ENABLE;
-                temp &= ~FDI_LINK_TRAIN_NONE;
+                        temp |= FDI_DP_PORT_WIDTH_X4; /* default */
-                temp |= FDI_LINK_TRAIN_PATTERN_1;
+                        temp &= ~FDI_LINK_TRAIN_NONE;
-                I915_WRITE(fdi_tx_reg, temp);
+                        temp |= FDI_LINK_TRAIN_PATTERN_1;
-                I915_READ(fdi_tx_reg);
+                        I915_WRITE(fdi_tx_reg, temp);
+                        I915_READ(fdi_tx_reg);
-                temp = I915_READ(fdi_rx_reg);
+                        temp = I915_READ(fdi_rx_reg);
-                temp &= ~FDI_LINK_TRAIN_NONE;
+                        temp &= ~FDI_LINK_TRAIN_NONE;
-                temp |= FDI_LINK_TRAIN_PATTERN_1;
+                        temp |= FDI_LINK_TRAIN_PATTERN_1;
-                I915_WRITE(fdi_rx_reg, temp | FDI_RX_ENABLE);
+                        I915_WRITE(fdi_rx_reg, temp | FDI_RX_ENABLE);
-                I915_READ(fdi_rx_reg);
+                        I915_READ(fdi_rx_reg);
-                udelay(150);
+                        udelay(150);
-                /* Train FDI. */
+                        /* Train FDI. */
-                /* umask FDI RX Interrupt symbol_lock and bit_lock bit
+                        /* umask FDI RX Interrupt symbol_lock and bit_lock bit
-                   for train result */
+                           for train result */
-                temp = I915_READ(fdi_rx_imr_reg);
+                        temp = I915_READ(fdi_rx_imr_reg);
-                temp &= ~FDI_RX_SYMBOL_LOCK;
+                        temp &= ~FDI_RX_SYMBOL_LOCK;
-                temp &= ~FDI_RX_BIT_LOCK;
+                        temp &= ~FDI_RX_BIT_LOCK;
-                I915_WRITE(fdi_rx_imr_reg, temp);
+                        I915_WRITE(fdi_rx_imr_reg, temp);
-                I915_READ(fdi_rx_imr_reg);
+                        I915_READ(fdi_rx_imr_reg);
-                udelay(150);
+                        udelay(150);
-                temp = I915_READ(fdi_rx_iir_reg);
+                        temp = I915_READ(fdi_rx_iir_reg);
-                DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+                        DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
-                if ((temp & FDI_RX_BIT_LOCK) == 0) {
+                        if ((temp & FDI_RX_BIT_LOCK) == 0) {
-                        for (j = 0; j < tries; j++) {
+                                for (j = 0; j < tries; j++) {
-                                temp = I915_READ(fdi_rx_iir_reg);
+                                        temp = I915_READ(fdi_rx_iir_reg);
-                                DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+                                        DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
-                                if (temp & FDI_RX_BIT_LOCK)
+                                        if (temp & FDI_RX_BIT_LOCK)
-                                        break;
+                                                break;
-                                udelay(200);
+                                        udelay(200);
-                        }
+                                }
-                        if (j != tries)
+                                if (j != tries)
+                                        I915_WRITE(fdi_rx_iir_reg,
+                                                        temp | FDI_RX_BIT_LOCK);
+                                else
+                                        DRM_DEBUG("train 1 fail\n");
+                        } else {
                                I915_WRITE(fdi_rx_iir_reg,
                                                temp | FDI_RX_BIT_LOCK);
-                        else
+                                DRM_DEBUG("train 1 ok 2!\n");
-                                DRM_DEBUG("train 1 fail\n");
+                        }
-                } else {
+                        temp = I915_READ(fdi_tx_reg);
-                        I915_WRITE(fdi_rx_iir_reg,
+                        temp &= ~FDI_LINK_TRAIN_NONE;
-                                        temp | FDI_RX_BIT_LOCK);
+                        temp |= FDI_LINK_TRAIN_PATTERN_2;
-                        DRM_DEBUG("train 1 ok 2!\n");
+                        I915_WRITE(fdi_tx_reg, temp);
-                }
-                temp = I915_READ(fdi_tx_reg);
+                        temp = I915_READ(fdi_rx_reg);
-                temp &= ~FDI_LINK_TRAIN_NONE;
+                        temp &= ~FDI_LINK_TRAIN_NONE;
-                temp |= FDI_LINK_TRAIN_PATTERN_2;
+                        temp |= FDI_LINK_TRAIN_PATTERN_2;
-                I915_WRITE(fdi_tx_reg, temp);
+                        I915_WRITE(fdi_rx_reg, temp);
-                temp = I915_READ(fdi_rx_reg);
-                temp &= ~FDI_LINK_TRAIN_NONE;
-                temp |= FDI_LINK_TRAIN_PATTERN_2;
-                I915_WRITE(fdi_rx_reg, temp);
-                udelay(150);
+                        udelay(150);
-                temp = I915_READ(fdi_rx_iir_reg);
+                        temp = I915_READ(fdi_rx_iir_reg);
-                DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+                        DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
-                if ((temp & FDI_RX_SYMBOL_LOCK) == 0) {
+                        if ((temp & FDI_RX_SYMBOL_LOCK) == 0) {
-                        for (j = 0; j < tries; j++) {
+                                for (j = 0; j < tries; j++) {
-                                temp = I915_READ(fdi_rx_iir_reg);
+                                        temp = I915_READ(fdi_rx_iir_reg);
-                                DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+                                        DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
-                                if (temp & FDI_RX_SYMBOL_LOCK)
+                                        if (temp & FDI_RX_SYMBOL_LOCK)
-                                        break;
+                                                break;
-                                udelay(200);
+                                        udelay(200);
-                        }
+                                }
-                        if (j != tries) {
+                                if (j != tries) {
+                                        I915_WRITE(fdi_rx_iir_reg,
+                                                        temp | FDI_RX_SYMBOL_LOCK);
+                                        DRM_DEBUG("train 2 ok 1!\n");
+                                } else
+                                        DRM_DEBUG("train 2 fail\n");
+                        } else {
                                I915_WRITE(fdi_rx_iir_reg,
                                                temp | FDI_RX_SYMBOL_LOCK);
-                                DRM_DEBUG("train 2 ok 1!\n");
+                                DRM_DEBUG("train 2 ok 2!\n");
-                        } else
+                        }
-                                DRM_DEBUG("train 2 fail\n");
+                        DRM_DEBUG("train done\n");
-                } else {
-                        I915_WRITE(fdi_rx_iir_reg, temp | FDI_RX_SYMBOL_LOCK);
-                        DRM_DEBUG("train 2 ok 2!\n");
-                }
-                DRM_DEBUG("train done\n");
-                /* set transcoder timing */
+                        /* set transcoder timing */
-                I915_WRITE(trans_htot_reg, I915_READ(cpu_htot_reg));
+                        I915_WRITE(trans_htot_reg, I915_READ(cpu_htot_reg));
-                I915_WRITE(trans_hblank_reg, I915_READ(cpu_hblank_reg));
+                        I915_WRITE(trans_hblank_reg, I915_READ(cpu_hblank_reg));
-                I915_WRITE(trans_hsync_reg, I915_READ(cpu_hsync_reg));
+                        I915_WRITE(trans_hsync_reg, I915_READ(cpu_hsync_reg));
-                I915_WRITE(trans_vtot_reg, I915_READ(cpu_vtot_reg));
+                        I915_WRITE(trans_vtot_reg, I915_READ(cpu_vtot_reg));
-                I915_WRITE(trans_vblank_reg, I915_READ(cpu_vblank_reg));
+                        I915_WRITE(trans_vblank_reg, I915_READ(cpu_vblank_reg));
-                I915_WRITE(trans_vsync_reg, I915_READ(cpu_vsync_reg));
+                        I915_WRITE(trans_vsync_reg, I915_READ(cpu_vsync_reg));
-                /* enable PCH transcoder */
+                        /* enable PCH transcoder */
-                temp = I915_READ(transconf_reg);
+                        temp = I915_READ(transconf_reg);
-                I915_WRITE(transconf_reg, temp | TRANS_ENABLE);
+                        I915_WRITE(transconf_reg, temp | TRANS_ENABLE);
-                I915_READ(transconf_reg);
+                        I915_READ(transconf_reg);
-                while ((I915_READ(transconf_reg) & TRANS_STATE_ENABLE) == 0)
+                        while ((I915_READ(transconf_reg) & TRANS_STATE_ENABLE) == 0)
-                        ;
+                                ;
-                /* enable normal */
+                        /* enable normal */
-                temp = I915_READ(fdi_tx_reg);
+                        temp = I915_READ(fdi_tx_reg);
-                temp &= ~FDI_LINK_TRAIN_NONE;
+                        temp &= ~FDI_LINK_TRAIN_NONE;
-                I915_WRITE(fdi_tx_reg, temp | FDI_LINK_TRAIN_NONE |
+                        I915_WRITE(fdi_tx_reg, temp | FDI_LINK_TRAIN_NONE |
-                                FDI_TX_ENHANCE_FRAME_ENABLE);
+                                        FDI_TX_ENHANCE_FRAME_ENABLE);
-                I915_READ(fdi_tx_reg);
+                        I915_READ(fdi_tx_reg);
-                temp = I915_READ(fdi_rx_reg);
+                        temp = I915_READ(fdi_rx_reg);
-                temp &= ~FDI_LINK_TRAIN_NONE;
+                        temp &= ~FDI_LINK_TRAIN_NONE;
-                I915_WRITE(fdi_rx_reg, temp | FDI_LINK_TRAIN_NONE |
+                        I915_WRITE(fdi_rx_reg, temp | FDI_LINK_TRAIN_NONE |
-                                FDI_RX_ENHANCE_FRAME_ENABLE);
+                                        FDI_RX_ENHANCE_FRAME_ENABLE);
-                I915_READ(fdi_rx_reg);
+                        I915_READ(fdi_rx_reg);
-                /* wait one idle pattern time */
+                        /* wait one idle pattern time */
-                udelay(100);
+                        udelay(100);
+                }
                intel_crtc_load_lut(crtc);
@@ -1200,8 +1348,7 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
        case DRM_MODE_DPMS_OFF:
                DRM_DEBUG("crtc %d dpms off\n", pipe);
-                /* Disable the VGA plane that we never use */
+                i915_disable_vga(dev);
-                I915_WRITE(CPU_VGACNTRL, VGA_DISP_DISABLE);
                /* Disable display plane */
                temp = I915_READ(dspcntr_reg);
@@ -1217,17 +1364,23 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
                if ((temp & PIPEACONF_ENABLE) != 0) {
                        I915_WRITE(pipeconf_reg, temp & ~PIPEACONF_ENABLE);
                        I915_READ(pipeconf_reg);
+                        n = 0;
                        /* wait for cpu pipe off, pipe state */
-                        while ((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) != 0)
+                        while ((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) != 0) {
-                                ;
+                                n++;
+                                if (n < 60) {
+                                        udelay(500);
+                                        continue;
+                                } else {
+                                        DRM_DEBUG("pipe %d off delay\n", pipe);
+                                        break;
+                                }
+                        }
                } else
                        DRM_DEBUG("crtc %d is disabled\n", pipe);
-                /* IGDNG-A : disable cpu panel fitter ? */
+                if (HAS_eDP) {
-                temp = I915_READ(pf_ctl_reg);
+                        igdng_disable_pll_edp(crtc);
-                if ((temp & PF_ENABLE) != 0) {
-                        I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
-                        I915_READ(pf_ctl_reg);
                }
                /* disable CPU FDI tx and PCH FDI rx */
@@ -1239,6 +1392,8 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
                I915_WRITE(fdi_rx_reg, temp & ~FDI_RX_ENABLE);
                I915_READ(fdi_rx_reg);
+                udelay(100);
                /* still set train pattern 1 */
                temp = I915_READ(fdi_tx_reg);
                temp &= ~FDI_LINK_TRAIN_NONE;
@@ -1250,14 +1405,25 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
                temp |= FDI_LINK_TRAIN_PATTERN_1;
                I915_WRITE(fdi_rx_reg, temp);
+                udelay(100);
                /* disable PCH transcoder */
                temp = I915_READ(transconf_reg);
                if ((temp & TRANS_ENABLE) != 0) {
                        I915_WRITE(transconf_reg, temp & ~TRANS_ENABLE);
                        I915_READ(transconf_reg);
+                        n = 0;
                        /* wait for PCH transcoder off, transcoder state */
-                        while ((I915_READ(transconf_reg) & TRANS_STATE_ENABLE) != 0)
+                        while ((I915_READ(transconf_reg) & TRANS_STATE_ENABLE) != 0) {
-                                ;
+                                n++;
+                                if (n < 60) {
+                                        udelay(500);
+                                        continue;
+                                } else {
+                                        DRM_DEBUG("transcoder %d off delay\n", pipe);
+                                        break;
+                                }
+                        }
                }
                /* disable PCH DPLL */
@@ -1275,6 +1441,22 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_READ(fdi_rx_reg);
                }
+                /* Disable CPU FDI TX PLL */
+                temp = I915_READ(fdi_tx_reg);
+                if ((temp & FDI_TX_PLL_ENABLE) != 0) {
+                        I915_WRITE(fdi_tx_reg, temp & ~FDI_TX_PLL_ENABLE);
+                        I915_READ(fdi_tx_reg);
+                        udelay(100);
+                }
+                /* Disable PF */
+                temp = I915_READ(pf_ctl_reg);
+                if ((temp & PF_ENABLE) != 0) {
+                        I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
+                        I915_READ(pf_ctl_reg);
+                }
+                I915_WRITE(pf_win_size, 0);
                /* Wait for the clocks to turn off. */
                udelay(150);
                break;
@@ -1342,7 +1524,7 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                //intel_crtc_dpms_video(crtc, FALSE); TODO
                /* Disable the VGA plane that we never use */
-                I915_WRITE(VGACNTRL, VGA_DISP_DISABLE);
+                i915_disable_vga(dev);
                /* Disable display plane */
                temp = I915_READ(dspcntr_reg);
@@ -1623,48 +1805,72 @@ static struct intel_watermark_params igd_cursor_hplloff_wm = {
        IGD_FIFO_LINE_SIZE
 };
 static struct intel_watermark_params i945_wm_info = {
-        I915_FIFO_LINE_SIZE,
+        I945_FIFO_SIZE,
        I915_MAX_WM,
        1,
-        0,
+        2,
-        IGD_FIFO_LINE_SIZE
+        I915_FIFO_LINE_SIZE
 };
 static struct intel_watermark_params i915_wm_info = {
-        I945_FIFO_SIZE,
+        I915_FIFO_SIZE,
        I915_MAX_WM,
        1,
-        0,
+        2,
        I915_FIFO_LINE_SIZE
 };
 static struct intel_watermark_params i855_wm_info = {
        I855GM_FIFO_SIZE,
        I915_MAX_WM,
        1,
-        0,
+        2,
        I830_FIFO_LINE_SIZE
 };
 static struct intel_watermark_params i830_wm_info = {
        I830_FIFO_SIZE,
        I915_MAX_WM,
        1,
-        0,
+        2,
        I830_FIFO_LINE_SIZE
 };
+/**
+ * intel_calculate_wm - calculate watermark level
+ * @clock_in_khz: pixel clock
+ * @wm: chip FIFO params
+ * @pixel_size: display pixel size
+ * @latency_ns: memory latency for the platform
+ *
+ * Calculate the watermark level (the level at which the display plane will
+ * start fetching from memory again).  Each chip has a different display
+ * FIFO size and allocation, so the caller needs to figure that out and pass
+ * in the correct intel_watermark_params structure.
+ *
+ * As the pixel clock runs, the FIFO will be drained at a rate that depends
+ * on the pixel size.  When it reaches the watermark level, it'll start
+ * fetching FIFO line sized based chunks from memory until the FIFO fills
+ * past the watermark point.  If the FIFO drains completely, a FIFO underrun
+ * will occur, and a display engine hang could result.
+ */
 static unsigned long intel_calculate_wm(unsigned long clock_in_khz,
                                        struct intel_watermark_params *wm,
                                        int pixel_size,
                                        unsigned long latency_ns)
 {
-        unsigned long bytes_required, wm_size;
+        long entries_required, wm_size;
+        entries_required = (clock_in_khz * pixel_size * latency_ns) / 1000000;
+        entries_required /= wm->cacheline_size;
-        bytes_required = (clock_in_khz * pixel_size * latency_ns) / 1000000;
+        DRM_DEBUG("FIFO entries required for mode: %d\n", entries_required);
-        bytes_required /= wm->cacheline_size;
-        wm_size = wm->fifo_size - bytes_required - wm->guard_size;
-        if (wm_size > wm->max_wm)
+        wm_size = wm->fifo_size - (entries_required + wm->guard_size);
+        DRM_DEBUG("FIFO watermark level: %d\n", wm_size);
+        /* Don't promote wm_size to unsigned... */
+        if (wm_size > (long)wm->max_wm)
                wm_size = wm->max_wm;
-        if (wm_size == 0)
+        if (wm_size <= 0)
                wm_size = wm->default_wm;
        return wm_size;
 }
@@ -1799,8 +2005,40 @@ static void igd_enable_cxsr(struct drm_device *dev, unsigned long clock,
        return;
 }
-const static int latency_ns = 5000; /* default for non-igd platforms */
+const static int latency_ns = 3000; /* default for non-igd platforms */
+static int intel_get_fifo_size(struct drm_device *dev, int plane)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        uint32_t dsparb = I915_READ(DSPARB);
+        int size;
+        if (IS_I9XX(dev)) {
+                if (plane == 0)
+                        size = dsparb & 0x7f;
+                else
+                        size = ((dsparb >> DSPARB_CSTART_SHIFT) & 0x7f) -
+                                (dsparb & 0x7f);
+        } else if (IS_I85X(dev)) {
+                if (plane == 0)
+                        size = dsparb & 0x1ff;
+                else
+                        size = ((dsparb >> DSPARB_BEND_SHIFT) & 0x1ff) -
+                                (dsparb & 0x1ff);
+                size >>= 1; /* Convert to cachelines */
+        } else if (IS_845G(dev)) {
+                size = dsparb & 0x7f;
+                size >>= 2; /* Convert to cachelines */
+        } else {
+                size = dsparb & 0x7f;
+                size >>= 1; /* Convert to cachelines */
+        }
+        DRM_DEBUG("FIFO size - (0x%08x) %s: %d\n", dsparb, plane ? "B" : "A",
+                  size);
+        return size;
+}
 static void i965_update_wm(struct drm_device *dev)
 {
@@ -1817,101 +2055,89 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
                           int planeb_clock, int sr_hdisplay, int pixel_size)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t fwater_lo = I915_READ(FW_BLC) & MM_FIFO_WATERMARK;
+        uint32_t fwater_lo;
-        uint32_t fwater_hi = I915_READ(FW_BLC2) & LM_FIFO_WATERMARK;
+        uint32_t fwater_hi;
-        int bsize, asize, cwm, bwm = 1, awm = 1, srwm = 1;
+        int total_size, cacheline_size, cwm, srwm = 1;
-        uint32_t dsparb = I915_READ(DSPARB);
+        int planea_wm, planeb_wm;
-        int planea_entries, planeb_entries;
+        struct intel_watermark_params planea_params, planeb_params;
-        struct intel_watermark_params *wm_params;
        unsigned long line_time_us;
        int sr_clock, sr_entries = 0;
+        /* Create copies of the base settings for each pipe */
        if (IS_I965GM(dev) || IS_I945GM(dev))
-                wm_params = &i945_wm_info;
+                planea_params = planeb_params = i945_wm_info;
        else if (IS_I9XX(dev))
-                wm_params = &i915_wm_info;
+                planea_params = planeb_params = i915_wm_info;
        else
-                wm_params = &i855_wm_info;
+                planea_params = planeb_params = i855_wm_info;
-        planea_entries = intel_calculate_wm(planea_clock, wm_params,
-                                            pixel_size, latency_ns);
-        planeb_entries = intel_calculate_wm(planeb_clock, wm_params,
-                                            pixel_size, latency_ns);
-        DRM_DEBUG("FIFO entries - A: %d, B: %d\n", planea_entries,
-                  planeb_entries);
-        if (IS_I9XX(dev)) {
+        /* Grab a couple of global values before we overwrite them */
-                asize = dsparb & 0x7f;
+        total_size = planea_params.fifo_size;
-                bsize = (dsparb >> DSPARB_CSTART_SHIFT) & 0x7f;
+        cacheline_size = planea_params.cacheline_size;
-        } else {
-                asize = dsparb & 0x1ff;
-                bsize = (dsparb >> DSPARB_BEND_SHIFT) & 0x1ff;
-        }
-        DRM_DEBUG("FIFO size - A: %d, B: %d\n", asize, bsize);
-        /* Two extra entries for padding */
+        /* Update per-plane FIFO sizes */
-        awm = asize - (planea_entries + 2);
+        planea_params.fifo_size = intel_get_fifo_size(dev, 0);
-        bwm = bsize - (planeb_entries + 2);
+        planeb_params.fifo_size = intel_get_fifo_size(dev, 1);
-        /* Sanity check against potentially bad FIFO allocations */
+        planea_wm = intel_calculate_wm(planea_clock, &planea_params,
-        if (awm <= 0) {
+                                       pixel_size, latency_ns);
-                /* pipe is on but has too few FIFO entries */
+        planeb_wm = intel_calculate_wm(planeb_clock, &planeb_params,
-                if (planea_entries != 0)
+                                       pixel_size, latency_ns);
-                        DRM_DEBUG("plane A needs more FIFO entries\n");
+        DRM_DEBUG("FIFO watermarks - A: %d, B: %d\n", planea_wm, planeb_wm);
-                awm = 1;
-        }
-        if (bwm <= 0) {
-                if (planeb_entries != 0)
-                        DRM_DEBUG("plane B needs more FIFO entries\n");
-                bwm = 1;
-        }
        /*
         * Overlay gets an aggressive default since video jitter is bad.
         */
        cwm = 2;
-        /* Calc sr entries for one pipe configs */
+        /* Calc sr entries for one plane configs */
-        if (!planea_clock || !planeb_clock) {
+        if (sr_hdisplay && (!planea_clock || !planeb_clock)) {
+                /* self-refresh has much higher latency */
+                const static int sr_latency_ns = 6000;
                sr_clock = planea_clock ? planea_clock : planeb_clock;
-                line_time_us = (sr_hdisplay * 1000) / sr_clock;
+                line_time_us = ((sr_hdisplay * 1000) / sr_clock);
-                sr_entries = (((latency_ns / line_time_us) + 1) * pixel_size *
-                              sr_hdisplay) / 1000;
+                /* Use ns/us then divide to preserve precision */
-                sr_entries = roundup(sr_entries / wm_params->cacheline_size, 1);
+                sr_entries = (((sr_latency_ns / line_time_us) + 1) *
-                if (sr_entries < wm_params->fifo_size)
+                              pixel_size * sr_hdisplay) / 1000;
-                        srwm = wm_params->fifo_size - sr_entries;
+                sr_entries = roundup(sr_entries / cacheline_size, 1);
+                DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
+                srwm = total_size - sr_entries;
+                if (srwm < 0)
+                        srwm = 1;
+                if (IS_I9XX(dev))
+                        I915_WRITE(FW_BLC_SELF, (srwm & 0x3f));
        }
        DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
-                  awm, bwm, cwm, srwm);
+                  planea_wm, planeb_wm, cwm, srwm);
-        fwater_lo = fwater_lo | ((bwm & 0x3f) << 16) | (awm & 0x3f);
+        fwater_lo = ((planeb_wm & 0x3f) << 16) | (planea_wm & 0x3f);
-        fwater_hi = fwater_hi | (cwm & 0x1f);
+        fwater_hi = (cwm & 0x1f);
+        /* Set request length to 8 cachelines per fetch */
+        fwater_lo = fwater_lo | (1 << 24) | (1 << 8);
+        fwater_hi = fwater_hi | (1 << 8);
        I915_WRITE(FW_BLC, fwater_lo);
        I915_WRITE(FW_BLC2, fwater_hi);
-        if (IS_I9XX(dev))
-                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN | (srwm & 0x3f));
 }
 static void i830_update_wm(struct drm_device *dev, int planea_clock,
                           int pixel_size)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t dsparb = I915_READ(DSPARB);
+        uint32_t fwater_lo = I915_READ(FW_BLC) & ~0xfff;
-        uint32_t fwater_lo = I915_READ(FW_BLC) & MM_FIFO_WATERMARK;
+        int planea_wm;
-        unsigned int asize, awm;
-        int planea_entries;
-        planea_entries = intel_calculate_wm(planea_clock, &i830_wm_info,
-                                            pixel_size, latency_ns);
-        asize = dsparb & 0x7f;
+        i830_wm_info.fifo_size = intel_get_fifo_size(dev, 0);
-        awm = asize - planea_entries;
+        planea_wm = intel_calculate_wm(planea_clock, &i830_wm_info,
+                                       pixel_size, latency_ns);
+        fwater_lo |= (3<<8) | planea_wm;
-        fwater_lo = fwater_lo | awm;
+        DRM_DEBUG("Setting FIFO watermarks - A: %d\n", planea_wm);
        I915_WRITE(FW_BLC, fwater_lo);
 }
@@ -1984,7 +2210,7 @@ static void intel_update_watermarks(struct drm_device *dev)
        if (enabled <= 0)
                return;
-        /* Single pipe configs can enable self refresh */
+        /* Single plane configs can enable self refresh */
        if (enabled == 1 && IS_IGD(dev))
                igd_enable_cxsr(dev, sr_clock, pixel_size);
        else if (IS_IGD(dev))
@@ -2028,6 +2254,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
        u32 dpll = 0, fp = 0, dspcntr, pipeconf;
        bool ok, is_sdvo = false, is_dvo = false;
        bool is_crt = false, is_lvds = false, is_tv = false, is_dp = false;
+        bool is_edp = false;
        struct drm_mode_config *mode_config = &dev->mode_config;
        struct drm_connector *connector;
        const intel_limit_t *limit;
@@ -2043,6 +2270,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
        int lvds_reg = LVDS;
        u32 temp;
        int sdvo_pixel_multiply;
+        int target_clock;
        drm_vblank_pre_modeset(dev, pipe);
@@ -2074,6 +2302,9 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                case INTEL_OUTPUT_DISPLAYPORT:
                        is_dp = true;
                        break;
+                case INTEL_OUTPUT_EDP:
+                        is_edp = true;
+                        break;
                }
                num_outputs++;
@@ -2125,11 +2356,29 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
        }
        /* FDI link */
-        if (IS_IGDNG(dev))
+        if (IS_IGDNG(dev)) {
-                igdng_compute_m_n(3, 4, /* lane num 4 */
+                int lane, link_bw;
-                                adjusted_mode->clock,
+                /* eDP doesn't require FDI link, so just set DP M/N
-                                270000, /* lane clock */
+                   according to current link config */
-                                &m_n);
+                if (is_edp) {
+                        struct drm_connector *edp;
+                        target_clock = mode->clock;
+                        edp = intel_pipe_get_output(crtc);
+                        intel_edp_link_config(to_intel_output(edp),
+                                        &lane, &link_bw);
+                } else {
+                        /* DP over FDI requires target mode clock
+                           instead of link clock */
+                        if (is_dp)
+                                target_clock = mode->clock;
+                        else
+                                target_clock = adjusted_mode->clock;
+                        lane = 4;
+                        link_bw = 270000;
+                }
+                igdng_compute_m_n(3, lane, target_clock,
+                                  link_bw, &m_n);
+        }
        if (IS_IGD(dev))
                fp = (1 << clock.n) << 16 | clock.m1 << 8 | clock.m2;
@@ -2250,29 +2499,15 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                dpll_reg = pch_dpll_reg;
        }
-        if (dpll & DPLL_VCO_ENABLE) {
+        if (is_edp) {
+                igdng_disable_pll_edp(crtc);
+        } else if ((dpll & DPLL_VCO_ENABLE)) {
                I915_WRITE(fp_reg, fp);
                I915_WRITE(dpll_reg, dpll & ~DPLL_VCO_ENABLE);
                I915_READ(dpll_reg);
                udelay(150);
        }
-        if (IS_IGDNG(dev)) {
-                /* enable PCH clock reference source */
-                /* XXX need to change the setting for other outputs */
-                u32 temp;
-                temp = I915_READ(PCH_DREF_CONTROL);
-                temp &= ~DREF_NONSPREAD_SOURCE_MASK;
-                temp |= DREF_NONSPREAD_CK505_ENABLE;
-                temp &= ~DREF_SSC_SOURCE_MASK;
-                temp |= DREF_SSC_SOURCE_ENABLE;
-                temp &= ~DREF_SSC1_ENABLE;
-                /* if no eDP, disable source output to CPU */
-                temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
-                temp |= DREF_CPU_SOURCE_OUTPUT_DISABLE;
-                I915_WRITE(PCH_DREF_CONTROL, temp);
-        }
        /* The LVDS pin pair needs to be on before the DPLLs are enabled.
         * This is an exception to the general rule that mode_set doesn't turn
         * things on.
@@ -2304,23 +2539,25 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
        if (is_dp)
                intel_dp_set_m_n(crtc, mode, adjusted_mode);
-        I915_WRITE(fp_reg, fp);
+        if (!is_edp) {
-        I915_WRITE(dpll_reg, dpll);
+                I915_WRITE(fp_reg, fp);
-        I915_READ(dpll_reg);
-        /* Wait for the clocks to stabilize. */
-        udelay(150);
-        if (IS_I965G(dev) && !IS_IGDNG(dev)) {
-                sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
-                I915_WRITE(dpll_md_reg, (0 << DPLL_MD_UDI_DIVIDER_SHIFT) |
-                           ((sdvo_pixel_multiply - 1) << DPLL_MD_UDI_MULTIPLIER_SHIFT));
-        } else {
-                /* write it again -- the BIOS does, after all */
                I915_WRITE(dpll_reg, dpll);
+                I915_READ(dpll_reg);
+                /* Wait for the clocks to stabilize. */
+                udelay(150);
+                if (IS_I965G(dev) && !IS_IGDNG(dev)) {
+                        sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
+                        I915_WRITE(dpll_md_reg, (0 << DPLL_MD_UDI_DIVIDER_SHIFT) |
+                                        ((sdvo_pixel_multiply - 1) << DPLL_MD_UDI_MULTIPLIER_SHIFT));
+                } else {
+                        /* write it again -- the BIOS does, after all */
+                        I915_WRITE(dpll_reg, dpll);
+                }
+                I915_READ(dpll_reg);
+                /* Wait for the clocks to stabilize. */
+                udelay(150);
        }
-        I915_READ(dpll_reg);
-        /* Wait for the clocks to stabilize. */
-        udelay(150);
        I915_WRITE(htot_reg, (adjusted_mode->crtc_hdisplay - 1) |
                   ((adjusted_mode->crtc_htotal - 1) << 16));
@@ -2350,10 +2587,14 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                I915_WRITE(link_m1_reg, m_n.link_m);
                I915_WRITE(link_n1_reg, m_n.link_n);
-                 /* enable FDI RX PLL too */
+                if (is_edp) {
-                temp = I915_READ(fdi_rx_reg);
+                        igdng_set_pll_edp(crtc, adjusted_mode->clock);
-                I915_WRITE(fdi_rx_reg, temp | FDI_RX_PLL_ENABLE);
+                } else {
-                udelay(200);
+                        /* enable FDI RX PLL too */
+                        temp = I915_READ(fdi_rx_reg);
+                        I915_WRITE(fdi_rx_reg, temp | FDI_RX_PLL_ENABLE);
+                        udelay(200);
+                }
        }
        I915_WRITE(pipeconf_reg, pipeconf);
@@ -2951,12 +3192,17 @@ static void intel_setup_outputs(struct drm_device *dev)
        if (IS_IGDNG(dev)) {
                int found;
+                if (IS_MOBILE(dev) && (I915_READ(DP_A) & DP_DETECTED))
+                        intel_dp_init(dev, DP_A);
                if (I915_READ(HDMIB) & PORT_DETECTED) {
                        /* check SDVOB */
                        /* found = intel_sdvo_init(dev, HDMIB); */
                        found = 0;
                        if (!found)
                                intel_hdmi_init(dev, HDMIB);
+                        if (!found && (I915_READ(PCH_DP_B) & DP_DETECTED))
+                                intel_dp_init(dev, PCH_DP_B);
                }
                if (I915_READ(HDMIC) & PORT_DETECTED)
@@ -2965,6 +3211,12 @@ static void intel_setup_outputs(struct drm_device *dev)
                if (I915_READ(HDMID) & PORT_DETECTED)
                        intel_hdmi_init(dev, HDMID);
+                if (I915_READ(PCH_DP_C) & DP_DETECTED)
+                        intel_dp_init(dev, PCH_DP_C);
+                if (I915_READ(PCH_DP_D) & DP_DETECTED)
+                        intel_dp_init(dev, PCH_DP_D);
        } else if (IS_I9XX(dev)) {
                int found;
                u32 reg;
@@ -3039,6 +3291,10 @@ static void intel_setup_outputs(struct drm_device *dev)
                                     (1 << 1));
                        clone_mask = (1 << INTEL_OUTPUT_DISPLAYPORT);
                        break;
+                case INTEL_OUTPUT_EDP:
+                        crtc_mask = (1 << 1);
+                        clone_mask = (1 << INTEL_OUTPUT_EDP);
+                        break;
                }
                encoder->possible_crtcs = crtc_mask;
                encoder->possible_clones = intel_connector_clones(dev, clone_mask);
@@ -3148,6 +3404,9 @@ void intel_modeset_init(struct drm_device *dev)
        if (IS_I965G(dev)) {
                dev->mode_config.max_width = 8192;
                dev->mode_config.max_height = 8192;
+        } else if (IS_I9XX(dev)) {
+                dev->mode_config.max_width = 4096;
+                dev->mode_config.max_height = 4096;
        } else {
                dev->mode_config.max_width = 2048;
                dev->mode_config.max_height = 2048;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 6770ae88370d..a6ff15ac548a 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -40,6 +40,8 @@
 #define DP_LINK_CONFIGURATION_SIZE      9
+#define IS_eDP(i) ((i)->type == INTEL_OUTPUT_EDP)
 struct intel_dp_priv {
        uint32_t output_reg;
        uint32_t DP;
@@ -63,6 +65,19 @@ intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
 static void
 intel_dp_link_down(struct intel_output *intel_output, uint32_t DP);
+void
+intel_edp_link_config (struct intel_output *intel_output,
+                int *lane_num, int *link_bw)
+{
+        struct intel_dp_priv   *dp_priv = intel_output->dev_priv;
+        *lane_num = dp_priv->lane_count;
+        if (dp_priv->link_bw == DP_LINK_BW_1_62)
+                *link_bw = 162000;
+        else if (dp_priv->link_bw == DP_LINK_BW_2_7)
+                *link_bw = 270000;
+}
 static int
 intel_dp_max_lane_count(struct intel_output *intel_output)
 {
@@ -206,7 +221,13 @@ intel_dp_aux_ch(struct intel_output *intel_output,
         * and would like to run at 2MHz. So, take the
         * hrawclk value and divide by 2 and use that
         */
-        aux_clock_divider = intel_hrawclk(dev) / 2;
+        if (IS_eDP(intel_output))
+                aux_clock_divider = 225; /* eDP input clock at 450Mhz */
+        else if (IS_IGDNG(dev))
+                aux_clock_divider = 62; /* IGDNG: input clock fixed at 125Mhz */
+        else
+                aux_clock_divider = intel_hrawclk(dev) / 2;
        /* Must try at least 3 times according to DP spec */
        for (try = 0; try < 5; try++) {
                /* Load the send data into the aux channel data registers */
@@ -236,7 +257,7 @@ intel_dp_aux_ch(struct intel_output *intel_output,
                }
        
                /* Clear done status and any errors */
-                I915_WRITE(ch_ctl, (ctl |
+                I915_WRITE(ch_ctl, (status |
                                DP_AUX_CH_CTL_DONE |
                                DP_AUX_CH_CTL_TIME_OUT_ERROR |
                                DP_AUX_CH_CTL_RECEIVE_ERROR));
@@ -295,7 +316,7 @@ intel_dp_aux_native_write(struct intel_output *intel_output,
                return -1;
        msg[0] = AUX_NATIVE_WRITE << 4;
        msg[1] = address >> 8;
-        msg[2] = address;
+        msg[2] = address & 0xff;
        msg[3] = send_bytes - 1;
        memcpy(&msg[4], send, send_bytes);
        msg_bytes = send_bytes + 4;
@@ -387,8 +408,8 @@ intel_dp_i2c_init(struct intel_output *intel_output, const char *name)
        memset(&dp_priv->adapter, '\0', sizeof (dp_priv->adapter));
        dp_priv->adapter.owner = THIS_MODULE;
        dp_priv->adapter.class = I2C_CLASS_DDC;
-        strncpy (dp_priv->adapter.name, name, sizeof dp_priv->adapter.name - 1);
+        strncpy (dp_priv->adapter.name, name, sizeof(dp_priv->adapter.name) - 1);
-        dp_priv->adapter.name[sizeof dp_priv->adapter.name - 1] = '\0';
+        dp_priv->adapter.name[sizeof(dp_priv->adapter.name) - 1] = '\0';
        dp_priv->adapter.algo_data = &dp_priv->algo;
        dp_priv->adapter.dev.parent = &intel_output->base.kdev;
        
@@ -493,22 +514,40 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
        intel_dp_compute_m_n(3, lane_count,
                             mode->clock, adjusted_mode->clock, &m_n);
-        if (intel_crtc->pipe == 0) {
+        if (IS_IGDNG(dev)) {
-                I915_WRITE(PIPEA_GMCH_DATA_M,
+                if (intel_crtc->pipe == 0) {
-                       ((m_n.tu - 1) << PIPE_GMCH_DATA_M_TU_SIZE_SHIFT) |
+                        I915_WRITE(TRANSA_DATA_M1,
-                       m_n.gmch_m);
+                                   ((m_n.tu - 1) << PIPE_GMCH_DATA_M_TU_SIZE_SHIFT) |
-                I915_WRITE(PIPEA_GMCH_DATA_N,
+                                   m_n.gmch_m);
-                       m_n.gmch_n);
+                        I915_WRITE(TRANSA_DATA_N1, m_n.gmch_n);
-                I915_WRITE(PIPEA_DP_LINK_M, m_n.link_m);
+                        I915_WRITE(TRANSA_DP_LINK_M1, m_n.link_m);
-                I915_WRITE(PIPEA_DP_LINK_N, m_n.link_n);
+                        I915_WRITE(TRANSA_DP_LINK_N1, m_n.link_n);
+                } else {
+                        I915_WRITE(TRANSB_DATA_M1,
+                                   ((m_n.tu - 1) << PIPE_GMCH_DATA_M_TU_SIZE_SHIFT) |
+                                   m_n.gmch_m);
+                        I915_WRITE(TRANSB_DATA_N1, m_n.gmch_n);
+                        I915_WRITE(TRANSB_DP_LINK_M1, m_n.link_m);
+                        I915_WRITE(TRANSB_DP_LINK_N1, m_n.link_n);
+                }
        } else {
-                I915_WRITE(PIPEB_GMCH_DATA_M,
+                if (intel_crtc->pipe == 0) {
-                       ((m_n.tu - 1) << PIPE_GMCH_DATA_M_TU_SIZE_SHIFT) |
+                        I915_WRITE(PIPEA_GMCH_DATA_M,
-                       m_n.gmch_m);
+                                   ((m_n.tu - 1) << PIPE_GMCH_DATA_M_TU_SIZE_SHIFT) |
-                I915_WRITE(PIPEB_GMCH_DATA_N,
+                                   m_n.gmch_m);
-                       m_n.gmch_n);
+                        I915_WRITE(PIPEA_GMCH_DATA_N,
-                I915_WRITE(PIPEB_DP_LINK_M, m_n.link_m);
+                                   m_n.gmch_n);
-                I915_WRITE(PIPEB_DP_LINK_N, m_n.link_n);
+                        I915_WRITE(PIPEA_DP_LINK_M, m_n.link_m);
+                        I915_WRITE(PIPEA_DP_LINK_N, m_n.link_n);
+                } else {
+                        I915_WRITE(PIPEB_GMCH_DATA_M,
+                                   ((m_n.tu - 1) << PIPE_GMCH_DATA_M_TU_SIZE_SHIFT) |
+                                   m_n.gmch_m);
+                        I915_WRITE(PIPEB_GMCH_DATA_N,
+                                        m_n.gmch_n);
+                        I915_WRITE(PIPEB_DP_LINK_M, m_n.link_m);
+                        I915_WRITE(PIPEB_DP_LINK_N, m_n.link_n);
+                }
        }
 }
@@ -556,8 +595,38 @@ intel_dp_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
        if (intel_crtc->pipe == 1)
                dp_priv->DP |= DP_PIPEB_SELECT;
+        if (IS_eDP(intel_output)) {
+                /* don't miss out required setting for eDP */
+                dp_priv->DP |= DP_PLL_ENABLE;
+                if (adjusted_mode->clock < 200000)
+                        dp_priv->DP |= DP_PLL_FREQ_160MHZ;
+                else
+                        dp_priv->DP |= DP_PLL_FREQ_270MHZ;
+        }
 }
+static void igdng_edp_backlight_on (struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 pp;
+        DRM_DEBUG("\n");
+        pp = I915_READ(PCH_PP_CONTROL);
+        pp |= EDP_BLC_ENABLE;
+        I915_WRITE(PCH_PP_CONTROL, pp);
+}
+static void igdng_edp_backlight_off (struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 pp;
+        DRM_DEBUG("\n");
+        pp = I915_READ(PCH_PP_CONTROL);
+        pp &= ~EDP_BLC_ENABLE;
+        I915_WRITE(PCH_PP_CONTROL, pp);
+}
 static void
 intel_dp_dpms(struct drm_encoder *encoder, int mode)
@@ -569,11 +638,17 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
        uint32_t dp_reg = I915_READ(dp_priv->output_reg);
        if (mode != DRM_MODE_DPMS_ON) {
-                if (dp_reg & DP_PORT_EN)
+                if (dp_reg & DP_PORT_EN) {
                        intel_dp_link_down(intel_output, dp_priv->DP);
+                        if (IS_eDP(intel_output))
+                                igdng_edp_backlight_off(dev);
+                }
        } else {
-                if (!(dp_reg & DP_PORT_EN))
+                if (!(dp_reg & DP_PORT_EN)) {
                        intel_dp_link_train(intel_output, dp_priv->DP, dp_priv->link_configuration);
+                        if (IS_eDP(intel_output))
+                                igdng_edp_backlight_on(dev);
+                }
        }
        dp_priv->dpms_mode = mode;
 }
@@ -935,6 +1010,23 @@ intel_dp_link_down(struct intel_output *intel_output, uint32_t DP)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        DRM_DEBUG("\n");
+        if (IS_eDP(intel_output)) {
+                DP &= ~DP_PLL_ENABLE;
+                I915_WRITE(dp_priv->output_reg, DP);
+                POSTING_READ(dp_priv->output_reg);
+                udelay(100);
+        }
+        DP &= ~DP_LINK_TRAIN_MASK;
+        I915_WRITE(dp_priv->output_reg, DP | DP_LINK_TRAIN_PAT_IDLE);
+        POSTING_READ(dp_priv->output_reg);
+        udelay(17000);
+        if (IS_eDP(intel_output))
+                DP |= DP_LINK_TRAIN_OFF;
        I915_WRITE(dp_priv->output_reg, DP & ~DP_PORT_EN);
        POSTING_READ(dp_priv->output_reg);
 }
@@ -978,6 +1070,24 @@ intel_dp_check_link_status(struct intel_output *intel_output)
                intel_dp_link_train(intel_output, dp_priv->DP, dp_priv->link_configuration);
 }
+static enum drm_connector_status
+igdng_dp_detect(struct drm_connector *connector)
+{
+        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        enum drm_connector_status status;
+        status = connector_status_disconnected;
+        if (intel_dp_aux_native_read(intel_output,
+                                     0x000, dp_priv->dpcd,
+                                     sizeof (dp_priv->dpcd)) == sizeof (dp_priv->dpcd))
+        {
+                if (dp_priv->dpcd[0] != 0)
+                        status = connector_status_connected;
+        }
+        return status;
+}
 /**
 * Uses CRT_HOTPLUG_EN and CRT_HOTPLUG_STAT to detect DP connection.
 *
@@ -996,6 +1106,9 @@ intel_dp_detect(struct drm_connector *connector)
        dp_priv->has_audio = false;
+        if (IS_IGDNG(dev))
+                return igdng_dp_detect(connector);
        temp = I915_READ(PORT_HOTPLUG_EN);
        I915_WRITE(PORT_HOTPLUG_EN,
@@ -1039,11 +1152,27 @@ intel_dp_detect(struct drm_connector *connector)
 static int intel_dp_get_modes(struct drm_connector *connector)
 {
        struct intel_output *intel_output = to_intel_output(connector);
+        struct drm_device *dev = intel_output->base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int ret;
        /* We should parse the EDID data and find out if it has an audio sink
         */
-        return intel_ddc_get_modes(intel_output);
+        ret = intel_ddc_get_modes(intel_output);
+        if (ret)
+                return ret;
+        /* if eDP has no EDID, try to use fixed panel mode from VBT */
+        if (IS_eDP(intel_output)) {
+                if (dev_priv->panel_fixed_mode != NULL) {
+                        struct drm_display_mode *mode;
+                        mode = drm_mode_duplicate(dev, dev_priv->panel_fixed_mode);
+                        drm_mode_probed_add(connector, mode);
+                        return 1;
+                }
+        }
+        return 0;
 }
 static void
@@ -1106,6 +1235,7 @@ intel_dp_init(struct drm_device *dev, int output_reg)
        struct drm_connector *connector;
        struct intel_output *intel_output;
        struct intel_dp_priv *dp_priv;
+        const char *name = NULL;
        intel_output = kcalloc(sizeof(struct intel_output) + 
                               sizeof(struct intel_dp_priv), 1, GFP_KERNEL);
@@ -1119,7 +1249,10 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                           DRM_MODE_CONNECTOR_DisplayPort);
        drm_connector_helper_add(connector, &intel_dp_connector_helper_funcs);
-        intel_output->type = INTEL_OUTPUT_DISPLAYPORT;
+        if (output_reg == DP_A)
+                intel_output->type = INTEL_OUTPUT_EDP;
+        else
+                intel_output->type = INTEL_OUTPUT_DISPLAYPORT;
        connector->interlace_allowed = true;
        connector->doublescan_allowed = 0;
@@ -1139,12 +1272,41 @@ intel_dp_init(struct drm_device *dev, int output_reg)
        drm_sysfs_connector_add(connector);
        /* Set up the DDC bus. */
-        intel_dp_i2c_init(intel_output,
+        switch (output_reg) {
-                          (output_reg == DP_B) ? "DPDDC-B" :
+                case DP_A:
-                          (output_reg == DP_C) ? "DPDDC-C" : "DPDDC-D");
+                        name = "DPDDC-A";
+                        break;
+                case DP_B:
+                case PCH_DP_B:
+                        name = "DPDDC-B";
+                        break;
+                case DP_C:
+                case PCH_DP_C:
+                        name = "DPDDC-C";
+                        break;
+                case DP_D:
+                case PCH_DP_D:
+                        name = "DPDDC-D";
+                        break;
+        }
+        intel_dp_i2c_init(intel_output, name);
        intel_output->ddc_bus = &dp_priv->adapter;
        intel_output->hot_plug = intel_dp_hot_plug;
+        if (output_reg == DP_A) {
+                /* initialize panel mode from VBT if available for eDP */
+                if (dev_priv->lfp_lvds_vbt_mode) {
+                        dev_priv->panel_fixed_mode =
+                                drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
+                        if (dev_priv->panel_fixed_mode) {
+                                dev_priv->panel_fixed_mode->type |=
+                                        DRM_MODE_TYPE_PREFERRED;
+                        }
+                }
+        }
        /* For G4X desktop chip, PEG_BAND_GAP_DATA 3:0 must first be written
         * 0xd.  Failure to do so will result in spurious interrupts being
         * generated on the port when a cable is not attached.
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 004541c935a8..d6f92ea1b553 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -55,6 +55,7 @@
 #define INTEL_OUTPUT_TVOUT 5
 #define INTEL_OUTPUT_HDMI 6
 #define INTEL_OUTPUT_DISPLAYPORT 7
+#define INTEL_OUTPUT_EDP 8
 #define INTEL_DVO_CHIP_NONE 0
 #define INTEL_DVO_CHIP_LVDS 1
@@ -121,6 +122,8 @@ extern void intel_dp_init(struct drm_device *dev, int dp_reg);
 void
 intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
                 struct drm_display_mode *adjusted_mode);
+extern void intel_edp_link_config (struct intel_output *, int *, int *);
 extern void intel_crtc_load_lut(struct drm_crtc *crtc);
 extern void intel_encoder_prepare (struct drm_encoder *encoder);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 9e30daae37dc..1842290cded3 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -130,16 +130,17 @@ static bool intel_hdmi_mode_fixup(struct drm_encoder *encoder,
 }
 static enum drm_connector_status
-intel_hdmi_edid_detect(struct drm_connector *connector)
+intel_hdmi_detect(struct drm_connector *connector)
 {
        struct intel_output *intel_output = to_intel_output(connector);
        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
        struct edid *edid = NULL;
        enum drm_connector_status status = connector_status_disconnected;
+        hdmi_priv->has_hdmi_sink = false;
        edid = drm_get_edid(&intel_output->base,
                            intel_output->ddc_bus);
-        hdmi_priv->has_hdmi_sink = false;
        if (edid) {
                if (edid->input & DRM_EDID_INPUT_DIGITAL) {
                        status = connector_status_connected;
@@ -148,65 +149,8 @@ intel_hdmi_edid_detect(struct drm_connector *connector)
                intel_output->base.display_info.raw_edid = NULL;
                kfree(edid);
        }
-        return status;
-}
-static enum drm_connector_status
-igdng_hdmi_detect(struct drm_connector *connector)
-{
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
-        /* FIXME hotplug detect */
-        hdmi_priv->has_hdmi_sink = false;
-        return intel_hdmi_edid_detect(connector);
-}
-static enum drm_connector_status
+        return status;
-intel_hdmi_detect(struct drm_connector *connector)
-{
-        struct drm_device *dev = connector->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
-        u32 temp, bit;
-        if (IS_IGDNG(dev))
-                return igdng_hdmi_detect(connector);
-        temp = I915_READ(PORT_HOTPLUG_EN);
-        switch (hdmi_priv->sdvox_reg) {
-        case SDVOB:
-                temp |= HDMIB_HOTPLUG_INT_EN;
-                break;
-        case SDVOC:
-                temp |= HDMIC_HOTPLUG_INT_EN;
-                break;
-        default:
-                return connector_status_unknown;
-        }
-        I915_WRITE(PORT_HOTPLUG_EN, temp);
-        POSTING_READ(PORT_HOTPLUG_EN);
-        switch (hdmi_priv->sdvox_reg) {
-        case SDVOB:
-                bit = HDMIB_HOTPLUG_INT_STATUS;
-                break;
-        case SDVOC:
-                bit = HDMIC_HOTPLUG_INT_STATUS;
-                break;
-        default:
-                return connector_status_unknown;
-        }
-        if ((I915_READ(PORT_HOTPLUG_STAT) & bit) != 0)
-                return intel_hdmi_edid_detect(connector);
-        else
-                return connector_status_disconnected;
 }
 static int intel_hdmi_get_modes(struct drm_connector *connector)
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 9ab38efffecf..3f445a80c552 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -780,6 +780,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
        },
        {
                .callback = intel_no_lvds_dmi_callback,
+                .ident = "AOpen Mini PC MP915",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
+                        DMI_MATCH(DMI_BOARD_NAME, "i915GMx-F"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
                .ident = "Aopen i945GTt-VFA",
                .matches = {
                        DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
@@ -884,6 +892,10 @@ void intel_lvds_init(struct drm_device *dev)
        if (IS_IGDNG(dev)) {
                if ((I915_READ(PCH_LVDS) & LVDS_DETECTED) == 0)
                        return;
+                if (dev_priv->edp_support) {
+                        DRM_DEBUG("disable LVDS for eDP support\n");
+                        return;
+                }
                gpio = PCH_GPIOC;
        }
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 4f0c30948bc4..5371d9332554 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -31,6 +31,7 @@
 #include "drm.h"
 #include "drm_crtc.h"
 #include "intel_drv.h"
+#include "drm_edid.h"
 #include "i915_drm.h"
 #include "i915_drv.h"
 #include "intel_sdvo_regs.h"
@@ -55,6 +56,12 @@ struct intel_sdvo_priv {
        /* Pixel clock limitations reported by the SDVO device, in kHz */
        int pixel_clock_min, pixel_clock_max;
+        /*
+        * For multiple function SDVO device,
+        * this is for current attached outputs.
+        */
+        uint16_t attached_output;
        /**
         * This is set if we're going to treat the device as TV-out.
         *
@@ -114,6 +121,9 @@ struct intel_sdvo_priv {
        u32 save_SDVOX;
 };
+static bool
+intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags);
 /**
 * Writes the SDVOB or SDVOC with the given value, but always writes both
 * SDVOB and SDVOC to work around apparent hardware issues (according to
@@ -1435,41 +1445,96 @@ void intel_sdvo_set_hotplug(struct drm_connector *connector, int on)
        intel_sdvo_read_response(intel_output, &response, 2);
 }
-static void
+static bool
-intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
+intel_sdvo_multifunc_encoder(struct intel_output *intel_output)
+{
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        int caps = 0;
+        if (sdvo_priv->caps.output_flags &
+                (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1))
+                caps++;
+        if (sdvo_priv->caps.output_flags &
+                (SDVO_OUTPUT_RGB0 | SDVO_OUTPUT_RGB1))
+                caps++;
+        if (sdvo_priv->caps.output_flags &
+                (SDVO_OUTPUT_SVID0 | SDVO_OUTPUT_SVID0))
+                caps++;
+        if (sdvo_priv->caps.output_flags &
+                (SDVO_OUTPUT_CVBS0 | SDVO_OUTPUT_CVBS1))
+                caps++;
+        if (sdvo_priv->caps.output_flags &
+                (SDVO_OUTPUT_YPRPB0 | SDVO_OUTPUT_YPRPB1))
+                caps++;
+        if (sdvo_priv->caps.output_flags &
+                (SDVO_OUTPUT_SCART0 | SDVO_OUTPUT_SCART1))
+                caps++;
+        if (sdvo_priv->caps.output_flags &
+                (SDVO_OUTPUT_LVDS0 | SDVO_OUTPUT_LVDS1))
+                caps++;
+        return (caps > 1);
+}
+enum drm_connector_status
+intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
 {
        struct intel_output *intel_output = to_intel_output(connector);
        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        enum drm_connector_status status = connector_status_connected;
        struct edid *edid = NULL;
        edid = drm_get_edid(&intel_output->base,
                            intel_output->ddc_bus);
        if (edid != NULL) {
-                sdvo_priv->is_hdmi = drm_detect_hdmi_monitor(edid);
+                /* Don't report the output as connected if it's a DVI-I
+                 * connector with a non-digital EDID coming out.
+                 */
+                if (response & (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1)) {
+                        if (edid->input & DRM_EDID_INPUT_DIGITAL)
+                                sdvo_priv->is_hdmi =
+                                        drm_detect_hdmi_monitor(edid);
+                        else
+                                status = connector_status_disconnected;
+                }
                kfree(edid);
                intel_output->base.display_info.raw_edid = NULL;
-        }
+        } else if (response & (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1))
+                status = connector_status_disconnected;
+        return status;
 }
 static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connector)
 {
-        u8 response[2];
+        uint16_t response;
        u8 status;
        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_ATTACHED_DISPLAYS, NULL, 0);
        status = intel_sdvo_read_response(intel_output, &response, 2);
-        DRM_DEBUG("SDVO response %d %d\n", response[0], response[1]);
+        DRM_DEBUG("SDVO response %d %d\n", response & 0xff, response >> 8);
        if (status != SDVO_CMD_STATUS_SUCCESS)
                return connector_status_unknown;
-        if ((response[0] != 0) || (response[1] != 0)) {
+        if (response == 0)
-                intel_sdvo_hdmi_sink_detect(connector);
-                return connector_status_connected;
-        } else
                return connector_status_disconnected;
+        if (intel_sdvo_multifunc_encoder(intel_output) &&
+                sdvo_priv->attached_output != response) {
+                if (sdvo_priv->controlled_output != response &&
+                        intel_sdvo_output_setup(intel_output, response) != true)
+                        return connector_status_unknown;
+                sdvo_priv->attached_output = response;
+        }
+        return intel_sdvo_hdmi_sink_detect(connector, response);
 }
 static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
@@ -1866,16 +1931,101 @@ intel_sdvo_get_slave_addr(struct drm_device *dev, int output_device)
                return 0x72;
 }
+static bool
+intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
+{
+        struct drm_connector *connector = &intel_output->base;
+        struct drm_encoder *encoder = &intel_output->enc;
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        bool ret = true, registered = false;
+        sdvo_priv->is_tv = false;
+        intel_output->needs_tv_clock = false;
+        sdvo_priv->is_lvds = false;
+        if (device_is_registered(&connector->kdev)) {
+                drm_sysfs_connector_remove(connector);
+                registered = true;
+        }
+        if (flags &
+            (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1)) {
+                if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS0)
+                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS0;
+                else
+                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS1;
+                encoder->encoder_type = DRM_MODE_ENCODER_TMDS;
+                connector->connector_type = DRM_MODE_CONNECTOR_DVID;
+                if (intel_sdvo_get_supp_encode(intel_output,
+                                               &sdvo_priv->encode) &&
+                    intel_sdvo_get_digital_encoding_mode(intel_output) &&
+                    sdvo_priv->is_hdmi) {
+                        /* enable hdmi encoding mode if supported */
+                        intel_sdvo_set_encode(intel_output, SDVO_ENCODE_HDMI);
+                        intel_sdvo_set_colorimetry(intel_output,
+                                                   SDVO_COLORIMETRY_RGB256);
+                        connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
+                }
+        } else if (flags & SDVO_OUTPUT_SVID0) {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_SVID0;
+                encoder->encoder_type = DRM_MODE_ENCODER_TVDAC;
+                connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
+                sdvo_priv->is_tv = true;
+                intel_output->needs_tv_clock = true;
+        } else if (flags & SDVO_OUTPUT_RGB0) {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
+                encoder->encoder_type = DRM_MODE_ENCODER_DAC;
+                connector->connector_type = DRM_MODE_CONNECTOR_VGA;
+        } else if (flags & SDVO_OUTPUT_RGB1) {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
+                encoder->encoder_type = DRM_MODE_ENCODER_DAC;
+                connector->connector_type = DRM_MODE_CONNECTOR_VGA;
+        } else if (flags & SDVO_OUTPUT_LVDS0) {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
+                encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
+                connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
+                sdvo_priv->is_lvds = true;
+        } else if (flags & SDVO_OUTPUT_LVDS1) {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
+                encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
+                connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
+                sdvo_priv->is_lvds = true;
+        } else {
+                unsigned char bytes[2];
+                sdvo_priv->controlled_output = 0;
+                memcpy(bytes, &sdvo_priv->caps.output_flags, 2);
+                DRM_DEBUG_KMS(I915_SDVO,
+                                "%s: Unknown SDVO output type (0x%02x%02x)\n",
+                                  SDVO_NAME(sdvo_priv),
+                                  bytes[0], bytes[1]);
+                ret = false;
+        }
+        if (ret && registered)
+                ret = drm_sysfs_connector_add(connector) == 0 ? true : false;
+        return ret;
+}
 bool intel_sdvo_init(struct drm_device *dev, int output_device)
 {
        struct drm_connector *connector;
        struct intel_output *intel_output;
        struct intel_sdvo_priv *sdvo_priv;
-        int connector_type;
        u8 ch[0x40];
        int i;
-        int encoder_type;
        intel_output = kcalloc(sizeof(struct intel_output)+sizeof(struct intel_sdvo_priv), 1, GFP_KERNEL);
        if (!intel_output) {
@@ -1925,88 +2075,28 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
        intel_output->ddc_bus->algo = &intel_sdvo_i2c_bit_algo;
        /* In defaut case sdvo lvds is false */
-        sdvo_priv->is_lvds = false;
        intel_sdvo_get_capabilities(intel_output, &sdvo_priv->caps);
-        if (sdvo_priv->caps.output_flags &
+        if (intel_sdvo_output_setup(intel_output,
-            (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1)) {
+                                    sdvo_priv->caps.output_flags) != true) {
-                if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS0)
+                DRM_DEBUG("SDVO output failed to setup on SDVO%c\n",
-                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS0;
+                          output_device == SDVOB ? 'B' : 'C');
-                else
-                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS1;
-                encoder_type = DRM_MODE_ENCODER_TMDS;
-                connector_type = DRM_MODE_CONNECTOR_DVID;
-                if (intel_sdvo_get_supp_encode(intel_output,
-                                               &sdvo_priv->encode) &&
-                    intel_sdvo_get_digital_encoding_mode(intel_output) &&
-                    sdvo_priv->is_hdmi) {
-                        /* enable hdmi encoding mode if supported */
-                        intel_sdvo_set_encode(intel_output, SDVO_ENCODE_HDMI);
-                        intel_sdvo_set_colorimetry(intel_output,
-                                                   SDVO_COLORIMETRY_RGB256);
-                        connector_type = DRM_MODE_CONNECTOR_HDMIA;
-                }
-        }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_SVID0)
-        {
-                sdvo_priv->controlled_output = SDVO_OUTPUT_SVID0;
-                encoder_type = DRM_MODE_ENCODER_TVDAC;
-                connector_type = DRM_MODE_CONNECTOR_SVIDEO;
-                sdvo_priv->is_tv = true;
-                intel_output->needs_tv_clock = true;
-        }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB0)
-        {
-                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
-                encoder_type = DRM_MODE_ENCODER_DAC;
-                connector_type = DRM_MODE_CONNECTOR_VGA;
-        }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB1)
-        {
-                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
-                encoder_type = DRM_MODE_ENCODER_DAC;
-                connector_type = DRM_MODE_CONNECTOR_VGA;
-        }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS0)
-        {
-                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
-                encoder_type = DRM_MODE_ENCODER_LVDS;
-                connector_type = DRM_MODE_CONNECTOR_LVDS;
-                sdvo_priv->is_lvds = true;
-        }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS1)
-        {
-                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
-                encoder_type = DRM_MODE_ENCODER_LVDS;
-                connector_type = DRM_MODE_CONNECTOR_LVDS;
-                sdvo_priv->is_lvds = true;
-        }
-        else
-        {
-                unsigned char bytes[2];
-                sdvo_priv->controlled_output = 0;
-                memcpy (bytes, &sdvo_priv->caps.output_flags, 2);
-                DRM_DEBUG_KMS(I915_SDVO,
-                                "%s: Unknown SDVO output type (0x%02x%02x)\n",
-                                  SDVO_NAME(sdvo_priv),
-                                  bytes[0], bytes[1]);
-                encoder_type = DRM_MODE_ENCODER_NONE;
-                connector_type = DRM_MODE_CONNECTOR_Unknown;
                goto err_i2c;
        }
        connector = &intel_output->base;
        drm_connector_init(dev, connector, &intel_sdvo_connector_funcs,
-                           connector_type);
+                           connector->connector_type);
        drm_connector_helper_add(connector, &intel_sdvo_connector_helper_funcs);
        connector->interlace_allowed = 0;
        connector->doublescan_allowed = 0;
        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
-        drm_encoder_init(dev, &intel_output->enc, &intel_sdvo_enc_funcs, encoder_type);
+        drm_encoder_init(dev, &intel_output->enc,
+                        &intel_sdvo_enc_funcs, intel_output->enc.encoder_type);
        drm_encoder_helper_add(&intel_output->enc, &intel_sdvo_helper_funcs);
        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index a43c98e3f077..da4ab4dc1630 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1490,6 +1490,27 @@ static struct input_res {
        {"1920x1080", 1920, 1080},
 };
+/*
+ * Chose preferred mode  according to line number of TV format
+ */
+static void
+intel_tv_chose_preferred_modes(struct drm_connector *connector,
+                               struct drm_display_mode *mode_ptr)
+{
+        struct intel_output *intel_output = to_intel_output(connector);
+        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
+        if (tv_mode->nbr_end < 480 && mode_ptr->vdisplay == 480)
+                mode_ptr->type |= DRM_MODE_TYPE_PREFERRED;
+        else if (tv_mode->nbr_end > 480) {
+                if (tv_mode->progressive == true && tv_mode->nbr_end < 720) {
+                        if (mode_ptr->vdisplay == 720)
+                                mode_ptr->type |= DRM_MODE_TYPE_PREFERRED;
+                } else if (mode_ptr->vdisplay == 1080)
+                                mode_ptr->type |= DRM_MODE_TYPE_PREFERRED;
+        }
+}
 /**
 * Stub get_modes function.
 *
@@ -1544,6 +1565,7 @@ intel_tv_get_modes(struct drm_connector *connector)
                mode_ptr->clock = (int) tmp;
                mode_ptr->type = DRM_MODE_TYPE_DRIVER;
+                intel_tv_chose_preferred_modes(connector, mode_ptr);
                drm_mode_probed_add(connector, mode_ptr);
                count++;
        }
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 05a44896dffb..f1ba8ff41130 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
                         unsigned idx)
 {
        struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
-        uint32_t header = ib_chunk->kdata[idx];
+        uint32_t header;
        if (idx >= ib_chunk->length_dw) {
                DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
                          idx, ib_chunk->length_dw);
                return -EINVAL;
        }
+        header = ib_chunk->kdata[idx];
        pkt->idx = idx;
        pkt->type = CP_PACKET_GET_TYPE(header);
        pkt->count = CP_PACKET_GET_COUNT(header);
diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c
index 146f3570af8e..20f17908b036 100644
--- a/drivers/gpu/drm/radeon/r600_cp.c
+++ b/drivers/gpu/drm/radeon/r600_cp.c
@@ -384,8 +384,9 @@ static void r600_cp_load_microcode(drm_radeon_private_t *dev_priv)
                DRM_INFO("Loading RV670 PFP Microcode\n");
                for (i = 0; i < PFP_UCODE_SIZE; i++)
                        RADEON_WRITE(R600_CP_PFP_UCODE_DATA, RV670_pfp_microcode[i]);
-        } else if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780)) {
+        } else if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780) ||
-                DRM_INFO("Loading RS780 CP Microcode\n");
+                   ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS880)) {
+                DRM_INFO("Loading RS780/RS880 CP Microcode\n");
                for (i = 0; i < PM4_UCODE_SIZE; i++) {
                        RADEON_WRITE(R600_CP_ME_RAM_DATA,
                                     RS780_cp_microcode[i][0]);
@@ -396,7 +397,7 @@ static void r600_cp_load_microcode(drm_radeon_private_t *dev_priv)
                }
                RADEON_WRITE(R600_CP_PFP_UCODE_ADDR, 0);
-                DRM_INFO("Loading RS780 PFP Microcode\n");
+                DRM_INFO("Loading RS780/RS880 PFP Microcode\n");
                for (i = 0; i < PFP_UCODE_SIZE; i++)
                        RADEON_WRITE(R600_CP_PFP_UCODE_DATA, RS780_pfp_microcode[i]);
        }
@@ -783,6 +784,7 @@ static void r600_gfx_init(struct drm_device *dev,
                break;
        case CHIP_RV610:
        case CHIP_RS780:
+        case CHIP_RS880:
        case CHIP_RV620:
                dev_priv->r600_max_pipes = 1;
                dev_priv->r600_max_tile_pipes = 1;
@@ -917,7 +919,8 @@ static void r600_gfx_init(struct drm_device *dev,
            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV630) ||
            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV610) ||
            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV620) ||
-            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780))
+            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780) ||
+            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS880))
                RADEON_WRITE(R600_DB_DEBUG, R600_PREZ_MUST_WAIT_FOR_POSTZ_DONE);
        else
                RADEON_WRITE(R600_DB_DEBUG, 0);
@@ -935,7 +938,8 @@ static void r600_gfx_init(struct drm_device *dev,
        sq_ms_fifo_sizes = RADEON_READ(R600_SQ_MS_FIFO_SIZES);
        if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV610) ||
            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV620) ||
-            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780)) {
+            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780) ||
+            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS880)) {
                sq_ms_fifo_sizes = (R600_CACHE_FIFO_SIZE(0xa) |
                                    R600_FETCH_FIFO_HIWATER(0xa) |
                                    R600_DONE_FIFO_HIWATER(0xe0) |
@@ -978,7 +982,8 @@ static void r600_gfx_init(struct drm_device *dev,
                                            R600_NUM_ES_STACK_ENTRIES(0));
        } else if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV610) ||
                   ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV620) ||
-                   ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780)) {
+                   ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780) ||
+                   ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS880)) {
                /* no vertex cache */
                sq_config &= ~R600_VC_ENABLE;
@@ -1035,7 +1040,8 @@ static void r600_gfx_init(struct drm_device *dev,
        if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV610) ||
            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV620) ||
-            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780))
+            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS780) ||
+            ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RS880))
                RADEON_WRITE(R600_VGT_CACHE_INVALIDATION, R600_CACHE_INVALIDATION(R600_TC_ONLY));
        else
                RADEON_WRITE(R600_VGT_CACHE_INVALIDATION, R600_CACHE_INVALIDATION(R600_VC_AND_TC));
@@ -1078,6 +1084,7 @@ static void r600_gfx_init(struct drm_device *dev,
                break;
        case CHIP_RV610:
        case CHIP_RS780:
+        case CHIP_RS880:
        case CHIP_RV620:
                gs_prim_buffer_depth = 32;
                break;
@@ -1123,6 +1130,7 @@ static void r600_gfx_init(struct drm_device *dev,
        switch (dev_priv->flags & RADEON_FAMILY_MASK) {
        case CHIP_RV610:
        case CHIP_RS780:
+        case CHIP_RS880:
        case CHIP_RV620:
                tc_cntl = R600_TC_L2_SIZE(8);
                break;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index a162ade74b7f..9ff6dcb97f9d 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -152,7 +152,9 @@ int radeon_mc_setup(struct radeon_device *rdev)
                }
        } else {
                rdev->mc.vram_location = 0;
-                rdev->mc.gtt_location = rdev->mc.mc_vram_size;
+                tmp = rdev->mc.mc_vram_size;
+                tmp = (tmp + rdev->mc.gtt_size - 1) & ~(rdev->mc.gtt_size - 1);
+                rdev->mc.gtt_location = tmp;
        }
        DRM_INFO("radeon: VRAM %uM\n", rdev->mc.real_vram_size >> 20);
        DRM_INFO("radeon: VRAM from 0x%08X to 0x%08X\n",
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 3cfcee17dc56..0bd5879a4957 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -318,6 +318,14 @@ static int __init radeon_init(void)
        driver = &driver_old;
        driver->num_ioctls = radeon_max_ioctl;
 #if defined(CONFIG_DRM_RADEON_KMS)
+#ifdef CONFIG_VGA_CONSOLE
+        if (vgacon_text_force() && radeon_modeset == -1) {
+                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
+                driver = &driver_old;
+                driver->driver_features &= ~DRIVER_MODESET;
+                radeon_modeset = 0;
+        }
+#endif
        /* if enabled by default */
        if (radeon_modeset == -1) {
                DRM_INFO("radeon default to kernel modesetting.\n");
@@ -329,17 +337,8 @@ static int __init radeon_init(void)
                driver->driver_features |= DRIVER_MODESET;
                driver->num_ioctls = radeon_max_kms_ioctl;
        }
        /* if the vga console setting is enabled still
         * let modprobe override it */
-#ifdef CONFIG_VGA_CONSOLE
-        if (vgacon_text_force() && radeon_modeset == -1) {
-                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
-                driver = &driver_old;
-                driver->driver_features &= ~DRIVER_MODESET;
-                radeon_modeset = 0;
-        }
-#endif
 #endif
        return drm_init(driver);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 127d0456f628..3933f8216a34 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -143,6 +143,7 @@ enum radeon_family {
        CHIP_RV635,
        CHIP_RV670,
        CHIP_RS780,
+        CHIP_RS880,
        CHIP_RV770,
        CHIP_RV730,
        CHIP_RV710,
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 937a2f1cdb46..3357110e30ce 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -58,6 +58,8 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
        if (r) {
                DRM_ERROR("Failed to initialize radeon, disabling IOCTL\n");
                radeon_device_fini(rdev);
+                kfree(rdev);
+                dev->dev_private = NULL;
                return r;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index dd9ac2fed6d6..e98cae3bf4a6 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -106,7 +106,7 @@ static inline uint32_t radeon_object_flags_from_domain(uint32_t domain)
                flags |= TTM_PL_FLAG_VRAM | TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED;
        }
        if (domain & RADEON_GEM_DOMAIN_GTT) {
-                flags |= TTM_PL_FLAG_TT | TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED;
+                flags |= TTM_PL_FLAG_TT | TTM_PL_MASK_CACHING;
        }
        if (domain & RADEON_GEM_DOMAIN_CPU) {
                flags |= TTM_PL_FLAG_SYSTEM | TTM_PL_MASK_CACHING;
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 551e608702e4..fd8f3ca716ea 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -370,6 +370,7 @@ void rv515_vram_info(struct radeon_device *rdev)
        rv515_vram_get_type(rdev);
+        r100_vram_init_sizes(rdev);
        /* FIXME: we should enforce default clock in case GPU is not in
         * default setup
         */
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 6538d4236989..c2b0d710d10f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1182,13 +1182,14 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
 int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type)
 {
-        struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+        struct ttm_mem_type_manager *man;
        int ret = -EINVAL;
        if (mem_type >= TTM_NUM_MEM_TYPES) {
                printk(KERN_ERR TTM_PFX "Illegal memory type %d\n", mem_type);
                return ret;
        }
+        man = &bdev->man[mem_type];
        if (!man->has_type) {
                printk(KERN_ERR TTM_PFX "Trying to take down uninitialized "
@@ -1575,6 +1576,10 @@ int ttm_bo_wait(struct ttm_buffer_object *bo,
                        driver->sync_obj_unref(&sync_obj);
                        driver->sync_obj_unref(&tmp_obj);
                        spin_lock(&bo->lock);
+                } else {
+                        spin_unlock(&bo->lock);
+                        driver->sync_obj_unref(&sync_obj);
+                        spin_lock(&bo->lock);
                }
        }
        return 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ce2e6f38ea01..ad4ada07c6cf 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -150,7 +150,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
        dst = kmap_atomic_prot(d, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                dst = vmap(&d, 1, 0, prot);
        else
                dst = kmap(d);
@@ -163,7 +163,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
        kunmap_atomic(dst, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                vunmap(dst);
        else
                kunmap(d);
@@ -186,7 +186,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
        src = kmap_atomic_prot(s, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                src = vmap(&s, 1, 0, prot);
        else
                src = kmap(s);
@@ -199,7 +199,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
        kunmap_atomic(src, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                vunmap(src);
        else
                kunmap(s);
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index e9b2e7cb05be..541b981ff075 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -27,6 +27,7 @@ struct matrix_keypad {
        const struct matrix_keypad_platform_data *pdata;
        struct input_dev *input_dev;
        unsigned short *keycodes;
+        unsigned int row_shift;
        uint32_t last_key_state[MATRIX_MAX_COLS];
        struct delayed_work work;
@@ -136,7 +137,7 @@ static void matrix_keypad_scan(struct work_struct *work)
                        if ((bits_changed & (1 << row)) == 0)
                                continue;
-                        code = (row << 4) + col;
+                        code = MATRIX_SCAN_CODE(row, col, keypad->row_shift);
                        input_event(input_dev, EV_MSC, MSC_SCAN, code);
                        input_report_key(input_dev,
                                         keypad->keycodes[code],
@@ -317,6 +318,7 @@ static int __devinit matrix_keypad_probe(struct platform_device *pdev)
        struct matrix_keypad *keypad;
        struct input_dev *input_dev;
        unsigned short *keycodes;
+        unsigned int row_shift;
        int i;
        int err;
@@ -332,14 +334,11 @@ static int __devinit matrix_keypad_probe(struct platform_device *pdev)
                return -EINVAL;
        }
-        if (!keymap_data->max_keymap_size) {
+        row_shift = get_count_order(pdata->num_col_gpios);
-                dev_err(&pdev->dev, "invalid keymap data supplied\n");
-                return -EINVAL;
-        }
        keypad = kzalloc(sizeof(struct matrix_keypad), GFP_KERNEL);
-        keycodes = kzalloc(keymap_data->max_keymap_size *
+        keycodes = kzalloc((pdata->num_row_gpios << row_shift) *
-                                sizeof(keypad->keycodes),
+                                sizeof(*keycodes),
                           GFP_KERNEL);
        input_dev = input_allocate_device();
        if (!keypad || !keycodes || !input_dev) {
@@ -350,6 +349,7 @@ static int __devinit matrix_keypad_probe(struct platform_device *pdev)
        keypad->input_dev = input_dev;
        keypad->pdata = pdata;
        keypad->keycodes = keycodes;
+        keypad->row_shift = row_shift;
        keypad->stopped = true;
        INIT_DELAYED_WORK(&keypad->work, matrix_keypad_scan);
        spin_lock_init(&keypad->lock);
@@ -363,7 +363,7 @@ static int __devinit matrix_keypad_probe(struct platform_device *pdev)
        input_dev->keycode      = keycodes;
        input_dev->keycodesize  = sizeof(*keycodes);
-        input_dev->keycodemax   = keymap_data->max_keymap_size;
+        input_dev->keycodemax   = pdata->num_row_gpios << keypad->row_shift;
        for (i = 0; i < keymap_data->keymap_size; i++) {
                unsigned int key = keymap_data->keymap[i];
@@ -371,7 +371,7 @@ static int __devinit matrix_keypad_probe(struct platform_device *pdev)
                unsigned int col = KEY_COL(key);
                unsigned short code = KEY_VAL(key);
-                keycodes[(row << 4) + col] = code;
+                keycodes[MATRIX_SCAN_CODE(row, col, row_shift)] = code;
                __set_bit(code, input_dev->keybit);
        }
        __clear_bit(KEY_RESERVED, input_dev->keybit);
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 26e17a9a22eb..27ee976eb54c 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -611,6 +611,20 @@ static struct key_entry keymap_wistron_generic[] __initdata = {
        { KE_END, 0 }
 };
+static struct key_entry keymap_prestigio[] __initdata = {
+        { KE_KEY,  0x11, {KEY_PROG1} },
+        { KE_KEY,  0x12, {KEY_PROG2} },
+        { KE_WIFI,  0x30 },
+        { KE_KEY,  0x22, {KEY_REWIND} },
+        { KE_KEY,  0x23, {KEY_FORWARD} },
+        { KE_KEY,  0x24, {KEY_PLAYPAUSE} },
+        { KE_KEY,  0x25, {KEY_STOPCD} },
+        { KE_KEY,  0x31, {KEY_MAIL} },
+        { KE_KEY,  0x36, {KEY_WWW} },
+        { KE_END,  0 }
+};
 /*
 * If your machine is not here (which is currently rather likely), please send
 * a list of buttons and their key codes (reported when loading this module
@@ -971,6 +985,8 @@ static int __init select_keymap(void)
        if (keymap_name != NULL) {
                if (strcmp (keymap_name, "1557/MS2141") == 0)
                        keymap = keymap_wistron_ms2141;
+                else if (strcmp (keymap_name, "prestigio") == 0)
+                        keymap = keymap_prestigio;
                else if (strcmp (keymap_name, "generic") == 0)
                        keymap = keymap_wistron_generic;
                else {
diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c
index b587e2d576ac..820e51673b26 100644
--- a/drivers/input/serio/hp_sdc_mlc.c
+++ b/drivers/input/serio/hp_sdc_mlc.c
@@ -296,7 +296,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)
        priv->tseq[3] = 0;
        if (mlc->opacket & HIL_CTRL_APE) {
                priv->tseq[3] |= HP_SDC_LPC_APE_IPF;
-                down_trylock(&mlc->csem);
+                BUG_ON(down_trylock(&mlc->csem));
        }
 enqueue:
        hp_sdc_enqueue_transaction(&priv->trans);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 924e8ed7f2cf..ae04d8a494e5 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -78,6 +78,14 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
                },
        },
        {
+                .ident = "ASUS G1S",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer Inc."),
+                        DMI_MATCH(DMI_BOARD_NAME, "G1S"),
+                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                },
+        },
+        {
                /* AUX LOOP command does not raise AUX IRQ */
                .ident = "ASUS P65UP5",
                .matches = {
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index c3b661a666cb..7e5f30dbc0a0 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -1480,7 +1480,7 @@ l1oip_init(void)
                return -ENOMEM;
        l1oip_cnt = 0;
-        while (type[l1oip_cnt] && l1oip_cnt < MAX_CARDS) {
+        while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
                switch (type[l1oip_cnt] & 0xff) {
                case 1:
                        pri = 0;
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 0ca1ee768a1f..8ce74d95ae4d 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -108,7 +108,7 @@ static int fill_pkg(struct cn_msg *msg, struct dm_ulog_request *tfr)
                                *(pkg->data_size) = 0;
                } else if (tfr->data_size > *(pkg->data_size)) {
                        DMERR("Insufficient space to receive package [%u] "
-                              "(%u vs %lu)", tfr->request_type,
+                              "(%u vs %zu)", tfr->request_type,
                              tfr->data_size, *(pkg->data_size));
                        *(pkg->data_size) = 0;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 5b98bea4ff9b..103f2d33fa89 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -359,6 +359,7 @@ static mddev_t * mddev_find(dev_t unit)
        else
                new->md_minor = MINOR(unit) >> MdpMinorShift;
+        mutex_init(&new->open_mutex);
        mutex_init(&new->reconfig_mutex);
        INIT_LIST_HEAD(&new->disks);
        INIT_LIST_HEAD(&new->all_mddevs);
@@ -1974,17 +1975,14 @@ repeat:
                /* otherwise we have to go forward and ... */
                mddev->events ++;
                if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
-                        /* .. if the array isn't clean, insist on an odd 'events' */
+                        /* .. if the array isn't clean, an 'even' event must also go
-                        if ((mddev->events&1)==0) {
+                         * to spares. */
-                                mddev->events++;
+                        if ((mddev->events&1)==0)
                                nospares = 0;
-                        }
                } else {
-                        /* otherwise insist on an even 'events' (for clean states) */
+                        /* otherwise an 'odd' event must go to spares */
-                        if ((mddev->events&1)) {
+                        if ((mddev->events&1))
-                                mddev->events++;
                                nospares = 0;
-                        }
                }
        }
@@ -3601,6 +3599,7 @@ max_sync_store(mddev_t *mddev, const char *buf, size_t len)
                if (max < mddev->resync_min)
                        return -EINVAL;
                if (max < mddev->resync_max &&
+                    mddev->ro == 0 &&
                    test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                        return -EBUSY;
@@ -4304,12 +4303,11 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
        struct gendisk *disk = mddev->gendisk;
        mdk_rdev_t *rdev;
+        mutex_lock(&mddev->open_mutex);
        if (atomic_read(&mddev->openers) > is_open) {
                printk("md: %s still in use.\n",mdname(mddev));
-                return -EBUSY;
+                err = -EBUSY;
-        }
+        } else if (mddev->pers) {
-        if (mddev->pers) {
                if (mddev->sync_thread) {
                        set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
@@ -4367,7 +4365,10 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                        set_disk_ro(disk, 1);
                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
        }
+out:
+        mutex_unlock(&mddev->open_mutex);
+        if (err)
+                return err;
        /*
         * Free resources if final stop
         */
@@ -4433,7 +4434,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
        blk_integrity_unregister(disk);
        md_new_event(mddev);
        sysfs_notify_dirent(mddev->sysfs_state);
-out:
        return err;
 }
@@ -5518,12 +5518,12 @@ static int md_open(struct block_device *bdev, fmode_t mode)
        }
        BUG_ON(mddev != bdev->bd_disk->private_data);
-        if ((err = mutex_lock_interruptible_nested(&mddev->reconfig_mutex, 1)))
+        if ((err = mutex_lock_interruptible(&mddev->open_mutex)))
                goto out;
        err = 0;
        atomic_inc(&mddev->openers);
-        mddev_unlock(mddev);
+        mutex_unlock(&mddev->open_mutex);
        check_disk_change(bdev);
 out:
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 78f03168baf9..f8fc188bc762 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -223,6 +223,16 @@ struct mddev_s
                                                            * so we don't loop trying */
        int                             in_sync;        /* know to not need resync */
+        /* 'open_mutex' avoids races between 'md_open' and 'do_md_stop', so
+         * that we are never stopping an array while it is open.
+         * 'reconfig_mutex' protects all other reconfiguration.
+         * These locks are separate due to conflicting interactions
+         * with bdev->bd_mutex.
+         * Lock ordering is:
+         *  reconfig_mutex -> bd_mutex : e.g. do_md_run -> revalidate_disk
+         *  bd_mutex -> open_mutex:  e.g. __blkdev_get -> md_open
+         */
+        struct mutex                    open_mutex;
        struct mutex                    reconfig_mutex;
        atomic_t                        active;         /* general refcount */
        atomic_t                        openers;        /* number of active opens */
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2b521ee67dfa..b8a2c5dc67ba 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3785,7 +3785,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                    conf->reshape_progress < raid5_size(mddev, 0, 0)) {
                        sector_nr = raid5_size(mddev, 0, 0)
                                - conf->reshape_progress;
-                } else if (mddev->delta_disks > 0 &&
+                } else if (mddev->delta_disks >= 0 &&
                           conf->reshape_progress > 0)
                        sector_nr = conf->reshape_progress;
                sector_div(sector_nr, new_data_disks);
@@ -4509,7 +4509,26 @@ static int run(mddev_t *mddev)
                           (old_disks-max_degraded));
                /* here_old is the first stripe that we might need to read
                 * from */
-                if (here_new >= here_old) {
+                if (mddev->delta_disks == 0) {
+                        /* We cannot be sure it is safe to start an in-place
+                         * reshape.  It is only safe if user-space if monitoring
+                         * and taking constant backups.
+                         * mdadm always starts a situation like this in
+                         * readonly mode so it can take control before
+                         * allowing any writes.  So just check for that.
+                         */
+                        if ((here_new * mddev->new_chunk_sectors != 
+                             here_old * mddev->chunk_sectors) ||
+                            mddev->ro == 0) {
+                                printk(KERN_ERR "raid5: in-place reshape must be started"
+                                       " in read-only mode - aborting\n");
+                                return -EINVAL;
+                        }
+                } else if (mddev->delta_disks < 0
+                    ? (here_new * mddev->new_chunk_sectors <=
+                       here_old * mddev->chunk_sectors)
+                    : (here_new * mddev->new_chunk_sectors >=
+                       here_old * mddev->chunk_sectors)) {
                        /* Reading from the same stripe as writing to - bad */
                        printk(KERN_ERR "raid5: reshape_position too early for "
                               "auto-recovery - aborting.\n");
@@ -5078,8 +5097,15 @@ static void raid5_finish_reshape(mddev_t *mddev)
                                        mddev->degraded--;
                        for (d = conf->raid_disks ;
                             d < conf->raid_disks - mddev->delta_disks;
-                             d++)
+                             d++) {
-                                raid5_remove_disk(mddev, d);
+                                mdk_rdev_t *rdev = conf->disks[d].rdev;
+                                if (rdev && raid5_remove_disk(mddev, d) == 0) {
+                                        char nm[20];
+                                        sprintf(nm, "rd%d", rdev->raid_disk);
+                                        sysfs_remove_link(&mddev->kobj, nm);
+                                        rdev->raid_disk = -1;
+                                }
+                        }
                }
                mddev->layout = conf->algorithm;
                mddev->chunk_sectors = conf->chunk_sectors;
diff --git a/drivers/media/common/tuners/qt1010.c b/drivers/media/common/tuners/qt1010.c
index 825aa1412e6f..9f5dba244cb8 100644
--- a/drivers/media/common/tuners/qt1010.c
+++ b/drivers/media/common/tuners/qt1010.c
@@ -64,24 +64,22 @@ static int qt1010_writereg(struct qt1010_priv *priv, u8 reg, u8 val)
 /* dump all registers */
 static void qt1010_dump_regs(struct qt1010_priv *priv)
 {
-        char buf[52], buf2[4];
        u8 reg, val;
        for (reg = 0; ; reg++) {
                if (reg % 16 == 0) {
                        if (reg)
-                                printk("%s\n", buf);
+                                printk(KERN_CONT "\n");
-                        sprintf(buf, "%02x: ", reg);
+                        printk(KERN_DEBUG "%02x:", reg);
                }
                if (qt1010_readreg(priv, reg, &val) == 0)
-                        sprintf(buf2, "%02x ", val);
+                        printk(KERN_CONT " %02x", val);
                else
-                        strcpy(buf2, "-- ");
+                        printk(KERN_CONT " --");
-                strcat(buf, buf2);
                if (reg == 0x2f)
                        break;
        }
-        printk("%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 static int qt1010_set_params(struct dvb_frontend *fe,
diff --git a/drivers/media/common/tuners/tuner-xc2028.c b/drivers/media/common/tuners/tuner-xc2028.c
index aa20ce8cc668..f270e605da83 100644
--- a/drivers/media/common/tuners/tuner-xc2028.c
+++ b/drivers/media/common/tuners/tuner-xc2028.c
@@ -1119,8 +1119,8 @@ static int xc2028_sleep(struct dvb_frontend *fe)
        struct xc2028_data *priv = fe->tuner_priv;
        int rc = 0;
-        /* Avoid firmware reload on slow devices */
+        /* Avoid firmware reload on slow devices or if PM disabled */
-        if (no_poweroff)
+        if (no_poweroff || priv->ctrl.disable_power_mgmt)
                return 0;
        tuner_dbg("Putting xc2028/3028 into poweroff mode.\n");
diff --git a/drivers/media/common/tuners/tuner-xc2028.h b/drivers/media/common/tuners/tuner-xc2028.h
index 19de7928a74e..a90c35d50add 100644
--- a/drivers/media/common/tuners/tuner-xc2028.h
+++ b/drivers/media/common/tuners/tuner-xc2028.h
@@ -38,6 +38,7 @@ struct xc2028_ctrl {
        unsigned int            input1:1;
        unsigned int            vhfbw7:1;
        unsigned int            uhfbw8:1;
+        unsigned int            disable_power_mgmt:1;
        unsigned int            demod;
        enum firmware_type      type:2;
 };
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index 4cb31e7c13c2..26690dfb3260 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -81,7 +81,6 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
        switch (req->cmd) {
        case GET_CONFIG:
-        case BOOT:
        case READ_MEMORY:
        case RECONNECT_USB:
        case GET_IR_CODE:
@@ -100,6 +99,7 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
        case WRITE_VIRTUAL_MEMORY:
        case COPY_FIRMWARE:
        case DOWNLOAD_FIRMWARE:
+        case BOOT:
                break;
        default:
                err("unknown command:%d", req->cmd);
diff --git a/drivers/media/dvb/frontends/cx22700.c b/drivers/media/dvb/frontends/cx22700.c
index ace5cb17165d..fbd838eca268 100644
--- a/drivers/media/dvb/frontends/cx22700.c
+++ b/drivers/media/dvb/frontends/cx22700.c
@@ -380,7 +380,7 @@ struct dvb_frontend* cx22700_attach(const struct cx22700_config* config,
        struct cx22700_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22700_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22700_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/cx22702.c b/drivers/media/dvb/frontends/cx22702.c
index 5d1abe34bddb..00b5c7e91d5d 100644
--- a/drivers/media/dvb/frontends/cx22702.c
+++ b/drivers/media/dvb/frontends/cx22702.c
@@ -580,7 +580,7 @@ struct dvb_frontend *cx22702_attach(const struct cx22702_config *config,
        struct cx22702_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22702_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22702_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/cx24110.c b/drivers/media/dvb/frontends/cx24110.c
index 87ae29db024f..ffbcfabd83f0 100644
--- a/drivers/media/dvb/frontends/cx24110.c
+++ b/drivers/media/dvb/frontends/cx24110.c
@@ -598,7 +598,7 @@ struct dvb_frontend* cx24110_attach(const struct cx24110_config* config,
        int ret;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx24110_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx24110_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/dvb_dummy_fe.c b/drivers/media/dvb/frontends/dvb_dummy_fe.c
index db8a937cc630..a7fc7e53a551 100644
--- a/drivers/media/dvb/frontends/dvb_dummy_fe.c
+++ b/drivers/media/dvb/frontends/dvb_dummy_fe.c
@@ -117,7 +117,7 @@ struct dvb_frontend* dvb_dummy_fe_ofdm_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
@@ -137,7 +137,7 @@ struct dvb_frontend *dvb_dummy_fe_qpsk_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
@@ -157,7 +157,7 @@ struct dvb_frontend *dvb_dummy_fe_qam_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
diff --git a/drivers/media/dvb/frontends/l64781.c b/drivers/media/dvb/frontends/l64781.c
index e1e70e9e0cb9..3051b64aa17c 100644
--- a/drivers/media/dvb/frontends/l64781.c
+++ b/drivers/media/dvb/frontends/l64781.c
@@ -501,7 +501,7 @@ struct dvb_frontend* l64781_attach(const struct l64781_config* config,
                           { .addr = config->demod_address, .flags = I2C_M_RD, .buf = b1, .len = 1 } };
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct l64781_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct l64781_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/lgs8gl5.c b/drivers/media/dvb/frontends/lgs8gl5.c
index 855852fddf22..bb37ed289a05 100644
--- a/drivers/media/dvb/frontends/lgs8gl5.c
+++ b/drivers/media/dvb/frontends/lgs8gl5.c
@@ -387,7 +387,7 @@ lgs8gl5_attach(const struct lgs8gl5_config *config, struct i2c_adapter *i2c)
        dprintk("%s\n", __func__);
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/mt312.c b/drivers/media/dvb/frontends/mt312.c
index a621f727935f..f69daaac78c9 100644
--- a/drivers/media/dvb/frontends/mt312.c
+++ b/drivers/media/dvb/frontends/mt312.c
@@ -782,7 +782,7 @@ struct dvb_frontend *mt312_attach(const struct mt312_config *config,
        struct mt312_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct mt312_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/nxt6000.c b/drivers/media/dvb/frontends/nxt6000.c
index 0eef22dbf8a0..a763ec756f7f 100644
--- a/drivers/media/dvb/frontends/nxt6000.c
+++ b/drivers/media/dvb/frontends/nxt6000.c
@@ -545,7 +545,7 @@ struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
        struct nxt6000_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index 8133ea3cddd7..38e67accb8c3 100644
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -562,7 +562,7 @@ struct dvb_frontend* or51132_attach(const struct or51132_config* config,
        struct or51132_state* state = NULL;
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51132_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51132_state), GFP_KERNEL);
        if (state == NULL)
                return NULL;
diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 16cf2fdd5d7d..c709ce6771c8 100644
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -527,7 +527,7 @@ struct dvb_frontend* or51211_attach(const struct or51211_config* config,
        struct or51211_state* state = NULL;
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51211_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51211_state), GFP_KERNEL);
        if (state == NULL)
                return NULL;
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index 3e08d985d6e5..fb3011518427 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -796,7 +796,7 @@ struct dvb_frontend *s5h1409_attach(const struct s5h1409_config *config,
        u16 reg;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/s5h1411.c b/drivers/media/dvb/frontends/s5h1411.c
index 66e2dd6d6fe4..d8adf1e32019 100644
--- a/drivers/media/dvb/frontends/s5h1411.c
+++ b/drivers/media/dvb/frontends/s5h1411.c
@@ -844,7 +844,7 @@ struct dvb_frontend *s5h1411_attach(const struct s5h1411_config *config,
        u16 reg;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/si21xx.c b/drivers/media/dvb/frontends/si21xx.c
index 0bd16af8a6cd..9552a22ccffb 100644
--- a/drivers/media/dvb/frontends/si21xx.c
+++ b/drivers/media/dvb/frontends/si21xx.c
@@ -928,7 +928,7 @@ struct dvb_frontend *si21xx_attach(const struct si21xx_config *config,
        dprintk("%s\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct si21xx_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct si21xx_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/sp8870.c b/drivers/media/dvb/frontends/sp8870.c
index 1c9a9b4051b9..b85eb60a893e 100644
--- a/drivers/media/dvb/frontends/sp8870.c
+++ b/drivers/media/dvb/frontends/sp8870.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp8870_attach(const struct sp8870_config* config,
        struct sp8870_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp8870_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp8870_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/sp887x.c b/drivers/media/dvb/frontends/sp887x.c
index 559509ab4dab..4a7c3d842608 100644
--- a/drivers/media/dvb/frontends/sp887x.c
+++ b/drivers/media/dvb/frontends/sp887x.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp887x_attach(const struct sp887x_config* config,
        struct sp887x_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp887x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp887x_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/stv0288.c b/drivers/media/dvb/frontends/stv0288.c
index ff1194de34c0..2930a5d6768a 100644
--- a/drivers/media/dvb/frontends/stv0288.c
+++ b/drivers/media/dvb/frontends/stv0288.c
@@ -570,7 +570,7 @@ struct dvb_frontend *stv0288_attach(const struct stv0288_config *config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0288_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0288_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/stv0297.c b/drivers/media/dvb/frontends/stv0297.c
index 62caf802ed99..4fd7479bb62b 100644
--- a/drivers/media/dvb/frontends/stv0297.c
+++ b/drivers/media/dvb/frontends/stv0297.c
@@ -663,7 +663,7 @@ struct dvb_frontend *stv0297_attach(const struct stv0297_config *config,
        struct stv0297_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0297_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0297_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/stv0299.c b/drivers/media/dvb/frontends/stv0299.c
index 6c1cb1973c6e..968874469726 100644
--- a/drivers/media/dvb/frontends/stv0299.c
+++ b/drivers/media/dvb/frontends/stv0299.c
@@ -667,7 +667,7 @@ struct dvb_frontend* stv0299_attach(const struct stv0299_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0299_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0299_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10021.c b/drivers/media/dvb/frontends/tda10021.c
index f648fdb64bb7..f5d7b3277a2f 100644
--- a/drivers/media/dvb/frontends/tda10021.c
+++ b/drivers/media/dvb/frontends/tda10021.c
@@ -413,7 +413,7 @@ struct dvb_frontend* tda10021_attach(const struct tda1002x_config* config,
        u8 id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10021_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10021_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10048.c b/drivers/media/dvb/frontends/tda10048.c
index cc8862ce4aae..4e2a7c8b2f62 100644
--- a/drivers/media/dvb/frontends/tda10048.c
+++ b/drivers/media/dvb/frontends/tda10048.c
@@ -1095,7 +1095,7 @@ struct dvb_frontend *tda10048_attach(const struct tda10048_config *config,
        dprintk(1, "%s()\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10048_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10048_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/tda1004x.c b/drivers/media/dvb/frontends/tda1004x.c
index 4981cef8b444..f2a8abe0a243 100644
--- a/drivers/media/dvb/frontends/tda1004x.c
+++ b/drivers/media/dvb/frontends/tda1004x.c
@@ -1269,7 +1269,7 @@ struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
        if (!state) {
                printk(KERN_ERR "Can't alocate memory for tda10045 state\n");
                return NULL;
@@ -1339,7 +1339,7 @@ struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
        if (!state) {
                printk(KERN_ERR "Can't alocate memory for tda10046 state\n");
                return NULL;
diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
index a17ce3c4ad86..f2c8faac6f36 100644
--- a/drivers/media/dvb/frontends/tda10086.c
+++ b/drivers/media/dvb/frontends/tda10086.c
@@ -745,7 +745,7 @@ struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
        dprintk ("%s\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10086_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10086_state), GFP_KERNEL);
        if (!state)
                return NULL;
diff --git a/drivers/media/dvb/frontends/tda8083.c b/drivers/media/dvb/frontends/tda8083.c
index 5b843b2e67e8..9369f7442f27 100644
--- a/drivers/media/dvb/frontends/tda8083.c
+++ b/drivers/media/dvb/frontends/tda8083.c
@@ -417,7 +417,7 @@ struct dvb_frontend* tda8083_attach(const struct tda8083_config* config,
        struct tda8083_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda8083_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda8083_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/ves1820.c b/drivers/media/dvb/frontends/ves1820.c
index a184597f1d9b..6e78e4865515 100644
--- a/drivers/media/dvb/frontends/ves1820.c
+++ b/drivers/media/dvb/frontends/ves1820.c
@@ -374,7 +374,7 @@ struct dvb_frontend* ves1820_attach(const struct ves1820_config* config,
        struct ves1820_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1820_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1820_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/ves1x93.c b/drivers/media/dvb/frontends/ves1x93.c
index bd558960bd87..8d7854c2fb0c 100644
--- a/drivers/media/dvb/frontends/ves1x93.c
+++ b/drivers/media/dvb/frontends/ves1x93.c
@@ -456,7 +456,7 @@ struct dvb_frontend* ves1x93_attach(const struct ves1x93_config* config,
        u8 identity;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/zl10353.c b/drivers/media/dvb/frontends/zl10353.c
index 148b6f7f6cb2..66f5c1fb3074 100644
--- a/drivers/media/dvb/frontends/zl10353.c
+++ b/drivers/media/dvb/frontends/zl10353.c
@@ -98,7 +98,6 @@ static int zl10353_read_register(struct zl10353_state *state, u8 reg)
 static void zl10353_dump_regs(struct dvb_frontend *fe)
 {
        struct zl10353_state *state = fe->demodulator_priv;
-        char buf[52], buf2[4];
        int ret;
        u8 reg;
@@ -106,19 +105,18 @@ static void zl10353_dump_regs(struct dvb_frontend *fe)
        for (reg = 0; ; reg++) {
                if (reg % 16 == 0) {
                        if (reg)
-                                printk(KERN_DEBUG "%s\n", buf);
+                                printk(KERN_CONT "\n");
-                        sprintf(buf, "%02x: ", reg);
+                        printk(KERN_DEBUG "%02x:", reg);
                }
                ret = zl10353_read_register(state, reg);
                if (ret >= 0)
-                        sprintf(buf2, "%02x ", (u8)ret);
+                        printk(KERN_CONT " %02x", (u8)ret);
                else
-                        strcpy(buf2, "-- ");
+                        printk(KERN_CONT " --");
-                strcat(buf, buf2);
                if (reg == 0xff)
                        break;
        }
-        printk(KERN_DEBUG "%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 static void zl10353_calc_nominal_rate(struct dvb_frontend *fe,
diff --git a/drivers/media/dvb/siano/Kconfig b/drivers/media/dvb/siano/Kconfig
index dd863f261672..88847d1dcbb5 100644
--- a/drivers/media/dvb/siano/Kconfig
+++ b/drivers/media/dvb/siano/Kconfig
@@ -4,7 +4,7 @@
 config DVB_SIANO_SMS1XXX
        tristate "Siano SMS1XXX USB dongle support"
-        depends on DVB_CORE && USB
+        depends on DVB_CORE && USB && INPUT
        ---help---
          Choose Y here if you have a USB dongle with a SMS1XXX chipset.
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index d8b15d583bde..0420e2885e75 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -116,99 +116,21 @@ static inline void sms_gpio_assign_11xx_default_led_config(
 int sms_board_event(struct smscore_device_t *coredev,
                enum SMS_BOARD_EVENTS gevent) {
-        int board_id = smscore_get_board_id(coredev);
-        struct sms_board *board = sms_get_board(board_id);
        struct smscore_gpio_config MyGpioConfig;
        sms_gpio_assign_11xx_default_led_config(&MyGpioConfig);
        switch (gevent) {
        case BOARD_EVENT_POWER_INIT: /* including hotplug */
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        /* set I/O and turn off all LEDs */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.leds_power,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.leds_power, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led0,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led0, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led1,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        /* set I/O and turn off LNA */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                break; /* BOARD_EVENT_BIND */
        case BOARD_EVENT_POWER_SUSPEND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                break; /* BOARD_EVENT_POWER_SUSPEND */
        case BOARD_EVENT_POWER_RESUME:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                break; /* BOARD_EVENT_POWER_RESUME */
        case BOARD_EVENT_BIND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                break; /* BOARD_EVENT_BIND */
        case BOARD_EVENT_SCAN_PROG:
@@ -218,20 +140,8 @@ int sms_board_event(struct smscore_device_t *coredev,
        case BOARD_EVENT_EMERGENCY_WARNING_SIGNAL:
                break; /* BOARD_EVENT_EMERGENCY_WARNING_SIGNAL */
        case BOARD_EVENT_FE_LOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                        board->board_cfg.led1, 1);
-                        break;
-                }
                break; /* BOARD_EVENT_FE_LOCK */
        case BOARD_EVENT_FE_UNLOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                break; /* BOARD_EVENT_FE_UNLOCK */
        case BOARD_EVENT_DEMOD_LOCK:
                break; /* BOARD_EVENT_DEMOD_LOCK */
@@ -248,20 +158,8 @@ int sms_board_event(struct smscore_device_t *coredev,
        case BOARD_EVENT_RECEPTION_LOST_0:
                break; /* BOARD_EVENT_RECEPTION_LOST_0 */
        case BOARD_EVENT_MULTIPLEX_OK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 1);
-                        break;
-                }
                break; /* BOARD_EVENT_MULTIPLEX_OK */
        case BOARD_EVENT_MULTIPLEX_ERRORS:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                break; /* BOARD_EVENT_MULTIPLEX_ERRORS */
        default:
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index a246903c3341..bd9ab9d0d12a 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -816,7 +816,7 @@ int smscore_set_device_mode(struct smscore_device_t *coredev, int mode)
        sms_debug("set device mode to %d", mode);
        if (coredev->device_flags & SMS_DEVICE_FAMILY2) {
-                if (mode < DEVICE_MODE_DVBT || mode > DEVICE_MODE_RAW_TUNER) {
+                if (mode < DEVICE_MODE_DVBT || mode >= DEVICE_MODE_RAW_TUNER) {
                        sms_err("invalid mode specified %d", mode);
                        return -EINVAL;
                }
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 84b6fc15519d..dcf9fa9264bb 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -920,6 +920,8 @@ source "drivers/media/video/pwc/Kconfig"
 config USB_ZR364XX
        tristate "USB ZR364XX Camera support"
        depends on VIDEO_V4L2
+        select VIDEOBUF_GEN
+        select VIDEOBUF_VMALLOC
        ---help---
          Say Y here if you want to connect this type of camera to your
          computer's USB port.
diff --git a/drivers/media/video/bw-qcam.c b/drivers/media/video/bw-qcam.c
index 10dbd4a11b30..9e39bc5f7b00 100644
--- a/drivers/media/video/bw-qcam.c
+++ b/drivers/media/video/bw-qcam.c
@@ -992,7 +992,7 @@ static int accept_bwqcam(struct parport *port)
        if (parport[0] && strncmp(parport[0], "auto", 4) != 0) {
                /* user gave parport parameters */
-                for(n=0; parport[n] && n<MAX_CAMS; n++){
+                for (n = 0; n < MAX_CAMS && parport[n]; n++) {
                        char *ep;
                        unsigned long r;
                        r = simple_strtoul(parport[n], &ep, 0);
diff --git a/drivers/media/video/cx18/cx18-controls.c b/drivers/media/video/cx18/cx18-controls.c
index 5136df198338..93f0dae01350 100644
--- a/drivers/media/video/cx18/cx18-controls.c
+++ b/drivers/media/video/cx18/cx18-controls.c
@@ -20,6 +20,7 @@
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
 *  02111-1307  USA
 */
+#include <linux/kernel.h>
 #include "cx18-driver.h"
 #include "cx18-cards.h"
@@ -317,7 +318,7 @@ int cx18_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                idx = p.audio_properties & 0x03;
                /* The audio clock of the digitizer must match the codec sample
                   rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                        cx18_call_all(cx, audio, s_clock_freq, freqs[idx]);
                return err;
        }
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index e0cf21e0b1bf..1a1048b18f70 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1715,6 +1715,8 @@ static struct video_device cx23885_mpeg_template = {
        .fops          = &mpeg_fops,
        .ioctl_ops     = &mpeg_ioctl_ops,
        .minor         = -1,
+        .tvnorms       = CX23885_NORMS,
+        .current_norm  = V4L2_STD_NTSC_M,
 };
 void cx23885_417_unregister(struct cx23885_dev *dev)
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index a5cc1c1fc2d6..39465301ec94 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -3003,6 +3003,14 @@ void cx88_setup_xc3028(struct cx88_core *core, struct xc2028_ctrl *ctl)
        case CX88_BOARD_DVICO_FUSIONHDTV_5_PCI_NANO:
                ctl->demod = XC3028_FE_OREN538;
                break;
+        case CX88_BOARD_GENIATECH_X8000_MT:
+                /* FIXME: For this board, the xc3028 never recovers after being
+                   powered down (the reset GPIO probably is not set properly).
+                   We don't have access to the hardware so we cannot determine
+                   which GPIO is used for xc3028, so just disable power xc3028
+                   power management for now */
+                ctl->disable_power_mgmt = 1;
+                break;
        case CX88_BOARD_WINFAST_TV2000_XP_GLOBAL:
        case CX88_BOARD_PROLINK_PV_GLOBAL_XTREME:
        case CX88_BOARD_PROLINK_PV_8000GT:
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index c44e87600219..e237b507659b 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -501,6 +501,7 @@ static struct zl10353_config cx88_pinnacle_hybrid_pctv = {
 static struct zl10353_config cx88_geniatech_x8000_mt = {
       .demod_address = (0x1e >> 1),
       .no_tuner = 1,
+       .disable_i2c_gate_ctrl = 1,
 };
 static struct s5h1411_config dvico_fusionhdtv7_config = {
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index da4e3912cd37..7172dcf2a4fa 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -116,6 +116,10 @@ static int cx8802_start_dma(struct cx8802_dev    *dev,
                        udelay(100);
                        break;
                case CX88_BOARD_HAUPPAUGE_HVR1300:
+                        /* Enable MPEG parallel IO and video signal pins */
+                        cx_write(MO_PINMUX_IO, 0x88);
+                        cx_write(TS_SOP_STAT, 0);
+                        cx_write(TS_VALERR_CNTRL, 0);
                        break;
                case CX88_BOARD_PINNACLE_PCTV_HD_800i:
                        /* Enable MPEG parallel IO and video signal pins */
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 320f1f60276e..ed281f565945 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -218,7 +218,7 @@ static struct em28xx_reg_seq silvercrest_reg_seq[] = {
 struct em28xx_board em28xx_boards[] = {
        [EM2750_BOARD_UNKNOWN] = {
                .name          = "EM2710/EM2750/EM2751 webcam grabber",
-                .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
+                .xclk          = EM28XX_XCLK_FREQUENCY_20MHZ,
                .tuner_type    = TUNER_ABSENT,
                .is_webcam     = 1,
                .input         = { {
@@ -622,22 +622,27 @@ struct em28xx_board em28xx_boards[] = {
        },
        [EM2861_BOARD_PLEXTOR_PX_TV100U] = {
                .name         = "Plextor ConvertX PX-TV100U",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                .tuner_type   = TUNER_TNF_5335MF,
+                .xclk         = EM28XX_XCLK_I2S_MSB_TIMING |
+                                EM28XX_XCLK_FREQUENCY_12MHZ,
                .tda9887_conf = TDA9887_PRESENT,
                .decoder      = EM28XX_TVP5150,
+                .has_msp34xx  = 1,
                .input        = { {
                        .type     = EM28XX_VMUX_TELEVISION,
                        .vmux     = TVP5150_COMPOSITE0,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                }, {
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                } },
        },
@@ -1544,6 +1549,8 @@ struct usb_device_id em28xx_id_table[] = {
                        .driver_info = EM2750_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2800),
                        .driver_info = EM2800_BOARD_UNKNOWN },
+        { USB_DEVICE(0xeb1a, 0x2710),
+                        .driver_info = EM2820_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2820),
                        .driver_info = EM2820_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2821),
@@ -1761,6 +1768,7 @@ static int em28xx_hint_sensor(struct em28xx *dev)
        __be16 version_be;
        u16 version;
+        /* Micron sensor detection */
        dev->i2c_client.addr = 0xba >> 1;
        cmd = 0;
        i2c_master_send(&dev->i2c_client, &cmd, 1);
@@ -1769,15 +1777,27 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                return -EINVAL;
        version = be16_to_cpu(version_be);
        switch (version) {
-        case 0x8243:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8232:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8243:            /* mt9v011 rev B 640x480 1.3 Mpix sensor */
                dev->model = EM2820_BOARD_SILVERCREST_WEBCAM;
+                em28xx_set_model(dev);
                sensor_name = "mt9v011";
                dev->em28xx_sensor = EM28XX_MT9V011;
                dev->sensor_xres = 640;
                dev->sensor_yres = 480;
-                dev->sensor_xtal = 6300000;
+                /*
+                 * FIXME: mt9v011 uses I2S speed as xtal clk - at least with
+                 * the Silvercrest cam I have here for testing - for higher
+                 * resolutions, a high clock cause horizontal artifacts, so we
+                 * need to use a lower xclk frequency.
+                 * Yet, it would be possible to adjust xclk depending on the
+                 * desired resolution, since this affects directly the
+                 * frame rate.
+                 */
+                dev->board.xclk = EM28XX_XCLK_FREQUENCY_4_3MHZ;
+                dev->sensor_xtal = 4300000;
                /* probably means GRGB 16 bit bayer */
                dev->vinmode = 0x0d;
@@ -1786,6 +1806,8 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                break;
        case 0x8431:
                dev->model = EM2750_BOARD_UNKNOWN;
+                em28xx_set_model(dev);
                sensor_name = "mt9m001";
                dev->em28xx_sensor = EM28XX_MT9M001;
                em28xx_initialize_mt9m001(dev);
@@ -1802,6 +1824,9 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                return -EINVAL;
        }
+        /* Setup webcam defaults */
+        em28xx_pre_card_setup(dev);
        em28xx_errdev("Sensor is %s, using model %s entry.\n",
                      sensor_name, em28xx_boards[dev->model].name);
@@ -1813,60 +1838,6 @@ static int em28xx_hint_sensor(struct em28xx *dev)
 */
 void em28xx_pre_card_setup(struct em28xx *dev)
 {
-        int rc;
-        em28xx_set_model(dev);
-        em28xx_info("Identified as %s (card=%d)\n",
-                    dev->board.name, dev->model);
-        /* Set the default GPO/GPIO for legacy devices */
-        dev->reg_gpo_num = EM2880_R04_GPO;
-        dev->reg_gpio_num = EM28XX_R08_GPIO;
-        dev->wait_after_write = 5;
-        /* Based on the Chip ID, set the device configuration */
-        rc = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
-        if (rc > 0) {
-                dev->chip_id = rc;
-                switch (dev->chip_id) {
-                case CHIP_ID_EM2750:
-                        em28xx_info("chip ID is em2750\n");
-                        break;
-                case CHIP_ID_EM2820:
-                        em28xx_info("chip ID is em2710 or em2820\n");
-                        break;
-                case CHIP_ID_EM2840:
-                        em28xx_info("chip ID is em2840\n");
-                        break;
-                case CHIP_ID_EM2860:
-                        em28xx_info("chip ID is em2860\n");
-                        break;
-                case CHIP_ID_EM2870:
-                        em28xx_info("chip ID is em2870\n");
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2874:
-                        em28xx_info("chip ID is em2874\n");
-                        dev->reg_gpio_num = EM2874_R80_GPIO;
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2883:
-                        em28xx_info("chip ID is em2882/em2883\n");
-                        dev->wait_after_write = 0;
-                        break;
-                default:
-                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
-                }
-        }
-        /* Prepopulate cached GPO register content */
-        rc = em28xx_read_reg(dev, dev->reg_gpo_num);
-        if (rc >= 0)
-                dev->reg_gpo = rc;
        /* Set the initial XCLK and I2C clock values based on the board
           definition */
        em28xx_write_reg(dev, EM28XX_R0F_XCLK, dev->board.xclk & 0x7f);
@@ -1876,9 +1847,8 @@ void em28xx_pre_card_setup(struct em28xx *dev)
        /* request some modules */
        switch (dev->model) {
        case EM2861_BOARD_PLEXTOR_PX_TV100U:
-                /* FIXME guess */
+                /* Sets the msp34xx I2S speed */
-                /* Turn on analog audio output */
+                dev->i2s_speed = 2048000;
-                em28xx_write_reg(dev, EM28XX_R08_GPIO, 0xfd);
                break;
        case EM2861_BOARD_KWORLD_PVRTV_300U:
        case EM2880_BOARD_KWORLD_DVB_305U:
@@ -2216,7 +2186,20 @@ void em28xx_register_i2c_ir(struct em28xx *dev)
 void em28xx_card_setup(struct em28xx *dev)
 {
-        em28xx_set_model(dev);
+        /*
+         * If the device can be a webcam, seek for a sensor.
+         * If sensor is not found, then it isn't a webcam.
+         */
+        if (dev->board.is_webcam) {
+                if (em28xx_hint_sensor(dev) < 0)
+                        dev->board.is_webcam = 0;
+                else
+                        dev->progressive = 1;
+        } else
+                em28xx_set_model(dev);
+        em28xx_info("Identified as %s (card=%d)\n",
+                    dev->board.name, dev->model);
        dev->tuner_type = em28xx_boards[dev->model].tuner_type;
        if (em28xx_boards[dev->model].tuner_addr)
@@ -2290,10 +2273,6 @@ void em28xx_card_setup(struct em28xx *dev)
                em28xx_gpio_set(dev, dev->board.tuner_gpio);
                em28xx_set_mode(dev, EM28XX_ANALOG_MODE);
                break;
-        case EM2820_BOARD_SILVERCREST_WEBCAM:
-                /* FIXME: need to document the registers bellow */
-                em28xx_write_reg(dev, 0x0d, 0x42);
-                em28xx_write_reg(dev, 0x13, 0x08);
        }
        if (dev->board.has_snapshot_button)
@@ -2433,7 +2412,7 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                           int minor)
 {
        struct em28xx *dev = *devhandle;
-        int retval = -ENOMEM;
+        int retval;
        int errCode;
        dev->udev = udev;
@@ -2450,6 +2429,58 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
        dev->em28xx_read_reg_req = em28xx_read_reg_req;
        dev->board.is_em2800 = em28xx_boards[dev->model].is_em2800;
+        em28xx_set_model(dev);
+        /* Set the default GPO/GPIO for legacy devices */
+        dev->reg_gpo_num = EM2880_R04_GPO;
+        dev->reg_gpio_num = EM28XX_R08_GPIO;
+        dev->wait_after_write = 5;
+        /* Based on the Chip ID, set the device configuration */
+        retval = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
+        if (retval > 0) {
+                dev->chip_id = retval;
+                switch (dev->chip_id) {
+                case CHIP_ID_EM2710:
+                        em28xx_info("chip ID is em2710\n");
+                        break;
+                case CHIP_ID_EM2750:
+                        em28xx_info("chip ID is em2750\n");
+                        break;
+                case CHIP_ID_EM2820:
+                        em28xx_info("chip ID is em2820 (or em2710)\n");
+                        break;
+                case CHIP_ID_EM2840:
+                        em28xx_info("chip ID is em2840\n");
+                        break;
+                case CHIP_ID_EM2860:
+                        em28xx_info("chip ID is em2860\n");
+                        break;
+                case CHIP_ID_EM2870:
+                        em28xx_info("chip ID is em2870\n");
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2874:
+                        em28xx_info("chip ID is em2874\n");
+                        dev->reg_gpio_num = EM2874_R80_GPIO;
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2883:
+                        em28xx_info("chip ID is em2882/em2883\n");
+                        dev->wait_after_write = 0;
+                        break;
+                default:
+                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
+                }
+        }
+        /* Prepopulate cached GPO register content */
+        retval = em28xx_read_reg(dev, dev->reg_gpo_num);
+        if (retval >= 0)
+                dev->reg_gpo = retval;
        em28xx_pre_card_setup(dev);
        if (!dev->board.is_em2800) {
@@ -2484,14 +2515,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
        dev->vinmode = 0x10;
        dev->vinctl  = 0x11;
-        /*
-         * If the device can be a webcam, seek for a sensor.
-         * If sensor is not found, then it isn't a webcam.
-         */
-        if (dev->board.is_webcam)
-                if (em28xx_hint_sensor(dev) < 0)
-                        dev->board.is_webcam = 0;
        /* Do board specific init and eeprom reading */
        em28xx_card_setup(dev);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 5b78e199abd1..98e140b5d95e 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -632,6 +632,9 @@ int em28xx_capture_start(struct em28xx *dev, int start)
                return rc;
        }
+        if (dev->board.is_webcam)
+                rc = em28xx_write_reg(dev, 0x13, 0x0c);
        /* enable video capture */
        rc = em28xx_write_reg(dev, 0x48, 0x00);
@@ -720,7 +723,10 @@ int em28xx_resolution_set(struct em28xx *dev)
 {
        int width, height;
        width = norm_maxw(dev);
-        height = norm_maxh(dev) >> 1;
+        height = norm_maxh(dev);
+        if (!dev->progressive)
+                height >>= norm_maxh(dev);
        em28xx_set_outfmt(dev);
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index cf0ac7f2a30d..d603575431b4 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -478,7 +478,6 @@ static int dvb_init(struct em28xx *dev)
                }
                break;
        case EM2880_BOARD_KWORLD_DVB_310U:
-        case EM2880_BOARD_EMPIRE_DUAL_TV:
                dvb->frontend = dvb_attach(zl10353_attach,
                                           &em28xx_zl10353_with_xc3028,
                                           &dev->i2c_adap);
@@ -488,6 +487,7 @@ static int dvb_init(struct em28xx *dev)
                }
                break;
        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+        case EM2880_BOARD_EMPIRE_DUAL_TV:
                dvb->frontend = dvb_attach(zl10353_attach,
                                           &em28xx_zl10353_xc3028_no_i2c_gate,
                                           &dev->i2c_adap);
diff --git a/drivers/media/video/em28xx/em28xx-reg.h b/drivers/media/video/em28xx/em28xx-reg.h
index a2676d63cfd0..6bf84bd787df 100644
--- a/drivers/media/video/em28xx/em28xx-reg.h
+++ b/drivers/media/video/em28xx/em28xx-reg.h
@@ -176,7 +176,8 @@
 /* FIXME: Need to be populated with the other chip ID's */
 enum em28xx_chip_id {
-        CHIP_ID_EM2820 = 18,    /* Also used by em2710 */
+        CHIP_ID_EM2710 = 17,
+        CHIP_ID_EM2820 = 18,    /* Also used by some em2710 */
        CHIP_ID_EM2840 = 20,
        CHIP_ID_EM2750 = 33,
        CHIP_ID_EM2860 = 34,
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index ff37b4c15f44..ab079d9256c4 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -194,15 +194,24 @@ static void em28xx_copy_video(struct em28xx *dev,
        startread = p;
        remain = len;
-        /* Interlaces frame */
+        if (dev->progressive)
-        if (buf->top_field)
                fieldstart = outp;
-        else
+        else {
-                fieldstart = outp + bytesperline;
+                /* Interlaces two half frames */
+                if (buf->top_field)
+                        fieldstart = outp;
+                else
+                        fieldstart = outp + bytesperline;
+        }
        linesdone = dma_q->pos / bytesperline;
        currlinedone = dma_q->pos % bytesperline;
-        offset = linesdone * bytesperline * 2 + currlinedone;
+        if (dev->progressive)
+                offset = linesdone * bytesperline + currlinedone;
+        else
+                offset = linesdone * bytesperline * 2 + currlinedone;
        startwrite = fieldstart + offset;
        lencopy = bytesperline - currlinedone;
        lencopy = lencopy > remain ? remain : lencopy;
@@ -376,7 +385,7 @@ static inline int em28xx_isoc_copy(struct em28xx *dev, struct urb *urb)
                        em28xx_isocdbg("Video frame %d, length=%i, %s\n", p[2],
                                       len, (p[2] & 1) ? "odd" : "even");
-                        if (!(p[2] & 1)) {
+                        if (dev->progressive || !(p[2] & 1)) {
                                if (buf != NULL)
                                        buffer_filled(dev, dma_q, buf);
                                get_next_buf(dma_q, &buf);
@@ -689,7 +698,10 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
        f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
        /* FIXME: TOP? NONE? BOTTOM? ALTENATE? */
-        f->fmt.pix.field = dev->interlaced ?
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
                           V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
        mutex_unlock(&dev->lock);
@@ -753,7 +765,11 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
        f->fmt.pix.bytesperline = (dev->width * fmt->depth + 7) >> 3;
        f->fmt.pix.sizeimage = f->fmt.pix.bytesperline * height;
        f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
-        f->fmt.pix.field = V4L2_FIELD_INTERLACED;
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
+                           V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
        return 0;
 }
@@ -846,6 +862,41 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *norm)
        return 0;
 }
+static int vidioc_g_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+        int rc = 0;
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        if (dev->board.is_webcam)
+                rc = v4l2_device_call_until_err(&dev->v4l2_dev, 0,
+                                                video, g_parm, p);
+        else
+                v4l2_video_std_frame_period(dev->norm,
+                                                 &p->parm.capture.timeperframe);
+        return rc;
+}
+static int vidioc_s_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+        if (!dev->board.is_webcam)
+                return -EINVAL;
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        return v4l2_device_call_until_err(&dev->v4l2_dev, 0, video, s_parm, p);
+}
 static const char *iname[] = {
        [EM28XX_VMUX_COMPOSITE1] = "Composite1",
        [EM28XX_VMUX_COMPOSITE2] = "Composite2",
@@ -1624,6 +1675,7 @@ static int em28xx_v4l2_open(struct file *filp)
        struct em28xx *dev;
        enum v4l2_buf_type fh_type;
        struct em28xx_fh *fh;
+        enum v4l2_field field;
        dev = em28xx_get_device(minor, &fh_type, &radio);
@@ -1665,8 +1717,13 @@ static int em28xx_v4l2_open(struct file *filp)
        dev->users++;
+        if (dev->progressive)
+                field = V4L2_FIELD_NONE;
+        else
+                field = V4L2_FIELD_INTERLACED;
        videobuf_queue_vmalloc_init(&fh->vb_vidq, &em28xx_video_qops,
-                        NULL, &dev->slock, fh->type, V4L2_FIELD_INTERLACED,
+                        NULL, &dev->slock, fh->type, field,
                        sizeof(struct em28xx_buffer), fh);
        mutex_unlock(&dev->lock);
@@ -1885,6 +1942,8 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
        .vidioc_qbuf                = vidioc_qbuf,
        .vidioc_dqbuf               = vidioc_dqbuf,
        .vidioc_s_std               = vidioc_s_std,
+        .vidioc_g_parm              = vidioc_g_parm,
+        .vidioc_s_parm              = vidioc_s_parm,
        .vidioc_enum_input          = vidioc_enum_input,
        .vidioc_g_input             = vidioc_g_input,
        .vidioc_s_input             = vidioc_s_input,
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 45bd513f62dc..8c2dc38bca9f 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -484,6 +484,9 @@ struct em28xx {
        int sensor_xres, sensor_yres;
        int sensor_xtal;
+        /* Allows progressive (e. g. non-interlaced) mode */
+        int progressive;
        /* Vinmode/Vinctl used at the driver */
        int vinmode, vinctl;
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index ccd47f57f42c..d678765cbba2 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -1220,6 +1220,8 @@ static const struct video_device hdpvr_video_template = {
                V4L2_STD_PAL_G | V4L2_STD_PAL_H | V4L2_STD_PAL_I |
                V4L2_STD_PAL_D | V4L2_STD_PAL_M | V4L2_STD_PAL_N |
                V4L2_STD_PAL_60,
+        .current_norm           = V4L2_STD_NTSC | V4L2_STD_PAL_M |
+                V4L2_STD_PAL_60,
 };
 int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
diff --git a/drivers/media/video/ivtv/ivtv-controls.c b/drivers/media/video/ivtv/ivtv-controls.c
index a3b77ed3f089..4a9c8ce0ecb3 100644
--- a/drivers/media/video/ivtv/ivtv-controls.c
+++ b/drivers/media/video/ivtv/ivtv-controls.c
@@ -17,6 +17,7 @@
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
+#include <linux/kernel.h>
 #include "ivtv-driver.h"
 #include "ivtv-cards.h"
@@ -281,7 +282,7 @@ int ivtv_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                idx = p.audio_properties & 0x03;
                /* The audio clock of the digitizer must match the codec sample
                   rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                        ivtv_call_all(itv, audio, s_clock_freq, freqs[idx]);
                return err;
        }
diff --git a/drivers/media/video/mt9v011.c b/drivers/media/video/mt9v011.c
index b2260de645f0..cc85f77a5706 100644
--- a/drivers/media/video/mt9v011.c
+++ b/drivers/media/video/mt9v011.c
@@ -52,13 +52,34 @@ static struct v4l2_queryctrl mt9v011_qctrl[] = {
                .step = 1,
                .default_value = 0,
                .flags = 0,
-        },
+        }, {
+                .id      = V4L2_CID_HFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Mirror",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+                .id      = V4L2_CID_VFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Vflip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+        }
 };
 struct mt9v011 {
        struct v4l2_subdev sd;
        unsigned width, height;
        unsigned xtal;
+        unsigned hflip:1;
+        unsigned vflip:1;
        u16 global_gain, red_bal, blue_bal;
 };
@@ -131,7 +152,6 @@ static const struct i2c_reg_value mt9v011_init_default[] = {
                { R0A_MT9V011_CLK_SPEED, 0x0000 },
                { R1E_MT9V011_DIGITAL_ZOOM,  0x0000 },
-                { R20_MT9V011_READ_MODE, 0x1000 },
                { R07_MT9V011_OUT_CTRL, 0x0002 },       /* chip enable */
 };
@@ -156,7 +176,7 @@ static void set_balance(struct v4l2_subdev *sd)
        mt9v011_write(sd, R2D_MT9V011_RED_GAIN, red_gain);
 }
-static void calc_fps(struct v4l2_subdev *sd)
+static void calc_fps(struct v4l2_subdev *sd, u32 *numerator, u32 *denominator)
 {
        struct mt9v011 *core = to_mt9v011(sd);
        unsigned height, width, hblank, vblank, speed;
@@ -179,6 +199,51 @@ static void calc_fps(struct v4l2_subdev *sd)
        v4l2_dbg(1, debug, sd, "Programmed to %u.%03u fps (%d pixel clcks)\n",
                tmp / 1000, tmp % 1000, t_time);
+        if (numerator && denominator) {
+                *numerator = 1000;
+                *denominator = (u32)frames_per_ms;
+        }
+}
+static u16 calc_speed(struct v4l2_subdev *sd, u32 numerator, u32 denominator)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned height, width, hblank, vblank;
+        unsigned row_time, line_time;
+        u64 t_time, speed;
+        /* Avoid bogus calculus */
+        if (!numerator || !denominator)
+                return 0;
+        height = mt9v011_read(sd, R03_MT9V011_HEIGHT);
+        width = mt9v011_read(sd, R04_MT9V011_WIDTH);
+        hblank = mt9v011_read(sd, R05_MT9V011_HBLANK);
+        vblank = mt9v011_read(sd, R06_MT9V011_VBLANK);
+        row_time = width + 113 + hblank;
+        line_time = height + vblank + 1;
+        t_time = core->xtal * ((u64)numerator);
+        /* round to the closest value */
+        t_time += denominator / 2;
+        do_div(t_time, denominator);
+        speed = t_time;
+        do_div(speed, row_time * line_time);
+        /* Avoid having a negative value for speed */
+        if (speed < 2)
+                speed = 0;
+        else
+                speed -= 2;
+        /* Avoid speed overflow */
+        if (speed > 15)
+                return 15;
+        return (u16)speed;
 }
 static void set_res(struct v4l2_subdev *sd)
@@ -207,9 +272,23 @@ static void set_res(struct v4l2_subdev *sd)
        mt9v011_write(sd, R03_MT9V011_HEIGHT, core->height);
        mt9v011_write(sd, R06_MT9V011_VBLANK, 508 - core->height);
-        calc_fps(sd);
+        calc_fps(sd, NULL, NULL);
 };
+static void set_read_mode(struct v4l2_subdev *sd)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned mode = 0x1000;
+        if (core->hflip)
+                mode |= 0x4000;
+        if (core->vflip)
+                mode |= 0x8000;
+        mt9v011_write(sd, R20_MT9V011_READ_MODE, mode);
+}
 static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
 {
        int i;
@@ -220,6 +299,7 @@ static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
        set_balance(sd);
        set_res(sd);
+        set_read_mode(sd);
        return 0;
 };
@@ -240,6 +320,12 @@ static int mt9v011_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
        case V4L2_CID_BLUE_BALANCE:
                ctrl->value = core->blue_bal;
                return 0;
+        case V4L2_CID_HFLIP:
+                ctrl->value = core->hflip ? 1 : 0;
+                return 0;
+        case V4L2_CID_VFLIP:
+                ctrl->value = core->vflip ? 1 : 0;
+                return 0;
        }
        return -EINVAL;
 }
@@ -288,6 +374,14 @@ static int mt9v011_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
        case V4L2_CID_BLUE_BALANCE:
                core->blue_bal = ctrl->value;
                break;
+        case V4L2_CID_HFLIP:
+                core->hflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
+        case V4L2_CID_VFLIP:
+                core->vflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
        default:
                return -EINVAL;
        }
@@ -322,6 +416,44 @@ static int mt9v011_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
        return 0;
 }
+static int mt9v011_g_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        memset(cp, 0, sizeof(struct v4l2_captureparm));
+        cp->capability = V4L2_CAP_TIMEPERFRAME;
+        calc_fps(sd,
+                 &cp->timeperframe.numerator,
+                 &cp->timeperframe.denominator);
+        return 0;
+}
+static int mt9v011_s_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+        struct v4l2_fract *tpf = &cp->timeperframe;
+        u16 speed;
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        if (cp->extendedmode != 0)
+                return -EINVAL;
+        speed = calc_speed(sd, tpf->numerator, tpf->denominator);
+        mt9v011_write(sd, R0A_MT9V011_CLK_SPEED, speed);
+        v4l2_dbg(1, debug, sd, "Setting speed to %d\n", speed);
+        /* Recalculate and update fps info */
+        calc_fps(sd, &tpf->numerator, &tpf->denominator);
+        return 0;
+}
 static int mt9v011_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
 {
        struct v4l2_pix_format *pix = &fmt->fmt.pix;
@@ -393,10 +525,13 @@ static int mt9v011_s_register(struct v4l2_subdev *sd,
 static int mt9v011_g_chip_ident(struct v4l2_subdev *sd,
                                struct v4l2_dbg_chip_ident *chip)
 {
+        u16 version;
        struct i2c_client *client = v4l2_get_subdevdata(sd);
+        version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
        return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_MT9V011,
-                                          MT9V011_VERSION);
+                                          version);
 }
 static const struct v4l2_subdev_core_ops mt9v011_core_ops = {
@@ -416,6 +551,8 @@ static const struct v4l2_subdev_video_ops mt9v011_video_ops = {
        .enum_fmt = mt9v011_enum_fmt,
        .try_fmt = mt9v011_try_fmt,
        .s_fmt = mt9v011_s_fmt,
+        .g_parm = mt9v011_g_parm,
+        .s_parm = mt9v011_s_parm,
 };
 static const struct v4l2_subdev_ops mt9v011_ops = {
@@ -449,8 +586,9 @@ static int mt9v011_probe(struct i2c_client *c,
        /* Check if the sensor is really a MT9V011 */
        version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
-        if (version != MT9V011_VERSION) {
+        if ((version != MT9V011_VERSION) &&
-                v4l2_info(sd, "*** unknown micron chip detected (0x%04x.\n",
+            (version != MT9V011_REV_B_VERSION)) {
+                v4l2_info(sd, "*** unknown micron chip detected (0x%04x).\n",
                          version);
                kfree(core);
                return -EINVAL;
@@ -461,8 +599,8 @@ static int mt9v011_probe(struct i2c_client *c,
        core->height = 480;
        core->xtal = 27000000;  /* Hz */
-        v4l_info(c, "chip found @ 0x%02x (%s)\n",
+        v4l_info(c, "chip found @ 0x%02x (%s - chip version 0x%04x)\n",
-                 c->addr << 1, c->adapter->name);
+                 c->addr << 1, c->adapter->name, version);
        return 0;
 }
diff --git a/drivers/media/video/mt9v011.h b/drivers/media/video/mt9v011.h
index 9e443ee30558..3350fd6083c3 100644
--- a/drivers/media/video/mt9v011.h
+++ b/drivers/media/video/mt9v011.h
@@ -30,6 +30,7 @@
 #define R35_MT9V011_GLOBAL_GAIN         0x35
 #define RF1_MT9V011_CHIP_ENABLE         0xf1
-#define MT9V011_VERSION                 0x8243
+#define MT9V011_VERSION                 0x8232
+#define MT9V011_REV_B_VERSION           0x8243
 #endif
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 2d075205bdfe..736c31d23194 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -234,6 +234,7 @@ static int mx1_camera_setup_dma(struct mx1_camera_dev *pcdev)
        return ret;
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void mx1_videobuf_queue(struct videobuf_queue *vq,
                                                struct videobuf_buffer *vb)
 {
@@ -241,13 +242,10 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct mx1_camera_dev *pcdev = ici->priv;
        struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb);
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                vb, vb->baddr, vb->bsize);
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        vb->state = VIDEOBUF_ACTIVE;
@@ -264,8 +262,6 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
                        __raw_writel(temp, pcdev->base + CSICR1);
                }
        }
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void mx1_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index e605c076ed89..9770cb7932ca 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -332,7 +332,10 @@ static enum pixel_fmt fourcc_to_ipu_pix(__u32 fourcc)
        }
 }
-/* Called with .vb_lock held */
+/*
+ * Called with .vb_lock mutex held and
+ * under spinlock_irqsave(&mx3_cam->lock, ...)
+ */
 static void mx3_videobuf_queue(struct videobuf_queue *vq,
                               struct videobuf_buffer *vb)
 {
@@ -346,7 +349,8 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
        struct idmac_video_param *video = &ichan->params.video;
        const struct soc_camera_data_format *data_fmt = icd->current_fmt;
        dma_cookie_t cookie;
-        unsigned long flags;
+        BUG_ON(!irqs_disabled());
        /* This is the configuration of one sg-element */
        video->out_pixel_fmt    = fourcc_to_ipu_pix(data_fmt->fourcc);
@@ -359,8 +363,6 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
        memset((void *)vb->baddr, 0xaa, vb->bsize);
 #endif
-        spin_lock_irqsave(&mx3_cam->lock, flags);
        list_add_tail(&vb->queue, &mx3_cam->capture);
        if (!mx3_cam->active) {
@@ -370,24 +372,23 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
                vb->state = VIDEOBUF_QUEUED;
        }
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
+        spin_unlock_irq(&mx3_cam->lock);
        cookie = txd->tx_submit(txd);
        dev_dbg(&icd->dev, "Submitted cookie %d DMA 0x%08x\n", cookie, sg_dma_address(&buf->sg));
+        spin_lock_irq(&mx3_cam->lock);
        if (cookie >= 0)
                return;
        /* Submit error */
        vb->state = VIDEOBUF_PREPARED;
-        spin_lock_irqsave(&mx3_cam->lock, flags);
        list_del_init(&vb->queue);
        if (mx3_cam->active == buf)
                mx3_cam->active = NULL;
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
 }
 /* Called with .vb_lock held */
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 46e0d8ad880f..016bb45ba0c3 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -612,6 +612,7 @@ static void pxa_camera_stop_capture(struct pxa_camera_dev *pcdev)
        dev_dbg(pcdev->soc_host.dev, "%s\n", __func__);
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void pxa_videobuf_queue(struct videobuf_queue *vq,
                               struct videobuf_buffer *vb)
 {
@@ -619,13 +620,10 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct pxa_camera_dev *pcdev = ici->priv;
        struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb);
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d active=%p\n", __func__,
                vb, vb->baddr, vb->bsize, pcdev->active);
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        vb->state = VIDEOBUF_ACTIVE;
@@ -633,8 +631,6 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
        if (!pcdev->active)
                pxa_camera_start_capture(pcdev);
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void pxa_videobuf_release(struct videobuf_queue *vq,
@@ -1579,6 +1575,7 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
                pcdev->mclk = 20000000;
        }
+        pcdev->soc_host.dev = &pdev->dev;
        pcdev->mclk_divisor = mclk_get_divisor(pcdev);
        INIT_LIST_HEAD(&pcdev->capture);
@@ -1644,7 +1641,6 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
        pcdev->soc_host.drv_name        = PXA_CAM_DRV_NAME;
        pcdev->soc_host.ops             = &pxa_soc_camera_host_ops;
        pcdev->soc_host.priv            = pcdev;
-        pcdev->soc_host.dev             = &pdev->dev;
        pcdev->soc_host.nr              = pdev->id;
        err = soc_camera_host_register(&pcdev->soc_host);
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 06861b782b95..6eebe3ef97d3 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -3331,8 +3331,8 @@ struct saa7134_board saa7134_boards[] = {
                        .gpio = 0x0200100,
                },
        },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
+        [SAA7134_BOARD_HAUPPAUGE_HVR1150] = {
-                .name           = "Hauppauge WinTV-HVR1120 ATSC/QAM-Hybrid",
+                .name           = "Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_PHILIPS_TDA8290,
                .radio_type     = UNSET,
@@ -3363,8 +3363,8 @@ struct saa7134_board saa7134_boards[] = {
                        .gpio = 0x0800100, /* GPIO 23 HI for FM */
                },
        },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1110R3] = {
+        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
-                .name           = "Hauppauge WinTV-HVR1110r3 DVB-T/Hybrid",
+                .name           = "Hauppauge WinTV-HVR1120 DVB-T/Hybrid",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_PHILIPS_TDA8290,
                .radio_type     = UNSET,
@@ -5862,31 +5862,31 @@ struct pci_device_id saa7134_pci_tbl[] = {
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6706,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6707,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6708,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6709,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x670a,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
@@ -6363,8 +6363,8 @@ static int saa7134_tda8290_18271_callback(struct saa7134_dev *dev,
        switch (command) {
        case TDA18271_CALLBACK_CMD_AGC_ENABLE: /* 0 */
                switch (dev->board) {
+                case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-                case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                        ret = saa7134_tda18271_hvr11x0_toggle_agc(dev, arg);
                        break;
                default:
@@ -6384,8 +6384,8 @@ static int saa7134_tda8290_callback(struct saa7134_dev *dev,
        int ret;
        switch (dev->board) {
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                /* tda8290 + tda18271 */
                ret = saa7134_tda8290_18271_callback(dev, command, arg);
                break;
@@ -6427,7 +6427,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
        switch (tv.model) {
        case 67019: /* WinTV-HVR1110 (Retail, IR Blaster, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67109: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
-        case 67201: /* WinTV-HVR1120 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
+        case 67201: /* WinTV-HVR1150 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67301: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
        case 67209: /* WinTV-HVR1110 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67559: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
@@ -6435,7 +6435,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
        case 67579: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM) */
        case 67589: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
        case 67599: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
-        case 67651: /* WinTV-HVR1120 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
+        case 67651: /* WinTV-HVR1150 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
        case 67659: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
                break;
        default:
@@ -6625,8 +6625,8 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_writeb (SAA7134_PRODUCTION_TEST_MODE, 0x00);
                break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                /* GPIO 26 high for digital, low for analog */
                saa7134_set_gpio(dev, 26, 0);
                msleep(1);
@@ -6891,8 +6891,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
                       dev->name, saa7134_boards[dev->board].name);
               }
               break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                hauppauge_eeprom(dev, dev->eedata+0x80);
                break;
        case SAA7134_BOARD_HAUPPAUGE_HVR1110:
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 31930f26ffc7..98f3efd1e944 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1119,7 +1119,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                         &tda827x_cfg_2) < 0)
                        goto dettach_frontend;
                break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
                fe0->dvb.frontend = dvb_attach(tda10048_attach,
                                               &hcw_tda10048_config,
                                               &dev->i2c_adap);
@@ -1147,7 +1147,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                         &tda827x_cfg_1) < 0)
                        goto dettach_frontend;
                break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                fe0->dvb.frontend = dvb_attach(lgdt3305_attach,
                                               &hcw_lgdt3305_config,
                                               &dev->i2c_adap);
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index 82268848f26a..fb564f14887c 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -278,8 +278,8 @@ struct saa7134_format {
 #define SAA7134_BOARD_ASUSTeK_TIGER         152
 #define SAA7134_BOARD_KWORLD_PLUS_TV_ANALOG 153
 #define SAA7134_BOARD_AVERMEDIA_GO_007_FM_PLUS 154
-#define SAA7134_BOARD_HAUPPAUGE_HVR1120     155
+#define SAA7134_BOARD_HAUPPAUGE_HVR1150     155
-#define SAA7134_BOARD_HAUPPAUGE_HVR1110R3   156
+#define SAA7134_BOARD_HAUPPAUGE_HVR1120   156
 #define SAA7134_BOARD_AVERMEDIA_STUDIO_507UA 157
 #define SAA7134_BOARD_AVERMEDIA_CARDBUS_501 158
 #define SAA7134_BOARD_BEHOLD_505RDS         159
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 0db88a53d92c..e86878deea71 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -282,27 +282,24 @@ out:
        return ret;
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq,
                                         struct videobuf_buffer *vb)
 {
        struct soc_camera_device *icd = vq->priv_data;
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct sh_mobile_ceu_dev *pcdev = ici->priv;
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %zd\n", __func__,
                vb, vb->baddr, vb->bsize);
        vb->state = VIDEOBUF_QUEUED;
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        if (!pcdev->active) {
                pcdev->active = vb;
                sh_mobile_ceu_capture(pcdev);
        }
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void sh_mobile_ceu_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/stk-webcam.c b/drivers/media/video/stk-webcam.c
index 4d6785e63455..b154bd961e3b 100644
--- a/drivers/media/video/stk-webcam.c
+++ b/drivers/media/video/stk-webcam.c
@@ -1050,8 +1050,8 @@ static int stk_setup_format(struct stk_camera *dev)
                depth = 1;
        else
                depth = 2;
-        while (stk_sizes[i].m != dev->vsettings.mode
+        while (i < ARRAY_SIZE(stk_sizes) &&
-                        && i < ARRAY_SIZE(stk_sizes))
+                        stk_sizes[i].m != dev->vsettings.mode)
                i++;
        if (i == ARRAY_SIZE(stk_sizes)) {
                STK_ERROR("Something is broken in %s\n", __func__);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 89927b7aec28..04b47832fa0a 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1845,11 +1845,29 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
-        /* ViMicro */
+        /* ViMicro Vega */
-        { .match_flags          = USB_DEVICE_ID_MATCH_VENDOR
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x332d,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x3410,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro Venus - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
          .idVendor             = 0x0ac8,
-          .idProduct            = 0x0000,
+          .idProduct            = 0x3420,
          .bInterfaceClass      = USB_CLASS_VIDEO,
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index f152a9903862..1ca6dff73612 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -145,8 +145,8 @@ static void uvc_status_complete(struct urb *urb)
                        break;
                default:
-                        uvc_printk(KERN_INFO, "unknown event type %u.\n",
+                        uvc_trace(UVC_TRACE_STATUS, "Unknown status event "
-                                dev->status[0]);
+                                "type %u.\n", dev->status[0]);
                        break;
                }
        }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index be64a502ea27..f2afc4e08379 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -1081,8 +1081,10 @@ static long __video_do_ioctl(struct file *file,
                /* Calls the specific handler */
                if (ops->vidioc_g_std)
                        ret = ops->vidioc_g_std(file, fh, id);
-                else
+                else if (vfd->current_norm)
                        *id = vfd->current_norm;
+                else
+                        ret = -EINVAL;
                if (!ret)
                        dbgarg(cmd, "std=0x%08Lx\n", (long long unsigned)*id);
@@ -1553,12 +1555,19 @@ static long __video_do_ioctl(struct file *file,
                                break;
                        ret = ops->vidioc_g_parm(file, fh, p);
                } else {
+                        v4l2_std_id std = vfd->current_norm;
                        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                                return -EINVAL;
-                        v4l2_video_std_frame_period(vfd->current_norm,
-                                                    &p->parm.capture.timeperframe);
                        ret = 0;
+                        if (ops->vidioc_g_std)
+                                ret = ops->vidioc_g_std(file, fh, &std);
+                        else if (std == 0)
+                                ret = -EINVAL;
+                        if (ret == 0)
+                                v4l2_video_std_frame_period(std,
+                                                    &p->parm.capture.timeperframe);
                }
                dbgarg(cmd, "type=%d\n", p->type);
diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
index bae61b22501c..7d430835655f 100644
--- a/drivers/mfd/twl4030-irq.c
+++ b/drivers/mfd/twl4030-irq.c
@@ -180,14 +180,9 @@ static struct completion irq_event;
 static int twl4030_irq_thread(void *data)
 {
        long irq = (long)data;
-        struct irq_desc *desc = irq_to_desc(irq);
        static unsigned i2c_errors;
        static const unsigned max_i2c_errors = 100;
-        if (!desc) {
-                pr_err("twl4030: Invalid IRQ: %ld\n", irq);
-                return -EINVAL;
-        }
        current->flags |= PF_NOFREEZE;
@@ -240,7 +235,7 @@ static int twl4030_irq_thread(void *data)
                }
                local_irq_enable();
-                desc->chip->unmask(irq);
+                enable_irq(irq);
        }
        return 0;
@@ -255,25 +250,13 @@ static int twl4030_irq_thread(void *data)
 * thread.  All we do here is acknowledge and mask the interrupt and wakeup
 * the kernel thread.
 */
-static void handle_twl4030_pih(unsigned int irq, struct irq_desc *desc)
+static irqreturn_t handle_twl4030_pih(int irq, void *devid)
 {
        /* Acknowledge, clear *AND* mask the interrupt... */
-        desc->chip->ack(irq);
+        disable_irq_nosync(irq);
-        complete(&irq_event);
+        complete(devid);
-}
+        return IRQ_HANDLED;
-static struct task_struct *start_twl4030_irq_thread(long irq)
-{
-        struct task_struct *thread;
-        init_completion(&irq_event);
-        thread = kthread_run(twl4030_irq_thread, (void *)irq, "twl4030-irq");
-        if (!thread)
-                pr_err("twl4030: could not create irq %ld thread!\n", irq);
-        return thread;
 }
 /*----------------------------------------------------------------------*/
 /*
@@ -734,18 +717,28 @@ int twl_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
        }
        /* install an irq handler to demultiplex the TWL4030 interrupt */
-        task = start_twl4030_irq_thread(irq_num);
-        if (!task) {
-                pr_err("twl4030: irq thread FAIL\n");
-                status = -ESRCH;
-                goto fail;
-        }
-        set_irq_data(irq_num, task);
-        set_irq_chained_handler(irq_num, handle_twl4030_pih);
-        return status;
+        init_completion(&irq_event);
+        status = request_irq(irq_num, handle_twl4030_pih, IRQF_DISABLED,
+                                "TWL4030-PIH", &irq_event);
+        if (status < 0) {
+                pr_err("twl4030: could not claim irq%d: %d\n", irq_num, status);
+                goto fail_rqirq;
+        }
+        task = kthread_run(twl4030_irq_thread, (void *)irq_num, "twl4030-irq");
+        if (IS_ERR(task)) {
+                pr_err("twl4030: could not create irq %d thread!\n", irq_num);
+                status = PTR_ERR(task);
+                goto fail_kthread;
+        }
+        return status;
+fail_kthread:
+        free_irq(irq_num, &irq_event);
+fail_rqirq:
+        /* clean up twl4030_sih_setup */
 fail:
        for (i = irq_base; i < irq_end; i++)
                set_irq_chip_and_handler(i, NULL, NULL);
diff --git a/drivers/mmc/host/sdhci-of.c b/drivers/mmc/host/sdhci-of.c
index 908844327db0..1e8aa590bb39 100644
--- a/drivers/mmc/host/sdhci-of.c
+++ b/drivers/mmc/host/sdhci-of.c
@@ -234,7 +234,7 @@ static int __devinit sdhci_of_probe(struct of_device *ofdev,
                return -ENODEV;
        host = sdhci_alloc_host(&ofdev->dev, sizeof(*of_host));
-        if (!host)
+        if (IS_ERR(host))
                return -ENOMEM;
        of_host = sdhci_priv(host);
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 0b98654d8eed..7a58bd5522fd 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -284,13 +284,6 @@ config MTD_L440GX
          BE VERY CAREFUL.
-config MTD_SBC8240
-        tristate "Flash device on SBC8240"
-        depends on MTD_JEDECPROBE && 8260
-        help
-          Flash access on the SBC8240 board from Wind River.  See
-          <http://www.windriver.com/products/sbc8240/>
 config MTD_TQM8XXL
        tristate "CFI Flash device mapped on TQM8XXL"
        depends on MTD_CFI && TQM8xxL
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index 8bae7f9850c0..5beb0662d724 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -50,7 +50,6 @@ obj-$(CONFIG_MTD_UCLINUX)	+= uclinux.o
 obj-$(CONFIG_MTD_NETtel)        += nettel.o
 obj-$(CONFIG_MTD_SCB2_FLASH)    += scb2_flash.o
 obj-$(CONFIG_MTD_H720X)         += h720x-flash.o
-obj-$(CONFIG_MTD_SBC8240)       += sbc8240.o
 obj-$(CONFIG_MTD_IXP4XX)        += ixp4xx.o
 obj-$(CONFIG_MTD_IXP2000)       += ixp2000.o
 obj-$(CONFIG_MTD_WRSBC8260)     += wr_sbc82xx_flash.o
diff --git a/drivers/mtd/maps/sbc8240.c b/drivers/mtd/maps/sbc8240.c
deleted file mode 100644
index d5374cdcb163..000000000000
--- a/drivers/mtd/maps/sbc8240.c
+++ /dev/null
@@ -1,250 +0,0 @@
-/*
- * Handle mapping of the flash memory access routines on the SBC8240 board.
- *
- * Carolyn Smith, Tektronix, Inc.
- *
- * This code is GPLed
- */
-/*
- * The SBC8240 has 2 flash banks.
- * Bank 0 is a 512 KiB AMD AM29F040B; 8 x 64 KiB sectors.
- * It contains the U-Boot code (7 sectors) and the environment (1 sector).
- * Bank 1 is 4 x 1 MiB AMD AM29LV800BT; 15 x 64 KiB sectors, 1 x 32 KiB sector,
- * 2 x 8 KiB sectors, 1 x 16 KiB sectors.
- * Both parts are JEDEC compatible.
- */
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <asm/io.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/cfi.h>
-#ifdef CONFIG_MTD_PARTITIONS
-#include <linux/mtd/partitions.h>
-#endif
-#define DEBUG
-#ifdef  DEBUG
-# define debugk(fmt,args...)    printk(fmt ,##args)
-#else
-# define debugk(fmt,args...)
-#endif
-#define WINDOW_ADDR0    0xFFF00000              /* 512 KiB */
-#define WINDOW_SIZE0    0x00080000
-#define BUSWIDTH0       1
-#define WINDOW_ADDR1    0xFF000000              /* 4 MiB */
-#define WINDOW_SIZE1    0x00400000
-#define BUSWIDTH1       8
-#define MSG_PREFIX "sbc8240:"   /* prefix for our printk()'s */
-#define MTDID      "sbc8240-%d" /* for mtdparts= partitioning */
-static struct map_info sbc8240_map[2] = {
-        {
-                .name           = "sbc8240 Flash Bank #0",
-                .size           = WINDOW_SIZE0,
-                .bankwidth       = BUSWIDTH0,
-        },
-        {
-                .name           = "sbc8240 Flash Bank #1",
-                .size           = WINDOW_SIZE1,
-                .bankwidth       = BUSWIDTH1,
-        }
-};
-#define NUM_FLASH_BANKS ARRAY_SIZE(sbc8240_map)
-/*
- * The following defines the partition layout of SBC8240 boards.
- *
- * See include/linux/mtd/partitions.h for definition of the
- * mtd_partition structure.
- *
- * The *_max_flash_size is the maximum possible mapped flash size
- * which is not necessarily the actual flash size. It must correspond
- * to the value specified in the mapping definition defined by the
- * "struct map_desc *_io_desc" for the corresponding machine.
- */
-#ifdef CONFIG_MTD_PARTITIONS
-static struct mtd_partition sbc8240_uboot_partitions [] = {
-        /* Bank 0 */
-        {
-                .name = "U-boot",                       /* U-Boot Firmware      */
-                .offset =       0,
-                .size = 0x00070000,                     /*  7 x 64 KiB sectors  */
-                .mask_flags = MTD_WRITEABLE,            /*  force read-only     */
-        },
-        {
-                .name = "environment",                  /* U-Boot environment   */
-                .offset =       0x00070000,
-                .size = 0x00010000,                     /*  1 x 64 KiB sector   */
-        },
-};
-static struct mtd_partition sbc8240_fs_partitions [] = {
-        {
-                .name = "jffs",                         /* JFFS  filesystem     */
-                .offset =       0,
-                .size = 0x003C0000,                     /*  4 * 15 * 64KiB      */
-        },
-        {
-                .name = "tmp32",
-                .offset =       0x003C0000,
-                .size = 0x00020000,                     /*  4 * 32KiB           */
-        },
-        {
-                .name = "tmp8a",
-                .offset =       0x003E0000,
-                .size = 0x00008000,                     /*  4 * 8KiB            */
-        },
-        {
-                .name = "tmp8b",
-                .offset =       0x003E8000,
-                .size = 0x00008000,                     /*  4 * 8KiB            */
-        },
-        {
-                .name = "tmp16",
-                .offset =       0x003F0000,
-                .size = 0x00010000,                     /*  4 * 16KiB           */
-        }
-};
-/* trivial struct to describe partition information */
-struct mtd_part_def
-{
-        int nums;
-        unsigned char *type;
-        struct mtd_partition* mtd_part;
-};
-static struct mtd_info *sbc8240_mtd[NUM_FLASH_BANKS];
-static struct mtd_part_def sbc8240_part_banks[NUM_FLASH_BANKS];
-#endif  /* CONFIG_MTD_PARTITIONS */
-static int __init init_sbc8240_mtd (void)
-{
-        static struct _cjs {
-                u_long addr;
-                u_long size;
-        } pt[NUM_FLASH_BANKS] = {
-                {
-                        .addr = WINDOW_ADDR0,
-                        .size = WINDOW_SIZE0
-                },
-                {
-                        .addr = WINDOW_ADDR1,
-                        .size = WINDOW_SIZE1
-                },
-        };
-        int devicesfound = 0;
-        int i,j;
-        for (i = 0; i < NUM_FLASH_BANKS; i++) {
-                printk (KERN_NOTICE MSG_PREFIX
-                        "Probing 0x%08lx at 0x%08lx\n", pt[i].size, pt[i].addr);
-                sbc8240_map[i].map_priv_1 =
-                        (unsigned long) ioremap (pt[i].addr, pt[i].size);
-                if (!sbc8240_map[i].map_priv_1) {
-                        printk (MSG_PREFIX "failed to ioremap\n");
-                        for (j = 0; j < i; j++) {
-                                iounmap((void *) sbc8240_map[j].map_priv_1);
-                                sbc8240_map[j].map_priv_1 = 0;
-                        }
-                        return -EIO;
-                }
-                simple_map_init(&sbc8240_mtd[i]);
-                sbc8240_mtd[i] = do_map_probe("jedec_probe", &sbc8240_map[i]);
-                if (sbc8240_mtd[i]) {
-                        sbc8240_mtd[i]->module = THIS_MODULE;
-                        devicesfound++;
-                } else {
-                        if (sbc8240_map[i].map_priv_1) {
-                                iounmap((void *) sbc8240_map[i].map_priv_1);
-                                sbc8240_map[i].map_priv_1 = 0;
-                        }
-                }
-        }
-        if (!devicesfound) {
-                printk(KERN_NOTICE MSG_PREFIX
-                       "No suppported flash chips found!\n");
-                return -ENXIO;
-        }
-#ifdef CONFIG_MTD_PARTITIONS
-        sbc8240_part_banks[0].mtd_part   = sbc8240_uboot_partitions;
-        sbc8240_part_banks[0].type       = "static image";
-        sbc8240_part_banks[0].nums       = ARRAY_SIZE(sbc8240_uboot_partitions);
-        sbc8240_part_banks[1].mtd_part   = sbc8240_fs_partitions;
-        sbc8240_part_banks[1].type       = "static file system";
-        sbc8240_part_banks[1].nums       = ARRAY_SIZE(sbc8240_fs_partitions);
-        for (i = 0; i < NUM_FLASH_BANKS; i++) {
-                if (!sbc8240_mtd[i]) continue;
-                if (sbc8240_part_banks[i].nums == 0) {
-                        printk (KERN_NOTICE MSG_PREFIX
-                                "No partition info available, registering whole device\n");
-                        add_mtd_device(sbc8240_mtd[i]);
-                } else {
-                        printk (KERN_NOTICE MSG_PREFIX
-                                "Using %s partition definition\n", sbc8240_part_banks[i].mtd_part->name);
-                        add_mtd_partitions (sbc8240_mtd[i],
-                                            sbc8240_part_banks[i].mtd_part,
-                                            sbc8240_part_banks[i].nums);
-                }
-        }
-#else
-        printk(KERN_NOTICE MSG_PREFIX
-               "Registering %d flash banks at once\n", devicesfound);
-        for (i = 0; i < devicesfound; i++) {
-                add_mtd_device(sbc8240_mtd[i]);
-        }
-#endif  /* CONFIG_MTD_PARTITIONS */
-        return devicesfound == 0 ? -ENXIO : 0;
-}
-static void __exit cleanup_sbc8240_mtd (void)
-{
-        int i;
-        for (i = 0; i < NUM_FLASH_BANKS; i++) {
-                if (sbc8240_mtd[i]) {
-                        del_mtd_device (sbc8240_mtd[i]);
-                        map_destroy (sbc8240_mtd[i]);
-                }
-                if (sbc8240_map[i].map_priv_1) {
-                        iounmap ((void *) sbc8240_map[i].map_priv_1);
-                        sbc8240_map[i].map_priv_1 = 0;
-                }
-        }
-}
-module_init (init_sbc8240_mtd);
-module_exit (cleanup_sbc8240_mtd);
-MODULE_LICENSE ("GPL");
-MODULE_AUTHOR ("Carolyn Smith <carolyn.smith@tektronix.com>");
-MODULE_DESCRIPTION ("MTD map driver for SBC8240 boards");
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index c3f62654b6df..7baba40c1ed2 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -144,7 +144,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
        struct mtd_blktrans_ops *tr = dev->tr;
        int ret = -ENODEV;
-        if (!try_module_get(dev->mtd->owner))
+        if (!get_mtd_device(NULL, dev->mtd->index))
                goto out;
        if (!try_module_get(tr->owner))
@@ -158,7 +158,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
        ret = 0;
        if (tr->open && (ret = tr->open(dev))) {
                dev->mtd->usecount--;
-                module_put(dev->mtd->owner);
+                put_mtd_device(dev->mtd);
        out_tr:
                module_put(tr->owner);
        }
@@ -177,7 +177,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode)
        if (!ret) {
                dev->mtd->usecount--;
-                module_put(dev->mtd->owner);
+                put_mtd_device(dev->mtd);
                module_put(tr->owner);
        }
diff --git a/drivers/mtd/mtdblock.c b/drivers/mtd/mtdblock.c
index 208c6faa0358..77db5ce24d92 100644
--- a/drivers/mtd/mtdblock.c
+++ b/drivers/mtd/mtdblock.c
@@ -29,6 +29,8 @@ static struct mtdblk_dev {
        enum { STATE_EMPTY, STATE_CLEAN, STATE_DIRTY } cache_state;
 } *mtdblks[MAX_MTD_DEVICES];
+static struct mutex mtdblks_lock;
 /*
 * Cache stuff...
 *
@@ -270,15 +272,19 @@ static int mtdblock_open(struct mtd_blktrans_dev *mbd)
        DEBUG(MTD_DEBUG_LEVEL1,"mtdblock_open\n");
+        mutex_lock(&mtdblks_lock);
        if (mtdblks[dev]) {
                mtdblks[dev]->count++;
+                mutex_unlock(&mtdblks_lock);
                return 0;
        }
        /* OK, it's not open. Create cache info for it */
        mtdblk = kzalloc(sizeof(struct mtdblk_dev), GFP_KERNEL);
-        if (!mtdblk)
+        if (!mtdblk) {
+                mutex_unlock(&mtdblks_lock);
                return -ENOMEM;
+        }
        mtdblk->count = 1;
        mtdblk->mtd = mtd;
@@ -291,6 +297,7 @@ static int mtdblock_open(struct mtd_blktrans_dev *mbd)
        }
        mtdblks[dev] = mtdblk;
+        mutex_unlock(&mtdblks_lock);
        DEBUG(MTD_DEBUG_LEVEL1, "ok\n");
@@ -304,6 +311,8 @@ static int mtdblock_release(struct mtd_blktrans_dev *mbd)
        DEBUG(MTD_DEBUG_LEVEL1, "mtdblock_release\n");
+        mutex_lock(&mtdblks_lock);
        mutex_lock(&mtdblk->cache_mutex);
        write_cached_data(mtdblk);
        mutex_unlock(&mtdblk->cache_mutex);
@@ -316,6 +325,9 @@ static int mtdblock_release(struct mtd_blktrans_dev *mbd)
                vfree(mtdblk->cache_data);
                kfree(mtdblk);
        }
+        mutex_unlock(&mtdblks_lock);
        DEBUG(MTD_DEBUG_LEVEL1, "ok\n");
        return 0;
@@ -376,6 +388,8 @@ static struct mtd_blktrans_ops mtdblock_tr = {
 static int __init init_mtdblock(void)
 {
+        mutex_init(&mtdblks_lock);
        return register_mtd_blktrans(&mtdblock_tr);
 }
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index fac54a3fa3f1..00ebf7af7467 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -65,8 +65,8 @@ static void mtd_release(struct device *dev)
 static int mtd_cls_suspend(struct device *dev, pm_message_t state)
 {
        struct mtd_info *mtd = dev_to_mtd(dev);
-        
-        if (mtd->suspend)
+        if (mtd && mtd->suspend)
                return mtd->suspend(mtd);
        else
                return 0;
@@ -76,7 +76,7 @@ static int mtd_cls_resume(struct device *dev)
 {
        struct mtd_info *mtd = dev_to_mtd(dev);
        
-        if (mtd->resume)
+        if (mtd && mtd->resume)
                mtd->resume(mtd);
        return 0;
 }
@@ -298,6 +298,7 @@ int add_mtd_device(struct mtd_info *mtd)
                        mtd->dev.class = &mtd_class;
                        mtd->dev.devt = MTD_DEVT(i);
                        dev_set_name(&mtd->dev, "mtd%d", i);
+                        dev_set_drvdata(&mtd->dev, mtd);
                        if (device_register(&mtd->dev) != 0) {
                                mtd_table[i] = NULL;
                                break;
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index 38d656b9b2ee..0108ed42e877 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -266,7 +266,7 @@ static inline int omap2_onenand_bufferram_offset(struct mtd_info *mtd, int area)
        if (ONENAND_CURRENT_BUFFERRAM(this)) {
                if (area == ONENAND_DATARAM)
-                        return mtd->writesize;
+                        return this->writesize;
                if (area == ONENAND_SPARERAM)
                        return mtd->oobsize;
        }
@@ -770,6 +770,7 @@ static int __devexit omap2_onenand_remove(struct platform_device *pdev)
        }
        iounmap(c->onenand.base);
        release_mem_region(c->phys_base, ONENAND_IO_SIZE);
+        gpmc_cs_free(c->gpmc_cs);
        kfree(c);
        return 0;
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 0f2034c3ed2f..e4d9ef0c965a 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -1254,6 +1254,7 @@ out_free:
                if (!ubi->volumes[i])
                        continue;
                kfree(ubi->volumes[i]->eba_tbl);
+                ubi->volumes[i]->eba_tbl = NULL;
        }
        return err;
 }
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index a423131b6171..b847745394b4 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -781,11 +781,22 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si,
                        return -EINVAL;
                }
+                /*
+                 * Make sure that all PEBs have the same image sequence number.
+                 * This allows us to detect situations when users flash UBI
+                 * images incorrectly, so that the flash has the new UBI image
+                 * and leftovers from the old one. This feature was added
+                 * relatively recently, and the sequence number was always
+                 * zero, because old UBI implementations always set it to zero.
+                 * For this reasons, we do not panic if some PEBs have zero
+                 * sequence number, while other PEBs have non-zero sequence
+                 * number.
+                 */
                image_seq = be32_to_cpu(ech->image_seq);
                if (!si->image_seq_set) {
                        ubi->image_seq = image_seq;
                        si->image_seq_set = 1;
-                } else if (ubi->image_seq != image_seq) {
+                } else if (ubi->image_seq && ubi->image_seq != image_seq) {
                        ubi_err("bad image sequence number %d in PEB %d, "
                                "expected %d", image_seq, pnum, ubi->image_seq);
                        ubi_dbg_dump_ec_hdr(ech);
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 3e00fa8ea65f..4a7c32895be5 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -832,7 +832,9 @@ static int corkscrew_open(struct net_device *dev)
                        skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                        vp->rx_ring[i].addr = isa_virt_to_bus(skb->data);
                }
-                vp->rx_ring[i - 1].next = isa_virt_to_bus(&vp->rx_ring[0]);     /* Wrap the ring. */
+                if (i != 0)
+                        vp->rx_ring[i - 1].next =
+                                isa_virt_to_bus(&vp->rx_ring[0]);       /* Wrap the ring. */
                outl(isa_virt_to_bus(&vp->rx_ring[0]), ioaddr + UpListPtr);
        }
        if (vp->full_bus_master_tx) {   /* Boomerang bus master Tx. */
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c34aee91250b..c20416850948 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -2721,13 +2721,15 @@ dump_tx_ring(struct net_device *dev)
                                   &vp->tx_ring[vp->dirty_tx % TX_RING_SIZE]);
                        issue_and_wait(dev, DownStall);
                        for (i = 0; i < TX_RING_SIZE; i++) {
-                                pr_err("  %d: @%p  length %8.8x status %8.8x\n", i,
+                                unsigned int length;
-                                           &vp->tx_ring[i],
 #if DO_ZEROCOPY
-                                           le32_to_cpu(vp->tx_ring[i].frag[0].length),
+                                length = le32_to_cpu(vp->tx_ring[i].frag[0].length);
 #else
-                                           le32_to_cpu(vp->tx_ring[i].length),
+                                length = le32_to_cpu(vp->tx_ring[i].length);
 #endif
+                                pr_err("  %d: @%p  length %8.8x status %8.8x\n",
+                                           i, &vp->tx_ring[i], length,
                                           le32_to_cpu(vp->tx_ring[i].status));
                        }
                        if (!stalled)
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 1686dca28748..1f016d66684a 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -1474,13 +1474,13 @@ static void eexp_hw_init586(struct net_device *dev)
        outw(0x0000, ioaddr + 0x800c);
        outw(0x0000, ioaddr + 0x800e);
-        for (i = 0; i < (sizeof(start_code)); i+=32) {
+        for (i = 0; i < ARRAY_SIZE(start_code) * 2; i+=32) {
                int j;
                outw(i, ioaddr + SM_PTR);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j)/2 < ARRAY_SIZE(start_code); j+=2)
                        outw(start_code[(i+j)/2],
                             ioaddr+0x4000+j);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j+16)/2 < ARRAY_SIZE(start_code); j+=2)
                        outw(start_code[(i+j+16)/2],
                             ioaddr+0x8000+j);
        }
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 78952f8324e2..fa311a950996 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0101"
+#define DRV_VERSION     "EHEA_0102"
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index e8d46cc1bec2..977c3d358279 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1545,6 +1545,9 @@ static int ehea_clean_portres(struct ehea_port *port, struct ehea_port_res *pr)
 {
        int ret, i;
+        if (pr->qp)
+                netif_napi_del(&pr->napi);
        ret = ehea_destroy_qp(pr->qp);
        if (!ret) {
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index dbf06e9313cc..2234118eedbb 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -366,9 +366,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                return -EINVAL;
        }
-        priv->rxic = mk_ic_value(
+        priv->rxic = mk_ic_value(cvals->rx_max_coalesced_frames,
-                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs),
+                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs));
-                cvals->rx_max_coalesced_frames);
        /* Set up tx coalescing */
        if ((cvals->tx_coalesce_usecs == 0) ||
@@ -390,9 +389,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                return -EINVAL;
        }
-        priv->txic = mk_ic_value(
+        priv->txic = mk_ic_value(cvals->tx_max_coalesced_frames,
-                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs),
+                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs));
-                cvals->tx_max_coalesced_frames);
        gfar_write(&priv->regs->rxic, 0);
        if (priv->rxcoalescing)
diff --git a/drivers/net/igbvf/vf.c b/drivers/net/igbvf/vf.c
index 2a4faf9ade69..a9a61efa964c 100644
--- a/drivers/net/igbvf/vf.c
+++ b/drivers/net/igbvf/vf.c
@@ -274,6 +274,8 @@ static s32 e1000_set_vfta_vf(struct e1000_hw *hw, u16 vid, bool set)
        err = mbx->ops.read_posted(hw, msgbuf, 2);
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
        /* if nacked the vlan was rejected */
        if (!err && (msgbuf[0] == (E1000_VF_SET_VLAN | E1000_VT_MSGTYPE_NACK)))
                err = -E1000_ERR_MAC_INIT;
@@ -317,6 +319,8 @@ static void e1000_rar_set_vf(struct e1000_hw *hw, u8 * addr, u32 index)
        if (!ret_val)
                ret_val = mbx->ops.read_posted(hw, msgbuf, 3);
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
        /* if nacked the address was rejected, use "perm_addr" */
        if (!ret_val &&
            (msgbuf[0] == (E1000_VF_SET_MAC_ADDR | E1000_VT_MSGTYPE_NACK)))
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 1b12c7ba275f..e11d83d5852b 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -96,6 +96,8 @@
 #define IXGBE_TX_FLAGS_VLAN_PRIO_MASK   0x0000e000
 #define IXGBE_TX_FLAGS_VLAN_SHIFT       16
+#define IXGBE_MAX_RSC_INT_RATE          162760
 /* wrapper around a pointer to a socket buffer,
 * so a DMA handle can be stored along with the buffer */
 struct ixgbe_tx_buffer {
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index b9923047ce11..522c03bc1dad 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -50,6 +50,51 @@ static s32 ixgbe_read_i2c_eeprom_82598(struct ixgbe_hw *hw, u8 byte_offset,
                                       u8 *eeprom_data);
 /**
+ *  ixgbe_set_pcie_completion_timeout - set pci-e completion timeout
+ *  @hw: pointer to the HW structure
+ *
+ *  The defaults for 82598 should be in the range of 50us to 50ms,
+ *  however the hardware default for these parts is 500us to 1ms which is less
+ *  than the 10ms recommended by the pci-e spec.  To address this we need to
+ *  increase the value to either 10ms to 250ms for capability version 1 config,
+ *  or 16ms to 55ms for version 2.
+ **/
+void ixgbe_set_pcie_completion_timeout(struct ixgbe_hw *hw)
+{
+        struct ixgbe_adapter *adapter = hw->back;
+        u32 gcr = IXGBE_READ_REG(hw, IXGBE_GCR);
+        u16 pcie_devctl2;
+        /* only take action if timeout value is defaulted to 0 */
+        if (gcr & IXGBE_GCR_CMPL_TMOUT_MASK)
+                goto out;
+        /*
+         * if capababilities version is type 1 we can write the
+         * timeout of 10ms to 250ms through the GCR register
+         */
+        if (!(gcr & IXGBE_GCR_CAP_VER2)) {
+                gcr |= IXGBE_GCR_CMPL_TMOUT_10ms;
+                goto out;
+        }
+        /*
+         * for version 2 capabilities we need to write the config space
+         * directly in order to set the completion timeout value for
+         * 16ms to 55ms
+         */
+        pci_read_config_word(adapter->pdev,
+                             IXGBE_PCI_DEVICE_CONTROL2, &pcie_devctl2);
+        pcie_devctl2 |= IXGBE_PCI_DEVICE_CONTROL2_16ms;
+        pci_write_config_word(adapter->pdev,
+                              IXGBE_PCI_DEVICE_CONTROL2, pcie_devctl2);
+out:
+        /* disable completion timeout resend */
+        gcr &= ~IXGBE_GCR_CMPL_TMOUT_RESEND;
+        IXGBE_WRITE_REG(hw, IXGBE_GCR, gcr);
+}
+/**
 *  ixgbe_get_pcie_msix_count_82598 - Gets MSI-X vector count
 *  @hw: pointer to hardware structure
 *
@@ -153,6 +198,26 @@ out:
 }
 /**
+ *  ixgbe_start_hw_82598 - Prepare hardware for Tx/Rx
+ *  @hw: pointer to hardware structure
+ *
+ *  Starts the hardware using the generic start_hw function.
+ *  Then set pcie completion timeout
+ **/
+s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw)
+{
+        s32 ret_val = 0;
+        ret_val = ixgbe_start_hw_generic(hw);
+        /* set the completion timeout for interface */
+        if (ret_val == 0)
+                ixgbe_set_pcie_completion_timeout(hw);
+        return ret_val;
+}
+/**
 *  ixgbe_get_link_capabilities_82598 - Determines link capabilities
 *  @hw: pointer to hardware structure
 *  @speed: pointer to link speed
@@ -1085,7 +1150,7 @@ out:
 static struct ixgbe_mac_operations mac_ops_82598 = {
        .init_hw                = &ixgbe_init_hw_generic,
        .reset_hw               = &ixgbe_reset_hw_82598,
-        .start_hw               = &ixgbe_start_hw_generic,
+        .start_hw               = &ixgbe_start_hw_82598,
        .clear_hw_cntrs         = &ixgbe_clear_hw_cntrs_generic,
        .get_media_type         = &ixgbe_get_media_type_82598,
        .get_supported_physical_layer = &ixgbe_get_supported_physical_layer_82598,
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 2a978008fd6e..79144e950a34 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1975,7 +1975,10 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 * any other value means disable eitr, which is best
                 * served by setting the interrupt rate very high
                 */
-                adapter->eitr_param = IXGBE_MAX_INT_RATE;
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
+                        adapter->eitr_param = IXGBE_MAX_RSC_INT_RATE;
+                else
+                        adapter->eitr_param = IXGBE_MAX_INT_RATE;
                adapter->itr_setting = 0;
        }
@@ -1999,13 +2002,13 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
        ethtool_op_set_flags(netdev, data);
-        if (!(adapter->flags & IXGBE_FLAG2_RSC_CAPABLE))
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
                return 0;
        /* if state changes we need to update adapter->flags and reset */
        if ((!!(data & ETH_FLAG_LRO)) != 
-            (!!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED))) {
+            (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) {
-                adapter->flags ^= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
                if (netif_running(netdev))
                        ixgbe_reinit_locked(adapter);
                else
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 200454f30f6a..110c65ab5cb5 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -780,7 +780,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                prefetch(next_rxd);
                cleaned_count++;
-                if (adapter->flags & IXGBE_FLAG2_RSC_CAPABLE)
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)
                        rsc_count = ixgbe_get_rsc_count(rx_desc);
                if (rsc_count) {
@@ -2036,7 +2036,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                        IXGBE_WRITE_REG(hw, IXGBE_PSRTYPE(0), psrtype);
                }
        } else {
-                if (!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED) &&
+                if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) &&
                    (netdev->mtu <= ETH_DATA_LEN))
                        rx_buf_len = MAXIMUM_ETHERNET_VLAN_SIZE;
                else
@@ -2165,7 +2165,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
        }
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED) {
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                /* Enable 82599 HW-RSC */
                for (i = 0; i < adapter->num_rx_queues; i++) {
                        j = adapter->rx_ring[i].reg_idx;
@@ -3812,8 +3812,8 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82598;
        } else if (hw->mac.type == ixgbe_mac_82599EB) {
                adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82599;
-                adapter->flags |= IXGBE_FLAG2_RSC_CAPABLE;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_CAPABLE;
-                adapter->flags |= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
                adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
                adapter->ring_feature[RING_F_FDIR].indices =
                                                         IXGBE_MAX_FDIR_INDICES;
@@ -5360,12 +5360,19 @@ static int ixgbe_del_sanmac_netdev(struct net_device *dev)
 static void ixgbe_netpoll(struct net_device *netdev)
 {
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        int i;
-        disable_irq(adapter->pdev->irq);
        adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
-        ixgbe_intr(adapter->pdev->irq, netdev);
+        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
+                int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+                for (i = 0; i < num_q_vectors; i++) {
+                        struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+                        ixgbe_msix_clean_many(0, q_vector);
+                }
+        } else {
+                ixgbe_intr(adapter->pdev->irq, netdev);
+        }
        adapter->flags &= ~IXGBE_FLAG_IN_NETPOLL;
-        enable_irq(adapter->pdev->irq);
 }
 #endif
@@ -5611,7 +5618,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
        if (pci_using_dac)
                netdev->features |= NETIF_F_HIGHDMA;
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED)
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
                netdev->features |= NETIF_F_LRO;
        /* make sure the EEPROM is good */
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index fa87309dc087..be90eb4575f6 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -718,6 +718,12 @@
 #define IXGBE_ECC_STATUS_82599  0x110E0
 #define IXGBE_BAR_CTRL_82599    0x110F4
+/* PCI Express Control */
+#define IXGBE_GCR_CMPL_TMOUT_MASK       0x0000F000
+#define IXGBE_GCR_CMPL_TMOUT_10ms       0x00001000
+#define IXGBE_GCR_CMPL_TMOUT_RESEND     0x00010000
+#define IXGBE_GCR_CAP_VER2              0x00040000
 /* Time Sync Registers */
 #define IXGBE_TSYNCRXCTL 0x05188 /* Rx Time Sync Control register - RW */
 #define IXGBE_TSYNCTXCTL 0x08C00 /* Tx Time Sync Control register - RW */
@@ -1521,6 +1527,7 @@
 /* PCI Bus Info */
 #define IXGBE_PCI_LINK_STATUS     0xB2
+#define IXGBE_PCI_DEVICE_CONTROL2 0xC8
 #define IXGBE_PCI_LINK_WIDTH      0x3F0
 #define IXGBE_PCI_LINK_WIDTH_1    0x10
 #define IXGBE_PCI_LINK_WIDTH_2    0x20
@@ -1531,6 +1538,7 @@
 #define IXGBE_PCI_LINK_SPEED_5000 0x2
 #define IXGBE_PCI_HEADER_TYPE_REGISTER  0x0E
 #define IXGBE_PCI_HEADER_TYPE_MULTIFUNC 0x80
+#define IXGBE_PCI_DEVICE_CONTROL2_16ms  0x0005
 /* Number of 100 microseconds we wait for PCI Express master disable */
 #define IXGBE_PCI_MASTER_DISABLE_TIMEOUT 800
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 08c43f2ae72b..5a88b3f57693 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -249,6 +249,7 @@ static u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv,
                                pci_unmap_page(mdev->pdev,
                                        (dma_addr_t) be64_to_cpu(data->addr),
                                         frag->size, PCI_DMA_TODEVICE);
+                                ++data;
                        }
                }
                /* Stamp the freed descriptor */
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 637ac8b89bac..3cd8cfcf627b 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -221,7 +221,7 @@ netxen_napi_disable(struct netxen_adapter *adapter)
        }
 }
-static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
+static int nx_set_dma_mask(struct netxen_adapter *adapter)
 {
        struct pci_dev *pdev = adapter->pdev;
        uint64_t mask, cmask;
@@ -229,19 +229,17 @@ static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
        adapter->pci_using_dac = 0;
        mask = DMA_BIT_MASK(32);
-        /*
-         * Consistent DMA mask is set to 32 bit because it cannot be set to
-         * 35 bits. For P3 also leave it at 32 bits for now. Only the rings
-         * come off this pool.
-         */
        cmask = DMA_BIT_MASK(32);
+        if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
 #ifndef CONFIG_IA64
-        if (revision_id >= NX_P3_B0)
-                mask = DMA_BIT_MASK(39);
-        else if (revision_id == NX_P2_C1)
                mask = DMA_BIT_MASK(35);
 #endif
+        } else {
+                mask = DMA_BIT_MASK(39);
+                cmask = mask;
+        }
        if (pci_set_dma_mask(pdev, mask) == 0 &&
                pci_set_consistent_dma_mask(pdev, cmask) == 0) {
                adapter->pci_using_dac = 1;
@@ -256,7 +254,7 @@ static int
 nx_update_dma_mask(struct netxen_adapter *adapter)
 {
        int change, shift, err;
-        uint64_t mask, old_mask;
+        uint64_t mask, old_mask, old_cmask;
        struct pci_dev *pdev = adapter->pdev;
        change = 0;
@@ -272,14 +270,29 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
        if (change) {
                old_mask = pdev->dma_mask;
+                old_cmask = pdev->dev.coherent_dma_mask;
                mask = (1ULL<<(32+shift)) - 1;
                err = pci_set_dma_mask(pdev, mask);
                if (err)
-                        return pci_set_dma_mask(pdev, old_mask);
+                        goto err_out;
+                if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+                        err = pci_set_consistent_dma_mask(pdev, mask);
+                        if (err)
+                                goto err_out;
+                }
+                dev_info(&pdev->dev, "using %d-bit dma mask\n", 32+shift);
        }
        return 0;
+err_out:
+        pci_set_dma_mask(pdev, old_mask);
+        pci_set_consistent_dma_mask(pdev, old_cmask);
+        return err;
 }
 static void netxen_check_options(struct netxen_adapter *adapter)
@@ -1006,7 +1019,7 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        revision_id = pdev->revision;
        adapter->ahw.revision_id = revision_id;
-        err = nx_set_dma_mask(adapter, revision_id);
+        err = nx_set_dma_mask(adapter);
        if (err)
                goto err_out_free_netdev;
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 28368157dac4..a646a445fda9 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1611,8 +1611,11 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                if (pcnet32_dwio_read_csr(ioaddr, 0) == 4
                    && pcnet32_dwio_check(ioaddr)) {
                        a = &pcnet32_dwio;
-                } else
+                } else {
+                        if (pcnet32_debug & NETIF_MSG_PROBE)
+                                printk(KERN_ERR PFX "No access methods\n");
                        goto err_release_region;
+                }
        }
        chip_version =
@@ -1719,7 +1722,9 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                ret = -ENOMEM;
                goto err_release_region;
        }
-        SET_NETDEV_DEV(dev, &pdev->dev);
+        if (pdev)
+                SET_NETDEV_DEV(dev, &pdev->dev);
        if (pcnet32_debug & NETIF_MSG_PROBE)
                printk(KERN_INFO PFX "%s at %#3lx,", chipname, ioaddr);
@@ -1818,7 +1823,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        spin_lock_init(&lp->lock);
-        SET_NETDEV_DEV(dev, &pdev->dev);
        lp->name = chipname;
        lp->shared_irq = shared;
        lp->tx_ring_size = TX_RING_SIZE;        /* default tx ring size */
@@ -1852,12 +1856,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
            ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
                lp->options |= PCNET32_PORT_FD;
-        if (!a) {
-                if (pcnet32_debug & NETIF_MSG_PROBE)
-                        printk(KERN_ERR PFX "No access methods\n");
-                ret = -ENODEV;
-                goto err_free_consistent;
-        }
        lp->a = *a;
        /* prior to register_netdev, dev->name is not yet correct */
@@ -1973,14 +1971,13 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        return 0;
-      err_free_ring:
+err_free_ring:
        pcnet32_free_ring(dev);
-      err_free_consistent:
        pci_free_consistent(lp->pci_dev, sizeof(*lp->init_block),
                            lp->init_block, lp->init_dma_addr);
-      err_free_netdev:
+err_free_netdev:
        free_netdev(dev);
-      err_release_region:
+err_release_region:
        release_region(ioaddr, PCNET32_TOTAL_SIZE);
        return ret;
 }
@@ -2089,6 +2086,7 @@ static void pcnet32_free_ring(struct net_device *dev)
 static int pcnet32_open(struct net_device *dev)
 {
        struct pcnet32_private *lp = netdev_priv(dev);
+        struct pci_dev *pdev = lp->pci_dev;
        unsigned long ioaddr = dev->base_addr;
        u16 val;
        int i;
@@ -2149,9 +2147,9 @@ static int pcnet32_open(struct net_device *dev)
        lp->a.write_csr(ioaddr, 124, val);
        /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
-        if (lp->pci_dev->subsystem_vendor == PCI_VENDOR_ID_AT &&
+        if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
-            (lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
+            (pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
-             lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
+             pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
                if (lp->options & PCNET32_PORT_ASEL) {
                        lp->options = PCNET32_PORT_FD | PCNET32_PORT_100;
                        if (netif_msg_link(lp))
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 639d11bc444e..cd37d739ac74 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1384,7 +1384,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
        /* create a     fragment for each channel */
        bits = B;
-        while (nfree > 0 &&     len     > 0) {
+        while (len      > 0) {
                list = list->next;
                if (list ==     &ppp->channels) {
                        i =     0;
@@ -1431,29 +1431,31 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                *otherwise divide it according to the speed
                *of the channel we are going to transmit on
                */
-                if (pch->speed == 0) {
+                if (nfree > 0) {
-                        flen = totlen/nfree     ;
+                        if (pch->speed == 0) {
-                        if (nbigger > 0) {
+                                flen = totlen/nfree     ;
-                                flen++;
+                                if (nbigger > 0) {
-                                nbigger--;
+                                        flen++;
-                        }
+                                        nbigger--;
-                } else {
+                                }
-                        flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
+                        } else {
-                                ((totspeed*totfree)/pch->speed)) - hdrlen;
+                                flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
-                        if (nbigger > 0) {
+                                        ((totspeed*totfree)/pch->speed)) - hdrlen;
-                                flen += ((totfree - nzero)*pch->speed)/totspeed;
+                                if (nbigger > 0) {
-                                nbigger -= ((totfree - nzero)*pch->speed)/
+                                        flen += ((totfree - nzero)*pch->speed)/totspeed;
+                                        nbigger -= ((totfree - nzero)*pch->speed)/
                                                        totspeed;
+                                }
                        }
+                        nfree--;
                }
-                nfree--;
                /*
                 *check if we are on the last channel or
                 *we exceded the lenght of the data     to
                 *fragment
                 */
-                if ((nfree == 0) || (flen > len))
+                if ((nfree <= 0) || (flen > len))
                        flen = len;
                /*
                 *it is not worth to tx on slow channels:
@@ -1467,7 +1469,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                        continue;
                }
-                mtu     = pch->chan->mtu + 2 - hdrlen;
+                mtu     = pch->chan->mtu - hdrlen;
                if (mtu < 4)
                        mtu     = 4;
                if (flen > mtu)
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index f0031f1f97e5..5f2090233d7b 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1063,6 +1063,7 @@ static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
        else {
                int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
+                po = NULL;
                while (++hash < PPPOE_HASH_SIZE) {
                        po = pn->hash_table[hash];
                        if (po)
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e7935d09c896..e0f9219a0aea 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -2680,6 +2680,7 @@ out_unregister_pppol2tp_proto:
 static void __exit pppol2tp_exit(void)
 {
        unregister_pppox_proto(PX_PROTO_OL2TP);
+        unregister_pernet_gen_device(pppol2tp_net_id, &pppol2tp_net_ops);
        proto_unregister(&pppol2tp_sk_proto);
 }
diff --git a/drivers/net/s6gmac.c b/drivers/net/s6gmac.c
index 5345e47b35ac..4525cbe8dd69 100644
--- a/drivers/net/s6gmac.c
+++ b/drivers/net/s6gmac.c
@@ -793,7 +793,7 @@ static inline int s6gmac_phy_start(struct net_device *dev)
        struct s6gmac *pd = netdev_priv(dev);
        int i = 0;
        struct phy_device *p = NULL;
-        while ((!(p = pd->mii.bus->phy_map[i])) && (i < PHY_MAX_ADDR))
+        while ((i < PHY_MAX_ADDR) && (!(p = pd->mii.bus->phy_map[i])))
                i++;
        p = phy_connect(dev, dev_name(&p->dev), &s6gmac_adjust_link, 0,
                        PHY_INTERFACE_MODE_RGMII);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3550c5dcd93c..0a551d8f5d95 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1488,6 +1488,8 @@ static int sky2_up(struct net_device *dev)
        sky2_set_vlan_mode(hw, port, sky2->vlgrp != NULL);
 #endif
+        sky2->restarting = 0;
        err = sky2_rx_start(sky2);
        if (err)
                goto err_out;
@@ -1500,6 +1502,9 @@ static int sky2_up(struct net_device *dev)
        sky2_set_multicast(dev);
+        /* wake queue incase we are restarting */
+        netif_wake_queue(dev);
        if (netif_msg_ifup(sky2))
                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
        return 0;
@@ -1533,6 +1538,8 @@ static inline int tx_dist(unsigned tail, unsigned head)
 /* Number of list elements available for next tx */
 static inline int tx_avail(const struct sky2_port *sky2)
 {
+        if (unlikely(sky2->restarting))
+                return 0;
        return sky2->tx_pending - tx_dist(sky2->tx_cons, sky2->tx_prod);
 }
@@ -1818,6 +1825,10 @@ static int sky2_down(struct net_device *dev)
        if (netif_msg_ifdown(sky2))
                printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
+        /* explicitly shut off tx incase we're restarting */
+        sky2->restarting = 1;
+        netif_tx_disable(dev);
        /* Force flow control off */
        sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
@@ -2359,7 +2370,7 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 {
        struct sky2_port *sky2 = netdev_priv(dev);
-        if (netif_running(dev)) {
+        if (likely(netif_running(dev) && !sky2->restarting)) {
                netif_tx_lock(dev);
                sky2_tx_complete(sky2, last);
                netif_tx_unlock(dev);
@@ -4283,6 +4294,7 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
        spin_lock_init(&sky2->phy_lock);
        sky2->tx_pending = TX_DEF_PENDING;
        sky2->rx_pending = RX_DEF_PENDING;
+        sky2->restarting = 0;
        hw->dev[port] = dev;
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index b5549c9e5107..4486b066b43f 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -2051,6 +2051,7 @@ struct sky2_port {
        u8                   duplex;    /* DUPLEX_HALF, DUPLEX_FULL */
        u8                   rx_csum;
        u8                   wol;
+        u8                   restarting;
        enum flow_control    flow_mode;
        enum flow_control    flow_status;
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index eb72d2e9ab3d..acfdccd44567 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -5059,7 +5059,7 @@ mii_get_phy(struct net_device *dev)
        if ((id == 0) || (id == 65535)) continue;  /* Valid ID? */
        for (j=0; j<limit; j++) {                  /* Search PHY table */
            if (id != phy_info[j].id) continue;    /* ID match? */
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
            if (k < DE4X5_MAX_PHY) {
                memcpy((char *)&lp->phy[k],
                       (char *)&phy_info[j], sizeof(struct phy_table));
@@ -5072,7 +5072,7 @@ mii_get_phy(struct net_device *dev)
            break;
        }
        if ((j == limit) && (i < DE4X5_MAX_MII)) {
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
            lp->phy[k].addr = i;
            lp->phy[k].id = id;
            lp->phy[k].spd.reg = GENERIC_REG;      /* ANLPA register         */
@@ -5091,7 +5091,7 @@ mii_get_phy(struct net_device *dev)
  purgatory:
    lp->active = 0;
    if (lp->phy[0].id) {                           /* Reset the PHY devices */
-        for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++) { /*For each PHY*/
+        for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++) { /*For each PHY*/
            mii_wr(MII_CR_RST, MII_CR, lp->phy[k].addr, DE4X5_MII);
            while (mii_rd(MII_CR, lp->phy[k].addr, DE4X5_MII) & MII_CR_RST);
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c70604f0329e..8ce5e4cee168 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
        readSsidRid(local, &SSID_rid);
        /* Check if we asked for `any' */
-        if(dwrq->flags == 0) {
+        if (dwrq->flags == 0) {
                /* Just send an empty SSID list */
                memset(&SSID_rid, 0, sizeof(SSID_rid));
        } else {
-                int     index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+                unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
                /* Check the size of the string */
-                if(dwrq->length > IW_ESSID_MAX_SIZE) {
+                if (dwrq->length > IW_ESSID_MAX_SIZE)
                        return -E2BIG ;
-                }
                /* Check if index is valid */
-                if((index < 0) || (index >= 4)) {
+                if (index >= ARRAY_SIZE(SSID_rid.ssids))
                        return -EINVAL;
-                }
                /* Set the SSID */
                memset(SSID_rid.ssids[index].ssid, 0,
@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
                return -EINVAL;
        }
        clear_bit (FLAG_RADIO_OFF, &local->flags);
-        for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
+        for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
                if (v == cap_rid.txPowerLevels[i]) {
                        readConfigRid(local, 1);
                        local->config.txPower = v;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index a2fda702b620..ce0e86c36a82 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                integer = swab32(eep->modalHeader.antCtrlCommon);
                eep->modalHeader.antCtrlCommon = integer;
-                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
                        integer = swab32(eep->modalHeader.antCtrlChain[i]);
                        eep->modalHeader.antCtrlChain[i] = integer;
                }
@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
                        ctlMode, numCtlModes, isHt40CtlMode,
                        (pCtlMode[ctlMode] & EXT_ADDITIVE));
-                for (i = 0; (i < AR5416_NUM_CTLS) &&
+                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
                                pEepData->ctlIndex[i]; i++) {
                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
                                "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index fbb3a573463e..2de6471d4be9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -112,7 +112,7 @@ enum iwl3945_antenna {
 #define IWL_TX_FIFO_NONE        7
 /* Minimum number of queues. MAX_NUM is defined in hw specific files */
-#define IWL_MIN_NUM_QUEUES      4
+#define IWL39_MIN_NUM_QUEUES    4
 #define IEEE80211_DATA_LEN              2304
 #define IEEE80211_4ADDR_LEN             30
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 6ab07165ea28..18b135f510e5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1332,6 +1332,9 @@ int iwl_setup_mac(struct iwl_priv *priv)
        hw->wiphy->custom_regulatory = true;
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 11e08c068917..ca00cc8ad4c7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -308,18 +308,18 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                return -ENODATA;
        }
+        ptr = priv->eeprom;
+        if (!ptr) {
+                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
+                return -ENOMEM;
+        }
        /* 4 characters for byte 0xYY */
        buf = kzalloc(buf_size, GFP_KERNEL);
        if (!buf) {
                IWL_ERR(priv, "Can not allocate Buffer\n");
                return -ENOMEM;
        }
-        ptr = priv->eeprom;
-        if (!ptr) {
-                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
-                return -ENOMEM;
-        }
        pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s\n",
                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
                        ? "OTP" : "EEPROM");
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index e2d620f0b6e8..650e20af20fa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -258,8 +258,10 @@ struct iwl_channel_info {
 #define IWL_TX_FIFO_HCCA_2      6
 #define IWL_TX_FIFO_NONE        7
-/* Minimum number of queues. MAX_NUM is defined in hw specific files */
+/* Minimum number of queues. MAX_NUM is defined in hw specific files.
-#define IWL_MIN_NUM_QUEUES      4
+ * Set the minimum to accommodate the 4 standard TX queues, 1 command
+ * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
+#define IWL_MIN_NUM_QUEUES      10
 /* Power management (not Tx power) structures */
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 2addf735b193..ffd5c61a7553 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -566,6 +566,8 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
        unsigned long flags;
        spin_lock_irqsave(&priv->sta_lock, flags);
+        IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
+                      keyconf->keyidx);
        if (!test_and_clear_bit(keyconf->keyidx, &priv->ucode_key_table))
                IWL_ERR(priv, "index %d not used in uCode key table.\n",
@@ -573,6 +575,11 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
        priv->default_wep_key--;
        memset(&priv->wep_keys[keyconf->keyidx], 0, sizeof(priv->wep_keys[0]));
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
        ret = iwl_send_static_wepkey_cmd(priv, 1);
        IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
                      keyconf->keyidx, ret);
@@ -853,6 +860,11 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled. \n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
        ret =  iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
        spin_unlock_irqrestore(&priv->sta_lock, flags);
        return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 9bbeec9427f0..2e89040e63be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -720,8 +720,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                goto drop_unlock;
        }
-        spin_unlock_irqrestore(&priv->lock, flags);
        hdr_len = ieee80211_hdrlen(fc);
        /* Find (or create) index into station table for destination station */
@@ -729,7 +727,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        if (sta_id == IWL_INVALID_STATION) {
                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                               hdr->addr1);
-                goto drop;
+                goto drop_unlock;
        }
        IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -750,14 +748,17 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                        txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
                        swq_id = iwl_virtual_agg_queue_num(swq_id, txq_id);
                }
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
        }
        txq = &priv->txq[txq_id];
        q = &txq->q;
        txq->swq_id = swq_id;
-        spin_lock_irqsave(&priv->lock, flags);
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
        /* Set up driver data for this TFD */
        memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
@@ -902,7 +903,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 drop_unlock:
        spin_unlock_irqrestore(&priv->lock, flags);
-drop:
        return -1;
 }
 EXPORT_SYMBOL(iwl_tx_skb);
@@ -1171,6 +1171,8 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                IWL_ERR(priv, "Start AGG on invalid station\n");
                return -ENXIO;
        }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
                IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 956798f2c80c..523843369ca2 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3968,6 +3968,9 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
        hw->wiphy->custom_regulatory = true;
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
@@ -4018,10 +4021,10 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
        SET_IEEE80211_DEV(hw, &pdev->dev);
        if ((iwl3945_mod_params.num_of_queues > IWL39_MAX_NUM_QUEUES) ||
-             (iwl3945_mod_params.num_of_queues < IWL_MIN_NUM_QUEUES)) {
+             (iwl3945_mod_params.num_of_queues < IWL39_MIN_NUM_QUEUES)) {
                IWL_ERR(priv,
                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
+                        IWL39_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
                err = -EINVAL;
                goto out_ieee80211_free_hw;
        }
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 834a7f544e5d..e2334d123599 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -220,6 +220,7 @@ int iwm_store_rxiq_calib_result(struct iwm_priv *iwm)
        eeprom_rxiq = iwm_eeprom_access(iwm, IWM_EEPROM_CALIB_RXIQ);
        if (IS_ERR(eeprom_rxiq)) {
                IWM_ERR(iwm, "Couldn't access EEPROM RX IQ entry\n");
+                kfree(rxiq);
                return PTR_ERR(eeprom_rxiq);
        }
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index aea5ccf24ccf..bf294e41753b 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -106,10 +106,8 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
        int ret = 0;
        wdev = iwm_wdev_alloc(sizeof_bus, dev);
-        if (!wdev) {
+        if (IS_ERR(wdev))
-                dev_err(dev, "no memory for wireless device instance\n");
+                return wdev;
-                return ERR_PTR(-ENOMEM);
-        }
        iwm = wdev_to_iwm(wdev);
        iwm->bus_ops = if_ops;
diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
index 9a5408e7d94a..5c6968101f0d 100644
--- a/drivers/net/wireless/libertas/11d.c
+++ b/drivers/net/wireless/libertas/11d.c
@@ -47,7 +47,7 @@ static u8 lbs_region_2_code(u8 *region)
 {
        u8 i;
-        for (i = 0; region[i] && i < COUNTRY_CODE_LEN; i++)
+        for (i = 0; i < COUNTRY_CODE_LEN && region[i]; i++)
                region[i] = toupper(region[i]);
        for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index b9b374119033..d6997371c27e 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,6 +1,7 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -43,21 +44,21 @@ static int get_common_rates(struct lbs_private *priv,
        u16 *rates_size)
 {
        u8 *card_rates = lbs_bg_rates;
-        size_t num_card_rates = sizeof(lbs_bg_rates);
        int ret = 0, i, j;
-        u8 tmp[30];
+        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
        size_t tmp_size = 0;
        /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
+        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
-                for (j = 0; rates[j] && (j < *rates_size); j++) {
+                for (j = 0; j < *rates_size && rates[j]; j++) {
                        if (rates[j] == card_rates[i])
                                tmp[tmp_size++] = card_rates[i];
                }
        }
        lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+                        ARRAY_SIZE(lbs_bg_rates));
        lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
        lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
@@ -69,10 +70,7 @@ static int get_common_rates(struct lbs_private *priv,
                lbs_pr_alert("Previously set fixed data rate %#x isn't "
                       "compatible with the network.\n", priv->cur_rate);
                ret = -1;
-                goto done;
        }
-        ret = 0;
 done:
        memset(rates, 0, *rates_size);
        *rates_size = min_t(int, tmp_size, *rates_size);
@@ -322,7 +320,7 @@ static int lbs_associate(struct lbs_private *priv,
        rates = (struct mrvl_ie_rates_param_set *) pos;
        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
        memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = MAX_RATES;
+        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
        if (get_common_rates(priv, rates->rates, &tmplen)) {
                ret = -1;
                goto done;
@@ -598,7 +596,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
        /* Copy Data rates from the rates recorded in scan response */
        memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
        memcpy(cmd.bss.rates, bss->rates, ratesize);
        if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 601b54249677..6c95af3023cc 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -5,6 +5,7 @@
  *  for sending scan commands to the firmware.
  */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
        iwe.u.bitrate.disabled = 0;
        iwe.u.bitrate.value = 0;
-        for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+        for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
                /* Bit rate given in 500 kb/s units */
                iwe.u.bitrate.value = bss->rates[j] * 500000;
                current_val = iwe_stream_add_value(info, start, current_val,
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 40b07b988224..3bd3c779fff3 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -698,7 +698,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                        && !mac->pass_ctrl)
                return 0;
-        fc = *(__le16 *)buffer;
+        fc = get_unaligned((__le16*)buffer);
        need_padding = ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc);
        skb = dev_alloc_skb(length + (need_padding ? 2 : 0));
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index 0f0e0b919ef4..a45b0c0d574e 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -70,7 +70,6 @@
 #undef CCIO_COLLECT_STATS
 #endif
-#include <linux/proc_fs.h>
 #include <asm/runway.h>         /* for proc_runway_root */
 #ifdef DEBUG_CCIO_INIT
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index c590974e9815..d69bde6a2343 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -614,7 +614,7 @@ dino_fixup_bus(struct pci_bus *bus)
                            dev_name(&bus->self->dev), i,
                            bus->self->resource[i].start,
                            bus->self->resource[i].end);
-                        pci_assign_resource(bus->self, i);
+                        WARN_ON(pci_assign_resource(bus->self, i));
                        DBG("DEBUG %s after assign %d [0x%lx,0x%lx]\n",
                            dev_name(&bus->self->dev), i,
                            bus->self->resource[i].start,
diff --git a/drivers/parisc/eisa_eeprom.c b/drivers/parisc/eisa_eeprom.c
index 685d94e69d44..8c0b26e9b98a 100644
--- a/drivers/parisc/eisa_eeprom.c
+++ b/drivers/parisc/eisa_eeprom.c
@@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct file * file,
        ssize_t ret;
        int i;
        
-        if (*ppos >= HPEE_MAX_LENGTH)
+        if (*ppos < 0 || *ppos >= HPEE_MAX_LENGTH)
                return 0;
        
        count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos;
diff --git a/drivers/parisc/hppb.c b/drivers/parisc/hppb.c
index 13856415b432..815db175d427 100644
--- a/drivers/parisc/hppb.c
+++ b/drivers/parisc/hppb.c
@@ -62,7 +62,8 @@ static int hppb_probe(struct parisc_device *dev)
                }
                card = card->next;
        }
-        printk(KERN_INFO "Found GeckoBoa at 0x%x\n", dev->hpa.start);
+        printk(KERN_INFO "Found GeckoBoa at 0x%llx\n",
+                        (unsigned long long) dev->hpa.start);
        card->hpa = dev->hpa.start;
        card->mmio_region.name = "HP-PB Bus";
@@ -73,8 +74,10 @@ static int hppb_probe(struct parisc_device *dev)
        status = ccio_request_resource(dev, &card->mmio_region);
        if(status < 0) {
-                printk(KERN_ERR "%s: failed to claim HP-PB bus space (%08x, %08x)\n",
+                printk(KERN_ERR "%s: failed to claim HP-PB "
-                        __FILE__, card->mmio_region.start, card->mmio_region.end);
+                        "bus space (0x%08llx, 0x%08llx)\n",
+                        __FILE__, (unsigned long long) card->mmio_region.start,
+                        (unsigned long long) card->mmio_region.end);
        }
        return 0;
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index ede614616f8e..3aeb3279c92a 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -992,7 +992,7 @@ lba_pat_resources(struct parisc_device *pa_dev, struct lba_device *lba_dev)
                return;
        io_pdc_cell = kzalloc(sizeof(pdc_pat_cell_mod_maddr_block_t), GFP_KERNEL);
-        if (!pa_pdc_cell) {
+        if (!io_pdc_cell) {
                kfree(pa_pdc_cell);
                return;
        }
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index f9f9a5f1bbd0..13a64bc081b6 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -370,7 +370,7 @@ pdcspath_layer_read(struct pdcspath_entry *entry, char *buf)
        if (!i) /* entry is not ready */
                return -ENODATA;
        
-        for (i = 0; devpath->layers[i] && (likely(i < 6)); i++)
+        for (i = 0; i < 6 && devpath->layers[i]; i++)
                out += sprintf(out, "%u ", devpath->layers[i]);
        out += sprintf(out, "\n");
diff --git a/drivers/pci/hotplug/sgi_hotplug.c b/drivers/pci/hotplug/sgi_hotplug.c
index a4494d78e7c2..8aebe1e9d3d6 100644
--- a/drivers/pci/hotplug/sgi_hotplug.c
+++ b/drivers/pci/hotplug/sgi_hotplug.c
@@ -90,11 +90,10 @@ static struct hotplug_slot_ops sn_hotplug_slot_ops = {
 static DEFINE_MUTEX(sn_hotplug_mutex);
-static ssize_t path_show (struct hotplug_slot *bss_hotplug_slot,
+static ssize_t path_show(struct pci_slot *pci_slot, char *buf)
-                          char *buf)
 {
        int retval = -ENOENT;
-        struct slot *slot = bss_hotplug_slot->private;
+        struct slot *slot = pci_slot->hotplug->private;
        if (!slot)
                return retval;
@@ -103,7 +102,7 @@ static ssize_t path_show (struct hotplug_slot *bss_hotplug_slot,
        return retval;
 }
-static struct hotplug_slot_attribute sn_slot_path_attr = __ATTR_RO(path);
+static struct pci_slot_attribute sn_slot_path_attr = __ATTR_RO(path);
 static int sn_pci_slot_valid(struct pci_bus *pci_bus, int device)
 {
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index ebc9b8dca881..2314ad7ee5fe 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -1505,7 +1505,6 @@ static int domain_context_mapping_one(struct dmar_domain *domain, int segment,
                        }
                        set_bit(num, iommu->domain_ids);
-                        set_bit(iommu->seq_id, &domain->iommu_bmp);
                        iommu->domains[num] = domain;
                        id = num;
                }
@@ -1648,6 +1647,14 @@ static int domain_context_mapped(struct pci_dev *pdev)
                                             tmp->devfn);
 }
+/* Returns a number of VTD pages, but aligned to MM page size */
+static inline unsigned long aligned_nrpages(unsigned long host_addr,
+                                            size_t size)
+{
+        host_addr &= ~PAGE_MASK;
+        return PAGE_ALIGN(host_addr + size) >> VTD_PAGE_SHIFT;
+}
 static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                            struct scatterlist *sg, unsigned long phys_pfn,
                            unsigned long nr_pages, int prot)
@@ -1675,7 +1682,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                uint64_t tmp;
                if (!sg_res) {
-                        sg_res = (sg->offset + sg->length + VTD_PAGE_SIZE - 1) >> VTD_PAGE_SHIFT;
+                        sg_res = aligned_nrpages(sg->offset, sg->length);
                        sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
                        sg->dma_length = sg->length;
                        pteval = page_to_phys(sg_page(sg)) | prot;
@@ -2415,14 +2422,6 @@ error:
        return ret;
 }
-/* Returns a number of VTD pages, but aligned to MM page size */
-static inline unsigned long aligned_nrpages(unsigned long host_addr,
-                                            size_t size)
-{
-        host_addr &= ~PAGE_MASK;
-        return PAGE_ALIGN(host_addr + size) >> VTD_PAGE_SHIFT;
-}
 /* This takes a number of _MM_ pages, not VTD pages */
 static struct iova *intel_alloc_iova(struct device *dev,
                                     struct dmar_domain *domain,
@@ -2551,6 +2550,7 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
        int prot = 0;
        int ret;
        struct intel_iommu *iommu;
+        unsigned long paddr_pfn = paddr >> PAGE_SHIFT;
        BUG_ON(dir == DMA_NONE);
@@ -2585,7 +2585,7 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
         * is not a big problem
         */
        ret = domain_pfn_mapping(domain, mm_to_dma_pfn(iova->pfn_lo),
-                                 paddr >> VTD_PAGE_SHIFT, size, prot);
+                                 mm_to_dma_pfn(paddr_pfn), size, prot);
        if (ret)
                goto error;
@@ -2875,7 +2875,7 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
        start_vpfn = mm_to_dma_pfn(iova->pfn_lo);
-        ret = domain_sg_mapping(domain, start_vpfn, sglist, mm_to_dma_pfn(size), prot);
+        ret = domain_sg_mapping(domain, start_vpfn, sglist, size, prot);
        if (unlikely(ret)) {
                /*  clear the page */
                dma_pte_clear_range(domain, start_vpfn,
@@ -3408,6 +3408,7 @@ static int md_domain_init(struct dmar_domain *domain, int guest_width)
        domain->iommu_count = 0;
        domain->iommu_coherency = 0;
+        domain->iommu_snooping = 0;
        domain->max_addr = 0;
        /* always allocate the top pgd */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 8030e25152fb..c75d6f35cb5f 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -553,40 +553,35 @@ static void _zfcp_erp_unit_reopen_all(struct zfcp_port *port, int clear,
                _zfcp_erp_unit_reopen(unit, clear, id, ref);
 }
-static void zfcp_erp_strategy_followup_actions(struct zfcp_erp_action *act)
+static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
 {
-        struct zfcp_adapter *adapter = act->adapter;
-        struct zfcp_port *port = act->port;
-        struct zfcp_unit *unit = act->unit;
-        u32 status = act->status;
-        /* initiate follow-up actions depending on success of finished action */
        switch (act->action) {
        case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_adapter_reopen(act->adapter, 0, "ersff_1", NULL);
-                        _zfcp_erp_port_reopen_all(adapter, 0, "ersfa_1", NULL);
-                else
-                        _zfcp_erp_adapter_reopen(adapter, 0, "ersfa_2", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_port_forced_reopen(act->port, 0, "ersff_2", NULL);
-                        _zfcp_erp_port_reopen(port, 0, "ersfa_3", NULL);
-                else
-                        _zfcp_erp_adapter_reopen(adapter, 0, "ersfa_4", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_PORT:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_port_reopen(act->port, 0, "ersff_3", NULL);
-                        _zfcp_erp_unit_reopen_all(port, 0, "ersfa_5", NULL);
-                else
-                        _zfcp_erp_port_forced_reopen(port, 0, "ersfa_6", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_UNIT:
-                if (status != ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_unit_reopen(act->unit, 0, "ersff_4", NULL);
-                        _zfcp_erp_port_reopen(unit->port, 0, "ersfa_7", NULL);
+                break;
+        }
+}
+static void zfcp_erp_strategy_followup_success(struct zfcp_erp_action *act)
+{
+        switch (act->action) {
+        case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
+                _zfcp_erp_port_reopen_all(act->adapter, 0, "ersfs_1", NULL);
+                break;
+        case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
+                _zfcp_erp_port_reopen(act->port, 0, "ersfs_2", NULL);
+                break;
+        case ZFCP_ERP_ACTION_REOPEN_PORT:
+                _zfcp_erp_unit_reopen_all(act->port, 0, "ersfs_3", NULL);
                break;
        }
 }
@@ -801,7 +796,7 @@ static int zfcp_erp_port_forced_strategy(struct zfcp_erp_action *erp_action)
                        return ZFCP_ERP_FAILED;
        case ZFCP_ERP_STEP_PHYS_PORT_CLOSING:
-                if (status & ZFCP_STATUS_PORT_PHYS_OPEN)
+                if (!(status & ZFCP_STATUS_PORT_PHYS_OPEN))
                        return ZFCP_ERP_SUCCEEDED;
        }
        return ZFCP_ERP_FAILED;
@@ -853,11 +848,17 @@ void zfcp_erp_port_strategy_open_lookup(struct work_struct *work)
                                              gid_pn_work);
        retval = zfcp_fc_ns_gid_pn(&port->erp_action);
-        if (retval == -ENOMEM)
+        if (!retval) {
-                zfcp_erp_notify(&port->erp_action, ZFCP_ERP_NOMEM);
+                port->erp_action.step = ZFCP_ERP_STEP_NAMESERVER_LOOKUP;
-        port->erp_action.step = ZFCP_ERP_STEP_NAMESERVER_LOOKUP;
+                goto out;
-        if (retval)
+        }
-                zfcp_erp_notify(&port->erp_action, ZFCP_ERP_FAILED);
+        if (retval == -ENOMEM) {
+                zfcp_erp_notify(&port->erp_action, ZFCP_STATUS_ERP_LOWMEM);
+                goto out;
+        }
+        /* all other error condtions */
+        zfcp_erp_notify(&port->erp_action, 0);
+out:
        zfcp_port_put(port);
 }
@@ -1289,7 +1290,10 @@ static int zfcp_erp_strategy(struct zfcp_erp_action *erp_action)
        retval = zfcp_erp_strategy_statechange(erp_action, retval);
        if (retval == ZFCP_ERP_EXIT)
                goto unlock;
-        zfcp_erp_strategy_followup_actions(erp_action);
+        if (retval == ZFCP_ERP_SUCCEEDED)
+                zfcp_erp_strategy_followup_success(erp_action);
+        if (retval == ZFCP_ERP_FAILED)
+                zfcp_erp_strategy_followup_failed(erp_action);
 unlock:
        write_unlock(&adapter->erp_lock);
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index 2f0705d76b72..47daebfa7e59 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -79,11 +79,9 @@ static int zfcp_wka_port_get(struct zfcp_wka_port *wka_port)
        mutex_unlock(&wka_port->mutex);
-        wait_event_timeout(
+        wait_event(wka_port->completion_wq,
-                wka_port->completion_wq,
+                   wka_port->status == ZFCP_WKA_PORT_ONLINE ||
-                wka_port->status == ZFCP_WKA_PORT_ONLINE ||
+                   wka_port->status == ZFCP_WKA_PORT_OFFLINE);
-                wka_port->status == ZFCP_WKA_PORT_OFFLINE,
-                HZ >> 1);
        if (wka_port->status == ZFCP_WKA_PORT_ONLINE) {
                atomic_inc(&wka_port->refcount);
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index c57658f3d34f..47795fbf081f 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -670,8 +670,11 @@ static int zfcp_fsf_req_sbal_get(struct zfcp_adapter *adapter)
                               zfcp_fsf_sbal_check(adapter), 5 * HZ);
        if (ret > 0)
                return 0;
-        if (!ret)
+        if (!ret) {
                atomic_inc(&adapter->qdio_outb_full);
+                /* assume hanging outbound queue, try queue recovery */
+                zfcp_erp_adapter_reopen(adapter, 0, "fsrsg_1", NULL);
+        }
        spin_lock_bh(&adapter->req_q_lock);
        return -EIO;
@@ -722,7 +725,7 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_adapter *adapter,
                req = zfcp_fsf_alloc_qtcb(pool);
        if (unlikely(!req))
-                return ERR_PTR(-EIO);
+                return ERR_PTR(-ENOMEM);
        if (adapter->req_no == 0)
                adapter->req_no++;
@@ -1010,6 +1013,23 @@ skip_fsfstatus:
                send_ct->handler(send_ct->handler_data);
 }
+static void zfcp_fsf_setup_ct_els_unchained(struct qdio_buffer_element *sbale,
+                                            struct scatterlist *sg_req,
+                                            struct scatterlist *sg_resp)
+{
+        sbale[0].flags |= SBAL_FLAGS0_TYPE_WRITE_READ;
+        sbale[2].addr   = sg_virt(sg_req);
+        sbale[2].length = sg_req->length;
+        sbale[3].addr   = sg_virt(sg_resp);
+        sbale[3].length = sg_resp->length;
+        sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
+}
+static int zfcp_fsf_one_sbal(struct scatterlist *sg)
+{
+        return sg_is_last(sg) && sg->length <= PAGE_SIZE;
+}
 static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
                                       struct scatterlist *sg_req,
                                       struct scatterlist *sg_resp,
@@ -1020,30 +1040,30 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
        int bytes;
        if (!(feat & FSF_FEATURE_ELS_CT_CHAINED_SBALS)) {
-                if (sg_req->length > PAGE_SIZE || sg_resp->length > PAGE_SIZE ||
+                if (!zfcp_fsf_one_sbal(sg_req) || !zfcp_fsf_one_sbal(sg_resp))
-                    !sg_is_last(sg_req) || !sg_is_last(sg_resp))
                        return -EOPNOTSUPP;
-                sbale[0].flags |= SBAL_FLAGS0_TYPE_WRITE_READ;
+                zfcp_fsf_setup_ct_els_unchained(sbale, sg_req, sg_resp);
-                sbale[2].addr   = sg_virt(sg_req);
+                return 0;
-                sbale[2].length = sg_req->length;
+        }
-                sbale[3].addr   = sg_virt(sg_resp);
-                sbale[3].length = sg_resp->length;
+        /* use single, unchained SBAL if it can hold the request */
-                sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
+        if (zfcp_fsf_one_sbal(sg_req) && zfcp_fsf_one_sbal(sg_resp)) {
+                zfcp_fsf_setup_ct_els_unchained(sbale, sg_req, sg_resp);
                return 0;
        }
        bytes = zfcp_qdio_sbals_from_sg(req, SBAL_FLAGS0_TYPE_WRITE_READ,
                                        sg_req, max_sbals);
        if (bytes <= 0)
-                return -ENOMEM;
+                return -EIO;
        req->qtcb->bottom.support.req_buf_length = bytes;
        req->sbale_curr = ZFCP_LAST_SBALE_PER_SBAL;
        bytes = zfcp_qdio_sbals_from_sg(req, SBAL_FLAGS0_TYPE_WRITE_READ,
                                        sg_resp, max_sbals);
        if (bytes <= 0)
-                return -ENOMEM;
+                return -EIO;
        req->qtcb->bottom.support.resp_buf_length = bytes;
        return 0;
@@ -1607,10 +1627,10 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
        case FSF_ACCESS_DENIED:
                wka_port->status = ZFCP_WKA_PORT_OFFLINE;
                break;
-        case FSF_PORT_ALREADY_OPEN:
-                break;
        case FSF_GOOD:
                wka_port->handle = header->port_handle;
+                /* fall through */
+        case FSF_PORT_ALREADY_OPEN:
                wka_port->status = ZFCP_WKA_PORT_ONLINE;
        }
 out:
@@ -1731,15 +1751,16 @@ static void zfcp_fsf_close_physical_port_handler(struct zfcp_fsf_req *req)
                zfcp_fsf_access_denied_port(req, port);
                break;
        case FSF_PORT_BOXED:
-                zfcp_erp_port_boxed(port, "fscpph2", req);
-                req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-                               ZFCP_STATUS_FSFREQ_RETRY;
                /* can't use generic zfcp_erp_modify_port_status because
                 * ZFCP_STATUS_COMMON_OPEN must not be reset for the port */
                atomic_clear_mask(ZFCP_STATUS_PORT_PHYS_OPEN, &port->status);
                list_for_each_entry(unit, &port->unit_list_head, list)
                        atomic_clear_mask(ZFCP_STATUS_COMMON_OPEN,
                                          &unit->status);
+                zfcp_erp_port_boxed(port, "fscpph2", req);
+                req->status |= ZFCP_STATUS_FSFREQ_ERROR |
+                               ZFCP_STATUS_FSFREQ_RETRY;
                break;
        case FSF_ADAPTER_STATUS_AVAILABLE:
                switch (header->fsf_status_qual.word[0]) {
@@ -2541,7 +2562,6 @@ struct zfcp_fsf_req *zfcp_fsf_control_file(struct zfcp_adapter *adapter,
        bytes = zfcp_qdio_sbals_from_sg(req, direction, fsf_cfdc->sg,
                                        FSF_MAX_SBALS_PER_REQ);
        if (bytes != ZFCP_CFDC_MAX_SIZE) {
-                retval = -ENOMEM;
                zfcp_fsf_req_free(req);
                goto out;
        }
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 967ede73f4c5..6925a1784682 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -167,20 +167,21 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
        struct zfcp_unit *unit = scpnt->device->hostdata;
        struct zfcp_fsf_req *old_req, *abrt_req;
        unsigned long flags;
-        unsigned long old_req_id = (unsigned long) scpnt->host_scribble;
+        unsigned long old_reqid = (unsigned long) scpnt->host_scribble;
        int retval = SUCCESS;
        int retry = 3;
+        char *dbf_tag;
        /* avoid race condition between late normal completion and abort */
        write_lock_irqsave(&adapter->abort_lock, flags);
        spin_lock(&adapter->req_list_lock);
-        old_req = zfcp_reqlist_find(adapter, old_req_id);
+        old_req = zfcp_reqlist_find(adapter, old_reqid);
        spin_unlock(&adapter->req_list_lock);
        if (!old_req) {
                write_unlock_irqrestore(&adapter->abort_lock, flags);
                zfcp_scsi_dbf_event_abort("lte1", adapter, scpnt, NULL,
-                                          old_req_id);
+                                          old_reqid);
                return FAILED; /* completion could be in progress */
        }
        old_req->data = NULL;
@@ -189,7 +190,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
        write_unlock_irqrestore(&adapter->abort_lock, flags);
        while (retry--) {
-                abrt_req = zfcp_fsf_abort_fcp_command(old_req_id, unit);
+                abrt_req = zfcp_fsf_abort_fcp_command(old_reqid, unit);
                if (abrt_req)
                        break;
@@ -197,7 +198,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                if (!(atomic_read(&adapter->status) &
                      ZFCP_STATUS_COMMON_RUNNING)) {
                        zfcp_scsi_dbf_event_abort("nres", adapter, scpnt, NULL,
-                                                  old_req_id);
+                                                  old_reqid);
                        return SUCCESS;
                }
        }
@@ -208,13 +209,14 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                   abrt_req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
        if (abrt_req->status & ZFCP_STATUS_FSFREQ_ABORTSUCCEEDED)
-                zfcp_scsi_dbf_event_abort("okay", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "okay";
        else if (abrt_req->status & ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED)
-                zfcp_scsi_dbf_event_abort("lte2", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "lte2";
        else {
-                zfcp_scsi_dbf_event_abort("fail", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "fail";
                retval = FAILED;
        }
+        zfcp_scsi_dbf_event_abort(dbf_tag, adapter, scpnt, abrt_req, old_reqid);
        zfcp_fsf_req_free(abrt_req);
        return retval;
 }
@@ -534,6 +536,9 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port)
        struct fc_rport_identifiers ids;
        struct fc_rport *rport;
+        if (port->rport)
+                return;
        ids.node_name = port->wwnn;
        ids.port_name = port->wwpn;
        ids.port_id = port->d_id;
@@ -557,8 +562,10 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port)
 {
        struct fc_rport *rport = port->rport;
-        if (rport)
+        if (rport) {
                fc_remote_port_delete(rport);
+                port->rport = NULL;
+        }
 }
 void zfcp_scsi_schedule_rport_register(struct zfcp_port *port)
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index 3e51e64d1108..0fe5cce818cb 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -494,9 +494,14 @@ static ssize_t zfcp_sysfs_adapter_q_full_show(struct device *dev,
        struct Scsi_Host *scsi_host = class_to_shost(dev);
        struct zfcp_adapter *adapter =
                (struct zfcp_adapter *) scsi_host->hostdata[0];
+        u64 util;
+        spin_lock_bh(&adapter->qdio_stat_lock);
+        util = adapter->req_q_util;
+        spin_unlock_bh(&adapter->qdio_stat_lock);
        return sprintf(buf, "%d %llu\n", atomic_read(&adapter->qdio_outb_full),
-                       (unsigned long long)adapter->req_q_util);
+                       (unsigned long long)util);
 }
 static DEVICE_ATTR(queue_full, S_IRUGO, zfcp_sysfs_adapter_q_full_show, NULL);
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 2bc22be5f849..145ab9ba55ea 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -415,9 +415,9 @@ static void fc_exch_timeout(struct work_struct *work)
        e_stat = ep->esb_stat;
        if (e_stat & ESB_ST_COMPLETE) {
                ep->esb_stat = e_stat & ~ESB_ST_REC_QUAL;
+                spin_unlock_bh(&ep->ex_lock);
                if (e_stat & ESB_ST_REC_QUAL)
                        fc_exch_rrq(ep);
-                spin_unlock_bh(&ep->ex_lock);
                goto done;
        } else {
                resp = ep->resp;
@@ -1624,14 +1624,14 @@ static void fc_exch_rrq(struct fc_exch *ep)
        struct fc_lport *lp;
        struct fc_els_rrq *rrq;
        struct fc_frame *fp;
-        struct fc_seq *rrq_sp;
        u32 did;
        lp = ep->lp;
        fp = fc_frame_alloc(lp, sizeof(*rrq));
        if (!fp)
-                return;
+                goto retry;
        rrq = fc_frame_payload_get(fp, sizeof(*rrq));
        memset(rrq, 0, sizeof(*rrq));
        rrq->rrq_cmd = ELS_RRQ;
@@ -1647,13 +1647,20 @@ static void fc_exch_rrq(struct fc_exch *ep)
                       fc_host_port_id(lp->host), FC_TYPE_ELS,
                       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
-        rrq_sp = fc_exch_seq_send(lp, fp, fc_exch_rrq_resp, NULL, ep,
+        if (fc_exch_seq_send(lp, fp, fc_exch_rrq_resp, NULL, ep, lp->e_d_tov))
-                                  lp->e_d_tov);
+                return;
-        if (!rrq_sp) {
-                ep->esb_stat |= ESB_ST_REC_QUAL;
+retry:
-                fc_exch_timer_set_locked(ep, ep->r_a_tov);
+        spin_lock_bh(&ep->ex_lock);
+        if (ep->state & (FC_EX_RST_CLEANUP | FC_EX_DONE)) {
+                spin_unlock_bh(&ep->ex_lock);
+                /* drop hold for rec qual */
+                fc_exch_release(ep);
                return;
        }
+        ep->esb_stat |= ESB_ST_REC_QUAL;
+        fc_exch_timer_set_locked(ep, ep->r_a_tov);
+        spin_unlock_bh(&ep->ex_lock);
 }
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 716cc344c5df..a751f6230c22 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1974,10 +1974,10 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
                 * good and have never sent us a successful tmf response
                 * then sent more data for the cmd.
                 */
-                spin_lock(&session->lock);
+                spin_lock_bh(&session->lock);
                fail_scsi_task(task, DID_ABORT);
                conn->tmf_state = TMF_INITIAL;
-                spin_unlock(&session->lock);
+                spin_unlock_bh(&session->lock);
                iscsi_start_tx(conn);
                goto success_unlocked;
        case TMF_TIMEDOUT:
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 54fa1e42dc4d..b3381959acce 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -766,6 +766,7 @@ static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
                if (!memcmp(phy->attached_sas_addr, ephy->attached_sas_addr,
                            SAS_ADDR_SIZE) && ephy->port) {
                        sas_port_add_phy(ephy->port, phy->phy);
+                        phy->port = ephy->port;
                        phy->phy_state = PHY_DEVICE_DISCOVERED;
                        return 0;
                }
@@ -945,11 +946,21 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
                        if (ex->ex_phy[i].phy_state == PHY_VACANT ||
                            ex->ex_phy[i].phy_state == PHY_NOT_PRESENT)
                                continue;
+                        /*
+                         * Due to races, the phy might not get added to the
+                         * wide port, so we add the phy to the wide port here.
+                         */
                        if (SAS_ADDR(ex->ex_phy[i].attached_sas_addr) ==
-                            SAS_ADDR(child->sas_addr))
+                            SAS_ADDR(child->sas_addr)) {
                                ex->ex_phy[i].phy_state= PHY_DEVICE_DISCOVERED;
+                                res = sas_ex_join_wide_port(dev, i);
+                                if (!res)
+                                        SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n",
+                                                    i, SAS_ADDR(ex->ex_phy[i].attached_sas_addr));
+                        }
                }
+                res = 0;
        }
        return res;
@@ -1598,7 +1609,7 @@ static int sas_get_phy_attached_sas_addr(struct domain_device *dev,
 }
 static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
-                              int from_phy)
+                              int from_phy, bool update)
 {
        struct expander_device *ex = &dev->ex_dev;
        int res = 0;
@@ -1611,7 +1622,9 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
                if (res)
                        goto out;
                else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
-                        ex->ex_phy[i].phy_change_count = phy_change_count;
+                        if (update)
+                                ex->ex_phy[i].phy_change_count =
+                                        phy_change_count;
                        *phy_id = i;
                        return 0;
                }
@@ -1653,31 +1666,52 @@ out:
        kfree(rg_req);
        return res;
 }
+/**
+ * sas_find_bcast_dev -  find the device issue BROADCAST(CHANGE).
+ * @dev:domain device to be detect.
+ * @src_dev: the device which originated BROADCAST(CHANGE).
+ *
+ * Add self-configuration expander suport. Suppose two expander cascading,
+ * when the first level expander is self-configuring, hotplug the disks in
+ * second level expander, BROADCAST(CHANGE) will not only be originated
+ * in the second level expander, but also be originated in the first level
+ * expander (see SAS protocol SAS 2r-14, 7.11 for detail), it is to say,
+ * expander changed count in two level expanders will all increment at least
+ * once, but the phy which chang count has changed is the source device which
+ * we concerned.
+ */
 static int sas_find_bcast_dev(struct domain_device *dev,
                              struct domain_device **src_dev)
 {
        struct expander_device *ex = &dev->ex_dev;
        int ex_change_count = -1;
+        int phy_id = -1;
        int res;
+        struct domain_device *ch;
        res = sas_get_ex_change_count(dev, &ex_change_count);
        if (res)
                goto out;
-        if (ex_change_count != -1 &&
+        if (ex_change_count != -1 && ex_change_count != ex->ex_change_count) {
-            ex_change_count != ex->ex_change_count) {
+                /* Just detect if this expander phys phy change count changed,
-                *src_dev = dev;
+                * in order to determine if this expander originate BROADCAST,
-                ex->ex_change_count = ex_change_count;
+                * and do not update phy change count field in our structure.
-        } else {
+                */
-                struct domain_device *ch;
+                res = sas_find_bcast_phy(dev, &phy_id, 0, false);
+                if (phy_id != -1) {
-                list_for_each_entry(ch, &ex->children, siblings) {
+                        *src_dev = dev;
-                        if (ch->dev_type == EDGE_DEV ||
+                        ex->ex_change_count = ex_change_count;
-                            ch->dev_type == FANOUT_DEV) {
+                        SAS_DPRINTK("Expander phy change count has changed\n");
-                                res = sas_find_bcast_dev(ch, src_dev);
+                        return res;
-                                if (src_dev)
+                } else
-                                        return res;
+                        SAS_DPRINTK("Expander phys DID NOT change\n");
-                        }
+        }
+        list_for_each_entry(ch, &ex->children, siblings) {
+                if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
+                        res = sas_find_bcast_dev(ch, src_dev);
+                        if (src_dev)
+                                return res;
                }
        }
 out:
@@ -1700,24 +1734,26 @@ static void sas_unregister_ex_tree(struct domain_device *dev)
 }
 static void sas_unregister_devs_sas_addr(struct domain_device *parent,
-                                         int phy_id)
+                                         int phy_id, bool last)
 {
        struct expander_device *ex_dev = &parent->ex_dev;
        struct ex_phy *phy = &ex_dev->ex_phy[phy_id];
        struct domain_device *child, *n;
+        if (last) {
-        list_for_each_entry_safe(child, n, &ex_dev->children, siblings) {
+                list_for_each_entry_safe(child, n,
-                if (SAS_ADDR(child->sas_addr) ==
+                        &ex_dev->children, siblings) {
-                    SAS_ADDR(phy->attached_sas_addr)) {
+                        if (SAS_ADDR(child->sas_addr) ==
-                        if (child->dev_type == EDGE_DEV ||
+                            SAS_ADDR(phy->attached_sas_addr)) {
-                            child->dev_type == FANOUT_DEV)
+                                if (child->dev_type == EDGE_DEV ||
-                                sas_unregister_ex_tree(child);
+                                    child->dev_type == FANOUT_DEV)
-                        else
+                                        sas_unregister_ex_tree(child);
-                                sas_unregister_dev(child);
+                                else
-                        break;
+                                        sas_unregister_dev(child);
+                                break;
+                        }
                }
+                sas_disable_routing(parent, phy->attached_sas_addr);
        }
-        sas_disable_routing(parent, phy->attached_sas_addr);
        memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
        sas_port_delete_phy(phy->port, phy->phy);
        if (phy->port->num_phys == 0)
@@ -1770,15 +1806,31 @@ static int sas_discover_new(struct domain_device *dev, int phy_id)
 {
        struct ex_phy *ex_phy = &dev->ex_dev.ex_phy[phy_id];
        struct domain_device *child;
-        int res;
+        bool found = false;
+        int res, i;
        SAS_DPRINTK("ex %016llx phy%d new device attached\n",
                    SAS_ADDR(dev->sas_addr), phy_id);
        res = sas_ex_phy_discover(dev, phy_id);
        if (res)
                goto out;
+        /* to support the wide port inserted */
+        for (i = 0; i < dev->ex_dev.num_phys; i++) {
+                struct ex_phy *ex_phy_temp = &dev->ex_dev.ex_phy[i];
+                if (i == phy_id)
+                        continue;
+                if (SAS_ADDR(ex_phy_temp->attached_sas_addr) ==
+                    SAS_ADDR(ex_phy->attached_sas_addr)) {
+                        found = true;
+                        break;
+                }
+        }
+        if (found) {
+                sas_ex_join_wide_port(dev, phy_id);
+                return 0;
+        }
        res = sas_ex_discover_devices(dev, phy_id);
-        if (res)
+        if (!res)
                goto out;
        list_for_each_entry(child, &dev->ex_dev.children, siblings) {
                if (SAS_ADDR(child->sas_addr) ==
@@ -1793,7 +1845,7 @@ out:
        return res;
 }
-static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
+static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
 {
        struct expander_device *ex = &dev->ex_dev;
        struct ex_phy *phy = &ex->ex_phy[phy_id];
@@ -1804,11 +1856,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
        switch (res) {
        case SMP_RESP_NO_PHY:
                phy->phy_state = PHY_NOT_PRESENT;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
                goto out; break;
        case SMP_RESP_PHY_VACANT:
                phy->phy_state = PHY_VACANT;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
                goto out; break;
        case SMP_RESP_FUNC_ACC:
                break;
@@ -1816,7 +1868,7 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
        if (SAS_ADDR(attached_sas_addr) == 0) {
                phy->phy_state = PHY_EMPTY;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
        } else if (SAS_ADDR(attached_sas_addr) ==
                   SAS_ADDR(phy->attached_sas_addr)) {
                SAS_DPRINTK("ex %016llx phy 0x%x broadcast flutter\n",
@@ -1828,12 +1880,27 @@ out:
        return res;
 }
+/**
+ * sas_rediscover - revalidate the domain.
+ * @dev:domain device to be detect.
+ * @phy_id: the phy id will be detected.
+ *
+ * NOTE: this process _must_ quit (return) as soon as any connection
+ * errors are encountered.  Connection recovery is done elsewhere.
+ * Discover process only interrogates devices in order to discover the
+ * domain.For plugging out, we un-register the device only when it is
+ * the last phy in the port, for other phys in this port, we just delete it
+ * from the port.For inserting, we do discovery when it is the
+ * first phy,for other phys in this port, we add it to the port to
+ * forming the wide-port.
+ */
 static int sas_rediscover(struct domain_device *dev, const int phy_id)
 {
        struct expander_device *ex = &dev->ex_dev;
        struct ex_phy *changed_phy = &ex->ex_phy[phy_id];
        int res = 0;
        int i;
+        bool last = true;       /* is this the last phy of the port */
        SAS_DPRINTK("ex %016llx phy%d originated BROADCAST(CHANGE)\n",
                    SAS_ADDR(dev->sas_addr), phy_id);
@@ -1848,13 +1915,13 @@ static int sas_rediscover(struct domain_device *dev, const int phy_id)
                            SAS_ADDR(changed_phy->attached_sas_addr)) {
                                SAS_DPRINTK("phy%d part of wide port with "
                                            "phy%d\n", phy_id, i);
-                                goto out;
+                                last = false;
+                                break;
                        }
                }
-                res = sas_rediscover_dev(dev, phy_id);
+                res = sas_rediscover_dev(dev, phy_id, last);
        } else
                res = sas_discover_new(dev, phy_id);
-out:
        return res;
 }
@@ -1881,7 +1948,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev)
                do {
                        phy_id = -1;
-                        res = sas_find_bcast_phy(dev, &phy_id, i);
+                        res = sas_find_bcast_phy(dev, &phy_id, i, true);
                        if (phy_id == -1)
                                break;
                        res = sas_rediscover(dev, phy_id);
diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index e6ac59c023f1..fe8b74c706d2 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -56,7 +56,7 @@ static void sas_form_port(struct asd_sas_phy *phy)
                }
        }
-        /* find a port */
+        /* see if the phy should be part of a wide port */
        spin_lock_irqsave(&sas_ha->phy_port_lock, flags);
        for (i = 0; i < sas_ha->num_phys; i++) {
                port = sas_ha->sas_port[i];
@@ -69,12 +69,23 @@ static void sas_form_port(struct asd_sas_phy *phy)
                        SAS_DPRINTK("phy%d matched wide port%d\n", phy->id,
                                    port->id);
                        break;
-                } else if (*(u64 *) port->sas_addr == 0 && port->num_phys==0) {
-                        memcpy(port->sas_addr, phy->sas_addr, SAS_ADDR_SIZE);
-                        break;
                }
                spin_unlock(&port->phy_list_lock);
        }
+        /* The phy does not match any existing port, create a new one */
+        if (i == sas_ha->num_phys) {
+                for (i = 0; i < sas_ha->num_phys; i++) {
+                        port = sas_ha->sas_port[i];
+                        spin_lock(&port->phy_list_lock);
+                        if (*(u64 *)port->sas_addr == 0
+                                && port->num_phys == 0) {
+                                memcpy(port->sas_addr, phy->sas_addr,
+                                        SAS_ADDR_SIZE);
+                                break;
+                        }
+                        spin_unlock(&port->phy_list_lock);
+                }
+        }
        if (i >= sas_ha->num_phys) {
                printk(KERN_NOTICE "%s: couldn't find a free port, bug?\n",
diff --git a/drivers/scsi/qla4xxx/ql4_dbg.c b/drivers/scsi/qla4xxx/ql4_dbg.c
index fcc184cd066d..cbceb0ebabf7 100644
--- a/drivers/scsi/qla4xxx/ql4_dbg.c
+++ b/drivers/scsi/qla4xxx/ql4_dbg.c
@@ -15,19 +15,18 @@ void qla4xxx_dump_buffer(void *b, uint32_t size)
        uint32_t cnt;
        uint8_t *c = b;
-        printk(" 0   1   2   3   4   5   6   7   8   9  Ah  Bh  Ch  Dh  Eh  "
+        printk(" 0   1   2   3   4   5   6   7   8   9  Ah  Bh  Ch  Dh  Eh  "
               "Fh\n");
        printk("------------------------------------------------------------"
               "--\n");
-        for (cnt = 0; cnt < size; cnt++, c++) {
+        for (cnt = 0; cnt < size; c++) {
-                printk(KERN_DEBUG "%02x", *c);
+                printk(KERN_INFO "%02x", *c);
-                if (!(cnt % 16))
+                if (!(++cnt % 16))
-                        printk(KERN_DEBUG "\n");
+                        printk(KERN_INFO "\n");
                else
-                        printk(KERN_DEBUG "  ");
+                        printk(KERN_INFO "  ");
        }
-        if (cnt % 16)
+        printk(KERN_INFO "\n");
-                printk(KERN_DEBUG "\n");
 }
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index b586f27c3bd4..81b5f29254e2 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -100,7 +100,6 @@
 #define MAX_SRBS                MAX_CMDS_TO_RISC
 #define MBOX_AEN_REG_COUNT      5
 #define MAX_INIT_RETRIES        5
-#define IOCB_HIWAT_CUSHION      16
 /*
 * Buffer sizes
@@ -184,6 +183,11 @@ struct srb {
        uint16_t cc_stat;
        u_long r_start;         /* Time we recieve a cmd from OS */
        u_long u_start;         /* Time when we handed the cmd to F/W */
+        /* Used for extended sense / status continuation */
+        uint8_t *req_sense_ptr;
+        uint16_t req_sense_len;
+        uint16_t reserved2;
 };
 /*
@@ -302,7 +306,6 @@ struct scsi_qla_host {
        uint32_t tot_ddbs;
        uint16_t        iocb_cnt;
-        uint16_t        iocb_hiwat;
        /* SRB cache. */
 #define SRB_MIN_REQ     128
@@ -436,6 +439,8 @@ struct scsi_qla_host {
        /* Map ddb_list entry by FW ddb index */
        struct ddb_entry *fw_ddb_index_map[MAX_DDB_ENTRIES];
+        /* Saved srb for status continuation entry processing */
+        struct srb *status_srb;
 };
 static inline int is_qla4010(struct scsi_qla_host *ha)
diff --git a/drivers/scsi/qla4xxx/ql4_fw.h b/drivers/scsi/qla4xxx/ql4_fw.h
index 1b667a70cffa..9cd7a608df38 100644
--- a/drivers/scsi/qla4xxx/ql4_fw.h
+++ b/drivers/scsi/qla4xxx/ql4_fw.h
@@ -572,6 +572,7 @@ struct conn_event_log_entry {
 *************************************************************************/
 #define IOCB_MAX_CDB_LEN            16  /* Bytes in a CBD */
 #define IOCB_MAX_SENSEDATA_LEN      32  /* Bytes of sense data */
+#define IOCB_MAX_EXT_SENSEDATA_LEN  60  /* Bytes of extended sense data */
 /* IOCB header structure */
 struct qla4_header {
@@ -733,6 +734,12 @@ struct status_entry {
 };
+/* Status Continuation entry */
+struct status_cont_entry {
+       struct qla4_header hdr; /* 00-03 */
+       uint8_t ext_sense_data[IOCB_MAX_EXT_SENSEDATA_LEN]; /* 04-63 */
+};
 struct passthru0 {
        struct qla4_header hdr;                /* 00-03 */
        uint32_t handle;        /* 04-07 */
diff --git a/drivers/scsi/qla4xxx/ql4_iocb.c b/drivers/scsi/qla4xxx/ql4_iocb.c
index 912a67494adf..e0c32159749c 100644
--- a/drivers/scsi/qla4xxx/ql4_iocb.c
+++ b/drivers/scsi/qla4xxx/ql4_iocb.c
@@ -10,9 +10,42 @@
 #include "ql4_dbg.h"
 #include "ql4_inline.h"
 #include <scsi/scsi_tcq.h>
+static int
+qla4xxx_space_in_req_ring(struct scsi_qla_host *ha, uint16_t req_cnt)
+{
+        uint16_t cnt;
+        /* Calculate number of free request entries. */
+        if ((req_cnt + 2) >= ha->req_q_count) {
+                cnt = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
+                if (ha->request_in < cnt)
+                        ha->req_q_count = cnt - ha->request_in;
+                else
+                        ha->req_q_count = REQUEST_QUEUE_DEPTH -
+                                                (ha->request_in - cnt);
+        }
+        /* Check if room for request in request ring. */
+        if ((req_cnt + 2) < ha->req_q_count)
+                return 1;
+        else
+                return 0;
+}
+static void qla4xxx_advance_req_ring_ptr(struct scsi_qla_host *ha)
+{
+        /* Advance request queue pointer */
+        if (ha->request_in == (REQUEST_QUEUE_DEPTH - 1)) {
+                ha->request_in = 0;
+                ha->request_ptr = ha->request_ring;
+        } else {
+                ha->request_in++;
+                ha->request_ptr++;
+        }
+}
 /**
 * qla4xxx_get_req_pkt - returns a valid entry in request queue.
 * @ha: Pointer to host adapter structure.
@@ -26,35 +59,18 @@
 static int qla4xxx_get_req_pkt(struct scsi_qla_host *ha,
                               struct queue_entry **queue_entry)
 {
-        uint16_t request_in;
+        uint16_t req_cnt = 1;
-        uint8_t status = QLA_SUCCESS;
-        *queue_entry = ha->request_ptr;
-        /* get the latest request_in and request_out index */
+        if (qla4xxx_space_in_req_ring(ha, req_cnt)) {
-        request_in = ha->request_in;
+                *queue_entry = ha->request_ptr;
-        ha->request_out = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
-        /* Advance request queue pointer and check for queue full */
-        if (request_in == (REQUEST_QUEUE_DEPTH - 1)) {
-                request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else {
-                request_in++;
-                ha->request_ptr++;
-        }
-        /* request queue is full, try again later */
-        if ((ha->iocb_cnt + 1) >= ha->iocb_hiwat) {
-                /* restore request pointer */
-                ha->request_ptr = *queue_entry;
-                status = QLA_ERROR;
-        } else {
-                ha->request_in = request_in;
                memset(*queue_entry, 0, sizeof(**queue_entry));
+                qla4xxx_advance_req_ring_ptr(ha);
+                ha->req_q_count -= req_cnt;
+                return QLA_SUCCESS;
        }
-        return status;
+        return QLA_ERROR;
 }
 /**
@@ -100,21 +116,14 @@ exit_send_marker:
        return status;
 }
-static struct continuation_t1_entry* qla4xxx_alloc_cont_entry(
+static struct continuation_t1_entry *
-        struct scsi_qla_host *ha)
+qla4xxx_alloc_cont_entry(struct scsi_qla_host *ha)
 {
        struct continuation_t1_entry *cont_entry;
        cont_entry = (struct continuation_t1_entry *)ha->request_ptr;
-        /* Advance request queue pointer */
+        qla4xxx_advance_req_ring_ptr(ha);
-        if (ha->request_in == (REQUEST_QUEUE_DEPTH - 1)) {
-                ha->request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else {
-                ha->request_in++;
-                ha->request_ptr++;
-        }
        /* Load packet defaults */
        cont_entry->hdr.entryType = ET_CONTINUE;
@@ -197,13 +206,10 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        struct scsi_cmnd *cmd = srb->cmd;
        struct ddb_entry *ddb_entry;
        struct command_t3_entry *cmd_entry;
        int nseg;
        uint16_t tot_dsds;
        uint16_t req_cnt;
        unsigned long flags;
-        uint16_t cnt;
        uint32_t index;
        char tag[2];
@@ -217,6 +223,19 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        index = (uint32_t)cmd->request->tag;
+        /*
+         * Check to see if adapter is online before placing request on
+         * request queue.  If a reset occurs and a request is in the queue,
+         * the firmware will still attempt to process the request, retrieving
+         * garbage for pointers.
+         */
+        if (!test_bit(AF_ONLINE, &ha->flags)) {
+                DEBUG2(printk("scsi%ld: %s: Adapter OFFLINE! "
+                              "Do not issue command.\n",
+                              ha->host_no, __func__));
+                goto queuing_error;
+        }
        /* Calculate the number of request entries needed. */
        nseg = scsi_dma_map(cmd);
        if (nseg < 0)
@@ -224,17 +243,7 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        tot_dsds = nseg;
        req_cnt = qla4xxx_calc_request_entries(tot_dsds);
+        if (!qla4xxx_space_in_req_ring(ha, req_cnt))
-        if (ha->req_q_count < (req_cnt + 2)) {
-                cnt = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
-                if (ha->request_in < cnt)
-                        ha->req_q_count = cnt - ha->request_in;
-                else
-                        ha->req_q_count = REQUEST_QUEUE_DEPTH -
-                                (ha->request_in - cnt);
-        }
-        if (ha->req_q_count < (req_cnt + 2))
                goto queuing_error;
        /* total iocbs active */
@@ -286,32 +295,10 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
                        break;
                }
+        qla4xxx_advance_req_ring_ptr(ha);
-        /* Advance request queue pointer */
-        ha->request_in++;
-        if (ha->request_in == REQUEST_QUEUE_DEPTH) {
-                ha->request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else
-                ha->request_ptr++;
        qla4xxx_build_scsi_iocbs(srb, cmd_entry, tot_dsds);
        wmb();
-        /*
-         * Check to see if adapter is online before placing request on
-         * request queue.  If a reset occurs and a request is in the queue,
-         * the firmware will still attempt to process the request, retrieving
-         * garbage for pointers.
-         */
-        if (!test_bit(AF_ONLINE, &ha->flags)) {
-                DEBUG2(printk("scsi%ld: %s: Adapter OFFLINE! "
-                              "Do not issue command.\n",
-                              ha->host_no, __func__));
-                goto queuing_error;
-        }
        srb->cmd->host_scribble = (unsigned char *)srb;
        /* update counters */
diff --git a/drivers/scsi/qla4xxx/ql4_isr.c b/drivers/scsi/qla4xxx/ql4_isr.c
index 799120fcb9be..8025ee16588e 100644
--- a/drivers/scsi/qla4xxx/ql4_isr.c
+++ b/drivers/scsi/qla4xxx/ql4_isr.c
@@ -11,6 +11,98 @@
 #include "ql4_inline.h"
 /**
+ * qla4xxx_copy_sense - copy sense data into cmd sense buffer
+ * @ha: Pointer to host adapter structure.
+ * @sts_entry: Pointer to status entry structure.
+ * @srb: Pointer to srb structure.
+ **/
+static void qla4xxx_copy_sense(struct scsi_qla_host *ha,
+                               struct status_entry *sts_entry,
+                               struct srb *srb)
+{
+        struct scsi_cmnd *cmd = srb->cmd;
+        uint16_t sense_len;
+        memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+        sense_len = le16_to_cpu(sts_entry->senseDataByteCnt);
+        if (sense_len == 0)
+                return;
+        /* Save total available sense length,
+         * not to exceed cmd's sense buffer size */
+        sense_len = min_t(uint16_t, sense_len, SCSI_SENSE_BUFFERSIZE);
+        srb->req_sense_ptr = cmd->sense_buffer;
+        srb->req_sense_len = sense_len;
+        /* Copy sense from sts_entry pkt */
+        sense_len = min_t(uint16_t, sense_len, IOCB_MAX_SENSEDATA_LEN);
+        memcpy(cmd->sense_buffer, sts_entry->senseData, sense_len);
+        DEBUG2(printk(KERN_INFO "scsi%ld:%d:%d:%d: %s: sense key = %x, "
+                "ASL= %02x, ASC/ASCQ = %02x/%02x\n", ha->host_no,
+                cmd->device->channel, cmd->device->id,
+                cmd->device->lun, __func__,
+                sts_entry->senseData[2] & 0x0f,
+                sts_entry->senseData[7],
+                sts_entry->senseData[12],
+                sts_entry->senseData[13]));
+        DEBUG5(qla4xxx_dump_buffer(cmd->sense_buffer, sense_len));
+        srb->flags |= SRB_GOT_SENSE;
+        /* Update srb, in case a sts_cont pkt follows */
+        srb->req_sense_ptr += sense_len;
+        srb->req_sense_len -= sense_len;
+        if (srb->req_sense_len != 0)
+                ha->status_srb = srb;
+        else
+                ha->status_srb = NULL;
+}
+/**
+ * qla4xxx_status_cont_entry - Process a Status Continuations entry.
+ * @ha: SCSI driver HA context
+ * @sts_cont: Entry pointer
+ *
+ * Extended sense data.
+ */
+static void
+qla4xxx_status_cont_entry(struct scsi_qla_host *ha,
+                          struct status_cont_entry *sts_cont)
+{
+        struct srb *srb = ha->status_srb;
+        struct scsi_cmnd *cmd;
+        uint8_t sense_len;
+        if (srb == NULL)
+                return;
+        cmd = srb->cmd;
+        if (cmd == NULL) {
+                DEBUG2(printk(KERN_INFO "scsi%ld: %s: Cmd already returned "
+                        "back to OS srb=%p srb->state:%d\n", ha->host_no,
+                        __func__, srb, srb->state));
+                ha->status_srb = NULL;
+                return;
+        }
+        /* Copy sense data. */
+        sense_len = min_t(uint16_t, srb->req_sense_len,
+                          IOCB_MAX_EXT_SENSEDATA_LEN);
+        memcpy(srb->req_sense_ptr, sts_cont->ext_sense_data, sense_len);
+        DEBUG5(qla4xxx_dump_buffer(srb->req_sense_ptr, sense_len));
+        srb->req_sense_ptr += sense_len;
+        srb->req_sense_len -= sense_len;
+        /* Place command on done queue. */
+        if (srb->req_sense_len == 0) {
+                qla4xxx_srb_compl(ha, srb);
+                ha->status_srb = NULL;
+        }
+}
+/**
 * qla4xxx_status_entry - processes status IOCBs
 * @ha: Pointer to host adapter structure.
 * @sts_entry: Pointer to status entry structure.
@@ -23,7 +115,6 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
        struct srb *srb;
        struct ddb_entry *ddb_entry;
        uint32_t residual;
-        uint16_t sensebytecnt;
        srb = qla4xxx_del_from_active_array(ha, le32_to_cpu(sts_entry->handle));
        if (!srb) {
@@ -92,24 +183,7 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
                        break;
                /* Copy Sense Data into sense buffer. */
-                memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+                qla4xxx_copy_sense(ha, sts_entry, srb);
-                sensebytecnt = le16_to_cpu(sts_entry->senseDataByteCnt);
-                if (sensebytecnt == 0)
-                        break;
-                memcpy(cmd->sense_buffer, sts_entry->senseData,
-                       min_t(uint16_t, sensebytecnt, SCSI_SENSE_BUFFERSIZE));
-                DEBUG2(printk("scsi%ld:%d:%d:%d: %s: sense key = %x, "
-                              "ASC/ASCQ = %02x/%02x\n", ha->host_no,
-                              cmd->device->channel, cmd->device->id,
-                              cmd->device->lun, __func__,
-                              sts_entry->senseData[2] & 0x0f,
-                              sts_entry->senseData[12],
-                              sts_entry->senseData[13]));
-                srb->flags |= SRB_GOT_SENSE;
                break;
        case SCS_INCOMPLETE:
@@ -176,23 +250,7 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
                                break;
                        /* Copy Sense Data into sense buffer. */
-                        memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+                        qla4xxx_copy_sense(ha, sts_entry, srb);
-                        sensebytecnt =
-                                le16_to_cpu(sts_entry->senseDataByteCnt);
-                        if (sensebytecnt == 0)
-                                break;
-                        memcpy(cmd->sense_buffer, sts_entry->senseData,
-                               min_t(uint16_t, sensebytecnt, SCSI_SENSE_BUFFERSIZE));
-                        DEBUG2(printk("scsi%ld:%d:%d:%d: %s: sense key = %x, "
-                                      "ASC/ASCQ = %02x/%02x\n", ha->host_no,
-                                      cmd->device->channel, cmd->device->id,
-                                      cmd->device->lun, __func__,
-                                      sts_entry->senseData[2] & 0x0f,
-                                      sts_entry->senseData[12],
-                                      sts_entry->senseData[13]));
                } else {
                        /*
                         * If RISC reports underrun and target does not
@@ -268,9 +326,10 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
 status_entry_exit:
-        /* complete the request */
+        /* complete the request, if not waiting for status_continuation pkt */
        srb->cc_stat = sts_entry->completionStatus;
-        qla4xxx_srb_compl(ha, srb);
+        if (ha->status_srb == NULL)
+                qla4xxx_srb_compl(ha, srb);
 }
 /**
@@ -305,10 +364,7 @@ static void qla4xxx_process_response_queue(struct scsi_qla_host * ha)
                /* process entry */
                switch (sts_entry->hdr.entryType) {
                case ET_STATUS:
-                        /*
+                        /* Common status */
-                         * Common status - Single completion posted in single
-                         * IOSB.
-                         */
                        qla4xxx_status_entry(ha, sts_entry);
                        break;
@@ -316,9 +372,8 @@ static void qla4xxx_process_response_queue(struct scsi_qla_host * ha)
                        break;
                case ET_STATUS_CONTINUATION:
-                        /* Just throw away the status continuation entries */
+                        qla4xxx_status_cont_entry(ha,
-                        DEBUG2(printk("scsi%ld: %s: Status Continuation entry "
+                                (struct status_cont_entry *) sts_entry);
-                                      "- ignoring\n", ha->host_no, __func__));
                        break;
                case ET_COMMAND:
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index 051b0f5e8c8e..09d6d4b76f39 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -385,16 +385,6 @@ int qla4xxx_get_firmware_status(struct scsi_qla_host * ha)
                              mbox_sts[0]));
                return QLA_ERROR;
        }
-        /* High-water mark of IOCBs */
-        ha->iocb_hiwat = mbox_sts[2];
-        if (ha->iocb_hiwat > IOCB_HIWAT_CUSHION)
-                ha->iocb_hiwat -= IOCB_HIWAT_CUSHION;
-        else
-                dev_info(&ha->pdev->dev, "WARNING!!!  You have less than %d "
-                           "firmware IOCBs available (%d).\n",
-                           IOCB_HIWAT_CUSHION, ha->iocb_hiwat);
        return QLA_SUCCESS;
 }
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index ec9da6ce8489..40e3cafb3a9c 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -66,6 +66,7 @@ static int qla4xxx_sess_get_param(struct iscsi_cls_session *sess,
 static int qla4xxx_host_get_param(struct Scsi_Host *shost,
                                  enum iscsi_host_param param, char *buf);
 static void qla4xxx_recovery_timedout(struct iscsi_cls_session *session);
+static enum blk_eh_timer_return qla4xxx_eh_cmd_timed_out(struct scsi_cmnd *sc);
 /*
 * SCSI host template entry points
@@ -89,6 +90,7 @@ static struct scsi_host_template qla4xxx_driver_template = {
        .eh_device_reset_handler = qla4xxx_eh_device_reset,
        .eh_target_reset_handler = qla4xxx_eh_target_reset,
        .eh_host_reset_handler  = qla4xxx_eh_host_reset,
+        .eh_timed_out           = qla4xxx_eh_cmd_timed_out,
        .slave_configure        = qla4xxx_slave_configure,
        .slave_alloc            = qla4xxx_slave_alloc,
@@ -124,6 +126,21 @@ static struct iscsi_transport qla4xxx_iscsi_transport = {
 static struct scsi_transport_template *qla4xxx_scsi_transport;
+static enum blk_eh_timer_return qla4xxx_eh_cmd_timed_out(struct scsi_cmnd *sc)
+{
+        struct iscsi_cls_session *session;
+        struct ddb_entry *ddb_entry;
+        session = starget_to_session(scsi_target(sc->device));
+        ddb_entry = session->dd_data;
+        /* if we are not logged in then the LLD is going to clean up the cmd */
+        if (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)
+                return BLK_EH_RESET_TIMER;
+        else
+                return BLK_EH_NOT_HANDLED;
+}
 static void qla4xxx_recovery_timedout(struct iscsi_cls_session *session)
 {
        struct ddb_entry *ddb_entry = session->dd_data;
@@ -904,18 +921,17 @@ static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
        /* Flush any pending ddb changed AENs */
        qla4xxx_process_aen(ha, FLUSH_DDB_CHANGED_AENS);
+        qla4xxx_flush_active_srbs(ha);
        /* Reset the firmware.  If successful, function
         * returns with ISP interrupts enabled.
         */
-        if (status == QLA_SUCCESS) {
+        DEBUG2(printk("scsi%ld: %s - Performing soft reset..\n",
-                DEBUG2(printk("scsi%ld: %s - Performing soft reset..\n",
+                      ha->host_no, __func__));
-                              ha->host_no, __func__));
+        if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
-                qla4xxx_flush_active_srbs(ha);
+                status = qla4xxx_soft_reset(ha);
-                if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
+        else
-                        status = qla4xxx_soft_reset(ha);
+                status = QLA_ERROR;
-                else
-                        status = QLA_ERROR;
-        }
        /* Flush any pending ddb changed AENs */
        qla4xxx_process_aen(ha, FLUSH_DDB_CHANGED_AENS);
@@ -1527,11 +1543,9 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd)
 {
        struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
        struct ddb_entry *ddb_entry = cmd->device->hostdata;
-        struct srb *sp;
        int ret = FAILED, stat;
-        sp = (struct srb *) cmd->SCp.ptr;
+        if (!ddb_entry)
-        if (!sp || !ddb_entry)
                return ret;
        dev_info(&ha->pdev->dev,
@@ -1644,7 +1658,7 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd)
        ha = (struct scsi_qla_host *) cmd->device->host->hostdata;
        dev_info(&ha->pdev->dev,
-                   "scsi(%ld:%d:%d:%d): ADAPTER RESET ISSUED.\n", ha->host_no,
+                   "scsi(%ld:%d:%d:%d): HOST RESET ISSUED.\n", ha->host_no,
                   cmd->device->channel, cmd->device->id, cmd->device->lun);
        if (qla4xxx_wait_for_hba_online(ha) != QLA_SUCCESS) {
diff --git a/drivers/scsi/qla4xxx/ql4_version.h b/drivers/scsi/qla4xxx/ql4_version.h
index ab984cb89cea..6980cb279c81 100644
--- a/drivers/scsi/qla4xxx/ql4_version.h
+++ b/drivers/scsi/qla4xxx/ql4_version.h
@@ -5,5 +5,5 @@
 * See LICENSE.qla4xxx for copyright and licensing details.
 */
-#define QLA4XXX_DRIVER_VERSION  "5.01.00-k8"
+#define QLA4XXX_DRIVER_VERSION  "5.01.00-k9"
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 783e33c65eb7..b47240ca4b19 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -990,7 +990,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
        struct iscsi_uevent *ev;
        int len = NLMSG_SPACE(sizeof(*ev) + data_size);
-        skb = alloc_skb(len, GFP_NOIO);
+        skb = alloc_skb(len, GFP_ATOMIC);
        if (!skb) {
                printk(KERN_ERR "can not deliver iscsi offload message:OOM\n");
                return -ENOMEM;
@@ -1012,7 +1012,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
        memcpy((char *)ev + sizeof(*ev), data, data_size);
-        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_NOIO);
+        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_ATOMIC);
 }
 EXPORT_SYMBOL_GPL(iscsi_offload_mesg);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 5616cd780ff3..b7b9fec67a98 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1840,6 +1840,18 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
        kfree(buffer);
 }
+static int sd_try_extended_inquiry(struct scsi_device *sdp)
+{
+        /*
+         * Although VPD inquiries can go to SCSI-2 type devices,
+         * some USB ones crash on receiving them, and the pages
+         * we currently ask for are for SPC-3 and beyond
+         */
+        if (sdp->scsi_level > SCSI_SPC_2)
+                return 1;
+        return 0;
+}
 /**
 *      sd_revalidate_disk - called the first time a new disk is seen,
 *      performs disk spin up, read_capacity, etc.
@@ -1877,8 +1889,12 @@ static int sd_revalidate_disk(struct gendisk *disk)
         */
        if (sdkp->media_present) {
                sd_read_capacity(sdkp, buffer);
-                sd_read_block_limits(sdkp);
-                sd_read_block_characteristics(sdkp);
+                if (sd_try_extended_inquiry(sdp)) {
+                        sd_read_block_limits(sdkp);
+                        sd_read_block_characteristics(sdkp);
+                }
                sd_read_write_protect_flag(sdkp, buffer);
                sd_read_cache_type(sdkp, buffer);
                sd_read_app_tag_own(sdkp, buffer);
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 037c1e0b7c4c..6553833c12db 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -527,7 +527,7 @@ config SERIAL_S3C24A0
 config SERIAL_S3C6400
        tristate "Samsung S3C6400/S3C6410 Serial port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C600 || CPU_S3C6410)
+        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410)
        default y
        help
          Serial port support for the Samsung S3C6400 and S3C6410
diff --git a/drivers/serial/s3c2400.c b/drivers/serial/s3c2400.c
index fb00ed5296e6..fed1a9a1ffb4 100644
--- a/drivers/serial/s3c2400.c
+++ b/drivers/serial/s3c2400.c
@@ -76,7 +76,7 @@ static int s3c2400_serial_probe(struct platform_device *dev)
        return s3c24xx_serial_probe(dev, &s3c2400_uart_inf);
 }
-static struct platform_driver s3c2400_serial_drv = {
+static struct platform_driver s3c2400_serial_driver = {
        .probe          = s3c2400_serial_probe,
        .remove         = __devexit_p(s3c24xx_serial_remove),
        .driver         = {
@@ -85,16 +85,16 @@ static struct platform_driver s3c2400_serial_drv = {
        },
 };
-s3c24xx_console_init(&s3c2400_serial_drv, &s3c2400_uart_inf);
+s3c24xx_console_init(&s3c2400_serial_driver, &s3c2400_uart_inf);
 static inline int s3c2400_serial_init(void)
 {
-        return s3c24xx_serial_init(&s3c2400_serial_drv, &s3c2400_uart_inf);
+        return s3c24xx_serial_init(&s3c2400_serial_driver, &s3c2400_uart_inf);
 }
 static inline void s3c2400_serial_exit(void)
 {
-        platform_driver_unregister(&s3c2400_serial_drv);
+        platform_driver_unregister(&s3c2400_serial_driver);
 }
 module_init(s3c2400_serial_init);
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index b5d7cbcba2ae..c99f0821cae3 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -88,7 +88,7 @@ static int s3c2410_serial_probe(struct platform_device *dev)
        return s3c24xx_serial_probe(dev, &s3c2410_uart_inf);
 }
-static struct platform_driver s3c2410_serial_drv = {
+static struct platform_driver s3c2410_serial_driver = {
        .probe          = s3c2410_serial_probe,
        .remove         = __devexit_p(s3c24xx_serial_remove),
        .driver         = {
@@ -97,16 +97,16 @@ static struct platform_driver s3c2410_serial_drv = {
        },
 };
-s3c24xx_console_init(&s3c2410_serial_drv, &s3c2410_uart_inf);
+s3c24xx_console_init(&s3c2410_serial_driver, &s3c2410_uart_inf);
 static int __init s3c2410_serial_init(void)
 {
-        return s3c24xx_serial_init(&s3c2410_serial_drv, &s3c2410_uart_inf);
+        return s3c24xx_serial_init(&s3c2410_serial_driver, &s3c2410_uart_inf);
 }
 static void __exit s3c2410_serial_exit(void)
 {
-        platform_driver_unregister(&s3c2410_serial_drv);
+        platform_driver_unregister(&s3c2410_serial_driver);
 }
 module_init(s3c2410_serial_init);
diff --git a/drivers/serial/s3c2412.c b/drivers/serial/s3c2412.c
index 11dcb90bdfef..6e057d8809d3 100644
--- a/drivers/serial/s3c2412.c
+++ b/drivers/serial/s3c2412.c
@@ -121,7 +121,7 @@ static int s3c2412_serial_probe(struct platform_device *dev)
        return s3c24xx_serial_probe(dev, &s3c2412_uart_inf);
 }
-static struct platform_driver s3c2412_serial_drv = {
+static struct platform_driver s3c2412_serial_driver = {
        .probe          = s3c2412_serial_probe,
        .remove         = __devexit_p(s3c24xx_serial_remove),
        .driver         = {
@@ -130,16 +130,16 @@ static struct platform_driver s3c2412_serial_drv = {
        },
 };
-s3c24xx_console_init(&s3c2412_serial_drv, &s3c2412_uart_inf);
+s3c24xx_console_init(&s3c2412_serial_driver, &s3c2412_uart_inf);
 static inline int s3c2412_serial_init(void)
 {
-        return s3c24xx_serial_init(&s3c2412_serial_drv, &s3c2412_uart_inf);
+        return s3c24xx_serial_init(&s3c2412_serial_driver, &s3c2412_uart_inf);
 }
 static inline void s3c2412_serial_exit(void)
 {
-        platform_driver_unregister(&s3c2412_serial_drv);
+        platform_driver_unregister(&s3c2412_serial_driver);
 }
 module_init(s3c2412_serial_init);
diff --git a/drivers/serial/s3c2440.c b/drivers/serial/s3c2440.c
index 06c5b0cc47a3..69ff5d340f04 100644
--- a/drivers/serial/s3c2440.c
+++ b/drivers/serial/s3c2440.c
@@ -151,7 +151,7 @@ static int s3c2440_serial_probe(struct platform_device *dev)
        return s3c24xx_serial_probe(dev, &s3c2440_uart_inf);
 }
-static struct platform_driver s3c2440_serial_drv = {
+static struct platform_driver s3c2440_serial_driver = {
        .probe          = s3c2440_serial_probe,
        .remove         = __devexit_p(s3c24xx_serial_remove),
        .driver         = {
@@ -160,16 +160,16 @@ static struct platform_driver s3c2440_serial_drv = {
        },
 };
-s3c24xx_console_init(&s3c2440_serial_drv, &s3c2440_uart_inf);
+s3c24xx_console_init(&s3c2440_serial_driver, &s3c2440_uart_inf);
 static int __init s3c2440_serial_init(void)
 {
-        return s3c24xx_serial_init(&s3c2440_serial_drv, &s3c2440_uart_inf);
+        return s3c24xx_serial_init(&s3c2440_serial_driver, &s3c2440_uart_inf);
 }
 static void __exit s3c2440_serial_exit(void)
 {
-        platform_driver_unregister(&s3c2440_serial_drv);
+        platform_driver_unregister(&s3c2440_serial_driver);
 }
 module_init(s3c2440_serial_init);
diff --git a/drivers/serial/s3c24a0.c b/drivers/serial/s3c24a0.c
index 786a067d62ac..26c49e18bdd1 100644
--- a/drivers/serial/s3c24a0.c
+++ b/drivers/serial/s3c24a0.c
@@ -92,7 +92,7 @@ static int s3c24a0_serial_probe(struct platform_device *dev)
        return s3c24xx_serial_probe(dev, &s3c24a0_uart_inf);
 }
-static struct platform_driver s3c24a0_serial_drv = {
+static struct platform_driver s3c24a0_serial_driver = {
        .probe          = s3c24a0_serial_probe,
        .remove         = __devexit_p(s3c24xx_serial_remove),
        .driver         = {
@@ -101,16 +101,16 @@ static struct platform_driver s3c24a0_serial_drv = {
        },
 };
-s3c24xx_console_init(&s3c24a0_serial_drv, &s3c24a0_uart_inf);
+s3c24xx_console_init(&s3c24a0_serial_driver, &s3c24a0_uart_inf);
 static int __init s3c24a0_serial_init(void)
 {
-        return s3c24xx_serial_init(&s3c24a0_serial_drv, &s3c24a0_uart_inf);
+        return s3c24xx_serial_init(&s3c24a0_serial_driver, &s3c24a0_uart_inf);
 }
 static void __exit s3c24a0_serial_exit(void)
 {
-        platform_driver_unregister(&s3c24a0_serial_drv);
+        platform_driver_unregister(&s3c24a0_serial_driver);
 }
 module_init(s3c24a0_serial_init);
diff --git a/drivers/serial/s3c6400.c b/drivers/serial/s3c6400.c
index 48f1a3781f0d..4be92ab50058 100644
--- a/drivers/serial/s3c6400.c
+++ b/drivers/serial/s3c6400.c
@@ -122,7 +122,7 @@ static int s3c6400_serial_probe(struct platform_device *dev)
        return s3c24xx_serial_probe(dev, &s3c6400_uart_inf);
 }
-static struct platform_driver s3c6400_serial_drv = {
+static struct platform_driver s3c6400_serial_driver = {
        .probe          = s3c6400_serial_probe,
        .remove         = __devexit_p(s3c24xx_serial_remove),
        .driver         = {
@@ -131,16 +131,16 @@ static struct platform_driver s3c6400_serial_drv = {
        },
 };
-s3c24xx_console_init(&s3c6400_serial_drv, &s3c6400_uart_inf);
+s3c24xx_console_init(&s3c6400_serial_driver, &s3c6400_uart_inf);
 static int __init s3c6400_serial_init(void)
 {
-        return s3c24xx_serial_init(&s3c6400_serial_drv, &s3c6400_uart_inf);
+        return s3c24xx_serial_init(&s3c6400_serial_driver, &s3c6400_uart_inf);
 }
 static void __exit s3c6400_serial_exit(void)
 {
-        platform_driver_unregister(&s3c6400_serial_drv);
+        platform_driver_unregister(&s3c6400_serial_driver);
 }
 module_init(s3c6400_serial_init);
diff --git a/drivers/serial/serial_ks8695.c b/drivers/serial/serial_ks8695.c
index 998e89dc5aaf..e0665630e4da 100644
--- a/drivers/serial/serial_ks8695.c
+++ b/drivers/serial/serial_ks8695.c
@@ -549,7 +549,7 @@ static struct uart_port ks8695uart_ports[SERIAL_KS8695_NR] = {
                .mapbase        = KS8695_UART_VA,
                .iotype         = SERIAL_IO_MEM,
                .irq            = KS8695_IRQ_UART_TX,
-                .uartclk        = CLOCK_TICK_RATE * 16,
+                .uartclk        = KS8695_CLOCK_RATE * 16,
                .fifosize       = 16,
                .ops            = &ks8695uart_pops,
                .flags          = ASYNC_BOOT_AUTOCONF,
diff --git a/drivers/staging/b3dfg/Kconfig b/drivers/staging/b3dfg/Kconfig
index 524231047de5..9e6573cf97d3 100644
--- a/drivers/staging/b3dfg/Kconfig
+++ b/drivers/staging/b3dfg/Kconfig
@@ -1,5 +1,6 @@
 config B3DFG
       tristate "Brontes 3d Frame Framegrabber"
+       depends on PCI
       default n
       ---help---
         This driver provides support for the Brontes 3d Framegrabber
diff --git a/drivers/staging/heci/Kconfig b/drivers/staging/heci/Kconfig
index ae8d588d3a27..c7206f8bcd93 100644
--- a/drivers/staging/heci/Kconfig
+++ b/drivers/staging/heci/Kconfig
@@ -1,5 +1,6 @@
 config HECI
        tristate "Intel Management Engine Interface (MEI) Support"
+        depends on PCI
        ---help---
          The Intel Management Engine Interface (Intel MEI) driver allows
          applications to access the Active Management Technology
diff --git a/drivers/staging/rspiusb/rspiusb.c b/drivers/staging/rspiusb/rspiusb.c
index 2f8155c1968b..04e2f92c0f62 100644
--- a/drivers/staging/rspiusb/rspiusb.c
+++ b/drivers/staging/rspiusb/rspiusb.c
@@ -716,6 +716,8 @@ static int MapUserBuffer(struct ioctl_struct *io, struct device_extension *pdx)
                pdx->PixelUrb[frameInfo][i]->transfer_flags =
                    URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT;
        }
+        if (i == 0)
+                return -EINVAL;
        /* only interrupt when last URB completes */
        pdx->PixelUrb[frameInfo][--i]->transfer_flags &= ~URB_NO_INTERRUPT;
        pdx->pendedPixelUrbs[frameInfo] =
diff --git a/drivers/staging/rt2860/rt_linux.h b/drivers/staging/rt2860/rt_linux.h
index 85175c182432..25b53ac3f820 100644
--- a/drivers/staging/rt2860/rt_linux.h
+++ b/drivers/staging/rt2860/rt_linux.h
@@ -43,9 +43,6 @@
 #include "rtmp_type.h"
 #include <linux/module.h>
 #include <linux/kernel.h>
-#if !defined(RT2860) && !defined(RT30xx)
-#include <linux/kthread.h>
-#endif
 #include <linux/spinlock.h>
 #include <linux/init.h>
@@ -166,9 +163,7 @@ typedef int (*HARD_START_XMIT_FUNC)(struct sk_buff *skb, struct net_device *net_
 #ifndef RT30xx
 typedef struct pid *    THREAD_PID;
-#ifdef RT2860
 #define THREAD_PID_INIT_VALUE   NULL
-#endif
 #define GET_PID(_v)     find_get_pid(_v)
 #define GET_PID_NUMBER(_v)      pid_nr(_v)
 #define CHECK_PID_LEGALITY(_pid)        if (pid_nr(_pid) >= 0)
@@ -188,12 +183,12 @@ struct os_cookie {
        dma_addr_t                              pAd_pa;
 #endif
 #ifdef RT2870
-        struct usb_device       *pUsb_Dev;
+        struct usb_device               *pUsb_Dev;
 #ifndef RT30xx
-        struct task_struct      *MLMEThr_task;
+        THREAD_PID                              MLMEThr_pid;
-        struct task_struct      *RTUSBCmdThr_task;
+        THREAD_PID                              RTUSBCmdThr_pid;
-        struct task_struct      *TimerQThr_task;
+        THREAD_PID                              TimerQThr_pid;
 #endif
 #ifdef RT30xx
        struct pid      *MLMEThr_pid;
diff --git a/drivers/staging/rt2870/2870_main_dev.c b/drivers/staging/rt2870/2870_main_dev.c
index dd01c64fbf61..a4e8696ca39c 100644
--- a/drivers/staging/rt2870/2870_main_dev.c
+++ b/drivers/staging/rt2870/2870_main_dev.c
@@ -235,7 +235,7 @@ INT MlmeThread(
        DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__));
 #ifndef RT30xx
-        pObj->MLMEThr_task = NULL;
+        pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE;
 #endif
 #ifdef RT30xx
        pObj->MLMEThr_pid = NULL;
@@ -348,7 +348,7 @@ INT RTUSBCmdThread(
        DBGPRINT(RT_DEBUG_TRACE,( "<---RTUSBCmdThread\n"));
 #ifndef RT30xx
-        pObj->RTUSBCmdThr_task = NULL;
+        pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE;
 #endif
 #ifdef RT30xx
        pObj->RTUSBCmdThr_pid = NULL;
@@ -447,7 +447,7 @@ INT TimerQThread(
        DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__));
 #ifndef RT30xx
-        pObj->TimerQThr_task = NULL;
+        pObj->TimerQThr_pid = THREAD_PID_INIT_VALUE;
 #endif
 #ifdef RT30xx
        pObj->TimerQThr_pid = NULL;
@@ -883,46 +883,69 @@ VOID RT28xxThreadTerminate(
        // Terminate Threads
 #ifndef RT30xx
-        BUG_ON(pObj->TimerQThr_task == NULL);
+        CHECK_PID_LEGALITY(pObj->TimerQThr_pid)
-        CHECK_PID_LEGALITY(task_pid(pObj->TimerQThr_task))
        {
                POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-                printk(KERN_DEBUG "Terminate the TimerQThr pid=%d!\n",
+                printk("Terminate the TimerQThr_pid=%d!\n", GET_PID_NUMBER(pObj->TimerQThr_pid));
-                        pid_nr(task_pid(pObj->TimerQThr_task)));
                mb();
                pAd->TimerFunc_kill = 1;
                mb();
-                kthread_stop(pObj->TimerQThr_task);
+                ret = KILL_THREAD_PID(pObj->TimerQThr_pid, SIGTERM, 1);
-                pObj->TimerQThr_task = NULL;
+                if (ret)
+                {
+                        printk(KERN_WARNING "%s: unable to stop TimerQThread, pid=%d, ret=%d!\n",
+                                        pAd->net_dev->name, GET_PID_NUMBER(pObj->TimerQThr_pid), ret);
+                }
+                else
+                {
+                        wait_for_completion(&pAd->TimerQComplete);
+                        pObj->TimerQThr_pid = THREAD_PID_INIT_VALUE;
+                }
        }
-        BUG_ON(pObj->MLMEThr_task == NULL);
+        CHECK_PID_LEGALITY(pObj->MLMEThr_pid)
-        CHECK_PID_LEGALITY(task_pid(pObj->MLMEThr_task))
        {
-                printk(KERN_DEBUG "Terminate the MLMEThr pid=%d!\n",
+                printk("Terminate the MLMEThr_pid=%d!\n", GET_PID_NUMBER(pObj->MLMEThr_pid));
-                        pid_nr(task_pid(pObj->MLMEThr_task)));
                mb();
                pAd->mlme_kill = 1;
                //RT28XX_MLME_HANDLER(pAd);
                mb();
-                kthread_stop(pObj->MLMEThr_task);
+                ret = KILL_THREAD_PID(pObj->MLMEThr_pid, SIGTERM, 1);
-                pObj->MLMEThr_task = NULL;
+                if (ret)
+                {
+                        printk (KERN_WARNING "%s: unable to Mlme thread, pid=%d, ret=%d!\n",
+                                        pAd->net_dev->name, GET_PID_NUMBER(pObj->MLMEThr_pid), ret);
+                }
+                else
+                {
+                        //wait_for_completion (&pAd->notify);
+                        wait_for_completion (&pAd->mlmeComplete);
+                        pObj->MLMEThr_pid = THREAD_PID_INIT_VALUE;
+                }
        }
-        BUG_ON(pObj->RTUSBCmdThr_task == NULL);
+        CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid)
-        CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task))
        {
-                printk(KERN_DEBUG "Terminate the RTUSBCmdThr pid=%d!\n",
+                printk("Terminate the RTUSBCmdThr_pid=%d!\n", GET_PID_NUMBER(pObj->RTUSBCmdThr_pid));
-                        pid_nr(task_pid(pObj->RTUSBCmdThr_task)));
                mb();
                NdisAcquireSpinLock(&pAd->CmdQLock);
                pAd->CmdQ.CmdQState = RT2870_THREAD_STOPED;
                NdisReleaseSpinLock(&pAd->CmdQLock);
                mb();
                //RTUSBCMDUp(pAd);
-                kthread_stop(pObj->RTUSBCmdThr_task);
+                ret = KILL_THREAD_PID(pObj->RTUSBCmdThr_pid, SIGTERM, 1);
-                pObj->RTUSBCmdThr_task = NULL;
+                if (ret)
+                {
+                        printk(KERN_WARNING "%s: unable to RTUSBCmd thread, pid=%d, ret=%d!\n",
+                                        pAd->net_dev->name, GET_PID_NUMBER(pObj->RTUSBCmdThr_pid), ret);
+                }
+                else
+                {
+                        //wait_for_completion (&pAd->notify);
+                        wait_for_completion (&pAd->CmdQComplete);
+                        pObj->RTUSBCmdThr_pid = THREAD_PID_INIT_VALUE;
+                }
        }
 #endif
 #ifdef RT30xx
@@ -1045,7 +1068,7 @@ BOOLEAN RT28XXChipsetCheck(
                        dev_p->descriptor.idProduct == rtusb_usb_id[i].idProduct)
                {
 #ifndef RT30xx
-                        printk(KERN_DEBUG "rt2870: idVendor = 0x%x, idProduct = 0x%x\n",
+                        printk("rt2870: idVendor = 0x%x, idProduct = 0x%x\n",
 #endif
 #ifdef RT30xx
                        printk("rt2870: idVendor = 0x%x, idProduct = 0x%x\n",
diff --git a/drivers/staging/rt2870/common/2870_rtmp_init.c b/drivers/staging/rt2870/common/2870_rtmp_init.c
index 0f4c8af97e47..80909e9ab5ae 100644
--- a/drivers/staging/rt2870/common/2870_rtmp_init.c
+++ b/drivers/staging/rt2870/common/2870_rtmp_init.c
@@ -700,8 +700,8 @@ NDIS_STATUS AdapterBlockAllocateMemory(
        usb_dev = pObj->pUsb_Dev;
 #ifndef RT30xx
-        pObj->MLMEThr_task              = NULL;
+        pObj->MLMEThr_pid               = THREAD_PID_INIT_VALUE;
-        pObj->RTUSBCmdThr_task  = NULL;
+        pObj->RTUSBCmdThr_pid   = THREAD_PID_INIT_VALUE;
 #endif
 #ifdef RT30xx
        pObj->MLMEThr_pid       = NULL;
@@ -743,7 +743,7 @@ NDIS_STATUS	 CreateThreads(
        PRTMP_ADAPTER pAd = net_dev->ml_priv;
        POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
 #ifndef RT30xx
-        struct task_struct *tsk;
+        pid_t pid_number = -1;
 #endif
 #ifdef RT30xx
        pid_t pid_number;
@@ -762,10 +762,10 @@ NDIS_STATUS	 CreateThreads(
        // Creat MLME Thread
 #ifndef RT30xx
-        pObj->MLMEThr_task = NULL;
+        pObj->MLMEThr_pid= THREAD_PID_INIT_VALUE;
-        tsk = kthread_run(MlmeThread, pAd, "%s", pAd->net_dev->name);
+        pid_number = kernel_thread(MlmeThread, pAd, CLONE_VM);
+        if (pid_number < 0)
-        if (IS_ERR(tsk)) {
+        {
 #endif
 #ifdef RT30xx
        pObj->MLMEThr_pid = NULL;
@@ -778,7 +778,7 @@ NDIS_STATUS	 CreateThreads(
        }
 #ifndef RT30xx
-        pObj->MLMEThr_task = tsk;
+        pObj->MLMEThr_pid = GET_PID(pid_number);
 #endif
 #ifdef RT30xx
        pObj->MLMEThr_pid = find_get_pid(pid_number);
@@ -788,10 +788,9 @@ NDIS_STATUS	 CreateThreads(
        // Creat Command Thread
 #ifndef RT30xx
-        pObj->RTUSBCmdThr_task = NULL;
+        pObj->RTUSBCmdThr_pid= THREAD_PID_INIT_VALUE;
-        tsk = kthread_run(RTUSBCmdThread, pAd, "%s", pAd->net_dev->name);
+        pid_number = kernel_thread(RTUSBCmdThread, pAd, CLONE_VM);
+        if (pid_number < 0)
-        if (IS_ERR(tsk) < 0)
 #endif
 #ifdef RT30xx
        pObj->RTUSBCmdThr_pid = NULL;
@@ -804,7 +803,7 @@ NDIS_STATUS	 CreateThreads(
        }
 #ifndef RT30xx
-        pObj->RTUSBCmdThr_task = tsk;
+        pObj->RTUSBCmdThr_pid = GET_PID(pid_number);
 #endif
 #ifdef RT30xx
        pObj->RTUSBCmdThr_pid = find_get_pid(pid_number);
@@ -812,9 +811,9 @@ NDIS_STATUS	 CreateThreads(
        wait_for_completion(&(pAd->CmdQComplete));
 #ifndef RT30xx
-        pObj->TimerQThr_task = NULL;
+        pObj->TimerQThr_pid= THREAD_PID_INIT_VALUE;
-        tsk = kthread_run(TimerQThread, pAd, "%s", pAd->net_dev->name);
+        pid_number = kernel_thread(TimerQThread, pAd, CLONE_VM);
-        if (IS_ERR(tsk) < 0)
+        if (pid_number < 0)
 #endif
 #ifdef RT30xx
        pObj->TimerQThr_pid = NULL;
@@ -826,7 +825,7 @@ NDIS_STATUS	 CreateThreads(
                return NDIS_STATUS_FAILURE;
        }
 #ifndef RT30xx
-        pObj->TimerQThr_task = tsk;
+        pObj->TimerQThr_pid = GET_PID(pid_number);
 #endif
 #ifdef RT30xx
        pObj->TimerQThr_pid = find_get_pid(pid_number);
diff --git a/drivers/staging/rt2870/common/rtusb_io.c b/drivers/staging/rt2870/common/rtusb_io.c
index fd1b0c18f2a0..704b5c2d5091 100644
--- a/drivers/staging/rt2870/common/rtusb_io.c
+++ b/drivers/staging/rt2870/common/rtusb_io.c
@@ -984,8 +984,7 @@ NDIS_STATUS	RTUSBEnqueueCmdFromNdis(
        POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
 #ifndef RT30xx
-        BUG_ON(pObj->RTUSBCmdThr_task == NULL);
+        CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid)
-        CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task))
 #endif
 #ifdef RT30xx
        if (pObj->RTUSBCmdThr_pid < 0)
diff --git a/drivers/staging/rt2870/rt2870.h b/drivers/staging/rt2870/rt2870.h
index 29e3b53e52a1..2b8872b2fd9d 100644
--- a/drivers/staging/rt2870/rt2870.h
+++ b/drivers/staging/rt2870/rt2870.h
@@ -79,6 +79,7 @@
 {       \
        {USB_DEVICE(0x148F,0x2770)}, /* Ralink */               \
        {USB_DEVICE(0x1737,0x0071)}, /* Linksys WUSB600N */     \
+        {USB_DEVICE(0x1737,0x0070)}, /* Linksys */      \
        {USB_DEVICE(0x148F,0x2870)}, /* Ralink */               \
        {USB_DEVICE(0x148F,0x3070)}, /* Ralink */               \
        {USB_DEVICE(0x0B05,0x1731)}, /* Asus */                 \
@@ -93,12 +94,14 @@
        {USB_DEVICE(0x14B2,0x3C06)}, /* Conceptronic */         \
        {USB_DEVICE(0x14B2,0x3C28)}, /* Conceptronic */         \
        {USB_DEVICE(0x2019,0xED06)}, /* Planex Communications, Inc. */          \
+        {USB_DEVICE(0x2019,0xED14)}, /* Planex Communications, Inc. */          \
        {USB_DEVICE(0x2019,0xAB25)}, /* Planex Communications, Inc. RT3070 */           \
        {USB_DEVICE(0x07D1,0x3C09)}, /* D-Link */               \
        {USB_DEVICE(0x07D1,0x3C11)}, /* D-Link */               \
        {USB_DEVICE(0x14B2,0x3C07)}, /* AL */                   \
        {USB_DEVICE(0x14B2,0x3C12)}, /* AL */           \
        {USB_DEVICE(0x050D,0x8053)}, /* Belkin */               \
+        {USB_DEVICE(0x050D,0x815C)}, /* Belkin */               \
        {USB_DEVICE(0x14B2,0x3C23)}, /* Airlink */              \
        {USB_DEVICE(0x14B2,0x3C27)}, /* Airlink */              \
        {USB_DEVICE(0x07AA,0x002F)}, /* Corega */               \
@@ -587,16 +590,14 @@ VOID RTUSBBulkRxComplete(purbb_t pUrb, struct pt_regs *pt_regs);
 #define RTUSBMlmeUp(pAd)                \
 {                                                                   \
        POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;  \
-        BUG_ON(pObj->MLMEThr_task == NULL);                 \
+        CHECK_PID_LEGALITY(pObj->MLMEThr_pid)               \
-        CHECK_PID_LEGALITY(task_pid(pObj->MLMEThr_task))                    \
        up(&(pAd->mlme_semaphore)); \
 }
 #define RTUSBCMDUp(pAd)                 \
 {                                                                           \
        POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;  \
-        BUG_ON(pObj->RTUSBCmdThr_task == NULL);     \
+        CHECK_PID_LEGALITY(pObj->RTUSBCmdThr_pid)           \
-        CHECK_PID_LEGALITY(task_pid(pObj->RTUSBCmdThr_task))        \
            up(&(pAd->RTUSBCmd_semaphore)); \
 }
 #endif
diff --git a/drivers/staging/rtl8192su/ieee80211.h b/drivers/staging/rtl8192su/ieee80211.h
index 0edb09a536f9..ea9739318037 100644
--- a/drivers/staging/rtl8192su/ieee80211.h
+++ b/drivers/staging/rtl8192su/ieee80211.h
@@ -2645,7 +2645,7 @@ extern int ieee80211_encrypt_fragment(
        struct sk_buff *frag,
        int hdr_len);
-extern int ieee80211_xmit(struct sk_buff *skb,
+extern int rtl8192_ieee80211_xmit(struct sk_buff *skb,
                          struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211.h b/drivers/staging/rtl8192su/ieee80211/ieee80211.h
index 720bfcbfadc1..5e3a2cbed2b1 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211.h
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211.h
@@ -2645,7 +2645,7 @@ extern int ieee80211_encrypt_fragment(
        struct sk_buff *frag,
        int hdr_len);
-extern int ieee80211_xmit(struct sk_buff *skb,
+extern int rtl8192_ieee80211_xmit(struct sk_buff *skb,
                          struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c
index 7294572b990f..cba12b84be5c 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c
@@ -618,7 +618,7 @@ void ieee80211_query_seqnum(struct ieee80211_device*ieee, struct sk_buff* skb, u
        }
 }
-int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
+int rtl8192_ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0))
        struct ieee80211_device *ieee = netdev_priv(dev);
@@ -943,5 +943,6 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
        return 1;
 }
+EXPORT_SYMBOL(rtl8192_ieee80211_xmit);
 EXPORT_SYMBOL(ieee80211_txb_free);
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 4ab250743e81..70f81a8f1291 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -12142,7 +12142,7 @@ static const struct net_device_ops rtl8192_netdev_ops = {
        .ndo_set_mac_address    = r8192_set_mac_adr,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_start_xmit         = ieee80211_xmit,
+        .ndo_start_xmit         = rtl8192_ieee80211_xmit,
 };
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2,5,0)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e1f89416ef8c..2bfc41ece0e1 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -387,7 +387,6 @@ static void acm_rx_tasklet(unsigned long _acm)
        struct acm_ru *rcv;
        unsigned long flags;
        unsigned char throttled;
-        struct usb_host_endpoint *ep;
        dbg("Entering acm_rx_tasklet");
@@ -463,14 +462,12 @@ urbs:
                rcv->buffer = buf;
-                ep = (usb_pipein(acm->rx_endpoint) ? acm->dev->ep_in : acm->dev->ep_out)
+                if (acm->is_int_ep)
-                                [usb_pipeendpoint(acm->rx_endpoint)];
-                if (usb_endpoint_xfer_int(&ep->desc))
                        usb_fill_int_urb(rcv->urb, acm->dev,
                                         acm->rx_endpoint,
                                         buf->base,
                                         acm->readsize,
-                                         acm_read_bulk, rcv, ep->desc.bInterval);
+                                         acm_read_bulk, rcv, acm->bInterval);
                else
                        usb_fill_bulk_urb(rcv->urb, acm->dev,
                                          acm->rx_endpoint,
@@ -1183,6 +1180,9 @@ made_compressed_probe:
        spin_lock_init(&acm->read_lock);
        mutex_init(&acm->mutex);
        acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
+        acm->is_int_ep = usb_endpoint_xfer_int(epread);
+        if (acm->is_int_ep)
+                acm->bInterval = epread->bInterval;
        tty_port_init(&acm->port);
        acm->port.ops = &acm_port_ops;
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 1602324808ba..c4a0ee8ffccf 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -126,6 +126,8 @@ struct acm {
        unsigned int ctrl_caps;                         /* control capabilities from the class specific header */
        unsigned int susp_count;                        /* number of suspended interfaces */
        int combined_interfaces:1;                      /* control and data collapsed */
+        int is_int_ep:1;                                /* interrupt endpoints contrary to spec used */
+        u8 bInterval;
        struct acm_wb *delayed_wb;                      /* write queued for a device about to be woken */
 };
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 38b8bce782d6..4247eccf858c 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -595,7 +595,7 @@ static int usbdev_open(struct inode *inode, struct file *file)
        if (!ps)
                goto out;
-        ret = -ENOENT;
+        ret = -ENODEV;
        /* usbdev device-node */
        if (imajor(inode) == USB_DEVICE_MAJOR)
@@ -1321,7 +1321,8 @@ static int get_urb32(struct usbdevfs_urb *kurb,
                     struct usbdevfs_urb32 __user *uurb)
 {
        __u32  uptr;
-        if (get_user(kurb->type, &uurb->type) ||
+        if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
+            __get_user(kurb->type, &uurb->type) ||
            __get_user(kurb->endpoint, &uurb->endpoint) ||
            __get_user(kurb->status, &uurb->status) ||
            __get_user(kurb->flags, &uurb->flags) ||
@@ -1536,8 +1537,9 @@ static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
        u32 udata;
        uioc = compat_ptr((long)arg);
-        if (get_user(ctrl.ifno, &uioc->ifno) ||
+        if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
-            get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
+            __get_user(ctrl.ifno, &uioc->ifno) ||
+            __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
            __get_user(udata, &uioc->data))
                return -EFAULT;
        ctrl.data = compat_ptr(udata);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 7d03549c3339..11c627ce6022 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -903,7 +903,8 @@ static int ehci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                        /* already started */
                        break;
                case QH_STATE_IDLE:
-                        WARN_ON(1);
+                        /* QH might be waiting for a Clear-TT-Buffer */
+                        qh_completions(ehci, qh);
                        break;
                }
                break;
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 9a1384747f3b..7673554fa64d 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -375,12 +375,11 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                                 */
                                if ((token & QTD_STS_XACT) &&
                                                QTD_CERR(token) == 0 &&
-                                                --qh->xacterrs > 0 &&
+                                                ++qh->xacterrs < QH_XACTERR_MAX &&
                                                !urb->unlinked) {
                                        ehci_dbg(ehci,
        "detected XactErr len %zu/%zu retry %d\n",
-        qtd->length - QTD_LENGTH(token), qtd->length,
+        qtd->length - QTD_LENGTH(token), qtd->length, qh->xacterrs);
-        QH_XACTERR_MAX - qh->xacterrs);
                                        /* reset the token in the qtd and the
                                         * qh overlay (which still contains
@@ -494,7 +493,7 @@ halt:
                last = qtd;
                /* reinit the xacterr counter for the next qtd */
-                qh->xacterrs = QH_XACTERR_MAX;
+                qh->xacterrs = 0;
        }
        /* last urb's completion might still need calling */
@@ -940,7 +939,8 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
        head->qh_next.qh = qh;
        head->hw_next = dma;
-        qh->xacterrs = QH_XACTERR_MAX;
+        qh_get(qh);
+        qh->xacterrs = 0;
        qh->qh_state = QH_STATE_LINKED;
        /* qtd completions reported later by interrupt */
 }
@@ -1080,7 +1080,7 @@ submit_async (
         * the HC and TT handle it when the TT has a buffer ready.
         */
        if (likely (qh->qh_state == QH_STATE_IDLE))
-                qh_link_async (ehci, qh_get (qh));
+                qh_link_async(ehci, qh);
 done:
        spin_unlock_irqrestore (&ehci->lock, flags);
        if (unlikely (qh == NULL))
@@ -1115,8 +1115,6 @@ static void end_unlink_async (struct ehci_hcd *ehci)
                        && HC_IS_RUNNING (ehci_to_hcd(ehci)->state))
                qh_link_async (ehci, qh);
        else {
-                qh_put (qh);            // refcount from async list
                /* it's not free to turn the async schedule on/off; leave it
                 * active but idle for a while once it empties.
                 */
@@ -1124,6 +1122,7 @@ static void end_unlink_async (struct ehci_hcd *ehci)
                                && ehci->async->qh_next.qh == NULL)
                        timer_action (ehci, TIMER_ASYNC_OFF);
        }
+        qh_put(qh);                     /* refcount from async list */
        if (next) {
                ehci->reclaim = NULL;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 74f7f83b29ad..edd61ee90323 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -542,6 +542,7 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
                }
        }
        qh->qh_state = QH_STATE_LINKED;
+        qh->xacterrs = 0;
        qh_get (qh);
        /* update per-qh bandwidth for usbfs */
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 70073b157f0a..803adcb5ac1d 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -12,6 +12,7 @@ config USB_MUSB_HDRC
        depends on !SUPERH
        select NOP_USB_XCEIV if ARCH_DAVINCI
        select TWL4030_USB if MACH_OMAP_3430SDP
+        select NOP_USB_XCEIV if MACH_OMAP3EVM
        select USB_OTG_UTILS
        tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
        help
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index b574878c78b2..8fec5d4455c9 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -699,6 +699,9 @@ static struct usb_device_id id_table_combined [] = {
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
        { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
+        { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+        { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { },                                    /* Optional parameter entry */
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 24dbd99e87d7..8c92b88166ae 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -954,6 +954,20 @@
 #define AURICAL_USB_PID         0x0010  /* Aurical USB Audiometer */
 /*
+ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+ * http://winglucofacts.com/cables/
+ */
+#define BAYER_VID                      0x1A79
+#define BAYER_CONTOUR_CABLE_PID        0x6001
+/*
+ * Marvell OpenRD Base, Client
+ * http://www.open-rd.org
+ * OpenRD Base, Client use VID 0x0403
+ */
+#define MARVELL_OPENRD_PID      0x9e90
+/*
 *   BmRequestType:  1100 0000b
 *   bRequest:       FTDI_E2_READ
 *   wValue:         0
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 7d15bfa7c2db..3e86815b2705 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -95,6 +95,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
        { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
        { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+        { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 12aac7d2462d..ee9505e1dd92 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -126,3 +126,7 @@
 /* Cressi Edy (diving computer) PC interface */
 #define CRESSI_VENDOR_ID        0x04b8
 #define CRESSI_EDY_PRODUCT_ID   0x0521
+/* Sony, USB data cable for CMD-Jxx mobile phones */
+#define SONY_VENDOR_ID          0x054c
+#define SONY_QN3USB_PRODUCT_ID  0x0437
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 1b9c5dd0fb27..7477d411959f 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0001,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY ),
+/* Reported by Rogerio Brito <rbrito@ime.usp.br> */
+UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
+                "Prolific Technology, Inc.",
+                "Mass Storage Device",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_NOT_LOCKABLE ),
 /* Reported by Richard -=[]=- <micro_flyer@hotmail.com> */
 /* Change to bcdDeviceMin (0x0100 to 0x0001) reported by
 * Thomas Bartosik <tbartdev@gmx-topmail.de> */
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 471a9a60376a..3a44695b9c09 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1082,7 +1082,6 @@ static void fbcon_init(struct vc_data *vc, int init)
        new_rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
        new_cols /= vc->vc_font.width;
        new_rows /= vc->vc_font.height;
-        vc_resize(vc, new_cols, new_rows);
        /*
         * We must always set the mode. The mode of the previous console
@@ -1111,10 +1110,11 @@ static void fbcon_init(struct vc_data *vc, int init)
         *  vc_{cols,rows}, but we must not set those if we are only
         *  resizing the console.
         */
-        if (!init) {
+        if (init) {
                vc->vc_cols = new_cols;
                vc->vc_rows = new_rows;
-        }
+        } else
+                vc_resize(vc, new_cols, new_rows);
        if (logo)
                fbcon_prepare_logo(vc, info, cols, rows, new_cols, new_rows);
diff --git a/drivers/video/console/fbcon_rotate.h b/drivers/video/console/fbcon_rotate.h
index 75be5ce53dc5..e233444cda66 100644
--- a/drivers/video/console/fbcon_rotate.h
+++ b/drivers/video/console/fbcon_rotate.h
@@ -45,7 +45,7 @@ static inline void rotate_ud(const char *in, char *out, u32 width, u32 height)
        width = (width + 7) & ~7;
        for (i = 0; i < height; i++) {
-                for (j = 0; j < width; j++) {
+                for (j = 0; j < width - shift; j++) {
                        if (pattern_test_bit(j, i, width, in))
                                pattern_set_bit(width - (1 + j + shift),
                                                height - (1 + i),
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index ef7870f5ea08..857b3668b3ba 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -957,9 +957,14 @@ static int __devinit sticore_pci_init(struct pci_dev *pd,
 #ifdef CONFIG_PCI
        unsigned long fb_base, rom_base;
        unsigned int fb_len, rom_len;
+        int err;
        struct sti_struct *sti;
        
-        pci_enable_device(pd);
+        err = pci_enable_device(pd);
+        if (err < 0) {
+                dev_err(&pd->dev, "Cannot enable PCI device\n");
+                return err;
+        }
        fb_base = pci_resource_start(pd, 0);
        fb_len = pci_resource_len(pd, 0);
@@ -1048,7 +1053,7 @@ static void __devinit sti_init_roms(void)
        /* Register drivers for native & PCI cards */
        register_parisc_driver(&pa_sti_driver);
-        pci_register_driver(&pci_sti_driver);
+        WARN_ON(pci_register_driver(&pci_sti_driver));
        /* if we didn't find the given default sti, take the first one */
        if (!default_sti)
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index f8778cde2183..054ef29be479 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -669,7 +669,8 @@ static uint32_t bpp_to_pixfmt(int bpp)
 }
 static int mx3fb_blank(int blank, struct fb_info *fbi);
-static int mx3fb_map_video_memory(struct fb_info *fbi, unsigned int mem_len);
+static int mx3fb_map_video_memory(struct fb_info *fbi, unsigned int mem_len,
+                                  bool lock);
 static int mx3fb_unmap_video_memory(struct fb_info *fbi);
 /**
@@ -711,12 +712,7 @@ static void mx3fb_dma_done(void *arg)
        complete(&mx3_fbi->flip_cmpl);
 }
-/**
+static int __set_par(struct fb_info *fbi, bool lock)
- * mx3fb_set_par() - set framebuffer parameters and change the operating mode.
- * @fbi:        framebuffer information pointer.
- * @return:     0 on success or negative error code on failure.
- */
-static int mx3fb_set_par(struct fb_info *fbi)
 {
        u32 mem_len;
        struct ipu_di_signal_cfg sig_cfg;
@@ -727,10 +723,6 @@ static int mx3fb_set_par(struct fb_info *fbi)
        struct idmac_video_param *video = &ichan->params.video;
        struct scatterlist *sg = mx3_fbi->sg;
-        dev_dbg(mx3fb->dev, "%s [%c]\n", __func__, list_empty(&ichan->queue) ? '-' : '+');
-        mutex_lock(&mx3_fbi->mutex);
        /* Total cleanup */
        if (mx3_fbi->txd)
                sdc_disable_channel(mx3_fbi);
@@ -742,10 +734,8 @@ static int mx3fb_set_par(struct fb_info *fbi)
                if (fbi->fix.smem_start)
                        mx3fb_unmap_video_memory(fbi);
-                if (mx3fb_map_video_memory(fbi, mem_len) < 0) {
+                if (mx3fb_map_video_memory(fbi, mem_len, lock) < 0)
-                        mutex_unlock(&mx3_fbi->mutex);
                        return -ENOMEM;
-                }
        }
        sg_init_table(&sg[0], 1);
@@ -791,7 +781,6 @@ static int mx3fb_set_par(struct fb_info *fbi)
                                   fbi->var.vsync_len,
                                   fbi->var.lower_margin +
                                   fbi->var.vsync_len, sig_cfg) != 0) {
-                        mutex_unlock(&mx3_fbi->mutex);
                        dev_err(fbi->device,
                                "mx3fb: Error initializing panel.\n");
                        return -EINVAL;
@@ -810,9 +799,30 @@ static int mx3fb_set_par(struct fb_info *fbi)
        if (mx3_fbi->blank == FB_BLANK_UNBLANK)
                sdc_enable_channel(mx3_fbi);
+        return 0;
+}
+/**
+ * mx3fb_set_par() - set framebuffer parameters and change the operating mode.
+ * @fbi:        framebuffer information pointer.
+ * @return:     0 on success or negative error code on failure.
+ */
+static int mx3fb_set_par(struct fb_info *fbi)
+{
+        struct mx3fb_info *mx3_fbi = fbi->par;
+        struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
+        struct idmac_channel *ichan = mx3_fbi->idmac_channel;
+        int ret;
+        dev_dbg(mx3fb->dev, "%s [%c]\n", __func__, list_empty(&ichan->queue) ? '-' : '+');
+        mutex_lock(&mx3_fbi->mutex);
+        ret = __set_par(fbi, true);
        mutex_unlock(&mx3_fbi->mutex);
-        return 0;
+        return ret;
 }
 /**
@@ -966,21 +976,11 @@ static int mx3fb_setcolreg(unsigned int regno, unsigned int red,
        return ret;
 }
-/**
+static void __blank(int blank, struct fb_info *fbi)
- * mx3fb_blank() - blank the display.
- */
-static int mx3fb_blank(int blank, struct fb_info *fbi)
 {
        struct mx3fb_info *mx3_fbi = fbi->par;
        struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
-        dev_dbg(fbi->device, "%s, blank = %d, base %p, len %u\n", __func__,
-                blank, fbi->screen_base, fbi->fix.smem_len);
-        if (mx3_fbi->blank == blank)
-                return 0;
-        mutex_lock(&mx3_fbi->mutex);
        mx3_fbi->blank = blank;
        switch (blank) {
@@ -999,6 +999,23 @@ static int mx3fb_blank(int blank, struct fb_info *fbi)
                sdc_set_brightness(mx3fb, mx3fb->backlight_level);
                break;
        }
+}
+/**
+ * mx3fb_blank() - blank the display.
+ */
+static int mx3fb_blank(int blank, struct fb_info *fbi)
+{
+        struct mx3fb_info *mx3_fbi = fbi->par;
+        dev_dbg(fbi->device, "%s, blank = %d, base %p, len %u\n", __func__,
+                blank, fbi->screen_base, fbi->fix.smem_len);
+        if (mx3_fbi->blank == blank)
+                return 0;
+        mutex_lock(&mx3_fbi->mutex);
+        __blank(blank, fbi);
        mutex_unlock(&mx3_fbi->mutex);
        return 0;
@@ -1198,6 +1215,7 @@ static int mx3fb_resume(struct platform_device *pdev)
 * mx3fb_map_video_memory() - allocates the DRAM memory for the frame buffer.
 * @fbi:        framebuffer information pointer
 * @mem_len:    length of mapped memory
+ * @lock:       do not lock during initialisation
 * @return:     Error code indicating success or failure
 *
 * This buffer is remapped into a non-cached, non-buffered, memory region to
@@ -1205,7 +1223,8 @@ static int mx3fb_resume(struct platform_device *pdev)
 * area is remapped, all virtual memory access to the video memory should occur
 * at the new region.
 */
-static int mx3fb_map_video_memory(struct fb_info *fbi, unsigned int mem_len)
+static int mx3fb_map_video_memory(struct fb_info *fbi, unsigned int mem_len,
+                                  bool lock)
 {
        int retval = 0;
        dma_addr_t addr;
@@ -1221,10 +1240,12 @@ static int mx3fb_map_video_memory(struct fb_info *fbi, unsigned int mem_len)
                goto err0;
        }
-        mutex_lock(&fbi->mm_lock);
+        if (lock)
+                mutex_lock(&fbi->mm_lock);
        fbi->fix.smem_start = addr;
        fbi->fix.smem_len = mem_len;
-        mutex_unlock(&fbi->mm_lock);
+        if (lock)
+                mutex_unlock(&fbi->mm_lock);
        dev_dbg(fbi->device, "allocated fb @ p=0x%08x, v=0x%p, size=%d.\n",
                (uint32_t) fbi->fix.smem_start, fbi->screen_base, fbi->fix.smem_len);
@@ -1365,6 +1386,11 @@ static int init_fb_chan(struct mx3fb_data *mx3fb, struct idmac_channel *ichan)
        init_completion(&mx3fbi->flip_cmpl);
        disable_irq(ichan->eof_irq);
        dev_dbg(mx3fb->dev, "disabling irq %d\n", ichan->eof_irq);
+        ret = __set_par(fbi, false);
+        if (ret < 0)
+                goto esetpar;
+        __blank(FB_BLANK_UNBLANK, fbi);
        dev_info(dev, "registered, using mode %s\n", fb_mode);
diff --git a/drivers/video/via/hw.c b/drivers/video/via/hw.c
index fcd53ceb88fa..c8960003f47d 100644
--- a/drivers/video/via/hw.c
+++ b/drivers/video/via/hw.c
@@ -2407,14 +2407,14 @@ int viafb_setmode(int vmode_index, int hor_res, int ver_res, int video_bpp,
                        viafb_dvi_set_mode(viafb_get_mode_index
                                     (viaparinfo->tmds_setting_info->h_active,
                                      viaparinfo->tmds_setting_info->
-                                      v_active, 1),
+                                      v_active),
                                     video_bpp1, viaparinfo->
                                     tmds_setting_info->iga_path);
                } else {
                        viafb_dvi_set_mode(viafb_get_mode_index
                                     (viaparinfo->tmds_setting_info->h_active,
                                      viaparinfo->
-                                      tmds_setting_info->v_active, 0),
+                                      tmds_setting_info->v_active),
                                     video_bpp, viaparinfo->
                                     tmds_setting_info->iga_path);
                }
diff --git a/drivers/video/via/lcd.c b/drivers/video/via/lcd.c
index 6c7290a6a447..78c6b3387947 100644
--- a/drivers/video/via/lcd.c
+++ b/drivers/video/via/lcd.c
@@ -580,10 +580,7 @@ static void load_lcd_k400_patch_tbl(int set_hres, int set_vres,
        int reg_num = 0;
        struct io_reg *lcd_patch_reg = NULL;
-        if (viaparinfo->lvds_setting_info->iga_path == IGA2)
+        vmode_index = viafb_get_mode_index(set_hres, set_vres);
-                vmode_index = viafb_get_mode_index(set_hres, set_vres, 1);
-        else
-                vmode_index = viafb_get_mode_index(set_hres, set_vres, 0);
        switch (panel_id) {
                /* LCD 800x600 */
        case LCD_PANEL_ID1_800X600:
@@ -761,10 +758,7 @@ static void load_lcd_p880_patch_tbl(int set_hres, int set_vres,
        int reg_num = 0;
        struct io_reg *lcd_patch_reg = NULL;
-        if (viaparinfo->lvds_setting_info->iga_path == IGA2)
+        vmode_index = viafb_get_mode_index(set_hres, set_vres);
-                vmode_index = viafb_get_mode_index(set_hres, set_vres, 1);
-        else
-                vmode_index = viafb_get_mode_index(set_hres, set_vres, 0);
        switch (panel_id) {
        case LCD_PANEL_ID5_1400X1050:
@@ -832,10 +826,7 @@ static void load_lcd_patch_regs(int set_hres, int set_vres,
 {
        int vmode_index;
-        if (viaparinfo->lvds_setting_info->iga_path == IGA2)
+        vmode_index = viafb_get_mode_index(set_hres, set_vres);
-                vmode_index = viafb_get_mode_index(set_hres, set_vres, 1);
-        else
-                vmode_index = viafb_get_mode_index(set_hres, set_vres, 0);
        viafb_unlock_crt();
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index a0fec298216e..72833f3334b5 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -32,7 +32,6 @@ static u32 pseudo_pal[17];
 /* video mode */
 static char *viafb_mode = "640x480";
 static char *viafb_mode1 = "640x480";
-static int viafb_resMode = VIA_RES_640X480;
 /* Added for specifying active devices.*/
 char *viafb_active_dev = "";
@@ -56,47 +55,47 @@ static void viafb_get_video_device(u32 *video_dev_info);
 /* Mode information */
 static const struct viafb_modeinfo viafb_modentry[] = {
-        {480, 640, VIA_RES_480X640, "480x640"},
+        {480, 640, VIA_RES_480X640},
-        {640, 480, VIA_RES_640X480, "640x480"},
+        {640, 480, VIA_RES_640X480},
-        {800, 480, VIA_RES_800X480, "800x480"},
+        {800, 480, VIA_RES_800X480},
-        {800, 600, VIA_RES_800X600, "800x600"},
+        {800, 600, VIA_RES_800X600},
-        {1024, 768, VIA_RES_1024X768, "1024x768"},
+        {1024, 768, VIA_RES_1024X768},
-        {1152, 864, VIA_RES_1152X864, "1152x864"},
+        {1152, 864, VIA_RES_1152X864},
-        {1280, 1024, VIA_RES_1280X1024, "1280x1024"},
+        {1280, 1024, VIA_RES_1280X1024},
-        {1600, 1200, VIA_RES_1600X1200, "1600x1200"},
+        {1600, 1200, VIA_RES_1600X1200},
-        {1440, 1050, VIA_RES_1440X1050, "1440x1050"},
+        {1440, 1050, VIA_RES_1440X1050},
-        {1280, 768, VIA_RES_1280X768, "1280x768"},
+        {1280, 768, VIA_RES_1280X768,},
-        {1280, 800, VIA_RES_1280X800, "1280x800"},
+        {1280, 800, VIA_RES_1280X800},
-        {1280, 960, VIA_RES_1280X960, "1280x960"},
+        {1280, 960, VIA_RES_1280X960},
-        {1920, 1440, VIA_RES_1920X1440, "1920x1440"},
+        {1920, 1440, VIA_RES_1920X1440},
-        {848, 480, VIA_RES_848X480, "848x480"},
+        {848, 480, VIA_RES_848X480},
-        {1400, 1050, VIA_RES_1400X1050, "1400x1050"},
+        {1400, 1050, VIA_RES_1400X1050},
-        {720, 480, VIA_RES_720X480, "720x480"},
+        {720, 480, VIA_RES_720X480},
-        {720, 576, VIA_RES_720X576, "720x576"},
+        {720, 576, VIA_RES_720X576},
-        {1024, 512, VIA_RES_1024X512, "1024x512"},
+        {1024, 512, VIA_RES_1024X512},
-        {1024, 576, VIA_RES_1024X576, "1024x576"},
+        {1024, 576, VIA_RES_1024X576},
-        {1024, 600, VIA_RES_1024X600, "1024x600"},
+        {1024, 600, VIA_RES_1024X600},
-        {1280, 720, VIA_RES_1280X720, "1280x720"},
+        {1280, 720, VIA_RES_1280X720},
-        {1920, 1080, VIA_RES_1920X1080, "1920x1080"},
+        {1920, 1080, VIA_RES_1920X1080},
-        {1366, 768, VIA_RES_1368X768, "1368x768"},
+        {1366, 768, VIA_RES_1368X768},
-        {1680, 1050, VIA_RES_1680X1050, "1680x1050"},
+        {1680, 1050, VIA_RES_1680X1050},
-        {960, 600, VIA_RES_960X600, "960x600"},
+        {960, 600, VIA_RES_960X600},
-        {1000, 600, VIA_RES_1000X600, "1000x600"},
+        {1000, 600, VIA_RES_1000X600},
-        {1024, 576, VIA_RES_1024X576, "1024x576"},
+        {1024, 576, VIA_RES_1024X576},
-        {1024, 600, VIA_RES_1024X600, "1024x600"},
+        {1024, 600, VIA_RES_1024X600},
-        {1088, 612, VIA_RES_1088X612, "1088x612"},
+        {1088, 612, VIA_RES_1088X612},
-        {1152, 720, VIA_RES_1152X720, "1152x720"},
+        {1152, 720, VIA_RES_1152X720},
-        {1200, 720, VIA_RES_1200X720, "1200x720"},
+        {1200, 720, VIA_RES_1200X720},
-        {1280, 600, VIA_RES_1280X600, "1280x600"},
+        {1280, 600, VIA_RES_1280X600},
-        {1360, 768, VIA_RES_1360X768, "1360x768"},
+        {1360, 768, VIA_RES_1360X768},
-        {1440, 900, VIA_RES_1440X900, "1440x900"},
+        {1440, 900, VIA_RES_1440X900},
-        {1600, 900, VIA_RES_1600X900, "1600x900"},
+        {1600, 900, VIA_RES_1600X900},
-        {1600, 1024, VIA_RES_1600X1024, "1600x1024"},
+        {1600, 1024, VIA_RES_1600X1024},
-        {1792, 1344, VIA_RES_1792X1344, "1792x1344"},
+        {1792, 1344, VIA_RES_1792X1344},
-        {1856, 1392, VIA_RES_1856X1392, "1856x1392"},
+        {1856, 1392, VIA_RES_1856X1392},
-        {1920, 1200, VIA_RES_1920X1200, "1920x1200"},
+        {1920, 1200, VIA_RES_1920X1200},
-        {2048, 1536, VIA_RES_2048X1536, "2048x1536"},
+        {2048, 1536, VIA_RES_2048X1536},
-        {0, 0, VIA_RES_INVALID, "640x480"}
+        {0, 0, VIA_RES_INVALID}
 };
 static struct fb_ops viafb_ops;
@@ -177,7 +176,7 @@ static int viafb_check_var(struct fb_var_screeninfo *var,
        if (var->vmode & FB_VMODE_INTERLACED || var->vmode & FB_VMODE_DOUBLE)
                return -EINVAL;
-        vmode_index = viafb_get_mode_index(var->xres, var->yres, 0);
+        vmode_index = viafb_get_mode_index(var->xres, var->yres);
        if (vmode_index == VIA_RES_INVALID) {
                DEBUG_MSG(KERN_INFO
                          "viafb: Mode %dx%dx%d not supported!!\n",
@@ -233,14 +232,14 @@ static int viafb_set_par(struct fb_info *info)
        viafb_update_device_setting(info->var.xres, info->var.yres,
                              info->var.bits_per_pixel, viafb_refresh, 0);
-        vmode_index = viafb_get_mode_index(info->var.xres, info->var.yres, 0);
+        vmode_index = viafb_get_mode_index(info->var.xres, info->var.yres);
        if (viafb_SAMM_ON == 1) {
                DEBUG_MSG(KERN_INFO
                "viafb_second_xres = %d, viafb_second_yres = %d, bpp = %d\n",
                          viafb_second_xres, viafb_second_yres, viafb_bpp1);
                vmode_index1 = viafb_get_mode_index(viafb_second_xres,
-                        viafb_second_yres, 1);
+                        viafb_second_yres);
                DEBUG_MSG(KERN_INFO "->viafb_SAMM_ON: index=%d\n",
                        vmode_index1);
@@ -1262,7 +1261,7 @@ static int viafb_sync(struct fb_info *info)
        return 0;
 }
-int viafb_get_mode_index(int hres, int vres, int flag)
+int viafb_get_mode_index(int hres, int vres)
 {
        u32 i;
        DEBUG_MSG(KERN_INFO "viafb_get_mode_index!\n");
@@ -1272,13 +1271,7 @@ int viafb_get_mode_index(int hres, int vres, int flag)
                        viafb_modentry[i].yres == vres)
                        break;
-        viafb_resMode = viafb_modentry[i].mode_index;
+        return viafb_modentry[i].mode_index;
-        if (flag)
-                viafb_mode1 = viafb_modentry[i].mode_res;
-        else
-                viafb_mode = viafb_modentry[i].mode_res;
-        return viafb_resMode;
 }
 static void check_available_device_to_enable(int device_id)
@@ -2199,7 +2192,7 @@ static int __devinit via_pci_probe(void)
        strict_strtoul(tmpc, 0, &default_xres);
        strict_strtoul(tmpm, 0, &default_yres);
-        vmode_index = viafb_get_mode_index(default_xres, default_yres, 0);
+        vmode_index = viafb_get_mode_index(default_xres, default_yres);
        DEBUG_MSG(KERN_INFO "0->index=%d\n", vmode_index);
        if (viafb_SAMM_ON == 1) {
diff --git a/drivers/video/via/viafbdev.h b/drivers/video/via/viafbdev.h
index a4158e872878..227b000feb38 100644
--- a/drivers/video/via/viafbdev.h
+++ b/drivers/video/via/viafbdev.h
@@ -81,7 +81,6 @@ struct viafb_modeinfo {
        u32 xres;
        u32 yres;
        int mode_index;
-        char *mode_res;
 };
 extern unsigned int viafb_second_virtual_yres;
 extern unsigned int viafb_second_virtual_xres;
@@ -102,7 +101,7 @@ extern int strict_strtoul(const char *cp, unsigned int base,
 void viafb_memory_pitch_patch(struct fb_info *info);
 void viafb_fill_var_timing_info(struct fb_var_screeninfo *var, int refresh,
                          int mode_index);
-int viafb_get_mode_index(int hres, int vres, int flag);
+int viafb_get_mode_index(int hres, int vres);
 u8 viafb_gpio_i2c_read_lvds(struct lvds_setting_information
        *plvds_setting_info, struct lvds_chip_information
        *plvds_chip_info, u8 index);
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index a7e3b706b9d3..0d92969404c3 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -687,6 +687,7 @@ static int omap_hdq_remove(struct platform_device *pdev)
        if (hdq_data->hdq_usecount) {
                dev_dbg(&pdev->dev, "removed when use count is not zero\n");
+                mutex_unlock(&hdq_data->hdq_mutex);
                return -EBUSY;
        }
diff --git a/drivers/watchdog/ks8695_wdt.c b/drivers/watchdog/ks8695_wdt.c
index 00b03eb43bf0..e1c82769b08e 100644
--- a/drivers/watchdog/ks8695_wdt.c
+++ b/drivers/watchdog/ks8695_wdt.c
@@ -66,7 +66,7 @@ static inline void ks8695_wdt_stop(void)
 static inline void ks8695_wdt_start(void)
 {
        unsigned long tmcon;
-        unsigned long tval = wdt_time * CLOCK_TICK_RATE;
+        unsigned long tval = wdt_time * KS8695_CLOCK_RATE;
        spin_lock(&ks8695_lock);
        /* disable timer0 */
@@ -103,7 +103,7 @@ static inline void ks8695_wdt_reload(void)
 static int ks8695_wdt_settimeout(int new_time)
 {
        /*
-         * All counting occurs at SLOW_CLOCK / 128 = 0.256 Hz
+         * All counting occurs at KS8695_CLOCK_RATE / 128 = 0.256 Hz
         *
         * Since WDV is a 16-bit counter, the maximum period is
         * 65536 / 0.256 = 256 seconds.
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 697f6b5f1313..e92f229e3c6e 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -828,15 +828,22 @@ static int load_flat_shared_library(int id, struct lib_info *libs)
        if (IS_ERR(bprm.file))
                return res;
+        bprm.cred = prepare_exec_creds();
+        res = -ENOMEM;
+        if (!bprm.cred)
+                goto out;
        res = prepare_binprm(&bprm);
        if (res <= (unsigned long)-4096)
                res = load_flat_file(&bprm, libs, id, NULL);
-        if (bprm.file) {
-                allow_write_access(bprm.file);
+        abort_creds(bprm.cred);
-                fput(bprm.file);
-                bprm.file = NULL;
+out:
-        }
+        allow_write_access(bprm.file);
+        fput(bprm.file);
        return(res);
 }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index dc84daee6bc4..72a2b9c28e9f 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -265,10 +265,6 @@ static int caching_kthread(void *data)
        atomic_inc(&block_group->space_info->caching_threads);
        last = max_t(u64, block_group->key.objectid, BTRFS_SUPER_INFO_OFFSET);
-again:
-        /* need to make sure the commit_root doesn't disappear */
-        down_read(&fs_info->extent_commit_sem);
        /*
         * We don't want to deadlock with somebody trying to allocate a new
         * extent for the extent root while also trying to search the extent
@@ -282,6 +278,10 @@ again:
        key.objectid = last;
        key.offset = 0;
        btrfs_set_key_type(&key, BTRFS_EXTENT_ITEM_KEY);
+again:
+        /* need to make sure the commit_root doesn't disappear */
+        down_read(&fs_info->extent_commit_sem);
        ret = btrfs_search_slot(NULL, fs_info->extent_root, &key, path, 0, 0);
        if (ret < 0)
                goto err;
@@ -304,6 +304,19 @@ again:
                        if (need_resched() ||
                            btrfs_transaction_in_commit(fs_info)) {
+                                leaf = path->nodes[0];
+                                /* this shouldn't happen, but if the
+                                 * leaf is empty just move on.
+                                 */
+                                if (btrfs_header_nritems(leaf) == 0)
+                                        break;
+                                /*
+                                 * we need to copy the key out so that
+                                 * we are sure the next search advances
+                                 * us forward in the btree.
+                                 */
+                                btrfs_item_key_to_cpu(leaf, &key, 0);
                                btrfs_release_path(fs_info->extent_root, path);
                                up_read(&fs_info->extent_commit_sem);
                                schedule_timeout(1);
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index af99b78b288e..5edcee3a617f 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -414,11 +414,29 @@ static noinline int remove_from_bitmap(struct btrfs_block_group_cache *block_gro
                              u64 *offset, u64 *bytes)
 {
        u64 end;
+        u64 search_start, search_bytes;
+        int ret;
 again:
        end = bitmap_info->offset +
                (u64)(BITS_PER_BITMAP * block_group->sectorsize) - 1;
+        /*
+         * XXX - this can go away after a few releases.
+         *
+         * since the only user of btrfs_remove_free_space is the tree logging
+         * stuff, and the only way to test that is under crash conditions, we
+         * want to have this debug stuff here just in case somethings not
+         * working.  Search the bitmap for the space we are trying to use to
+         * make sure its actually there.  If its not there then we need to stop
+         * because something has gone wrong.
+         */
+        search_start = *offset;
+        search_bytes = *bytes;
+        ret = search_bitmap(block_group, bitmap_info, &search_start,
+                            &search_bytes);
+        BUG_ON(ret < 0 || search_start != *offset);
        if (*offset > bitmap_info->offset && *offset + *bytes > end) {
                bitmap_clear_bits(block_group, bitmap_info, *offset,
                                  end - *offset + 1);
@@ -430,6 +448,7 @@ again:
        }
        if (*bytes) {
+                struct rb_node *next = rb_next(&bitmap_info->offset_index);
                if (!bitmap_info->bytes) {
                        unlink_free_space(block_group, bitmap_info);
                        kfree(bitmap_info->bitmap);
@@ -438,16 +457,36 @@ again:
                        recalculate_thresholds(block_group);
                }
-                bitmap_info = tree_search_offset(block_group,
+                /*
-                                                 offset_to_bitmap(block_group,
+                 * no entry after this bitmap, but we still have bytes to
-                                                                  *offset),
+                 * remove, so something has gone wrong.
-                                                 1, 0);
+                 */
-                if (!bitmap_info)
+                if (!next)
                        return -EINVAL;
+                bitmap_info = rb_entry(next, struct btrfs_free_space,
+                                       offset_index);
+                /*
+                 * if the next entry isn't a bitmap we need to return to let the
+                 * extent stuff do its work.
+                 */
                if (!bitmap_info->bitmap)
                        return -EAGAIN;
+                /*
+                 * Ok the next item is a bitmap, but it may not actually hold
+                 * the information for the rest of this free space stuff, so
+                 * look for it, and if we don't find it return so we can try
+                 * everything over again.
+                 */
+                search_start = *offset;
+                search_bytes = *bytes;
+                ret = search_bitmap(block_group, bitmap_info, &search_start,
+                                    &search_bytes);
+                if (ret < 0 || search_start != *offset)
+                        return -EAGAIN;
                goto again;
        } else if (!bitmap_info->bytes) {
                unlink_free_space(block_group, bitmap_info);
@@ -644,8 +683,17 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
 again:
        info = tree_search_offset(block_group, offset, 0, 0);
        if (!info) {
-                WARN_ON(1);
+                /*
-                goto out_lock;
+                 * oops didn't find an extent that matched the space we wanted
+                 * to remove, look for a bitmap instead
+                 */
+                info = tree_search_offset(block_group,
+                                          offset_to_bitmap(block_group, offset),
+                                          1, 0);
+                if (!info) {
+                        WARN_ON(1);
+                        goto out_lock;
+                }
        }
        if (info->bytes < bytes && rb_next(&info->offset_index)) {
@@ -957,8 +1005,15 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
        if (cluster->block_group != block_group)
                goto out;
-        entry = tree_search_offset(block_group, search_start, 0, 0);
+        /*
+         * search_start is the beginning of the bitmap, but at some point it may
+         * be a good idea to point to the actual start of the free area in the
+         * bitmap, so do the offset_to_bitmap trick anyway, and set bitmap_only
+         * to 1 to make sure we get the bitmap entry
+         */
+        entry = tree_search_offset(block_group,
+                                   offset_to_bitmap(block_group, search_start),
+                                   1, 0);
        if (!entry || !entry->bitmap)
                goto out;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 56fe83fa60c4..272b9b2bea86 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4785,8 +4785,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         * and the replacement file is large.  Start IO on it now so
         * we don't add too much work to the end of the transaction
         */
-        if (new_inode && old_inode && S_ISREG(old_inode->i_mode) &&
+        if (new_inode && S_ISREG(old_inode->i_mode) && new_inode->i_size &&
-            new_inode->i_size &&
            old_inode->i_size > BTRFS_ORDERED_OPERATIONS_FLUSH_LIMIT)
                filemap_flush(old_inode->i_mapping);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index e71264d1c2c9..c04f7f212602 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2553,8 +2553,13 @@ int relocate_inode_pages(struct inode *inode, u64 start, u64 len)
        last_index = (start + len - 1) >> PAGE_CACHE_SHIFT;
        /* make sure the dirty trick played by the caller work */
-        ret = invalidate_inode_pages2_range(inode->i_mapping,
+        while (1) {
-                                            first_index, last_index);
+                ret = invalidate_inode_pages2_range(inode->i_mapping,
+                                                    first_index, last_index);
+                if (ret != -EBUSY)
+                        break;
+                schedule_timeout(HZ/10);
+        }
        if (ret)
                goto out_unlock;
diff --git a/fs/btrfs/zlib.c b/fs/btrfs/zlib.c
index ecfbce836d32..3e2b90eaa239 100644
--- a/fs/btrfs/zlib.c
+++ b/fs/btrfs/zlib.c
@@ -208,7 +208,7 @@ int btrfs_zlib_compress_pages(struct address_space *mapping,
        *total_in = 0;
        workspace = find_zlib_workspace();
-        if (!workspace)
+        if (IS_ERR(workspace))
                return -1;
        if (Z_OK != zlib_deflateInit(&workspace->def_strm, 3)) {
@@ -366,7 +366,7 @@ int btrfs_zlib_decompress_biovec(struct page **pages_in,
        char *kaddr;
        workspace = find_zlib_workspace();
-        if (!workspace)
+        if (IS_ERR(workspace))
                return -ENOMEM;
        data_in = kmap(pages_in[page_in_index]);
@@ -547,7 +547,7 @@ int btrfs_zlib_decompress(unsigned char *data_in,
                return -ENOMEM;
        workspace = find_zlib_workspace();
-        if (!workspace)
+        if (IS_ERR(workspace))
                return -ENOMEM;
        workspace->inf_strm.next_in = data_in;
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 92888aa90749..e85b1e4389e0 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,10 @@
+Version 1.60
+-------------
+Fix memory leak in reconnect.  Fix oops in DFS mount error path.
+Set s_maxbytes to smaller (the max that vfs can handle) so that
+sendfile will now work over cifs mounts again.  Add noforcegid
+and noforceuid mount parameters.
 Version 1.59
 ------------
 Client uses server inode numbers (which are persistent) rather than
diff --git a/fs/cifs/README b/fs/cifs/README
index ad92921dbde4..79c1a93400be 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -262,11 +262,11 @@ A partial list of the supported mount options follows:
                mount.  
  domain        Set the SMB/CIFS workgroup name prepended to the
                username during CIFS session establishment
-  forceuid      Set the default uid for inodes based on the uid
+  forceuid      Set the default uid for inodes to the uid
-                passed in. For mounts to servers
+                passed in on mount. For mounts to servers
                which do support the CIFS Unix extensions, such as a
                properly configured Samba server, the server provides
-                the uid, gid and mode so this parameter should  not be
+                the uid, gid and mode so this parameter should not be
                specified unless the server and clients uid and gid
                numbering differ.  If the server and client are in the
                same domain (e.g. running winbind or nss_ldap) and
@@ -278,11 +278,7 @@ A partial list of the supported mount options follows:
                of existing files will be the uid (gid) of the person
                who executed the mount (root, except when mount.cifs
                is configured setuid for user mounts) unless the "uid=" 
-                (gid) mount option is specified.  For the uid (gid) of newly
+                (gid) mount option is specified. Also note that permission
-                created files and directories, ie files created since 
-                the last mount of the server share, the expected uid 
-                (gid) is cached as long as the inode remains in 
-                memory on the client.   Also note that permission
                checks (authorization checks) on accesses to a file occur
                at the server, but there are cases in which an administrator
                may want to restrict at the client as well.  For those
@@ -290,12 +286,15 @@ A partial list of the supported mount options follows:
                (such as Windows), permissions can also be checked at the
                client, and a crude form of client side permission checking 
                can be enabled by specifying file_mode and dir_mode on 
-                the client.  Note that the mount.cifs helper must be
+                the client.  (default)
-                at version 1.10 or higher to support specifying the uid
+  forcegid      (similar to above but for the groupid instead of uid) (default)
-                (or gid) in non-numeric form.
+  noforceuid    Fill in file owner information (uid) by requesting it from
-  forcegid      (similar to above but for the groupid instead of uid)
+                the server if possible. With this option, the value given in
+                the uid= option (on mount) will only be used if the server
+                can not support returning uids on inodes.
+  noforcegid    (similar to above but for the group owner, gid, instead of uid)
  uid           Set the default uid for inodes, and indicate to the
-                cifs kernel driver which local user mounted . If the server
+                cifs kernel driver which local user mounted. If the server
                supports the unix extensions the default uid is
                not used to fill in the owner fields of inodes (files)
                unless the "forceuid" parameter is specified.
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 3bb11be8b6a8..606912d8f2a8 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -55,7 +55,7 @@ void cifs_dfs_release_automount_timer(void)
 * i.e. strips from UNC trailing path that is not part of share
 * name and fixup missing '\' in the begining of DFS node refferal
 * if neccessary.
- * Returns pointer to share name on success or NULL on error.
+ * Returns pointer to share name on success or ERR_PTR on error.
 * Caller is responsible for freeing returned string.
 */
 static char *cifs_get_share_name(const char *node_name)
@@ -68,7 +68,7 @@ static char *cifs_get_share_name(const char *node_name)
        UNC = kmalloc(len+2 /*for term null and additional \ if it's missed */,
                         GFP_KERNEL);
        if (!UNC)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        /* get share name and server name */
        if (node_name[1] != '\\') {
@@ -87,7 +87,7 @@ static char *cifs_get_share_name(const char *node_name)
                cERROR(1, ("%s: no server name end in node name: %s",
                        __func__, node_name));
                kfree(UNC);
-                return NULL;
+                return ERR_PTR(-EINVAL);
        }
        /* find sharename end */
@@ -133,6 +133,12 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
                return ERR_PTR(-EINVAL);
        *devname = cifs_get_share_name(ref->node_name);
+        if (IS_ERR(*devname)) {
+                rc = PTR_ERR(*devname);
+                *devname = NULL;
+                goto compose_mount_options_err;
+        }
        rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
        if (rc != 0) {
                cERROR(1, ("%s: Failed to resolve server part of %s to IP: %d",
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 60e3c4253de0..714a542cbafc 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -44,7 +44,7 @@ cifs_ucs2_bytes(const __le16 *from, int maxbytes,
        int maxwords = maxbytes / 2;
        char tmp[NLS_MAX_CHARSET_SIZE];
-        for (i = 0; from[i] && i < maxwords; i++) {
+        for (i = 0; i < maxwords && from[i]; i++) {
                charlen = codepage->uni2char(le16_to_cpu(from[i]), tmp,
                                             NLS_MAX_CHARSET_SIZE);
                if (charlen > 0)
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 44f30504b82d..84b75253b05a 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -376,10 +376,14 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
        seq_printf(s, ",uid=%d", cifs_sb->mnt_uid);
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID)
                seq_printf(s, ",forceuid");
+        else
+                seq_printf(s, ",noforceuid");
        seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)
                seq_printf(s, ",forcegid");
+        else
+                seq_printf(s, ",noforcegid");
        cifs_show_address(s, tcon->ses->server);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index fc44d316d0bb..1f3345d7fa79 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -803,6 +803,10 @@ cifs_parse_mount_options(char *options, const char *devname,
        char *data;
        unsigned int  temp_len, i, j;
        char separator[2];
+        short int override_uid = -1;
+        short int override_gid = -1;
+        bool uid_specified = false;
+        bool gid_specified = false;
        separator[0] = ',';
        separator[1] = 0;
@@ -1093,18 +1097,20 @@ cifs_parse_mount_options(char *options, const char *devname,
                                                    "too long.\n");
                                return 1;
                        }
-                } else if (strnicmp(data, "uid", 3) == 0) {
+                } else if (!strnicmp(data, "uid", 3) && value && *value) {
-                        if (value && *value)
+                        vol->linux_uid = simple_strtoul(value, &value, 0);
-                                vol->linux_uid =
+                        uid_specified = true;
-                                        simple_strtoul(value, &value, 0);
+                } else if (!strnicmp(data, "forceuid", 8)) {
-                } else if (strnicmp(data, "forceuid", 8) == 0) {
+                        override_uid = 1;
-                                vol->override_uid = 1;
+                } else if (!strnicmp(data, "noforceuid", 10)) {
-                } else if (strnicmp(data, "gid", 3) == 0) {
+                        override_uid = 0;
-                        if (value && *value)
+                } else if (!strnicmp(data, "gid", 3) && value && *value) {
-                                vol->linux_gid =
+                        vol->linux_gid = simple_strtoul(value, &value, 0);
-                                        simple_strtoul(value, &value, 0);
+                        gid_specified = true;
-                } else if (strnicmp(data, "forcegid", 8) == 0) {
+                } else if (!strnicmp(data, "forcegid", 8)) {
-                                vol->override_gid = 1;
+                        override_gid = 1;
+                } else if (!strnicmp(data, "noforcegid", 10)) {
+                        override_gid = 0;
                } else if (strnicmp(data, "file_mode", 4) == 0) {
                        if (value && *value) {
                                vol->file_mode =
@@ -1355,6 +1361,18 @@ cifs_parse_mount_options(char *options, const char *devname,
        if (vol->UNCip == NULL)
                vol->UNCip = &vol->UNC[2];
+        if (uid_specified)
+                vol->override_uid = override_uid;
+        else if (override_uid == 1)
+                printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
+                                   "specified with no uid= option.\n");
+        if (gid_specified)
+                vol->override_gid = override_gid;
+        else if (override_gid == 1)
+                printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
+                                   "specified with no gid= option.\n");
        return 0;
 }
@@ -2544,11 +2562,20 @@ remote_path_check:
                        if (mount_data != mount_data_global)
                                kfree(mount_data);
                        mount_data = cifs_compose_mount_options(
                                        cifs_sb->mountdata, full_path + 1,
                                        referrals, &fake_devname);
-                        kfree(fake_devname);
                        free_dfs_info_array(referrals, num_referrals);
+                        kfree(fake_devname);
+                        kfree(full_path);
+                        if (IS_ERR(mount_data)) {
+                                rc = PTR_ERR(mount_data);
+                                mount_data = NULL;
+                                goto mount_fail_check;
+                        }
                        if (tcon)
                                cifs_put_tcon(tcon);
@@ -2556,8 +2583,6 @@ remote_path_check:
                                cifs_put_smb_ses(pSesInfo);
                        cleanup_volume_info(&volume_info);
-                        FreeXid(xid);
-                        kfree(full_path);
                        referral_walks_count++;
                        goto try_mount_again;
                }
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f28f070a60fc..f91fd51b32e3 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1905,6 +1905,7 @@ COMPATIBLE_IOCTL(FIONCLEX)
 COMPATIBLE_IOCTL(FIOASYNC)
 COMPATIBLE_IOCTL(FIONBIO)
 COMPATIBLE_IOCTL(FIONREAD)  /* This is also TIOCINQ */
+COMPATIBLE_IOCTL(FS_IOC_FIEMAP)
 /* 0x00 */
 COMPATIBLE_IOCTL(FIBMAP)
 COMPATIBLE_IOCTL(FIGETBSZ)
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 23419dc3027b..a7cbfbd340c7 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -386,16 +386,16 @@ static ssize_t jid_show(struct gfs2_sbd *sdp, char *buf)
 #define GDLM_ATTR(_name,_mode,_show,_store) \
 static struct gfs2_attr gdlm_attr_##_name = __ATTR(_name,_mode,_show,_store)
-GDLM_ATTR(proto_name,     0444, proto_name_show,        NULL);
+GDLM_ATTR(proto_name,           0444, proto_name_show,          NULL);
-GDLM_ATTR(block,          0644, block_show,             block_store);
+GDLM_ATTR(block,                0644, block_show,               block_store);
-GDLM_ATTR(withdraw,       0644, withdraw_show,          withdraw_store);
+GDLM_ATTR(withdraw,             0644, withdraw_show,            withdraw_store);
-GDLM_ATTR(id,             0444, lkid_show,              NULL);
+GDLM_ATTR(id,                   0444, lkid_show,                NULL);
-GDLM_ATTR(jid,            0444, jid_show,               NULL);
+GDLM_ATTR(jid,                  0444, jid_show,                 NULL);
-GDLM_ATTR(first,          0444, lkfirst_show,           NULL);
+GDLM_ATTR(first,                0444, lkfirst_show,             NULL);
-GDLM_ATTR(first_done,     0444, first_done_show,        NULL);
+GDLM_ATTR(first_done,           0444, first_done_show,          NULL);
-GDLM_ATTR(recover,        0200, NULL,                   recover_store);
+GDLM_ATTR(recover,              0600, NULL,                     recover_store);
-GDLM_ATTR(recover_done,   0444, recover_done_show,      NULL);
+GDLM_ATTR(recover_done,         0444, recover_done_show,        NULL);
-GDLM_ATTR(recover_status, 0444, recover_status_show,    NULL);
+GDLM_ATTR(recover_status,       0444, recover_status_show,      NULL);
 static struct attribute *lock_module_attrs[] = {
        &gdlm_attr_proto_name.attr,
diff --git a/fs/inode.c b/fs/inode.c
index 901bad1e5f12..ae7b67e48661 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -120,12 +120,11 @@ static void wake_up_inode(struct inode *inode)
 * These are initializations that need to be done on every inode
 * allocation as the fields are not initialised by slab allocation.
 */
-struct inode *inode_init_always(struct super_block *sb, struct inode *inode)
+int inode_init_always(struct super_block *sb, struct inode *inode)
 {
        static const struct address_space_operations empty_aops;
        static struct inode_operations empty_iops;
        static const struct file_operations empty_fops;
        struct address_space *const mapping = &inode->i_data;
        inode->i_sb = sb;
@@ -152,7 +151,7 @@ struct inode *inode_init_always(struct super_block *sb, struct inode *inode)
        inode->dirtied_when = 0;
        if (security_inode_alloc(inode))
-                goto out_free_inode;
+                goto out;
        /* allocate and initialize an i_integrity */
        if (ima_inode_alloc(inode))
@@ -198,16 +197,12 @@ struct inode *inode_init_always(struct super_block *sb, struct inode *inode)
        inode->i_fsnotify_mask = 0;
 #endif
-        return inode;
+        return 0;
 out_free_security:
        security_inode_free(inode);
-out_free_inode:
+out:
-        if (inode->i_sb->s_op->destroy_inode)
+        return -ENOMEM;
-                inode->i_sb->s_op->destroy_inode(inode);
-        else
-                kmem_cache_free(inode_cachep, (inode));
-        return NULL;
 }
 EXPORT_SYMBOL(inode_init_always);
@@ -220,12 +215,21 @@ static struct inode *alloc_inode(struct super_block *sb)
        else
                inode = kmem_cache_alloc(inode_cachep, GFP_KERNEL);
-        if (inode)
+        if (!inode)
-                return inode_init_always(sb, inode);
+                return NULL;
-        return NULL;
+        if (unlikely(inode_init_always(sb, inode))) {
+                if (inode->i_sb->s_op->destroy_inode)
+                        inode->i_sb->s_op->destroy_inode(inode);
+                else
+                        kmem_cache_free(inode_cachep, inode);
+                return NULL;
+        }
+        return inode;
 }
-void destroy_inode(struct inode *inode)
+void __destroy_inode(struct inode *inode)
 {
        BUG_ON(inode_has_buffers(inode));
        ima_inode_free(inode);
@@ -237,13 +241,17 @@ void destroy_inode(struct inode *inode)
        if (inode->i_default_acl && inode->i_default_acl != ACL_NOT_CACHED)
                posix_acl_release(inode->i_default_acl);
 #endif
+}
+EXPORT_SYMBOL(__destroy_inode);
+void destroy_inode(struct inode *inode)
+{
+        __destroy_inode(inode);
        if (inode->i_sb->s_op->destroy_inode)
                inode->i_sb->s_op->destroy_inode(inode);
        else
                kmem_cache_free(inode_cachep, (inode));
 }
-EXPORT_SYMBOL(destroy_inode);
 /*
 * These are initializations that only need to be done
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index 5edc2bf20581..23c947539864 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -99,7 +99,7 @@ static int jffs2_do_readpage_nolock (struct inode *inode, struct page *pg)
        kunmap(pg);
        D2(printk(KERN_DEBUG "readpage finished\n"));
-        return 0;
+        return ret;
 }
 int jffs2_do_readpage_unlock(struct inode *inode, struct page *pg)
diff --git a/fs/namespace.c b/fs/namespace.c
index 277c28a63ead..7230787d18b0 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -316,7 +316,8 @@ EXPORT_SYMBOL_GPL(mnt_clone_write);
 */
 int mnt_want_write_file(struct file *file)
 {
-        if (!(file->f_mode & FMODE_WRITE))
+        struct inode *inode = file->f_dentry->d_inode;
+        if (!(file->f_mode & FMODE_WRITE) || special_file(inode->i_mode))
                return mnt_want_write(file->f_path.mnt);
        else
                return mnt_clone_write(file->f_path.mnt);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 489fc01a3204..e4e089a8f294 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -255,7 +255,7 @@ static void nfs_direct_read_release(void *calldata)
        if (put_dreq(dreq))
                nfs_direct_complete(dreq);
-        nfs_readdata_release(calldata);
+        nfs_readdata_free(data);
 }
 static const struct rpc_call_ops nfs_read_direct_ops = {
@@ -314,14 +314,14 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                                        data->npages, 1, 0, data->pagevec, NULL);
                up_read(&current->mm->mmap_sem);
                if (result < 0) {
-                        nfs_readdata_release(data);
+                        nfs_readdata_free(data);
                        break;
                }
                if ((unsigned)result < data->npages) {
                        bytes = result * PAGE_SIZE;
                        if (bytes <= pgbase) {
                                nfs_direct_release_pages(data->pagevec, result);
-                                nfs_readdata_release(data);
+                                nfs_readdata_free(data);
                                break;
                        }
                        bytes -= pgbase;
@@ -334,7 +334,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                data->inode = inode;
                data->cred = msg.rpc_cred;
                data->args.fh = NFS_FH(inode);
-                data->args.context = get_nfs_open_context(ctx);
+                data->args.context = ctx;
                data->args.offset = pos;
                data->args.pgbase = pgbase;
                data->args.pages = data->pagevec;
@@ -441,7 +441,7 @@ static void nfs_direct_free_writedata(struct nfs_direct_req *dreq)
                struct nfs_write_data *data = list_entry(dreq->rewrite_list.next, struct nfs_write_data, pages);
                list_del(&data->pages);
                nfs_direct_release_pages(data->pagevec, data->npages);
-                nfs_writedata_release(data);
+                nfs_writedata_free(data);
        }
 }
@@ -534,7 +534,7 @@ static void nfs_direct_commit_release(void *calldata)
        dprintk("NFS: %5u commit returned %d\n", data->task.tk_pid, status);
        nfs_direct_write_complete(dreq, data->inode);
-        nfs_commitdata_release(calldata);
+        nfs_commit_free(data);
 }
 static const struct rpc_call_ops nfs_commit_direct_ops = {
@@ -570,7 +570,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
        data->args.fh = NFS_FH(data->inode);
        data->args.offset = 0;
        data->args.count = 0;
-        data->args.context = get_nfs_open_context(dreq->ctx);
+        data->args.context = dreq->ctx;
        data->res.count = 0;
        data->res.fattr = &data->fattr;
        data->res.verf = &data->verf;
@@ -734,14 +734,14 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                                        data->npages, 0, 0, data->pagevec, NULL);
                up_read(&current->mm->mmap_sem);
                if (result < 0) {
-                        nfs_writedata_release(data);
+                        nfs_writedata_free(data);
                        break;
                }
                if ((unsigned)result < data->npages) {
                        bytes = result * PAGE_SIZE;
                        if (bytes <= pgbase) {
                                nfs_direct_release_pages(data->pagevec, result);
-                                nfs_writedata_release(data);
+                                nfs_writedata_free(data);
                                break;
                        }
                        bytes -= pgbase;
@@ -756,7 +756,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                data->inode = inode;
                data->cred = msg.rpc_cred;
                data->args.fh = NFS_FH(inode);
-                data->args.context = get_nfs_open_context(ctx);
+                data->args.context = ctx;
                data->args.offset = pos;
                data->args.pgbase = pgbase;
                data->args.pages = data->pagevec;
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 73ea5e8d66ce..12c9e66d3f1d 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -60,17 +60,15 @@ struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
        return p;
 }
-static void nfs_readdata_free(struct nfs_read_data *p)
+void nfs_readdata_free(struct nfs_read_data *p)
 {
        if (p && (p->pagevec != &p->page_array[0]))
                kfree(p->pagevec);
        mempool_free(p, nfs_rdata_mempool);
 }
-void nfs_readdata_release(void *data)
+static void nfs_readdata_release(struct nfs_read_data *rdata)
 {
-        struct nfs_read_data *rdata = data;
        put_nfs_open_context(rdata->args.context);
        nfs_readdata_free(rdata);
 }
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 0a0a2ff767c3..a34fae21fe10 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -87,17 +87,15 @@ struct nfs_write_data *nfs_writedata_alloc(unsigned int pagecount)
        return p;
 }
-static void nfs_writedata_free(struct nfs_write_data *p)
+void nfs_writedata_free(struct nfs_write_data *p)
 {
        if (p && (p->pagevec != &p->page_array[0]))
                kfree(p->pagevec);
        mempool_free(p, nfs_wdata_mempool);
 }
-void nfs_writedata_release(void *data)
+static void nfs_writedata_release(struct nfs_write_data *wdata)
 {
-        struct nfs_write_data *wdata = data;
        put_nfs_open_context(wdata->args.context);
        nfs_writedata_free(wdata);
 }
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 3d3ddb3f5177..2dfd47714ae5 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -412,8 +412,10 @@ nilfs_mdt_write_page(struct page *page, struct writeback_control *wbc)
                return 0; /* Do not request flush for shadow page cache */
        if (!sb) {
                writer = nilfs_get_writer(NILFS_MDT(inode)->mi_nilfs);
-                if (!writer)
+                if (!writer) {
+                        nilfs_put_writer(NILFS_MDT(inode)->mi_nilfs);
                        return -EROFS;
+                }
                sb = writer->s_super;
        }
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 8b5e4778cf28..51ff3d0a4ee2 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1859,12 +1859,26 @@ static void nilfs_end_page_io(struct page *page, int err)
        if (!page)
                return;
-        if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page))
+        if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page)) {
                /*
                 * For b-tree node pages, this function may be called twice
                 * or more because they might be split in a segment.
                 */
+                if (PageDirty(page)) {
+                        /*
+                         * For pages holding split b-tree node buffers, dirty
+                         * flag on the buffers may be cleared discretely.
+                         * In that case, the page is once redirtied for
+                         * remaining buffers, and it must be cancelled if
+                         * all the buffers get cleaned later.
+                         */
+                        lock_page(page);
+                        if (nilfs_page_buffers_clean(page))
+                                __nilfs_clear_page_dirty(page);
+                        unlock_page(page);
+                }
                return;
+        }
        __nilfs_end_page_io(page, err);
 }
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 47cd258fd24d..5dcbafe72d71 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -62,13 +62,14 @@ static int inotify_handle_event(struct fsnotify_group *group, struct fsnotify_ev
        event_priv->wd = wd;
        ret = fsnotify_add_notify_event(group, event, fsn_event_priv);
-        /* EEXIST is not an error */
+        if (ret) {
-        if (ret == -EEXIST)
-                ret = 0;
-        /* did event_priv get attached? */
-        if (list_empty(&fsn_event_priv->event_list))
                inotify_free_event_priv(fsn_event_priv);
+                /* EEXIST says we tail matched, EOVERFLOW isn't something
+                 * to report up the stack. */
+                if ((ret == -EEXIST) ||
+                    (ret == -EOVERFLOW))
+                        ret = 0;
+        }
        /*
         * If we hold the entry until after the event is on the queue
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index f30d9bbc2e1b..dc32ed8323ba 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -386,6 +386,7 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
        struct fsnotify_event *ignored_event;
        struct inotify_event_private_data *event_priv;
        struct fsnotify_event_private_data *fsn_event_priv;
+        int ret;
        ignored_event = fsnotify_create_event(NULL, FS_IN_IGNORED, NULL,
                                              FSNOTIFY_EVENT_NONE, NULL, 0,
@@ -404,10 +405,8 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
        fsn_event_priv->group = group;
        event_priv->wd = ientry->wd;
-        fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
+        ret = fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
+        if (ret)
-        /* did the private data get added? */
-        if (list_empty(&fsn_event_priv->event_list))
                inotify_free_event_priv(fsn_event_priv);
 skip_send_ignore:
@@ -568,7 +567,7 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
        spin_lock_init(&group->inotify_data.idr_lock);
        idr_init(&group->inotify_data.idr);
-        group->inotify_data.last_wd = 0;
+        group->inotify_data.last_wd = 1;
        group->inotify_data.user = user;
        group->inotify_data.fa = NULL;
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 521368574e97..3816d5750dd5 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -153,6 +153,10 @@ static bool event_compare(struct fsnotify_event *old, struct fsnotify_event *new
                                return true;
                        break;
                case (FSNOTIFY_EVENT_NONE):
+                        if (old->mask & FS_Q_OVERFLOW)
+                                return true;
+                        else if (old->mask & FS_IN_IGNORED)
+                                return false;
                        return false;
                };
        }
@@ -171,9 +175,7 @@ int fsnotify_add_notify_event(struct fsnotify_group *group, struct fsnotify_even
        struct list_head *list = &group->notification_list;
        struct fsnotify_event_holder *last_holder;
        struct fsnotify_event *last_event;
+        int ret = 0;
-        /* easy to tell if priv was attached to the event */
-        INIT_LIST_HEAD(&priv->event_list);
        /*
         * There is one fsnotify_event_holder embedded inside each fsnotify_event.
@@ -194,6 +196,7 @@ alloc_holder:
        if (group->q_len >= group->max_events) {
                event = &q_overflow_event;
+                ret = -EOVERFLOW;
                /* sorry, no private data on the overflow event */
                priv = NULL;
        }
@@ -235,7 +238,7 @@ alloc_holder:
        mutex_unlock(&group->notification_mutex);
        wake_up(&group->notification_waitq);
-        return 0;
+        return ret;
 }
 /*
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 9edcde4974aa..f9a3e8942669 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -1914,7 +1914,8 @@ static void ocfs2_adjust_adjacent_records(struct ocfs2_extent_rec *left_rec,
         * immediately to their right.
         */
        left_clusters = le32_to_cpu(right_child_el->l_recs[0].e_cpos);
-        if (ocfs2_is_empty_extent(&right_child_el->l_recs[0])) {
+        if (!ocfs2_rec_clusters(right_child_el, &right_child_el->l_recs[0])) {
+                BUG_ON(right_child_el->l_tree_depth);
                BUG_ON(le16_to_cpu(right_child_el->l_next_free_rec) <= 1);
                left_clusters = le32_to_cpu(right_child_el->l_recs[1].e_cpos);
        }
@@ -2476,15 +2477,37 @@ out_ret_path:
        return ret;
 }
-static void ocfs2_update_edge_lengths(struct inode *inode, handle_t *handle,
+static int ocfs2_update_edge_lengths(struct inode *inode, handle_t *handle,
-                                      struct ocfs2_path *path)
+                                     int subtree_index, struct ocfs2_path *path)
 {
-        int i, idx;
+        int i, idx, ret;
        struct ocfs2_extent_rec *rec;
        struct ocfs2_extent_list *el;
        struct ocfs2_extent_block *eb;
        u32 range;
+        /*
+         * In normal tree rotation process, we will never touch the
+         * tree branch above subtree_index and ocfs2_extend_rotate_transaction
+         * doesn't reserve the credits for them either.
+         *
+         * But we do have a special case here which will update the rightmost
+         * records for all the bh in the path.
+         * So we have to allocate extra credits and access them.
+         */
+        ret = ocfs2_extend_trans(handle,
+                                 handle->h_buffer_credits + subtree_index);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+        ret = ocfs2_journal_access_path(inode, handle, path);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
        /* Path should always be rightmost. */
        eb = (struct ocfs2_extent_block *)path_leaf_bh(path)->b_data;
        BUG_ON(eb->h_next_leaf_blk != 0ULL);
@@ -2505,6 +2528,8 @@ static void ocfs2_update_edge_lengths(struct inode *inode, handle_t *handle,
                ocfs2_journal_dirty(handle, path->p_node[i].bh);
        }
+out:
+        return ret;
 }
 static void ocfs2_unlink_path(struct inode *inode, handle_t *handle,
@@ -2717,7 +2742,12 @@ static int ocfs2_rotate_subtree_left(struct inode *inode, handle_t *handle,
        if (del_right_subtree) {
                ocfs2_unlink_subtree(inode, handle, left_path, right_path,
                                     subtree_index, dealloc);
-                ocfs2_update_edge_lengths(inode, handle, left_path);
+                ret = ocfs2_update_edge_lengths(inode, handle, subtree_index,
+                                                left_path);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out;
+                }
                eb = (struct ocfs2_extent_block *)path_leaf_bh(left_path)->b_data;
                ocfs2_et_set_last_eb_blk(et, le64_to_cpu(eb->h_blkno));
@@ -3034,7 +3064,12 @@ static int ocfs2_remove_rightmost_path(struct inode *inode, handle_t *handle,
                ocfs2_unlink_subtree(inode, handle, left_path, path,
                                     subtree_index, dealloc);
-                ocfs2_update_edge_lengths(inode, handle, left_path);
+                ret = ocfs2_update_edge_lengths(inode, handle, subtree_index,
+                                                left_path);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out;
+                }
                eb = (struct ocfs2_extent_block *)path_leaf_bh(left_path)->b_data;
                ocfs2_et_set_last_eb_blk(et, le64_to_cpu(eb->h_blkno));
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index b2c52b3a1484..b401654011a2 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -193,6 +193,7 @@ static int ocfs2_get_block(struct inode *inode, sector_t iblock,
                             (unsigned long long)OCFS2_I(inode)->ip_blkno);
                        mlog(ML_ERROR, "Size %llu, clusters %u\n", (unsigned long long)i_size_read(inode), OCFS2_I(inode)->ip_clusters);
                        dump_stack();
+                        goto bail;
                }
                past_eof = ocfs2_blocks_for_bytes(inode->i_sb, i_size_read(inode));
@@ -894,18 +895,17 @@ struct ocfs2_write_cluster_desc {
         */
        unsigned        c_new;
        unsigned        c_unwritten;
+        unsigned        c_needs_zero;
 };
-static inline int ocfs2_should_zero_cluster(struct ocfs2_write_cluster_desc *d)
-{
-        return d->c_new || d->c_unwritten;
-}
 struct ocfs2_write_ctxt {
        /* Logical cluster position / len of write */
        u32                             w_cpos;
        u32                             w_clen;
+        /* First cluster allocated in a nonsparse extend */
+        u32                             w_first_new_cpos;
        struct ocfs2_write_cluster_desc w_desc[OCFS2_MAX_CLUSTERS_PER_PAGE];
        /*
@@ -983,6 +983,7 @@ static int ocfs2_alloc_write_ctxt(struct ocfs2_write_ctxt **wcp,
                return -ENOMEM;
        wc->w_cpos = pos >> osb->s_clustersize_bits;
+        wc->w_first_new_cpos = UINT_MAX;
        cend = (pos + len - 1) >> osb->s_clustersize_bits;
        wc->w_clen = cend - wc->w_cpos + 1;
        get_bh(di_bh);
@@ -1217,20 +1218,18 @@ out:
 */
 static int ocfs2_write_cluster(struct address_space *mapping,
                               u32 phys, unsigned int unwritten,
+                               unsigned int should_zero,
                               struct ocfs2_alloc_context *data_ac,
                               struct ocfs2_alloc_context *meta_ac,
                               struct ocfs2_write_ctxt *wc, u32 cpos,
                               loff_t user_pos, unsigned user_len)
 {
-        int ret, i, new, should_zero = 0;
+        int ret, i, new;
        u64 v_blkno, p_blkno;
        struct inode *inode = mapping->host;
        struct ocfs2_extent_tree et;
        new = phys == 0 ? 1 : 0;
-        if (new || unwritten)
-                should_zero = 1;
        if (new) {
                u32 tmp_pos;
@@ -1301,7 +1300,7 @@ static int ocfs2_write_cluster(struct address_space *mapping,
                if (tmpret) {
                        mlog_errno(tmpret);
                        if (ret == 0)
-                                tmpret = ret;
+                                ret = tmpret;
                }
        }
@@ -1341,7 +1340,9 @@ static int ocfs2_write_cluster_by_desc(struct address_space *mapping,
                        local_len = osb->s_clustersize - cluster_off;
                ret = ocfs2_write_cluster(mapping, desc->c_phys,
-                                          desc->c_unwritten, data_ac, meta_ac,
+                                          desc->c_unwritten,
+                                          desc->c_needs_zero,
+                                          data_ac, meta_ac,
                                          wc, desc->c_cpos, pos, local_len);
                if (ret) {
                        mlog_errno(ret);
@@ -1391,14 +1392,14 @@ static void ocfs2_set_target_boundaries(struct ocfs2_super *osb,
                 * newly allocated cluster.
                 */
                desc = &wc->w_desc[0];
-                if (ocfs2_should_zero_cluster(desc))
+                if (desc->c_needs_zero)
                        ocfs2_figure_cluster_boundaries(osb,
                                                        desc->c_cpos,
                                                        &wc->w_target_from,
                                                        NULL);
                desc = &wc->w_desc[wc->w_clen - 1];
-                if (ocfs2_should_zero_cluster(desc))
+                if (desc->c_needs_zero)
                        ocfs2_figure_cluster_boundaries(osb,
                                                        desc->c_cpos,
                                                        NULL,
@@ -1466,13 +1467,28 @@ static int ocfs2_populate_write_desc(struct inode *inode,
                        phys++;
                }
+                /*
+                 * If w_first_new_cpos is < UINT_MAX, we have a non-sparse
+                 * file that got extended.  w_first_new_cpos tells us
+                 * where the newly allocated clusters are so we can
+                 * zero them.
+                 */
+                if (desc->c_cpos >= wc->w_first_new_cpos) {
+                        BUG_ON(phys == 0);
+                        desc->c_needs_zero = 1;
+                }
                desc->c_phys = phys;
                if (phys == 0) {
                        desc->c_new = 1;
+                        desc->c_needs_zero = 1;
                        *clusters_to_alloc = *clusters_to_alloc + 1;
                }
-                if (ext_flags & OCFS2_EXT_UNWRITTEN)
+                if (ext_flags & OCFS2_EXT_UNWRITTEN) {
                        desc->c_unwritten = 1;
+                        desc->c_needs_zero = 1;
+                }
                num_clusters--;
        }
@@ -1632,10 +1648,13 @@ static int ocfs2_expand_nonsparse_inode(struct inode *inode, loff_t pos,
        if (newsize <= i_size_read(inode))
                return 0;
-        ret = ocfs2_extend_no_holes(inode, newsize, newsize - len);
+        ret = ocfs2_extend_no_holes(inode, newsize, pos);
        if (ret)
                mlog_errno(ret);
+        wc->w_first_new_cpos =
+                ocfs2_clusters_for_bytes(inode->i_sb, i_size_read(inode));
        return ret;
 }
@@ -1644,7 +1663,7 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
                             struct page **pagep, void **fsdata,
                             struct buffer_head *di_bh, struct page *mmap_page)
 {
-        int ret, credits = OCFS2_INODE_UPDATE_CREDITS;
+        int ret, cluster_of_pages, credits = OCFS2_INODE_UPDATE_CREDITS;
        unsigned int clusters_to_alloc, extents_to_split;
        struct ocfs2_write_ctxt *wc;
        struct inode *inode = mapping->host;
@@ -1722,8 +1741,19 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
        }
-        ocfs2_set_target_boundaries(osb, wc, pos, len,
+        /*
-                                    clusters_to_alloc + extents_to_split);
+         * We have to zero sparse allocated clusters, unwritten extent clusters,
+         * and non-sparse clusters we just extended.  For non-sparse writes,
+         * we know zeros will only be needed in the first and/or last cluster.
+         */
+        if (clusters_to_alloc || extents_to_split ||
+            wc->w_desc[0].c_needs_zero ||
+            wc->w_desc[wc->w_clen - 1].c_needs_zero)
+                cluster_of_pages = 1;
+        else
+                cluster_of_pages = 0;
+        ocfs2_set_target_boundaries(osb, wc, pos, len, cluster_of_pages);
        handle = ocfs2_start_trans(osb, credits);
        if (IS_ERR(handle)) {
@@ -1756,8 +1786,7 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
         * extent.
         */
        ret = ocfs2_grab_pages_for_write(mapping, wc, wc->w_cpos, pos,
-                                         clusters_to_alloc + extents_to_split,
+                                         cluster_of_pages, mmap_page);
-                                         mmap_page);
        if (ret) {
                mlog_errno(ret);
                goto out_quota;
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index b574431a031d..2f28b7de2c8d 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -310,22 +310,19 @@ out_attach:
        return ret;
 }
-static DEFINE_SPINLOCK(dentry_list_lock);
+DEFINE_SPINLOCK(dentry_list_lock);
 /* We limit the number of dentry locks to drop in one go. We have
 * this limit so that we don't starve other users of ocfs2_wq. */
 #define DL_INODE_DROP_COUNT 64
 /* Drop inode references from dentry locks */
-void ocfs2_drop_dl_inodes(struct work_struct *work)
+static void __ocfs2_drop_dl_inodes(struct ocfs2_super *osb, int drop_count)
 {
-        struct ocfs2_super *osb = container_of(work, struct ocfs2_super,
-                                               dentry_lock_work);
        struct ocfs2_dentry_lock *dl;
-        int drop_count = DL_INODE_DROP_COUNT;
        spin_lock(&dentry_list_lock);
-        while (osb->dentry_lock_list && drop_count--) {
+        while (osb->dentry_lock_list && (drop_count < 0 || drop_count--)) {
                dl = osb->dentry_lock_list;
                osb->dentry_lock_list = dl->dl_next;
                spin_unlock(&dentry_list_lock);
@@ -333,11 +330,32 @@ void ocfs2_drop_dl_inodes(struct work_struct *work)
                kfree(dl);
                spin_lock(&dentry_list_lock);
        }
-        if (osb->dentry_lock_list)
+        spin_unlock(&dentry_list_lock);
+}
+void ocfs2_drop_dl_inodes(struct work_struct *work)
+{
+        struct ocfs2_super *osb = container_of(work, struct ocfs2_super,
+                                               dentry_lock_work);
+        __ocfs2_drop_dl_inodes(osb, DL_INODE_DROP_COUNT);
+        /*
+         * Don't queue dropping if umount is in progress. We flush the
+         * list in ocfs2_dismount_volume
+         */
+        spin_lock(&dentry_list_lock);
+        if (osb->dentry_lock_list &&
+            !ocfs2_test_osb_flag(osb, OCFS2_OSB_DROP_DENTRY_LOCK_IMMED))
                queue_work(ocfs2_wq, &osb->dentry_lock_work);
        spin_unlock(&dentry_list_lock);
 }
+/* Flush the whole work queue */
+void ocfs2_drop_all_dl_inodes(struct ocfs2_super *osb)
+{
+        __ocfs2_drop_dl_inodes(osb, -1);
+}
 /*
 * ocfs2_dentry_iput() and friends.
 *
@@ -368,7 +386,8 @@ static void ocfs2_drop_dentry_lock(struct ocfs2_super *osb,
        /* We leave dropping of inode reference to ocfs2_wq as that can
         * possibly lead to inode deletion which gets tricky */
        spin_lock(&dentry_list_lock);
-        if (!osb->dentry_lock_list)
+        if (!osb->dentry_lock_list &&
+            !ocfs2_test_osb_flag(osb, OCFS2_OSB_DROP_DENTRY_LOCK_IMMED))
                queue_work(ocfs2_wq, &osb->dentry_lock_work);
        dl->dl_next = osb->dentry_lock_list;
        osb->dentry_lock_list = dl;
diff --git a/fs/ocfs2/dcache.h b/fs/ocfs2/dcache.h
index faa12e75f98d..f5dd1789acf1 100644
--- a/fs/ocfs2/dcache.h
+++ b/fs/ocfs2/dcache.h
@@ -49,10 +49,13 @@ struct ocfs2_dentry_lock {
 int ocfs2_dentry_attach_lock(struct dentry *dentry, struct inode *inode,
                             u64 parent_blkno);
+extern spinlock_t dentry_list_lock;
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                           struct ocfs2_dentry_lock *dl);
 void ocfs2_drop_dl_inodes(struct work_struct *work);
+void ocfs2_drop_all_dl_inodes(struct ocfs2_super *osb);
 struct dentry *ocfs2_find_local_alias(struct inode *inode, u64 parent_blkno,
                                      int skip_unhashed);
diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c
index d07ddbe4b283..81eff8e58322 100644
--- a/fs/ocfs2/dlm/dlmast.c
+++ b/fs/ocfs2/dlm/dlmast.c
@@ -103,7 +103,6 @@ static void __dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock)
                     lock->ast_pending, lock->ml.type);
                BUG();
        }
-        BUG_ON(!list_empty(&lock->ast_list));
        if (lock->ast_pending)
                mlog(0, "lock has an ast getting flushed right now\n");
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index bcb9260c3735..43e6e3280569 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1118,7 +1118,7 @@ static int dlm_send_mig_lockres_msg(struct dlm_ctxt *dlm,
        mlog(0, "%s:%.*s: sending mig lockres (%s) to %u\n",
             dlm->name, res->lockname.len, res->lockname.name,
-             orig_flags & DLM_MRES_MIGRATION ? "migrate" : "recovery",
+             orig_flags & DLM_MRES_MIGRATION ? "migration" : "recovery",
             send_to);
        /* send it */
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 62442e413a00..aa501d3f93f1 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1851,6 +1851,7 @@ relock:
                if (ret)
                        goto out_dio;
+                count = ocount;
                ret = generic_write_checks(file, ppos, &count,
                                           S_ISBLK(inode->i_mode));
                if (ret)
@@ -1918,8 +1919,10 @@ out_sems:
        mutex_unlock(&inode->i_mutex);
+        if (written)
+                ret = written;
        mlog_exit(ret);
-        return written ? written : ret;
+        return ret;
 }
 static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index f033760ecbea..c48b93ac6b65 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -1954,10 +1954,16 @@ void ocfs2_orphan_scan_init(struct ocfs2_super *osb)
        os->os_osb = osb;
        os->os_count = 0;
        os->os_seqno = 0;
-        os->os_scantime = CURRENT_TIME;
        mutex_init(&os->os_lock);
        INIT_DELAYED_WORK(&os->os_orphan_scan_work, ocfs2_orphan_scan_work);
+}
+void ocfs2_orphan_scan_start(struct ocfs2_super *osb)
+{
+        struct ocfs2_orphan_scan *os;
+        os = &osb->osb_orphan_scan;
+        os->os_scantime = CURRENT_TIME;
        if (ocfs2_is_hard_readonly(osb) || ocfs2_mount_local(osb))
                atomic_set(&os->os_state, ORPHAN_SCAN_INACTIVE);
        else {
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index 5432c7f79cc6..2c3222aec622 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -145,6 +145,7 @@ static inline void ocfs2_inode_set_new(struct ocfs2_super *osb,
 /* Exported only for the journal struct init code in super.c. Do not call. */
 void ocfs2_orphan_scan_init(struct ocfs2_super *osb);
+void ocfs2_orphan_scan_start(struct ocfs2_super *osb);
 void ocfs2_orphan_scan_stop(struct ocfs2_super *osb);
 void ocfs2_orphan_scan_exit(struct ocfs2_super *osb);
@@ -329,20 +330,27 @@ int                  ocfs2_journal_dirty(handle_t *handle,
 /* extended attribute block update */
 #define OCFS2_XATTR_BLOCK_UPDATE_CREDITS 1
+/* Update of a single quota block */
+#define OCFS2_QUOTA_BLOCK_UPDATE_CREDITS 1
 /* global quotafile inode update, data block */
-#define OCFS2_QINFO_WRITE_CREDITS (OCFS2_INODE_UPDATE_CREDITS + 1)
+#define OCFS2_QINFO_WRITE_CREDITS (OCFS2_INODE_UPDATE_CREDITS + \
+                                   OCFS2_QUOTA_BLOCK_UPDATE_CREDITS)
+#define OCFS2_LOCAL_QINFO_WRITE_CREDITS OCFS2_QUOTA_BLOCK_UPDATE_CREDITS
 /*
 * The two writes below can accidentally see global info dirty due
 * to set_info() quotactl so make them prepared for the writes.
 */
 /* quota data block, global info */
 /* Write to local quota file */
-#define OCFS2_QWRITE_CREDITS (OCFS2_QINFO_WRITE_CREDITS + 1)
+#define OCFS2_QWRITE_CREDITS (OCFS2_QINFO_WRITE_CREDITS + \
+                              OCFS2_QUOTA_BLOCK_UPDATE_CREDITS)
 /* global quota data block, local quota data block, global quota inode,
 * global quota info */
-#define OCFS2_QSYNC_CREDITS (OCFS2_INODE_UPDATE_CREDITS + 3)
+#define OCFS2_QSYNC_CREDITS (OCFS2_QINFO_WRITE_CREDITS + \
+                             2 * OCFS2_QUOTA_BLOCK_UPDATE_CREDITS)
 static inline int ocfs2_quota_trans_credits(struct super_block *sb)
 {
@@ -355,11 +363,6 @@ static inline int ocfs2_quota_trans_credits(struct super_block *sb)
        return credits;
 }
-/* Number of credits needed for removing quota structure from file */
-int ocfs2_calc_qdel_credits(struct super_block *sb, int type);
-/* Number of credits needed for initialization of new quota structure */
-int ocfs2_calc_qinit_credits(struct super_block *sb, int type);
 /* group extend. inode update and last group update. */
 #define OCFS2_GROUP_EXTEND_CREDITS      (OCFS2_INODE_UPDATE_CREDITS + 1)
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index c9345ebb8493..39e1d5a39505 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -224,10 +224,12 @@ enum ocfs2_mount_options
        OCFS2_MOUNT_GRPQUOTA = 1 << 10, /* We support group quotas */
 };
-#define OCFS2_OSB_SOFT_RO       0x0001
+#define OCFS2_OSB_SOFT_RO                       0x0001
-#define OCFS2_OSB_HARD_RO       0x0002
+#define OCFS2_OSB_HARD_RO                       0x0002
-#define OCFS2_OSB_ERROR_FS      0x0004
+#define OCFS2_OSB_ERROR_FS                      0x0004
-#define OCFS2_DEFAULT_ATIME_QUANTUM     60
+#define OCFS2_OSB_DROP_DENTRY_LOCK_IMMED        0x0008
+#define OCFS2_DEFAULT_ATIME_QUANTUM             60
 struct ocfs2_journal;
 struct ocfs2_slot_info;
@@ -490,6 +492,18 @@ static inline void ocfs2_set_osb_flag(struct ocfs2_super *osb,
        spin_unlock(&osb->osb_lock);
 }
+static inline unsigned long  ocfs2_test_osb_flag(struct ocfs2_super *osb,
+                                                 unsigned long flag)
+{
+        unsigned long ret;
+        spin_lock(&osb->osb_lock);
+        ret = osb->osb_flags & flag;
+        spin_unlock(&osb->osb_lock);
+        return ret;
+}
 static inline void ocfs2_set_ro_flag(struct ocfs2_super *osb,
                                     int hard)
 {
diff --git a/fs/ocfs2/quota.h b/fs/ocfs2/quota.h
index 7365e2e08706..3fb96fcd4c81 100644
--- a/fs/ocfs2/quota.h
+++ b/fs/ocfs2/quota.h
@@ -50,7 +50,6 @@ struct ocfs2_mem_dqinfo {
        unsigned int dqi_chunks;        /* Number of chunks in local quota file */
        unsigned int dqi_blocks;        /* Number of blocks allocated for local quota file */
        unsigned int dqi_syncms;        /* How often should we sync with other nodes */
-        unsigned int dqi_syncjiff;      /* Precomputed dqi_syncms in jiffies */
        struct list_head dqi_chunk;     /* List of chunks */
        struct inode *dqi_gqinode;      /* Global quota file inode */
        struct ocfs2_lock_res dqi_gqlock;       /* Lock protecting quota information structure */
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index edfa60cd155c..bf7742d0ee3b 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -69,6 +69,7 @@ static void ocfs2_global_mem2diskdqb(void *dp, struct dquot *dquot)
        d->dqb_curspace = cpu_to_le64(m->dqb_curspace);
        d->dqb_btime = cpu_to_le64(m->dqb_btime);
        d->dqb_itime = cpu_to_le64(m->dqb_itime);
+        d->dqb_pad1 = d->dqb_pad2 = 0;
 }
 static int ocfs2_global_is_id(void *dp, struct dquot *dquot)
@@ -211,14 +212,13 @@ ssize_t ocfs2_quota_write(struct super_block *sb, int type,
        mutex_lock_nested(&gqinode->i_mutex, I_MUTEX_QUOTA);
        if (gqinode->i_size < off + len) {
-                down_write(&OCFS2_I(gqinode)->ip_alloc_sem);
+                loff_t rounded_end =
-                err = ocfs2_extend_no_holes(gqinode, off + len, off);
+                                ocfs2_align_bytes_to_blocks(sb, off + len);
-                up_write(&OCFS2_I(gqinode)->ip_alloc_sem);
-                if (err < 0)
+                /* Space is already allocated in ocfs2_global_read_dquot() */
-                        goto out;
                err = ocfs2_simple_size_update(gqinode,
                                               oinfo->dqi_gqi_bh,
-                                               off + len);
+                                               rounded_end);
                if (err < 0)
                        goto out;
                new = 1;
@@ -234,7 +234,7 @@ ssize_t ocfs2_quota_write(struct super_block *sb, int type,
        }
        if (err) {
                mlog_errno(err);
-                return err;
+                goto out;
        }
        lock_buffer(bh);
        if (new)
@@ -342,7 +342,6 @@ int ocfs2_global_read_info(struct super_block *sb, int type)
        info->dqi_bgrace = le32_to_cpu(dinfo.dqi_bgrace);
        info->dqi_igrace = le32_to_cpu(dinfo.dqi_igrace);
        oinfo->dqi_syncms = le32_to_cpu(dinfo.dqi_syncms);
-        oinfo->dqi_syncjiff = msecs_to_jiffies(oinfo->dqi_syncms);
        oinfo->dqi_gi.dqi_blocks = le32_to_cpu(dinfo.dqi_blocks);
        oinfo->dqi_gi.dqi_free_blk = le32_to_cpu(dinfo.dqi_free_blk);
        oinfo->dqi_gi.dqi_free_entry = le32_to_cpu(dinfo.dqi_free_entry);
@@ -352,7 +351,7 @@ int ocfs2_global_read_info(struct super_block *sb, int type)
        oinfo->dqi_gi.dqi_qtree_depth = qtree_depth(&oinfo->dqi_gi);
        INIT_DELAYED_WORK(&oinfo->dqi_sync_work, qsync_work_fn);
        queue_delayed_work(ocfs2_quota_wq, &oinfo->dqi_sync_work,
-                           oinfo->dqi_syncjiff);
+                           msecs_to_jiffies(oinfo->dqi_syncms));
 out_err:
        mlog_exit(status);
@@ -402,13 +401,36 @@ int ocfs2_global_write_info(struct super_block *sb, int type)
        return err;
 }
+static int ocfs2_global_qinit_alloc(struct super_block *sb, int type)
+{
+        struct ocfs2_mem_dqinfo *oinfo = sb_dqinfo(sb, type)->dqi_priv;
+        /*
+         * We may need to allocate tree blocks and a leaf block but not the
+         * root block
+         */
+        return oinfo->dqi_gi.dqi_qtree_depth;
+}
+static int ocfs2_calc_global_qinit_credits(struct super_block *sb, int type)
+{
+        /* We modify all the allocated blocks, tree root, and info block */
+        return (ocfs2_global_qinit_alloc(sb, type) + 2) *
+                        OCFS2_QUOTA_BLOCK_UPDATE_CREDITS;
+}
 /* Read in information from global quota file and acquire a reference to it.
 * dquot_acquire() has already started the transaction and locked quota file */
 int ocfs2_global_read_dquot(struct dquot *dquot)
 {
        int err, err2, ex = 0;
-        struct ocfs2_mem_dqinfo *info =
+        struct super_block *sb = dquot->dq_sb;
-                        sb_dqinfo(dquot->dq_sb, dquot->dq_type)->dqi_priv;
+        int type = dquot->dq_type;
+        struct ocfs2_mem_dqinfo *info = sb_dqinfo(sb, type)->dqi_priv;
+        struct ocfs2_super *osb = OCFS2_SB(sb);
+        struct inode *gqinode = info->dqi_gqinode;
+        int need_alloc = ocfs2_global_qinit_alloc(sb, type);
+        handle_t *handle = NULL;
        err = ocfs2_qinfo_lock(info, 0);
        if (err < 0)
@@ -419,14 +441,33 @@ int ocfs2_global_read_dquot(struct dquot *dquot)
        OCFS2_DQUOT(dquot)->dq_use_count++;
        OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace;
        OCFS2_DQUOT(dquot)->dq_originodes = dquot->dq_dqb.dqb_curinodes;
+        ocfs2_qinfo_unlock(info, 0);
        if (!dquot->dq_off) {   /* No real quota entry? */
-                /* Upgrade to exclusive lock for allocation */
-                ocfs2_qinfo_unlock(info, 0);
-                err = ocfs2_qinfo_lock(info, 1);
-                if (err < 0)
-                        goto out_qlock;
                ex = 1;
+                /*
+                 * Add blocks to quota file before we start a transaction since
+                 * locking allocators ranks above a transaction start
+                 */
+                WARN_ON(journal_current_handle());
+                down_write(&OCFS2_I(gqinode)->ip_alloc_sem);
+                err = ocfs2_extend_no_holes(gqinode,
+                        gqinode->i_size + (need_alloc << sb->s_blocksize_bits),
+                        gqinode->i_size);
+                up_write(&OCFS2_I(gqinode)->ip_alloc_sem);
+                if (err < 0)
+                        goto out;
        }
+        handle = ocfs2_start_trans(osb,
+                                   ocfs2_calc_global_qinit_credits(sb, type));
+        if (IS_ERR(handle)) {
+                err = PTR_ERR(handle);
+                goto out;
+        }
+        err = ocfs2_qinfo_lock(info, ex);
+        if (err < 0)
+                goto out_trans;
        err = qtree_write_dquot(&info->dqi_gi, dquot);
        if (ex && info_dirty(sb_dqinfo(dquot->dq_sb, dquot->dq_type))) {
                err2 = __ocfs2_global_write_info(dquot->dq_sb, dquot->dq_type);
@@ -438,6 +479,9 @@ out_qlock:
                ocfs2_qinfo_unlock(info, 1);
        else
                ocfs2_qinfo_unlock(info, 0);
+out_trans:
+        if (handle)
+                ocfs2_commit_trans(osb, handle);
 out:
        if (err < 0)
                mlog_errno(err);
@@ -607,7 +651,7 @@ static void qsync_work_fn(struct work_struct *work)
        dquot_scan_active(sb, ocfs2_sync_dquot_helper, oinfo->dqi_type);
        queue_delayed_work(ocfs2_quota_wq, &oinfo->dqi_sync_work,
-                           oinfo->dqi_syncjiff);
+                           msecs_to_jiffies(oinfo->dqi_syncms));
 }
 /*
@@ -635,20 +679,18 @@ out:
        return status;
 }
-int ocfs2_calc_qdel_credits(struct super_block *sb, int type)
+static int ocfs2_calc_qdel_credits(struct super_block *sb, int type)
 {
-        struct ocfs2_mem_dqinfo *oinfo;
+        struct ocfs2_mem_dqinfo *oinfo = sb_dqinfo(sb, type)->dqi_priv;
-        int features[MAXQUOTAS] = { OCFS2_FEATURE_RO_COMPAT_USRQUOTA,
+        /*
-                                    OCFS2_FEATURE_RO_COMPAT_GRPQUOTA };
+         * We modify tree, leaf block, global info, local chunk header,
+         * global and local inode; OCFS2_QINFO_WRITE_CREDITS already
-        if (!OCFS2_HAS_RO_COMPAT_FEATURE(sb, features[type]))
+         * accounts for inode update
-                return 0;
+         */
+        return (oinfo->dqi_gi.dqi_qtree_depth + 2) *
-        oinfo = sb_dqinfo(sb, type)->dqi_priv;
+               OCFS2_QUOTA_BLOCK_UPDATE_CREDITS +
-        /* We modify tree, leaf block, global info, local chunk header,
+               OCFS2_QINFO_WRITE_CREDITS +
-         * global and local inode */
+               OCFS2_INODE_UPDATE_CREDITS;
-        return oinfo->dqi_gi.dqi_qtree_depth + 2 + 1 +
-               2 * OCFS2_INODE_UPDATE_CREDITS;
 }
 static int ocfs2_release_dquot(struct dquot *dquot)
@@ -680,33 +722,10 @@ out:
        return status;
 }
-int ocfs2_calc_qinit_credits(struct super_block *sb, int type)
-{
-        struct ocfs2_mem_dqinfo *oinfo;
-        int features[MAXQUOTAS] = { OCFS2_FEATURE_RO_COMPAT_USRQUOTA,
-                                    OCFS2_FEATURE_RO_COMPAT_GRPQUOTA };
-        struct ocfs2_dinode *lfe, *gfe;
-        if (!OCFS2_HAS_RO_COMPAT_FEATURE(sb, features[type]))
-                return 0;
-        oinfo = sb_dqinfo(sb, type)->dqi_priv;
-        gfe = (struct ocfs2_dinode *)oinfo->dqi_gqi_bh->b_data;
-        lfe = (struct ocfs2_dinode *)oinfo->dqi_lqi_bh->b_data;
-        /* We can extend local file + global file. In local file we
-         * can modify info, chunk header block and dquot block. In
-         * global file we can modify info, tree and leaf block */
-        return ocfs2_calc_extend_credits(sb, &lfe->id2.i_list, 0) +
-               ocfs2_calc_extend_credits(sb, &gfe->id2.i_list, 0) +
-               3 + oinfo->dqi_gi.dqi_qtree_depth + 2;
-}
 static int ocfs2_acquire_dquot(struct dquot *dquot)
 {
-        handle_t *handle;
        struct ocfs2_mem_dqinfo *oinfo =
                        sb_dqinfo(dquot->dq_sb, dquot->dq_type)->dqi_priv;
-        struct ocfs2_super *osb = OCFS2_SB(dquot->dq_sb);
        int status = 0;
        mlog_entry("id=%u, type=%d", dquot->dq_id, dquot->dq_type);
@@ -715,16 +734,7 @@ static int ocfs2_acquire_dquot(struct dquot *dquot)
        status = ocfs2_lock_global_qf(oinfo, 1);
        if (status < 0)
                goto out;
-        handle = ocfs2_start_trans(osb,
-                ocfs2_calc_qinit_credits(dquot->dq_sb, dquot->dq_type));
-        if (IS_ERR(handle)) {
-                status = PTR_ERR(handle);
-                mlog_errno(status);
-                goto out_ilock;
-        }
        status = dquot_acquire(dquot);
-        ocfs2_commit_trans(osb, handle);
-out_ilock:
        ocfs2_unlock_global_qf(oinfo, 1);
 out:
        mlog_exit(status);
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 5a460fa82553..bdb09cb6e1fe 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -20,6 +20,7 @@
 #include "sysfile.h"
 #include "dlmglue.h"
 #include "quota.h"
+#include "uptodate.h"
 /* Number of local quota structures per block */
 static inline unsigned int ol_quota_entries_per_block(struct super_block *sb)
@@ -100,7 +101,8 @@ static int ocfs2_modify_bh(struct inode *inode, struct buffer_head *bh,
        handle_t *handle;
        int status;
-        handle = ocfs2_start_trans(OCFS2_SB(sb), 1);
+        handle = ocfs2_start_trans(OCFS2_SB(sb),
+                                   OCFS2_QUOTA_BLOCK_UPDATE_CREDITS);
        if (IS_ERR(handle)) {
                status = PTR_ERR(handle);
                mlog_errno(status);
@@ -610,7 +612,8 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb,
                        goto out_bh;
                /* Mark quota file as clean if we are recovering quota file of
                 * some other node. */
-                handle = ocfs2_start_trans(osb, 1);
+                handle = ocfs2_start_trans(osb,
+                                           OCFS2_LOCAL_QINFO_WRITE_CREDITS);
                if (IS_ERR(handle)) {
                        status = PTR_ERR(handle);
                        mlog_errno(status);
@@ -940,7 +943,7 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
        struct ocfs2_local_disk_chunk *dchunk;
        int status;
        handle_t *handle;
-        struct buffer_head *bh = NULL;
+        struct buffer_head *bh = NULL, *dbh = NULL;
        u64 p_blkno;
        /* We are protected by dqio_sem so no locking needed */
@@ -964,32 +967,35 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
                mlog_errno(status);
                goto out;
        }
+        /* Local quota info and two new blocks we initialize */
+        handle = ocfs2_start_trans(OCFS2_SB(sb),
+                        OCFS2_LOCAL_QINFO_WRITE_CREDITS +
+                        2 * OCFS2_QUOTA_BLOCK_UPDATE_CREDITS);
+        if (IS_ERR(handle)) {
+                status = PTR_ERR(handle);
+                mlog_errno(status);
+                goto out;
+        }
+        /* Initialize chunk header */
        down_read(&OCFS2_I(lqinode)->ip_alloc_sem);
        status = ocfs2_extent_map_get_blocks(lqinode, oinfo->dqi_blocks,
                                             &p_blkno, NULL, NULL);
        up_read(&OCFS2_I(lqinode)->ip_alloc_sem);
        if (status < 0) {
                mlog_errno(status);
-                goto out;
+                goto out_trans;
        }
        bh = sb_getblk(sb, p_blkno);
        if (!bh) {
                status = -ENOMEM;
                mlog_errno(status);
-                goto out;
+                goto out_trans;
        }
        dchunk = (struct ocfs2_local_disk_chunk *)bh->b_data;
+        ocfs2_set_new_buffer_uptodate(lqinode, bh);
-        handle = ocfs2_start_trans(OCFS2_SB(sb), 2);
-        if (IS_ERR(handle)) {
-                status = PTR_ERR(handle);
-                mlog_errno(status);
-                goto out;
-        }
        status = ocfs2_journal_access_dq(handle, lqinode, bh,
-                                         OCFS2_JOURNAL_ACCESS_WRITE);
+                                         OCFS2_JOURNAL_ACCESS_CREATE);
        if (status < 0) {
                mlog_errno(status);
                goto out_trans;
@@ -999,7 +1005,6 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
        memset(dchunk->dqc_bitmap, 0,
               sb->s_blocksize - sizeof(struct ocfs2_local_disk_chunk) -
               OCFS2_QBLK_RESERVED_SPACE);
-        set_buffer_uptodate(bh);
        unlock_buffer(bh);
        status = ocfs2_journal_dirty(handle, bh);
        if (status < 0) {
@@ -1007,6 +1012,38 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
                goto out_trans;
        }
+        /* Initialize new block with structures */
+        down_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        status = ocfs2_extent_map_get_blocks(lqinode, oinfo->dqi_blocks + 1,
+                                             &p_blkno, NULL, NULL);
+        up_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        dbh = sb_getblk(sb, p_blkno);
+        if (!dbh) {
+                status = -ENOMEM;
+                mlog_errno(status);
+                goto out_trans;
+        }
+        ocfs2_set_new_buffer_uptodate(lqinode, dbh);
+        status = ocfs2_journal_access_dq(handle, lqinode, dbh,
+                                         OCFS2_JOURNAL_ACCESS_CREATE);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        lock_buffer(dbh);
+        memset(dbh->b_data, 0, sb->s_blocksize - OCFS2_QBLK_RESERVED_SPACE);
+        unlock_buffer(dbh);
+        status = ocfs2_journal_dirty(handle, dbh);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        /* Update local quotafile info */
        oinfo->dqi_blocks += 2;
        oinfo->dqi_chunks++;
        status = ocfs2_local_write_info(sb, type);
@@ -1031,6 +1068,7 @@ out_trans:
        ocfs2_commit_trans(OCFS2_SB(sb), handle);
 out:
        brelse(bh);
+        brelse(dbh);
        kmem_cache_free(ocfs2_qf_chunk_cachep, chunk);
        return ERR_PTR(status);
 }
@@ -1048,6 +1086,8 @@ static struct ocfs2_quota_chunk *ocfs2_extend_local_quota_file(
        struct ocfs2_local_disk_chunk *dchunk;
        int epb = ol_quota_entries_per_block(sb);
        unsigned int chunk_blocks;
+        struct buffer_head *bh;
+        u64 p_blkno;
        int status;
        handle_t *handle;
@@ -1075,12 +1115,49 @@ static struct ocfs2_quota_chunk *ocfs2_extend_local_quota_file(
                mlog_errno(status);
                goto out;
        }
-        handle = ocfs2_start_trans(OCFS2_SB(sb), 2);
+        /* Get buffer from the just added block */
+        down_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        status = ocfs2_extent_map_get_blocks(lqinode, oinfo->dqi_blocks,
+                                             &p_blkno, NULL, NULL);
+        up_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out;
+        }
+        bh = sb_getblk(sb, p_blkno);
+        if (!bh) {
+                status = -ENOMEM;
+                mlog_errno(status);
+                goto out;
+        }
+        ocfs2_set_new_buffer_uptodate(lqinode, bh);
+        /* Local quota info, chunk header and the new block we initialize */
+        handle = ocfs2_start_trans(OCFS2_SB(sb),
+                        OCFS2_LOCAL_QINFO_WRITE_CREDITS +
+                        2 * OCFS2_QUOTA_BLOCK_UPDATE_CREDITS);
        if (IS_ERR(handle)) {
                status = PTR_ERR(handle);
                mlog_errno(status);
                goto out;
        }
+        /* Zero created block */
+        status = ocfs2_journal_access_dq(handle, lqinode, bh,
+                                 OCFS2_JOURNAL_ACCESS_CREATE);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        lock_buffer(bh);
+        memset(bh->b_data, 0, sb->s_blocksize);
+        unlock_buffer(bh);
+        status = ocfs2_journal_dirty(handle, bh);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        /* Update chunk header */
        status = ocfs2_journal_access_dq(handle, lqinode, chunk->qc_headerbh,
                                 OCFS2_JOURNAL_ACCESS_WRITE);
        if (status < 0) {
@@ -1097,6 +1174,7 @@ static struct ocfs2_quota_chunk *ocfs2_extend_local_quota_file(
                mlog_errno(status);
                goto out_trans;
        }
+        /* Update file header */
        oinfo->dqi_blocks++;
        status = ocfs2_local_write_info(sb, type);
        if (status < 0) {
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index 3f661376a2de..e49c41050264 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -17,6 +17,7 @@
 * General Public License for more details.
 */
+#include <linux/kernel.h>
 #include <linux/crc32.h>
 #include <linux/module.h>
@@ -153,7 +154,7 @@ static int status_map[] = {
 static int dlm_status_to_errno(enum dlm_status status)
 {
-        BUG_ON(status > (sizeof(status_map) / sizeof(status_map[0])));
+        BUG_ON(status < 0 || status >= ARRAY_SIZE(status_map));
        return status_map[status];
 }
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 7efb349fb9bd..b0ee0fdf799a 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -777,6 +777,7 @@ static int ocfs2_sb_probe(struct super_block *sb,
                }
                di = (struct ocfs2_dinode *) (*bh)->b_data;
                memset(stats, 0, sizeof(struct ocfs2_blockcheck_stats));
+                spin_lock_init(&stats->b_lock);
                status = ocfs2_verify_volume(di, *bh, blksize, stats);
                if (status >= 0)
                        goto bail;
@@ -1182,7 +1183,7 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
        wake_up(&osb->osb_mount_event);
        /* Start this when the mount is almost sure of being successful */
-        ocfs2_orphan_scan_init(osb);
+        ocfs2_orphan_scan_start(osb);
        mlog_exit(status);
        return status;
@@ -1213,14 +1214,27 @@ static int ocfs2_get_sb(struct file_system_type *fs_type,
                           mnt);
 }
+static void ocfs2_kill_sb(struct super_block *sb)
+{
+        struct ocfs2_super *osb = OCFS2_SB(sb);
+        /* Prevent further queueing of inode drop events */
+        spin_lock(&dentry_list_lock);
+        ocfs2_set_osb_flag(osb, OCFS2_OSB_DROP_DENTRY_LOCK_IMMED);
+        spin_unlock(&dentry_list_lock);
+        /* Wait for work to finish and/or remove it */
+        cancel_work_sync(&osb->dentry_lock_work);
+        kill_block_super(sb);
+}
 static struct file_system_type ocfs2_fs_type = {
        .owner          = THIS_MODULE,
        .name           = "ocfs2",
        .get_sb         = ocfs2_get_sb, /* is this called when we mount
                                        * the fs? */
-        .kill_sb        = kill_block_super, /* set to the generic one
+        .kill_sb        = ocfs2_kill_sb,
-                                             * right now, but do we
-                                             * need to change that? */
        .fs_flags       = FS_REQUIRES_DEV|FS_RENAME_DOES_D_MOVE,
        .next           = NULL
 };
@@ -1819,6 +1833,12 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
        debugfs_remove(osb->osb_ctxt);
+        /*
+         * Flush inode dropping work queue so that deletes are
+         * performed while the filesystem is still working
+         */
+        ocfs2_drop_all_dl_inodes(osb);
        /* Orphan scan should be stopped as early as possible */
        ocfs2_orphan_scan_stop(osb);
@@ -1981,6 +2001,8 @@ static int ocfs2_initialize_super(struct super_block *sb,
        snprintf(osb->dev_str, sizeof(osb->dev_str), "%u,%u",
                 MAJOR(osb->sb->s_dev), MINOR(osb->sb->s_dev));
+        ocfs2_orphan_scan_init(osb);
        status = ocfs2_recovery_init(osb);
        if (status) {
                mlog(ML_ERROR, "Unable to initialize recovery state\n");
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index ba320e250747..d1a27cda984f 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1052,7 +1052,8 @@ static int ocfs2_xattr_block_get(struct inode *inode,
        struct ocfs2_xattr_block *xb;
        struct ocfs2_xattr_value_root *xv;
        size_t size;
-        int ret = -ENODATA, name_offset, name_len, block_off, i;
+        int ret = -ENODATA, name_offset, name_len, i;
+        int uninitialized_var(block_off);
        xs->bucket = ocfs2_xattr_bucket_new(inode);
        if (!xs->bucket) {
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 3ce5ae9e3d2d..175db258942f 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -234,23 +234,20 @@ static int check_mem_permission(struct task_struct *task)
 struct mm_struct *mm_for_maps(struct task_struct *task)
 {
-        struct mm_struct *mm = get_task_mm(task);
+        struct mm_struct *mm;
-        if (!mm)
+        if (mutex_lock_killable(&task->cred_guard_mutex))
                return NULL;
-        down_read(&mm->mmap_sem);
-        task_lock(task);
+        mm = get_task_mm(task);
-        if (task->mm != mm)
+        if (mm && mm != current->mm &&
-                goto out;
+                        !ptrace_may_access(task, PTRACE_MODE_READ)) {
-        if (task->mm != current->mm &&
+                mmput(mm);
-            __ptrace_may_access(task, PTRACE_MODE_READ) < 0)
+                mm = NULL;
-                goto out;
+        }
-        task_unlock(task);
+        mutex_unlock(&task->cred_guard_mutex);
        return mm;
-out:
-        task_unlock(task);
-        up_read(&mm->mmap_sem);
-        mmput(mm);
-        return NULL;
 }
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 6f61b7cc32e0..9bd8be1d235c 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
        mm = mm_for_maps(priv->task);
        if (!mm)
                return NULL;
+        down_read(&mm->mmap_sem);
        tail_vma = get_gate_vma(priv->task);
        priv->tail_vma = tail_vma;
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 64a72e2e7650..8f5c05d3dbd3 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
                priv->task = NULL;
                return NULL;
        }
+        down_read(&mm->mmap_sem);
        /* start from the Nth VMA */
        for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
diff --git a/fs/select.c b/fs/select.c
index d870237e42c7..8084834e123e 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -110,6 +110,7 @@ void poll_initwait(struct poll_wqueues *pwq)
 {
        init_poll_funcptr(&pwq->pt, __pollwait);
        pwq->polling_task = current;
+        pwq->triggered = 0;
        pwq->error = 0;
        pwq->table = NULL;
        pwq->inline_index = 0;
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 0c93c7ef3d18..965df1227d64 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -770,7 +770,7 @@ xfs_buf_associate_memory(
        bp->b_pages = NULL;
        bp->b_addr = mem;
-        rval = _xfs_buf_get_pages(bp, page_count, 0);
+        rval = _xfs_buf_get_pages(bp, page_count, XBF_DONT_BLOCK);
        if (rval)
                return rval;
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index b619d6b8ca43..98ef624d9baf 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -708,6 +708,16 @@ xfs_reclaim_inode(
        return 0;
 }
+void
+__xfs_inode_set_reclaim_tag(
+        struct xfs_perag        *pag,
+        struct xfs_inode        *ip)
+{
+        radix_tree_tag_set(&pag->pag_ici_root,
+                           XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino),
+                           XFS_ICI_RECLAIM_TAG);
+}
 /*
 * We set the inode flag atomically with the radix tree tag.
 * Once we get tag lookups on the radix tree, this inode flag
@@ -722,8 +732,7 @@ xfs_inode_set_reclaim_tag(
        read_lock(&pag->pag_ici_lock);
        spin_lock(&ip->i_flags_lock);
-        radix_tree_tag_set(&pag->pag_ici_root,
+        __xfs_inode_set_reclaim_tag(pag, ip);
-                        XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
        __xfs_iflags_set(ip, XFS_IRECLAIMABLE);
        spin_unlock(&ip->i_flags_lock);
        read_unlock(&pag->pag_ici_lock);
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index 2a10301c99c7..59120602588a 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -48,6 +48,7 @@ int xfs_reclaim_inode(struct xfs_inode *ip, int locked, int sync_mode);
 int xfs_reclaim_inodes(struct xfs_mount *mp, int mode);
 void xfs_inode_set_reclaim_tag(struct xfs_inode *ip);
+void __xfs_inode_set_reclaim_tag(struct xfs_perag *pag, struct xfs_inode *ip);
 void xfs_inode_clear_reclaim_tag(struct xfs_inode *ip);
 void __xfs_inode_clear_reclaim_tag(struct xfs_mount *mp, struct xfs_perag *pag,
                                struct xfs_inode *ip);
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index db15feb906ff..4ece1906bd41 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -2010,7 +2010,9 @@ xfs_attr_rmtval_get(xfs_da_args_t *args)
                        dblkno = XFS_FSB_TO_DADDR(mp, map[i].br_startblock);
                        blkcnt = XFS_FSB_TO_BB(mp, map[i].br_blockcount);
                        error = xfs_read_buf(mp, mp->m_ddev_targp, dblkno,
-                                             blkcnt, XFS_BUF_LOCK, &bp);
+                                             blkcnt,
+                                             XFS_BUF_LOCK | XBF_DONT_BLOCK,
+                                             &bp);
                        if (error)
                                return(error);
@@ -2141,8 +2143,8 @@ xfs_attr_rmtval_set(xfs_da_args_t *args)
                dblkno = XFS_FSB_TO_DADDR(mp, map.br_startblock),
                blkcnt = XFS_FSB_TO_BB(mp, map.br_blockcount);
-                bp = xfs_buf_get_flags(mp->m_ddev_targp, dblkno,
+                bp = xfs_buf_get_flags(mp->m_ddev_targp, dblkno, blkcnt,
-                                                        blkcnt, XFS_BUF_LOCK);
+                                       XFS_BUF_LOCK | XBF_DONT_BLOCK);
                ASSERT(bp);
                ASSERT(!XFS_BUF_GETERROR(bp));
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 7928b9983c1d..8ee5b5a76a2a 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -6009,7 +6009,7 @@ xfs_getbmap(
         */
        error = ENOMEM;
        subnex = 16;
-        map = kmem_alloc(subnex * sizeof(*map), KM_MAYFAIL);
+        map = kmem_alloc(subnex * sizeof(*map), KM_MAYFAIL | KM_NOFS);
        if (!map)
                goto out_unlock_ilock;
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index e9df99574829..26717388acf5 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -120,8 +120,8 @@ xfs_btree_check_sblock(
                        XFS_RANDOM_BTREE_CHECK_SBLOCK))) {
                if (bp)
                        xfs_buftrace("SBTREE ERROR", bp);
-                XFS_ERROR_REPORT("xfs_btree_check_sblock", XFS_ERRLEVEL_LOW,
+                XFS_CORRUPTION_ERROR("xfs_btree_check_sblock",
-                                 cur->bc_mp);
+                        XFS_ERRLEVEL_LOW, cur->bc_mp, block);
                return XFS_ERROR(EFSCORRUPTED);
        }
        return 0;
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 9ff6e57a5075..2847bbc1c534 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -2201,7 +2201,7 @@ kmem_zone_t *xfs_dabuf_zone;		/* dabuf zone */
 xfs_da_state_t *
 xfs_da_state_alloc(void)
 {
-        return kmem_zone_zalloc(xfs_da_state_zone, KM_SLEEP);
+        return kmem_zone_zalloc(xfs_da_state_zone, KM_NOFS);
 }
 /*
@@ -2261,9 +2261,9 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps, inst_t *ra)
        int             off;
        if (nbuf == 1)
-                dabuf = kmem_zone_alloc(xfs_dabuf_zone, KM_SLEEP);
+                dabuf = kmem_zone_alloc(xfs_dabuf_zone, KM_NOFS);
        else
-                dabuf = kmem_alloc(XFS_DA_BUF_SIZE(nbuf), KM_SLEEP);
+                dabuf = kmem_alloc(XFS_DA_BUF_SIZE(nbuf), KM_NOFS);
        dabuf->dirty = 0;
 #ifdef XFS_DABUF_DEBUG
        dabuf->ra = ra;
diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c
index c657bec6d951..bb1d58eb3982 100644
--- a/fs/xfs/xfs_dir2.c
+++ b/fs/xfs/xfs_dir2.c
@@ -256,7 +256,7 @@ xfs_dir_cilookup_result(
                                        !(args->op_flags & XFS_DA_OP_CILOOKUP))
                return EEXIST;
-        args->value = kmem_alloc(len, KM_MAYFAIL);
+        args->value = kmem_alloc(len, KM_NOFS | KM_MAYFAIL);
        if (!args->value)
                return ENOMEM;
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index cbd451bb4848..2d0b3e1da9e6 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -167,17 +167,25 @@ xfs_growfs_data_private(
        new = nb - mp->m_sb.sb_dblocks;
        oagcount = mp->m_sb.sb_agcount;
        if (nagcount > oagcount) {
+                void *new_perag, *old_perag;
                xfs_filestream_flush(mp);
+                new_perag = kmem_zalloc(sizeof(xfs_perag_t) * nagcount,
+                                        KM_MAYFAIL);
+                if (!new_perag)
+                        return XFS_ERROR(ENOMEM);
                down_write(&mp->m_peraglock);
-                mp->m_perag = kmem_realloc(mp->m_perag,
+                memcpy(new_perag, mp->m_perag, sizeof(xfs_perag_t) * oagcount);
-                        sizeof(xfs_perag_t) * nagcount,
+                old_perag = mp->m_perag;
-                        sizeof(xfs_perag_t) * oagcount,
+                mp->m_perag = new_perag;
-                        KM_SLEEP);
-                memset(&mp->m_perag[oagcount], 0,
-                        (nagcount - oagcount) * sizeof(xfs_perag_t));
                mp->m_flags |= XFS_MOUNT_32BITINODES;
                nagimax = xfs_initialize_perag(mp, nagcount);
                up_write(&mp->m_peraglock);
+                kmem_free(old_perag);
        }
        tp = xfs_trans_alloc(mp, XFS_TRANS_GROWFS);
        tp->t_flags |= XFS_TRANS_RESERVE;
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 5fcec6f020a7..ecbf8b4d2e2e 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -64,6 +64,10 @@ xfs_inode_alloc(
        ip = kmem_zone_alloc(xfs_inode_zone, KM_SLEEP);
        if (!ip)
                return NULL;
+        if (inode_init_always(mp->m_super, VFS_I(ip))) {
+                kmem_zone_free(xfs_inode_zone, ip);
+                return NULL;
+        }
        ASSERT(atomic_read(&ip->i_iocount) == 0);
        ASSERT(atomic_read(&ip->i_pincount) == 0);
@@ -105,17 +109,6 @@ xfs_inode_alloc(
 #ifdef XFS_DIR2_TRACE
        ip->i_dir_trace = ktrace_alloc(XFS_DIR2_KTRACE_SIZE, KM_NOFS);
 #endif
-        /*
-        * Now initialise the VFS inode. We do this after the xfs_inode
-        * initialisation as internal failures will result in ->destroy_inode
-        * being called and that will pass down through the reclaim path and
-        * free the XFS inode. This path requires the XFS inode to already be
-        * initialised. Hence if this call fails, the xfs_inode has already
-        * been freed and we should not reference it at all in the error
-        * handling.
-        */
-        if (!inode_init_always(mp->m_super, VFS_I(ip)))
-                return NULL;
        /* prevent anyone from using this yet */
        VFS_I(ip)->i_state = I_NEW|I_LOCK;
@@ -123,6 +116,71 @@ xfs_inode_alloc(
        return ip;
 }
+STATIC void
+xfs_inode_free(
+        struct xfs_inode        *ip)
+{
+        switch (ip->i_d.di_mode & S_IFMT) {
+        case S_IFREG:
+        case S_IFDIR:
+        case S_IFLNK:
+                xfs_idestroy_fork(ip, XFS_DATA_FORK);
+                break;
+        }
+        if (ip->i_afp)
+                xfs_idestroy_fork(ip, XFS_ATTR_FORK);
+#ifdef XFS_INODE_TRACE
+        ktrace_free(ip->i_trace);
+#endif
+#ifdef XFS_BMAP_TRACE
+        ktrace_free(ip->i_xtrace);
+#endif
+#ifdef XFS_BTREE_TRACE
+        ktrace_free(ip->i_btrace);
+#endif
+#ifdef XFS_RW_TRACE
+        ktrace_free(ip->i_rwtrace);
+#endif
+#ifdef XFS_ILOCK_TRACE
+        ktrace_free(ip->i_lock_trace);
+#endif
+#ifdef XFS_DIR2_TRACE
+        ktrace_free(ip->i_dir_trace);
+#endif
+        if (ip->i_itemp) {
+                /*
+                 * Only if we are shutting down the fs will we see an
+                 * inode still in the AIL. If it is there, we should remove
+                 * it to prevent a use-after-free from occurring.
+                 */
+                xfs_log_item_t  *lip = &ip->i_itemp->ili_item;
+                struct xfs_ail  *ailp = lip->li_ailp;
+                ASSERT(((lip->li_flags & XFS_LI_IN_AIL) == 0) ||
+                                       XFS_FORCED_SHUTDOWN(ip->i_mount));
+                if (lip->li_flags & XFS_LI_IN_AIL) {
+                        spin_lock(&ailp->xa_lock);
+                        if (lip->li_flags & XFS_LI_IN_AIL)
+                                xfs_trans_ail_delete(ailp, lip);
+                        else
+                                spin_unlock(&ailp->xa_lock);
+                }
+                xfs_inode_item_destroy(ip);
+                ip->i_itemp = NULL;
+        }
+        /* asserts to verify all state is correct here */
+        ASSERT(atomic_read(&ip->i_iocount) == 0);
+        ASSERT(atomic_read(&ip->i_pincount) == 0);
+        ASSERT(!spin_is_locked(&ip->i_flags_lock));
+        ASSERT(completion_done(&ip->i_flush));
+        kmem_zone_free(xfs_inode_zone, ip);
+}
 /*
 * Check the validity of the inode we just found it the cache
 */
@@ -133,80 +191,82 @@ xfs_iget_cache_hit(
        int                     flags,
        int                     lock_flags) __releases(pag->pag_ici_lock)
 {
+        struct inode            *inode = VFS_I(ip);
        struct xfs_mount        *mp = ip->i_mount;
-        int                     error = EAGAIN;
+        int                     error;
+        spin_lock(&ip->i_flags_lock);
        /*
-         * If INEW is set this inode is being set up
+         * If we are racing with another cache hit that is currently
-         * If IRECLAIM is set this inode is being torn down
+         * instantiating this inode or currently recycling it out of
-         * Pause and try again.
+         * reclaimabe state, wait for the initialisation to complete
+         * before continuing.
+         *
+         * XXX(hch): eventually we should do something equivalent to
+         *           wait_on_inode to wait for these flags to be cleared
+         *           instead of polling for it.
         */
-        if (xfs_iflags_test(ip, (XFS_INEW|XFS_IRECLAIM))) {
+        if (ip->i_flags & (XFS_INEW|XFS_IRECLAIM)) {
                XFS_STATS_INC(xs_ig_frecycle);
+                error = EAGAIN;
                goto out_error;
        }
-        /* If IRECLAIMABLE is set, we've torn down the vfs inode part */
+        /*
-        if (xfs_iflags_test(ip, XFS_IRECLAIMABLE)) {
+         * If lookup is racing with unlink return an error immediately.
+         */
-                /*
+        if (ip->i_d.di_mode == 0 && !(flags & XFS_IGET_CREATE)) {
-                 * If lookup is racing with unlink, then we should return an
+                error = ENOENT;
-                 * error immediately so we don't remove it from the reclaim
+                goto out_error;
-                 * list and potentially leak the inode.
+        }
-                 */
-                if ((ip->i_d.di_mode == 0) && !(flags & XFS_IGET_CREATE)) {
-                        error = ENOENT;
-                        goto out_error;
-                }
+        /*
+         * If IRECLAIMABLE is set, we've torn down the VFS inode already.
+         * Need to carefully get it back into useable state.
+         */
+        if (ip->i_flags & XFS_IRECLAIMABLE) {
                xfs_itrace_exit_tag(ip, "xfs_iget.alloc");
                /*
-                 * We need to re-initialise the VFS inode as it has been
+                 * We need to set XFS_INEW atomically with clearing the
-                 * 'freed' by the VFS. Do this here so we can deal with
+                 * reclaimable tag so that we do have an indicator of the
-                 * errors cleanly, then tag it so it can be set up correctly
+                 * inode still being initialized.
-                 * later.
                 */
-                if (!inode_init_always(mp->m_super, VFS_I(ip))) {
+                ip->i_flags |= XFS_INEW;
-                        error = ENOMEM;
+                ip->i_flags &= ~XFS_IRECLAIMABLE;
-                        goto out_error;
+                __xfs_inode_clear_reclaim_tag(mp, pag, ip);
-                }
-                /*
+                spin_unlock(&ip->i_flags_lock);
-                 * We must set the XFS_INEW flag before clearing the
+                read_unlock(&pag->pag_ici_lock);
-                 * XFS_IRECLAIMABLE flag so that if a racing lookup does
-                 * not find the XFS_IRECLAIMABLE above but has the igrab()
-                 * below succeed we can safely check XFS_INEW to detect
-                 * that this inode is still being initialised.
-                 */
-                xfs_iflags_set(ip, XFS_INEW);
-                xfs_iflags_clear(ip, XFS_IRECLAIMABLE);
-                /* clear the radix tree reclaim flag as well. */
+                error = -inode_init_always(mp->m_super, inode);
-                __xfs_inode_clear_reclaim_tag(mp, pag, ip);
+                if (error) {
-        } else if (!igrab(VFS_I(ip))) {
+                        /*
+                         * Re-initializing the inode failed, and we are in deep
+                         * trouble.  Try to re-add it to the reclaim list.
+                         */
+                        read_lock(&pag->pag_ici_lock);
+                        spin_lock(&ip->i_flags_lock);
+                        ip->i_flags &= ~XFS_INEW;
+                        ip->i_flags |= XFS_IRECLAIMABLE;
+                        __xfs_inode_set_reclaim_tag(pag, ip);
+                        goto out_error;
+                }
+                inode->i_state = I_LOCK|I_NEW;
+        } else {
                /* If the VFS inode is being torn down, pause and try again. */
-                XFS_STATS_INC(xs_ig_frecycle);
+                if (!igrab(inode)) {
-                goto out_error;
+                        error = EAGAIN;
-        } else if (xfs_iflags_test(ip, XFS_INEW)) {
+                        goto out_error;
-                /*
+                }
-                 * We are racing with another cache hit that is
-                 * currently recycling this inode out of the XFS_IRECLAIMABLE
-                 * state. Wait for the initialisation to complete before
-                 * continuing.
-                 */
-                wait_on_inode(VFS_I(ip));
-        }
-        if (ip->i_d.di_mode == 0 && !(flags & XFS_IGET_CREATE)) {
+                /* We've got a live one. */
-                error = ENOENT;
+                spin_unlock(&ip->i_flags_lock);
-                iput(VFS_I(ip));
+                read_unlock(&pag->pag_ici_lock);
-                goto out_error;
        }
-        /* We've got a live one. */
-        read_unlock(&pag->pag_ici_lock);
        if (lock_flags != 0)
                xfs_ilock(ip, lock_flags);
@@ -216,6 +276,7 @@ xfs_iget_cache_hit(
        return 0;
 out_error:
+        spin_unlock(&ip->i_flags_lock);
        read_unlock(&pag->pag_ici_lock);
        return error;
 }
@@ -299,7 +360,8 @@ out_preload_end:
        if (lock_flags)
                xfs_iunlock(ip, lock_flags);
 out_destroy:
-        xfs_destroy_inode(ip);
+        __destroy_inode(VFS_I(ip));
+        xfs_inode_free(ip);
        return error;
 }
@@ -504,62 +566,7 @@ xfs_ireclaim(
        xfs_qm_dqdetach(ip);
        xfs_iunlock(ip, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
-        switch (ip->i_d.di_mode & S_IFMT) {
+        xfs_inode_free(ip);
-        case S_IFREG:
-        case S_IFDIR:
-        case S_IFLNK:
-                xfs_idestroy_fork(ip, XFS_DATA_FORK);
-                break;
-        }
-        if (ip->i_afp)
-                xfs_idestroy_fork(ip, XFS_ATTR_FORK);
-#ifdef XFS_INODE_TRACE
-        ktrace_free(ip->i_trace);
-#endif
-#ifdef XFS_BMAP_TRACE
-        ktrace_free(ip->i_xtrace);
-#endif
-#ifdef XFS_BTREE_TRACE
-        ktrace_free(ip->i_btrace);
-#endif
-#ifdef XFS_RW_TRACE
-        ktrace_free(ip->i_rwtrace);
-#endif
-#ifdef XFS_ILOCK_TRACE
-        ktrace_free(ip->i_lock_trace);
-#endif
-#ifdef XFS_DIR2_TRACE
-        ktrace_free(ip->i_dir_trace);
-#endif
-        if (ip->i_itemp) {
-                /*
-                 * Only if we are shutting down the fs will we see an
-                 * inode still in the AIL. If it is there, we should remove
-                 * it to prevent a use-after-free from occurring.
-                 */
-                xfs_log_item_t  *lip = &ip->i_itemp->ili_item;
-                struct xfs_ail  *ailp = lip->li_ailp;
-                ASSERT(((lip->li_flags & XFS_LI_IN_AIL) == 0) ||
-                                       XFS_FORCED_SHUTDOWN(ip->i_mount));
-                if (lip->li_flags & XFS_LI_IN_AIL) {
-                        spin_lock(&ailp->xa_lock);
-                        if (lip->li_flags & XFS_LI_IN_AIL)
-                                xfs_trans_ail_delete(ailp, lip);
-                        else
-                                spin_unlock(&ailp->xa_lock);
-                }
-                xfs_inode_item_destroy(ip);
-                ip->i_itemp = NULL;
-        }
-        /* asserts to verify all state is correct here */
-        ASSERT(atomic_read(&ip->i_iocount) == 0);
-        ASSERT(atomic_read(&ip->i_pincount) == 0);
-        ASSERT(!spin_is_locked(&ip->i_flags_lock));
-        ASSERT(completion_done(&ip->i_flush));
-        kmem_zone_free(xfs_inode_zone, ip);
 }
 /*
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 1f22d65fed0a..da428b3fe0f5 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -343,6 +343,16 @@ xfs_iformat(
                return XFS_ERROR(EFSCORRUPTED);
        }
+        if (unlikely((ip->i_d.di_flags & XFS_DIFLAG_REALTIME) &&
+                     !ip->i_mount->m_rtdev_targp)) {
+                xfs_fs_repair_cmn_err(CE_WARN, ip->i_mount,
+                        "corrupt dinode %Lu, has realtime flag set.",
+                        ip->i_ino);
+                XFS_CORRUPTION_ERROR("xfs_iformat(realtime)",
+                                     XFS_ERRLEVEL_LOW, ip->i_mount, dip);
+                return XFS_ERROR(EFSCORRUPTED);
+        }
        switch (ip->i_d.di_mode & S_IFMT) {
        case S_IFIFO:
        case S_IFCHR:
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 1804f866a71d..65f24a3cc992 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -310,23 +310,6 @@ static inline struct inode *VFS_I(struct xfs_inode *ip)
 }
 /*
- * Get rid of a partially initialized inode.
- *
- * We have to go through destroy_inode to make sure allocations
- * from init_inode_always like the security data are undone.
- *
- * We mark the inode bad so that it takes the short cut in
- * the reclaim path instead of going through the flush path
- * which doesn't make sense for an inode that has never seen the
- * light of day.
- */
-static inline void xfs_destroy_inode(struct xfs_inode *ip)
-{
-        make_bad_inode(VFS_I(ip));
-        return destroy_inode(VFS_I(ip));
-}
-/*
 * i_flags helper functions
 */
 static inline void
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 3750f04ede0b..9dbdff3ea484 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -3180,7 +3180,7 @@ try_again:
 STATIC void
 xlog_state_want_sync(xlog_t *log, xlog_in_core_t *iclog)
 {
-        ASSERT(spin_is_locked(&log->l_icloglock));
+        assert_spin_locked(&log->l_icloglock);
        if (iclog->ic_state == XLOG_STATE_ACTIVE) {
                xlog_state_switch_iclogs(log, iclog, 0);
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index c4eca5ed5dab..492d75bae2bf 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -538,7 +538,9 @@ xfs_readlink_bmap(
                d = XFS_FSB_TO_DADDR(mp, mval[n].br_startblock);
                byte_cnt = XFS_FSB_TO_B(mp, mval[n].br_blockcount);
-                bp = xfs_buf_read(mp->m_ddev_targp, d, BTOBB(byte_cnt), 0);
+                bp = xfs_buf_read_flags(mp->m_ddev_targp, d, BTOBB(byte_cnt),
+                                        XBF_LOCK | XBF_MAPPED |
+                                        XBF_DONT_BLOCK);
                error = XFS_BUF_GETERROR(bp);
                if (error) {
                        xfs_ioerror_alert("xfs_readlink",
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 7174818c2c13..853508499d20 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -257,9 +257,12 @@
        {0x1002, 0x940F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R600|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94A1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94B1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94B3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94B5, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9440, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9441, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9442, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
@@ -288,6 +291,7 @@
        {0x1002, 0x948F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9490, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9491, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9495, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9498, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x949C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x949E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
@@ -325,6 +329,7 @@
        {0x1002, 0x9552, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9553, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9555, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9557, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9580, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9581, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9583, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
@@ -365,6 +370,11 @@
        {0x1002, 0x9614, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS780|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9615, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS780|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9616, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS780|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9710, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9711, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0, 0, 0}
 #define r128_PCI_IDS \
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index e7cb5dbf6c26..69103e053c92 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -913,6 +913,7 @@ extern void blk_queue_logical_block_size(struct request_queue *, unsigned short)
 extern void blk_queue_physical_block_size(struct request_queue *, unsigned short);
 extern void blk_queue_alignment_offset(struct request_queue *q,
                                       unsigned int alignment);
+extern void blk_limits_io_min(struct queue_limits *limits, unsigned int min);
 extern void blk_queue_io_min(struct request_queue *q, unsigned int min);
 extern void blk_queue_io_opt(struct request_queue *q, unsigned int opt);
 extern void blk_set_default_limits(struct queue_limits *lim);
diff --git a/include/linux/decompress/generic.h b/include/linux/decompress/generic.h
index 6dfb856327bb..0c7111a55a1a 100644
--- a/include/linux/decompress/generic.h
+++ b/include/linux/decompress/generic.h
@@ -1,31 +1,37 @@
 #ifndef DECOMPRESS_GENERIC_H
 #define DECOMPRESS_GENERIC_H
-/* Minimal chunksize to be read.
- *Bzip2 prefers at least 4096
- *Lzma prefers 0x10000 */
-#define COMPR_IOBUF_SIZE        4096
 typedef int (*decompress_fn) (unsigned char *inbuf, int len,
                              int(*fill)(void*, unsigned int),
-                              int(*writebb)(void*, unsigned int),
+                              int(*flush)(void*, unsigned int),
-                              unsigned char *output,
+                              unsigned char *outbuf,
                              int *posp,
                              void(*error)(char *x));
 /* inbuf   - input buffer
 *len     - len of pre-read data in inbuf
- *fill    - function to fill inbuf if empty
+ *fill    - function to fill inbuf when empty
- *writebb - function to write out outbug
+ *flush   - function to write out outbuf
+ *outbuf  - output buffer
 *posp    - if non-null, input position (number of bytes read) will be
 *        returned here
 *
- *If len != 0, the inbuf is initialized (with as much data), and fill
+ *If len != 0, inbuf should contain all the necessary input data, and fill
- *should not be called
+ *should be NULL
- *If len = 0, the inbuf is allocated, but empty. Its size is IOBUF_SIZE
+ *If len = 0, inbuf can be NULL, in which case the decompressor will allocate
- *fill should be called (repeatedly...) to read data, at most IOBUF_SIZE
+ *the input buffer.  If inbuf != NULL it must be at least XXX_IOBUF_SIZE bytes.
+ *fill will be called (repeatedly...) to read data, at most XXX_IOBUF_SIZE
+ *bytes should be read per call.  Replace XXX with the appropriate decompressor
+ *name, i.e. LZMA_IOBUF_SIZE.
+ *
+ *If flush = NULL, outbuf must be large enough to buffer all the expected
+ *output.  If flush != NULL, the output buffer will be allocated by the
+ *decompressor (outbuf = NULL), and the flush function will be called to
+ *flush the output buffer at the appropriate time (decompressor and stream
+ *dependent).
 */
 /* Utility routine to detect the decompression method */
 decompress_fn decompress_method(const unsigned char *inbuf, int len,
                                const char **name);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index a36ffa5a77a4..67888a9e0655 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2137,7 +2137,7 @@ extern loff_t default_llseek(struct file *file, loff_t offset, int origin);
 extern loff_t vfs_llseek(struct file *file, loff_t offset, int origin);
-extern struct inode * inode_init_always(struct super_block *, struct inode *);
+extern int inode_init_always(struct super_block *, struct inode *);
 extern void inode_init_once(struct inode *);
 extern void inode_add_to_lists(struct super_block *, struct inode *);
 extern void iput(struct inode *);
@@ -2164,6 +2164,7 @@ extern void __iget(struct inode * inode);
 extern void iget_failed(struct inode *);
 extern void clear_inode(struct inode *);
 extern void destroy_inode(struct inode *);
+extern void __destroy_inode(struct inode *);
 extern struct inode *new_inode(struct super_block *);
 extern int should_remove_suid(struct dentry *);
 extern int file_remove_suid(struct file *);
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 5c093ffc655b..a81170de7f6b 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -89,7 +89,9 @@ enum print_line_t {
        TRACE_TYPE_NO_CONSUME   = 3     /* Handled but ask to not consume */
 };
+void tracing_generic_entry_update(struct trace_entry *entry,
+                                  unsigned long flags,
+                                  int pc);
 struct ring_buffer_event *
 trace_current_buffer_lock_reserve(int type, unsigned long len,
                                  unsigned long flags, int pc);
@@ -119,11 +121,9 @@ struct ftrace_event_call {
        void                    *filter;
        void                    *mod;
-#ifdef CONFIG_EVENT_PROFILE
+        atomic_t                profile_count;
-        atomic_t        profile_count;
+        int                     (*profile_enable)(struct ftrace_event_call *);
-        int             (*profile_enable)(struct ftrace_event_call *);
+        void                    (*profile_disable)(struct ftrace_event_call *);
-        void            (*profile_disable)(struct ftrace_event_call *);
-#endif
 };
 #define MAX_FILTER_PRED         32
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index acef2a770b6b..ad27c7da8798 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -82,7 +82,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_FORWARD(in_dev)          IN_DEV_CONF_GET((in_dev), FORWARDING)
 #define IN_DEV_MFORWARD(in_dev)         IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
-#define IN_DEV_RPFILTER(in_dev)         IN_DEV_ANDCONF((in_dev), RP_FILTER)
+#define IN_DEV_RPFILTER(in_dev)         IN_DEV_MAXCONF((in_dev), RP_FILTER)
 #define IN_DEV_SOURCE_ROUTE(in_dev)     IN_DEV_ANDCONF((in_dev), \
                                                       ACCEPT_SOURCE_ROUTE)
 #define IN_DEV_BOOTP_RELAY(in_dev)      IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
diff --git a/include/linux/input/matrix_keypad.h b/include/linux/input/matrix_keypad.h
index 7964516c6954..15d5903af2dd 100644
--- a/include/linux/input/matrix_keypad.h
+++ b/include/linux/input/matrix_keypad.h
@@ -15,12 +15,13 @@
 #define KEY_COL(k)              (((k) >> 16) & 0xff)
 #define KEY_VAL(k)              ((k) & 0xffff)
+#define MATRIX_SCAN_CODE(row, col, row_shift)   (((row) << (row_shift)) + (col))
 /**
 * struct matrix_keymap_data - keymap for matrix keyboards
 * @keymap: pointer to array of uint32 values encoded with KEY() macro
 *      representing keymap
 * @keymap_size: number of entries (initialized) in this keymap
- * @max_keymap_size: maximum size of keymap supported by the device
 *
 * This structure is supposed to be used by platform code to supply
 * keymaps to drivers that implement matrix-like keypads/keyboards.
@@ -28,14 +29,13 @@
 struct matrix_keymap_data {
        const uint32_t *keymap;
        unsigned int    keymap_size;
-        unsigned int    max_keymap_size;
 };
 /**
 * struct matrix_keypad_platform_data - platform-dependent keypad data
 * @keymap_data: pointer to &matrix_keymap_data
- * @row_gpios: array of gpio numbers reporesenting rows
+ * @row_gpios: pointer to array of gpio numbers representing rows
- * @col_gpios: array of gpio numbers reporesenting colums
+ * @col_gpios: pointer to array of gpio numbers reporesenting colums
 * @num_row_gpios: actual number of row gpios used by device
 * @num_col_gpios: actual number of col gpios used by device
 * @col_scan_delay_us: delay, measured in microseconds, that is
@@ -48,8 +48,9 @@ struct matrix_keymap_data {
 struct matrix_keypad_platform_data {
        const struct matrix_keymap_data *keymap_data;
-        unsigned int    row_gpios[MATRIX_MAX_ROWS];
+        const unsigned int *row_gpios;
-        unsigned int    col_gpios[MATRIX_MAX_COLS];
+        const unsigned int *col_gpios;
        unsigned int    num_row_gpios;
        unsigned int    num_col_gpios;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 16713dc672e4..3060bdc35ffe 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -110,6 +110,7 @@ struct kvm_memory_slot {
 struct kvm_kernel_irq_routing_entry {
        u32 gsi;
+        u32 type;
        int (*set)(struct kvm_kernel_irq_routing_entry *e,
                    struct kvm *kvm, int level);
        union {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index ba3a7cb1eaa0..9a72cc78e6b8 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -34,8 +34,6 @@ extern int sysctl_legacy_va_layout;
 #define sysctl_legacy_va_layout 0
 #endif
-extern unsigned long mmap_min_addr;
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -575,19 +573,6 @@ static inline void set_page_links(struct page *page, enum zone_type zone,
 }
 /*
- * If a hint addr is less than mmap_min_addr change hint to be as
- * low as possible but still greater than mmap_min_addr
- */
-static inline unsigned long round_hint_to_min(unsigned long hint)
-{
-        hint &= PAGE_MASK;
-        if (((void *)hint != NULL) &&
-            (hint < mmap_min_addr))
-                return PAGE_ALIGN(mmap_min_addr);
-        return hint;
-}
-/*
 * Some inline functions in vmstat.h depend on page_zone()
 */
 #include <linux/vmstat.h>
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index 5675b63a0631..0f32a9b6ff55 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -251,7 +251,7 @@ struct mtd_info {
 static inline struct mtd_info *dev_to_mtd(struct device *dev)
 {
-        return dev ? container_of(dev, struct mtd_info, dev) : NULL;
+        return dev ? dev_get_drvdata(dev) : NULL;
 }
 static inline uint32_t mtd_div_by_eb(uint64_t sz, struct mtd_info *mtd)
diff --git a/include/linux/mtd/partitions.h b/include/linux/mtd/partitions.h
index af6dcb992bc3..b70313d33ff8 100644
--- a/include/linux/mtd/partitions.h
+++ b/include/linux/mtd/partitions.h
@@ -47,6 +47,8 @@ struct mtd_partition {
 #define MTDPART_SIZ_FULL        (0)
+struct mtd_info;
 int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
 int del_mtd_partitions(struct mtd_info *);
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index fdffb413b192..f6b90240dd41 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -473,7 +473,6 @@ extern int  nfs_writepages(struct address_space *, struct writeback_control *);
 extern int  nfs_flush_incompatible(struct file *file, struct page *page);
 extern int  nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int);
 extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *);
-extern void nfs_writedata_release(void *);
 /*
 * Try to write back everything synchronously (but check the
@@ -488,7 +487,6 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);
 extern int  nfs_commit_inode(struct inode *, int);
 extern struct nfs_write_data *nfs_commitdata_alloc(void);
 extern void nfs_commit_free(struct nfs_write_data *wdata);
-extern void nfs_commitdata_release(void *wdata);
 #else
 static inline int
 nfs_commit_inode(struct inode *inode, int how)
@@ -507,6 +505,7 @@ nfs_have_writebacks(struct inode *inode)
 * Allocate nfs_write_data structures
 */
 extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages);
+extern void nfs_writedata_free(struct nfs_write_data *);
 /*
 * linux/fs/nfs/read.c
@@ -515,7 +514,6 @@ extern int  nfs_readpage(struct file *, struct page *);
 extern int  nfs_readpages(struct file *, struct address_space *,
                struct list_head *, unsigned);
 extern int  nfs_readpage_result(struct rpc_task *, struct nfs_read_data *);
-extern void nfs_readdata_release(void *data);
 extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
                               struct page *);
@@ -523,6 +521,7 @@ extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
 * Allocate nfs_read_data structures
 */
 extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages);
+extern void nfs_readdata_free(struct nfs_read_data *);
 /*
 * linux/fs/nfs3proc.c
diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
index 829b94b156f2..b359c4a9ec9e 100644
--- a/include/linux/nodemask.h
+++ b/include/linux/nodemask.h
@@ -82,6 +82,12 @@
 *    to generate slightly worse code.  So use a simple one-line #define
 *    for node_isset(), instead of wrapping an inline inside a macro, the
 *    way we do the other calls.
+ *
+ * NODEMASK_SCRATCH
+ * When doing above logical AND, OR, XOR, Remap operations the callers tend to
+ * need temporary nodemask_t's on the stack. But if NODES_SHIFT is large,
+ * nodemask_t's consume too much stack space.  NODEMASK_SCRATCH is a helper
+ * for such situations. See below and CPUMASK_ALLOC also.
 */
 #include <linux/kernel.h>
@@ -473,4 +479,26 @@ static inline int num_node_state(enum node_states state)
 #define for_each_node(node)        for_each_node_state(node, N_POSSIBLE)
 #define for_each_online_node(node) for_each_node_state(node, N_ONLINE)
+/*
+ * For nodemask scrach area.(See CPUMASK_ALLOC() in cpumask.h)
+ */
+#if NODES_SHIFT > 8 /* nodemask_t > 64 bytes */
+#define NODEMASK_ALLOC(x, m) struct x *m = kmalloc(sizeof(*m), GFP_KERNEL)
+#define NODEMASK_FREE(m) kfree(m)
+#else
+#define NODEMASK_ALLOC(x, m) struct x _m, *m = &_m
+#define NODEMASK_FREE(m)
+#endif
+/* A example struture for using NODEMASK_ALLOC, used in mempolicy. */
+struct nodemask_scratch {
+        nodemask_t      mask1;
+        nodemask_t      mask2;
+};
+#define NODEMASK_SCRATCH(x) NODEMASK_ALLOC(nodemask_scratch, x)
+#define NODEMASK_SCRATCH_FREE(x)  NODEMASK_FREE(x)
 #endif /* __LINUX_NODEMASK_H */
diff --git a/include/linux/perf_counter.h b/include/linux/perf_counter.h
index bd15d7a5f5ce..b53f7006cc4e 100644
--- a/include/linux/perf_counter.h
+++ b/include/linux/perf_counter.h
@@ -115,27 +115,44 @@ enum perf_counter_sample_format {
        PERF_SAMPLE_TID                         = 1U << 1,
        PERF_SAMPLE_TIME                        = 1U << 2,
        PERF_SAMPLE_ADDR                        = 1U << 3,
-        PERF_SAMPLE_GROUP                       = 1U << 4,
+        PERF_SAMPLE_READ                        = 1U << 4,
        PERF_SAMPLE_CALLCHAIN                   = 1U << 5,
        PERF_SAMPLE_ID                          = 1U << 6,
        PERF_SAMPLE_CPU                         = 1U << 7,
        PERF_SAMPLE_PERIOD                      = 1U << 8,
        PERF_SAMPLE_STREAM_ID                   = 1U << 9,
+        PERF_SAMPLE_RAW                         = 1U << 10,
-        PERF_SAMPLE_MAX = 1U << 10,             /* non-ABI */
+        PERF_SAMPLE_MAX = 1U << 11,             /* non-ABI */
 };
 /*
- * Bits that can be set in attr.read_format to request that
+ * The format of the data returned by read() on a perf counter fd,
- * reads on the counter should return the indicated quantities,
+ * as specified by attr.read_format:
- * in increasing order of bit value, after the counter value.
+ *
+ * struct read_format {
+ *      { u64           value;
+ *        { u64         time_enabled; } && PERF_FORMAT_ENABLED
+ *        { u64         time_running; } && PERF_FORMAT_RUNNING
+ *        { u64         id;           } && PERF_FORMAT_ID
+ *      } && !PERF_FORMAT_GROUP
+ *
+ *      { u64           nr;
+ *        { u64         time_enabled; } && PERF_FORMAT_ENABLED
+ *        { u64         time_running; } && PERF_FORMAT_RUNNING
+ *        { u64         value;
+ *          { u64       id;           } && PERF_FORMAT_ID
+ *        }             cntr[nr];
+ *      } && PERF_FORMAT_GROUP
+ * };
 */
 enum perf_counter_read_format {
        PERF_FORMAT_TOTAL_TIME_ENABLED          = 1U << 0,
        PERF_FORMAT_TOTAL_TIME_RUNNING          = 1U << 1,
        PERF_FORMAT_ID                          = 1U << 2,
+        PERF_FORMAT_GROUP                       = 1U << 3,
-        PERF_FORMAT_MAX = 1U << 3,              /* non-ABI */
+        PERF_FORMAT_MAX = 1U << 4,              /* non-ABI */
 };
 #define PERF_ATTR_SIZE_VER0     64      /* sizeof first published struct */
@@ -181,8 +198,9 @@ struct perf_counter_attr {
                                freq           :  1, /* use freq, not period  */
                                inherit_stat   :  1, /* per task counts       */
                                enable_on_exec :  1, /* next exec enables     */
+                                task           :  1, /* trace fork/exit       */
-                                __reserved_1   : 51;
+                                __reserved_1   : 50;
        __u32                   wakeup_events;  /* wakeup every n events */
        __u32                   __reserved_2;
@@ -311,6 +329,15 @@ enum perf_event_type {
        /*
         * struct {
         *      struct perf_event_header        header;
+         *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
+         * };
+         */
+        PERF_EVENT_EXIT                 = 4,
+        /*
+         * struct {
+         *      struct perf_event_header        header;
         *      u64                             time;
         *      u64                             id;
         *      u64                             stream_id;
@@ -323,6 +350,7 @@ enum perf_event_type {
         * struct {
         *      struct perf_event_header        header;
         *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
         * };
         */
        PERF_EVENT_FORK                 = 7,
@@ -331,10 +359,8 @@ enum perf_event_type {
         * struct {
         *      struct perf_event_header        header;
         *      u32                             pid, tid;
-         *      u64                             value;
+         *
-         *      { u64           time_enabled;   } && PERF_FORMAT_ENABLED
+         *      struct read_format              values;
-         *      { u64           time_running;   } && PERF_FORMAT_RUNNING
-         *      { u64           parent_id;      } && PERF_FORMAT_ID
         * };
         */
        PERF_EVENT_READ                 = 8,
@@ -352,11 +378,24 @@ enum perf_event_type {
         *      { u32                   cpu, res; } && PERF_SAMPLE_CPU
         *      { u64                   period;   } && PERF_SAMPLE_PERIOD
         *
-         *      { u64                   nr;
+         *      { struct read_format    values;   } && PERF_SAMPLE_READ
-         *        { u64 id, val; }      cnt[nr];  } && PERF_SAMPLE_GROUP
         *
         *      { u64                   nr,
         *        u64                   ips[nr];  } && PERF_SAMPLE_CALLCHAIN
+         *
+         *      #
+         *      # The RAW record below is opaque data wrt the ABI
+         *      #
+         *      # That is, the ABI doesn't make any promises wrt to
+         *      # the stability of its content, it may vary depending
+         *      # on event, hardware, kernel version and phase of
+         *      # the moon.
+         *      #
+         *      # In other words, PERF_SAMPLE_RAW contents are not an ABI.
+         *      #
+         *
+         *      { u32                   size;
+         *        char                  data[size];}&& PERF_SAMPLE_RAW
         * };
         */
        PERF_EVENT_SAMPLE               = 9,
@@ -402,6 +441,11 @@ struct perf_callchain_entry {
        __u64                           ip[PERF_MAX_STACK_DEPTH];
 };
+struct perf_raw_record {
+        u32                             size;
+        void                            *data;
+};
 struct task_struct;
 /**
@@ -670,10 +714,13 @@ struct perf_sample_data {
        struct pt_regs                  *regs;
        u64                             addr;
        u64                             period;
+        struct perf_raw_record          *raw;
 };
 extern int perf_counter_overflow(struct perf_counter *counter, int nmi,
                                 struct perf_sample_data *data);
+extern void perf_counter_output(struct perf_counter *counter, int nmi,
+                                struct perf_sample_data *data);
 /*
 * Return 1 for a software counter, 0 for a hardware counter
diff --git a/include/linux/security.h b/include/linux/security.h
index 5eff459b3833..1f16eea2017b 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -28,6 +28,7 @@
 #include <linux/resource.h>
 #include <linux/sem.h>
 #include <linux/shm.h>
+#include <linux/mm.h> /* PAGE_ALIGN */
 #include <linux/msg.h>
 #include <linux/sched.h>
 #include <linux/key.h>
@@ -66,6 +67,9 @@ extern int cap_inode_setxattr(struct dentry *dentry, const char *name,
 extern int cap_inode_removexattr(struct dentry *dentry, const char *name);
 extern int cap_inode_need_killpriv(struct dentry *dentry);
 extern int cap_inode_killpriv(struct dentry *dentry);
+extern int cap_file_mmap(struct file *file, unsigned long reqprot,
+                         unsigned long prot, unsigned long flags,
+                         unsigned long addr, unsigned long addr_only);
 extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
 extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                          unsigned long arg4, unsigned long arg5);
@@ -92,6 +96,7 @@ extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
 extern int cap_netlink_recv(struct sk_buff *skb, int cap);
 extern unsigned long mmap_min_addr;
+extern unsigned long dac_mmap_min_addr;
 /*
 * Values used in the task_security_ops calls
 */
@@ -116,6 +121,21 @@ struct request_sock;
 #define LSM_UNSAFE_PTRACE       2
 #define LSM_UNSAFE_PTRACE_CAP   4
+/*
+ * If a hint addr is less than mmap_min_addr change hint to be as
+ * low as possible but still greater than mmap_min_addr
+ */
+static inline unsigned long round_hint_to_min(unsigned long hint)
+{
+        hint &= PAGE_MASK;
+        if (((void *)hint != NULL) &&
+            (hint < mmap_min_addr))
+                return PAGE_ALIGN(mmap_min_addr);
+        return hint;
+}
+extern int mmap_min_addr_handler(struct ctl_table *table, int write, struct file *filp,
+                                 void __user *buffer, size_t *lenp, loff_t *ppos);
 #ifdef CONFIG_SECURITY
 struct security_mnt_opts {
@@ -2197,9 +2217,7 @@ static inline int security_file_mmap(struct file *file, unsigned long reqprot,
                                     unsigned long addr,
                                     unsigned long addr_only)
 {
-        if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO))
+        return cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
-                return -EACCES;
-        return 0;
 }
 static inline int security_file_mprotect(struct vm_area_struct *vma,
diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
index 40f38d896777..0c4ee9b88f85 100644
--- a/include/linux/tty_ldisc.h
+++ b/include/linux/tty_ldisc.h
@@ -144,7 +144,7 @@ struct tty_ldisc_ops {
 struct tty_ldisc {
        struct tty_ldisc_ops *ops;
-        int refcount;
+        atomic_t users;
 };
 #define TTY_LDISC_MAGIC 0x5403
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 6788e1a4d4ca..cf3c2f5dba51 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -77,7 +77,14 @@ struct task_struct;
 #define __WAIT_BIT_KEY_INITIALIZER(word, bit)                           \
        { .flags = word, .bit_nr = bit, }
-extern void init_waitqueue_head(wait_queue_head_t *q);
+extern void __init_waitqueue_head(wait_queue_head_t *q, struct lock_class_key *);
+#define init_waitqueue_head(q)                          \
+        do {                                            \
+                static struct lock_class_key __key;     \
+                                                        \
+                __init_waitqueue_head((q), &__key);     \
+        } while (0)
 #ifdef CONFIG_LOCKDEP
 # define __WAIT_QUEUE_HEAD_INIT_ONSTACK(name) \
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 80072611d26a..c274993234e3 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -355,7 +355,17 @@ struct rfcomm_dev_list_req {
 };
 int  rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+#ifdef CONFIG_BT_RFCOMM_TTY
 int  rfcomm_init_ttys(void);
 void rfcomm_cleanup_ttys(void);
+#else
+static inline int rfcomm_init_ttys(void)
+{
+        return 0;
+}
+static inline void rfcomm_cleanup_ttys(void)
+{
+}
+#endif
 #endif /* __RFCOMM_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1a21895b732b..d1892d66701a 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -979,6 +979,10 @@ struct cfg80211_ops {
 *      channels at a later time. This can be used for devices which do not
 *      have calibration information gauranteed for frequencies or settings
 *      outside of its regulatory domain.
+ * @disable_beacon_hints: enable this if your driver needs to ensure that
+ *      passive scan flags and beaconing flags may not be lifted by cfg80211
+ *      due to regulatory beacon hints. For more information on beacon
+ *      hints read the documenation for regulatory_hint_found_beacon()
 * @reg_notifier: the driver's regulatory notification callback
 * @regd: the driver's regulatory domain, if one was requested via
 *      the regulatory_hint() API. This can be used by the driver
@@ -1004,6 +1008,7 @@ struct wiphy {
        bool custom_regulatory;
        bool strict_regulatory;
+        bool disable_beacon_hints;
        enum cfg80211_signal_type signal_type;
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 1867553c61e5..f64fbaae781a 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -144,6 +144,9 @@
 #undef TP_fast_assign
 #define TP_fast_assign(args...) args
+#undef TP_perf_assign
+#define TP_perf_assign(args...)
 #undef TRACE_EVENT
 #define TRACE_EVENT(call, proto, args, tstruct, func, print)            \
 static int                                                              \
@@ -345,6 +348,56 @@ static inline int ftrace_get_offsets_##call(				\
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
+#ifdef CONFIG_EVENT_PROFILE
+/*
+ * Generate the functions needed for tracepoint perf_counter support.
+ *
+ * NOTE: The insertion profile callback (ftrace_profile_<call>) is defined later
+ *
+ * static int ftrace_profile_enable_<call>(struct ftrace_event_call *event_call)
+ * {
+ *      int ret = 0;
+ *
+ *      if (!atomic_inc_return(&event_call->profile_count))
+ *              ret = register_trace_<call>(ftrace_profile_<call>);
+ *
+ *      return ret;
+ * }
+ *
+ * static void ftrace_profile_disable_<call>(struct ftrace_event_call *event_call)
+ * {
+ *      if (atomic_add_negative(-1, &event->call->profile_count))
+ *              unregister_trace_<call>(ftrace_profile_<call>);
+ * }
+ *
+ */
+#undef TRACE_EVENT
+#define TRACE_EVENT(call, proto, args, tstruct, assign, print)          \
+                                                                        \
+static void ftrace_profile_##call(proto);                               \
+                                                                        \
+static int ftrace_profile_enable_##call(struct ftrace_event_call *event_call) \
+{                                                                       \
+        int ret = 0;                                                    \
+                                                                        \
+        if (!atomic_inc_return(&event_call->profile_count))             \
+                ret = register_trace_##call(ftrace_profile_##call);     \
+                                                                        \
+        return ret;                                                     \
+}                                                                       \
+                                                                        \
+static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
+{                                                                       \
+        if (atomic_add_negative(-1, &event_call->profile_count))        \
+                unregister_trace_##call(ftrace_profile_##call);         \
+}
+#include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
+#endif
 /*
 * Stage 4 of the trace events.
 *
@@ -447,28 +500,6 @@ static inline int ftrace_get_offsets_##call(				\
 #define TP_FMT(fmt, args...)    fmt "\n", ##args
 #ifdef CONFIG_EVENT_PROFILE
-#define _TRACE_PROFILE(call, proto, args)                               \
-static void ftrace_profile_##call(proto)                                \
-{                                                                       \
-        extern void perf_tpcounter_event(int);                          \
-        perf_tpcounter_event(event_##call.id);                          \
-}                                                                       \
-                                                                        \
-static int ftrace_profile_enable_##call(struct ftrace_event_call *event_call) \
-{                                                                       \
-        int ret = 0;                                                    \
-                                                                        \
-        if (!atomic_inc_return(&event_call->profile_count))             \
-                ret = register_trace_##call(ftrace_profile_##call);     \
-                                                                        \
-        return ret;                                                     \
-}                                                                       \
-                                                                        \
-static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
-{                                                                       \
-        if (atomic_add_negative(-1, &event_call->profile_count))        \
-                unregister_trace_##call(ftrace_profile_##call);         \
-}
 #define _TRACE_PROFILE_INIT(call)                                       \
        .profile_count = ATOMIC_INIT(-1),                               \
@@ -476,7 +507,6 @@ static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
        .profile_disable = ftrace_profile_disable_##call,
 #else
-#define _TRACE_PROFILE(call, proto, args)
 #define _TRACE_PROFILE_INIT(call)
 #endif
@@ -502,7 +532,6 @@ static void ftrace_profile_disable_##call(struct ftrace_event_call *event_call)\
 #undef TRACE_EVENT
 #define TRACE_EVENT(call, proto, args, tstruct, assign, print)          \
-_TRACE_PROFILE(call, PARAMS(proto), PARAMS(args))                       \
                                                                        \
 static struct ftrace_event_call event_##call;                           \
                                                                        \
@@ -586,6 +615,110 @@ __attribute__((section("_ftrace_events"))) event_##call = {		\
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
-#undef _TRACE_PROFILE
+/*
+ * Define the insertion callback to profile events
+ *
+ * The job is very similar to ftrace_raw_event_<call> except that we don't
+ * insert in the ring buffer but in a perf counter.
+ *
+ * static void ftrace_profile_<call>(proto)
+ * {
+ *      struct ftrace_data_offsets_<call> __maybe_unused __data_offsets;
+ *      struct ftrace_event_call *event_call = &event_<call>;
+ *      extern void perf_tpcounter_event(int, u64, u64, void *, int);
+ *      struct ftrace_raw_##call *entry;
+ *      u64 __addr = 0, __count = 1;
+ *      unsigned long irq_flags;
+ *      int __entry_size;
+ *      int __data_size;
+ *      int pc;
+ *
+ *      local_save_flags(irq_flags);
+ *      pc = preempt_count();
+ *
+ *      __data_size = ftrace_get_offsets_<call>(&__data_offsets, args);
+ *
+ *      // Below we want to get the aligned size by taking into account
+ *      // the u32 field that will later store the buffer size
+ *      __entry_size = ALIGN(__data_size + sizeof(*entry) + sizeof(u32),
+ *                           sizeof(u64));
+ *      __entry_size -= sizeof(u32);
+ *
+ *      do {
+ *              char raw_data[__entry_size]; <- allocate our sample in the stack
+ *              struct trace_entry *ent;
+ *
+ *              zero dead bytes from alignment to avoid stack leak to userspace:
+ *
+ *              *(u64 *)(&raw_data[__entry_size - sizeof(u64)]) = 0ULL;
+ *              entry = (struct ftrace_raw_<call> *)raw_data;
+ *              ent = &entry->ent;
+ *              tracing_generic_entry_update(ent, irq_flags, pc);
+ *              ent->type = event_call->id;
+ *
+ *              <tstruct> <- do some jobs with dynamic arrays
+ *
+ *              <assign>  <- affect our values
+ *
+ *              perf_tpcounter_event(event_call->id, __addr, __count, entry,
+ *                           __entry_size);  <- submit them to perf counter
+ *      } while (0);
+ *
+ * }
+ */
+#ifdef CONFIG_EVENT_PROFILE
+#undef __perf_addr
+#define __perf_addr(a) __addr = (a)
+#undef __perf_count
+#define __perf_count(c) __count = (c)
+#undef TRACE_EVENT
+#define TRACE_EVENT(call, proto, args, tstruct, assign, print)          \
+static void ftrace_profile_##call(proto)                                \
+{                                                                       \
+        struct ftrace_data_offsets_##call __maybe_unused __data_offsets;\
+        struct ftrace_event_call *event_call = &event_##call;           \
+        extern void perf_tpcounter_event(int, u64, u64, void *, int);   \
+        struct ftrace_raw_##call *entry;                                \
+        u64 __addr = 0, __count = 1;                                    \
+        unsigned long irq_flags;                                        \
+        int __entry_size;                                               \
+        int __data_size;                                                \
+        int pc;                                                         \
+                                                                        \
+        local_save_flags(irq_flags);                                    \
+        pc = preempt_count();                                           \
+                                                                        \
+        __data_size = ftrace_get_offsets_##call(&__data_offsets, args); \
+        __entry_size = ALIGN(__data_size + sizeof(*entry) + sizeof(u32),\
+                             sizeof(u64));                              \
+        __entry_size -= sizeof(u32);                                    \
+                                                                        \
+        do {                                                            \
+                char raw_data[__entry_size];                            \
+                struct trace_entry *ent;                                \
+                                                                        \
+                *(u64 *)(&raw_data[__entry_size - sizeof(u64)]) = 0ULL; \
+                entry = (struct ftrace_raw_##call *)raw_data;           \
+                ent = &entry->ent;                                      \
+                tracing_generic_entry_update(ent, irq_flags, pc);       \
+                ent->type = event_call->id;                             \
+                                                                        \
+                tstruct                                                 \
+                                                                        \
+                { assign; }                                             \
+                                                                        \
+                perf_tpcounter_event(event_call->id, __addr, __count, entry,\
+                             __entry_size);                             \
+        } while (0);                                                    \
+                                                                        \
+}
+#include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
+#endif /* CONFIG_EVENT_PROFILE */
 #undef _TRACE_PROFILE_INIT
diff --git a/init/Kconfig b/init/Kconfig
index cb2c09270226..3f7e60995c80 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -940,6 +940,7 @@ menu "Performance Counters"
 config PERF_COUNTERS
        bool "Kernel Performance Counters"
+        default y if PROFILING
        depends on HAVE_PERF_COUNTERS
        select ANON_INODES
        help
@@ -961,9 +962,17 @@ config PERF_COUNTERS
          Say Y if unsure.
 config EVENT_PROFILE
-        bool "Tracepoint profile sources"
+        bool "Tracepoint profiling sources"
        depends on PERF_COUNTERS && EVENT_TRACING
        default y
+        help
+         Allow the use of tracepoints as software performance counters.
+         When this is enabled, you can create perf counters based on
+         tracepoints using PERF_TYPE_TRACEPOINT and the tracepoint ID
+         found in debugfs://tracing/events/*/*/id. (The -e/--events
+         option to the perf tool can parse and interpret symbolic
+         tracepoints, in the subsystem:tracepoint_name format.)
 endmenu
diff --git a/kernel/fork.c b/kernel/fork.c
index 29b532e718f7..021e1138556e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -568,18 +568,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
         * the value intact in a core dump, and to save the unnecessary
         * trouble otherwise.  Userland only wants this done for a sys_exit.
         */
-        if (tsk->clear_child_tid
+        if (tsk->clear_child_tid) {
-            && !(tsk->flags & PF_SIGNALED)
+                if (!(tsk->flags & PF_SIGNALED) &&
-            && atomic_read(&mm->mm_users) > 1) {
+                    atomic_read(&mm->mm_users) > 1) {
-                u32 __user * tidptr = tsk->clear_child_tid;
+                        /*
+                         * We don't check the error code - if userspace has
+                         * not set up a proper pointer then tough luck.
+                         */
+                        put_user(0, tsk->clear_child_tid);
+                        sys_futex(tsk->clear_child_tid, FUTEX_WAKE,
+                                        1, NULL, NULL, 0);
+                }
                tsk->clear_child_tid = NULL;
-                /*
-                 * We don't check the error code - if userspace has
-                 * not set up a proper pointer then tough luck.
-                 */
-                put_user(0, tidptr);
-                sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0);
        }
 }
@@ -1269,6 +1269,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        write_unlock_irq(&tasklist_lock);
        proc_fork_connector(p);
        cgroup_post_fork(p);
+        perf_counter_fork(p);
        return p;
 bad_fork_free_pid:
@@ -1410,9 +1411,6 @@ long do_fork(unsigned long clone_flags,
                        init_completion(&vfork);
                }
-                if (!(clone_flags & CLONE_THREAD))
-                        perf_counter_fork(p);
                audit_finish_fork(p);
                tracehook_report_clone(regs, clone_flags, nr, p);
diff --git a/kernel/futex.c b/kernel/futex.c
index 0672ff88f159..e18cfbdc7190 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1010,15 +1010,19 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
 * requeue_pi_wake_futex() - Wake a task that acquired the lock during requeue
 * q:   the futex_q
 * key: the key of the requeue target futex
+ * hb:  the hash_bucket of the requeue target futex
 *
 * During futex_requeue, with requeue_pi=1, it is possible to acquire the
 * target futex if it is uncontended or via a lock steal.  Set the futex_q key
 * to the requeue target futex so the waiter can detect the wakeup on the right
 * futex, but remove it from the hb and NULL the rt_waiter so it can detect
- * atomic lock acquisition.  Must be called with the q->lock_ptr held.
+ * atomic lock acquisition.  Set the q->lock_ptr to the requeue target hb->lock
+ * to protect access to the pi_state to fixup the owner later.  Must be called
+ * with both q->lock_ptr and hb->lock held.
 */
 static inline
-void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key)
+void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+                           struct futex_hash_bucket *hb)
 {
        drop_futex_key_refs(&q->key);
        get_futex_key_refs(key);
@@ -1030,6 +1034,11 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key)
        WARN_ON(!q->rt_waiter);
        q->rt_waiter = NULL;
+        q->lock_ptr = &hb->lock;
+#ifdef CONFIG_DEBUG_PI_LIST
+        q->list.plist.lock = &hb->lock;
+#endif
        wake_up_state(q->task, TASK_NORMAL);
 }
@@ -1088,7 +1097,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
        ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
                                   set_waiters);
        if (ret == 1)
-                requeue_pi_wake_futex(top_waiter, key2);
+                requeue_pi_wake_futex(top_waiter, key2, hb2);
        return ret;
 }
@@ -1247,8 +1256,15 @@ retry_private:
                if (!match_futex(&this->key, &key1))
                        continue;
-                WARN_ON(!requeue_pi && this->rt_waiter);
+                /*
-                WARN_ON(requeue_pi && !this->rt_waiter);
+                 * FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
+                 * be paired with each other and no other futex ops.
+                 */
+                if ((requeue_pi && !this->rt_waiter) ||
+                    (!requeue_pi && this->rt_waiter)) {
+                        ret = -EINVAL;
+                        break;
+                }
                /*
                 * Wake nr_wake waiters.  For requeue_pi, if we acquired the
@@ -1273,7 +1289,7 @@ retry_private:
                                                        this->task, 1);
                        if (ret == 1) {
                                /* We got the lock. */
-                                requeue_pi_wake_futex(this, &key2);
+                                requeue_pi_wake_futex(this, &key2, hb2);
                                continue;
                        } else if (ret) {
                                /* -EDEADLK */
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index d607a5b9ee29..235716556bf1 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -180,7 +180,8 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
        int cmd = op & FUTEX_CMD_MASK;
        if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
-                      cmd == FUTEX_WAIT_BITSET)) {
+                      cmd == FUTEX_WAIT_BITSET ||
+                      cmd == FUTEX_WAIT_REQUEUE_PI)) {
                if (get_compat_timespec(&ts, utime))
                        return -EFAULT;
                if (!timespec_valid(&ts))
@@ -191,7 +192,8 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
                        t = ktime_add_safe(ktime_get(), t);
                tp = &t;
        }
-        if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE)
+        if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
+            cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
                val2 = (int) (unsigned long) utime;
        return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 61c679db4687..d222515a5a06 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -761,7 +761,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 {
        struct irq_desc *desc = irq_to_desc(irq);
        struct irqaction *action, **action_ptr;
-        struct task_struct *irqthread;
        unsigned long flags;
        WARN(in_interrupt(), "Trying to free IRQ %d from IRQ context!\n", irq);
@@ -809,9 +808,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                        desc->chip->disable(irq);
        }
-        irqthread = action->thread;
-        action->thread = NULL;
        spin_unlock_irqrestore(&desc->lock, flags);
        unregister_handler_proc(irq, action);
@@ -819,12 +815,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
        /* Make sure it's not being used on another CPU: */
        synchronize_irq(irq);
-        if (irqthread) {
-                if (!test_bit(IRQTF_DIED, &action->thread_flags))
-                        kthread_stop(irqthread);
-                put_task_struct(irqthread);
-        }
 #ifdef CONFIG_DEBUG_SHIRQ
        /*
         * It's a shared IRQ -- the driver ought to be prepared for an IRQ
@@ -840,6 +830,13 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                local_irq_restore(flags);
        }
 #endif
+        if (action->thread) {
+                if (!test_bit(IRQTF_DIED, &action->thread_flags))
+                        kthread_stop(action->thread);
+                put_task_struct(action->thread);
+        }
        return action;
 }
diff --git a/kernel/irq/numa_migrate.c b/kernel/irq/numa_migrate.c
index 2f69bee57bf2..3fd30197da2e 100644
--- a/kernel/irq/numa_migrate.c
+++ b/kernel/irq/numa_migrate.c
@@ -107,8 +107,8 @@ out_unlock:
 struct irq_desc *move_irq_desc(struct irq_desc *desc, int node)
 {
-        /* those all static, do move them */
+        /* those static or target node is -1, do not move them */
-        if (desc->irq < NR_IRQS_LEGACY)
+        if (desc->irq < NR_IRQS_LEGACY || node == -1)
                return desc;
        if (desc->node != node)
diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
index d7135aa2d2c4..e94caa666dba 100644
--- a/kernel/lockdep_proc.c
+++ b/kernel/lockdep_proc.c
@@ -758,7 +758,8 @@ static int __init lockdep_proc_init(void)
                    &proc_lockdep_stats_operations);
 #ifdef CONFIG_LOCK_STAT
-        proc_create("lock_stat", S_IRUSR, NULL, &proc_lock_stat_operations);
+        proc_create("lock_stat", S_IRUSR | S_IWUSR, NULL,
+                    &proc_lock_stat_operations);
 #endif
        return 0;
diff --git a/kernel/panic.c b/kernel/panic.c
index 984b3ecbd72c..512ab73b0ca3 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -301,6 +301,7 @@ int oops_may_print(void)
 */
 void oops_enter(void)
 {
+        tracing_off();
        /* can't trust the integrity of the kernel anymore: */
        debug_locks_off();
        do_oops_enter_exit();
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index 950931041954..534e20d14d63 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -42,6 +42,7 @@ static int perf_overcommit __read_mostly = 1;
 static atomic_t nr_counters __read_mostly;
 static atomic_t nr_mmap_counters __read_mostly;
 static atomic_t nr_comm_counters __read_mostly;
+static atomic_t nr_task_counters __read_mostly;
 /*
 * perf counter paranoia level:
@@ -87,6 +88,7 @@ void __weak hw_perf_disable(void)		{ barrier(); }
 void __weak hw_perf_enable(void)                { barrier(); }
 void __weak hw_perf_counter_setup(int cpu)      { barrier(); }
+void __weak hw_perf_counter_setup_online(int cpu)       { barrier(); }
 int __weak
 hw_perf_group_sched_in(struct perf_counter *group_leader,
@@ -305,6 +307,10 @@ counter_sched_out(struct perf_counter *counter,
                return;
        counter->state = PERF_COUNTER_STATE_INACTIVE;
+        if (counter->pending_disable) {
+                counter->pending_disable = 0;
+                counter->state = PERF_COUNTER_STATE_OFF;
+        }
        counter->tstamp_stopped = ctx->time;
        counter->pmu->disable(counter);
        counter->oncpu = -1;
@@ -1103,7 +1109,7 @@ static void perf_counter_sync_stat(struct perf_counter_context *ctx,
                __perf_counter_sync_stat(counter, next_counter);
                counter = list_next_entry(counter, event_entry);
-                next_counter = list_next_entry(counter, event_entry);
+                next_counter = list_next_entry(next_counter, event_entry);
        }
 }
@@ -1654,6 +1660,8 @@ static void free_counter(struct perf_counter *counter)
                        atomic_dec(&nr_mmap_counters);
                if (counter->attr.comm)
                        atomic_dec(&nr_comm_counters);
+                if (counter->attr.task)
+                        atomic_dec(&nr_task_counters);
        }
        if (counter->destroy)
@@ -1688,14 +1696,133 @@ static int perf_release(struct inode *inode, struct file *file)
        return 0;
 }
+static int perf_counter_read_size(struct perf_counter *counter)
+{
+        int entry = sizeof(u64); /* value */
+        int size = 0;
+        int nr = 1;
+        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+                size += sizeof(u64);
+        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+                size += sizeof(u64);
+        if (counter->attr.read_format & PERF_FORMAT_ID)
+                entry += sizeof(u64);
+        if (counter->attr.read_format & PERF_FORMAT_GROUP) {
+                nr += counter->group_leader->nr_siblings;
+                size += sizeof(u64);
+        }
+        size += entry * nr;
+        return size;
+}
+static u64 perf_counter_read_value(struct perf_counter *counter)
+{
+        struct perf_counter *child;
+        u64 total = 0;
+        total += perf_counter_read(counter);
+        list_for_each_entry(child, &counter->child_list, child_list)
+                total += perf_counter_read(child);
+        return total;
+}
+static int perf_counter_read_entry(struct perf_counter *counter,
+                                   u64 read_format, char __user *buf)
+{
+        int n = 0, count = 0;
+        u64 values[2];
+        values[n++] = perf_counter_read_value(counter);
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(counter);
+        count = n * sizeof(u64);
+        if (copy_to_user(buf, values, count))
+                return -EFAULT;
+        return count;
+}
+static int perf_counter_read_group(struct perf_counter *counter,
+                                   u64 read_format, char __user *buf)
+{
+        struct perf_counter *leader = counter->group_leader, *sub;
+        int n = 0, size = 0, err = -EFAULT;
+        u64 values[3];
+        values[n++] = 1 + leader->nr_siblings;
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+                values[n++] = leader->total_time_enabled +
+                        atomic64_read(&leader->child_total_time_enabled);
+        }
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+                values[n++] = leader->total_time_running +
+                        atomic64_read(&leader->child_total_time_running);
+        }
+        size = n * sizeof(u64);
+        if (copy_to_user(buf, values, size))
+                return -EFAULT;
+        err = perf_counter_read_entry(leader, read_format, buf + size);
+        if (err < 0)
+                return err;
+        size += err;
+        list_for_each_entry(sub, &leader->sibling_list, list_entry) {
+                err = perf_counter_read_entry(counter, read_format,
+                                buf + size);
+                if (err < 0)
+                        return err;
+                size += err;
+        }
+        return size;
+}
+static int perf_counter_read_one(struct perf_counter *counter,
+                                 u64 read_format, char __user *buf)
+{
+        u64 values[4];
+        int n = 0;
+        values[n++] = perf_counter_read_value(counter);
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+                values[n++] = counter->total_time_enabled +
+                        atomic64_read(&counter->child_total_time_enabled);
+        }
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+                values[n++] = counter->total_time_running +
+                        atomic64_read(&counter->child_total_time_running);
+        }
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(counter);
+        if (copy_to_user(buf, values, n * sizeof(u64)))
+                return -EFAULT;
+        return n * sizeof(u64);
+}
 /*
 * Read the performance counter - simple non blocking version for now
 */
 static ssize_t
 perf_read_hw(struct perf_counter *counter, char __user *buf, size_t count)
 {
-        u64 values[4];
+        u64 read_format = counter->attr.read_format;
-        int n;
+        int ret;
        /*
         * Return end-of-file for a read on a counter that is in
@@ -1705,28 +1832,18 @@ perf_read_hw(struct perf_counter *counter, char __user *buf, size_t count)
        if (counter->state == PERF_COUNTER_STATE_ERROR)
                return 0;
+        if (count < perf_counter_read_size(counter))
+                return -ENOSPC;
        WARN_ON_ONCE(counter->ctx->parent_ctx);
        mutex_lock(&counter->child_mutex);
-        values[0] = perf_counter_read(counter);
+        if (read_format & PERF_FORMAT_GROUP)
-        n = 1;
+                ret = perf_counter_read_group(counter, read_format, buf);
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+        else
-                values[n++] = counter->total_time_enabled +
+                ret = perf_counter_read_one(counter, read_format, buf);
-                        atomic64_read(&counter->child_total_time_enabled);
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
-                values[n++] = counter->total_time_running +
-                        atomic64_read(&counter->child_total_time_running);
-        if (counter->attr.read_format & PERF_FORMAT_ID)
-                values[n++] = primary_counter_id(counter);
        mutex_unlock(&counter->child_mutex);
-        if (count < n * sizeof(u64))
+        return ret;
-                return -EINVAL;
-        count = n * sizeof(u64);
-        if (copy_to_user(buf, values, count))
-                return -EFAULT;
-        return count;
 }
 static ssize_t
@@ -2230,7 +2347,7 @@ static void perf_pending_counter(struct perf_pending_entry *entry)
        if (counter->pending_disable) {
                counter->pending_disable = 0;
-                perf_counter_disable(counter);
+                __perf_counter_disable(counter);
        }
        if (counter->pending_wakeup) {
@@ -2615,7 +2732,80 @@ static u32 perf_counter_tid(struct perf_counter *counter, struct task_struct *p)
        return task_pid_nr_ns(p, counter->ns);
 }
-static void perf_counter_output(struct perf_counter *counter, int nmi,
+static void perf_output_read_one(struct perf_output_handle *handle,
+                                 struct perf_counter *counter)
+{
+        u64 read_format = counter->attr.read_format;
+        u64 values[4];
+        int n = 0;
+        values[n++] = atomic64_read(&counter->count);
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+                values[n++] = counter->total_time_enabled +
+                        atomic64_read(&counter->child_total_time_enabled);
+        }
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+                values[n++] = counter->total_time_running +
+                        atomic64_read(&counter->child_total_time_running);
+        }
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(counter);
+        perf_output_copy(handle, values, n * sizeof(u64));
+}
+/*
+ * XXX PERF_FORMAT_GROUP vs inherited counters seems difficult.
+ */
+static void perf_output_read_group(struct perf_output_handle *handle,
+                            struct perf_counter *counter)
+{
+        struct perf_counter *leader = counter->group_leader, *sub;
+        u64 read_format = counter->attr.read_format;
+        u64 values[5];
+        int n = 0;
+        values[n++] = 1 + leader->nr_siblings;
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+                values[n++] = leader->total_time_enabled;
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+                values[n++] = leader->total_time_running;
+        if (leader != counter)
+                leader->pmu->read(leader);
+        values[n++] = atomic64_read(&leader->count);
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(leader);
+        perf_output_copy(handle, values, n * sizeof(u64));
+        list_for_each_entry(sub, &leader->sibling_list, list_entry) {
+                n = 0;
+                if (sub != counter)
+                        sub->pmu->read(sub);
+                values[n++] = atomic64_read(&sub->count);
+                if (read_format & PERF_FORMAT_ID)
+                        values[n++] = primary_counter_id(sub);
+                perf_output_copy(handle, values, n * sizeof(u64));
+        }
+}
+static void perf_output_read(struct perf_output_handle *handle,
+                             struct perf_counter *counter)
+{
+        if (counter->attr.read_format & PERF_FORMAT_GROUP)
+                perf_output_read_group(handle, counter);
+        else
+                perf_output_read_one(handle, counter);
+}
+void perf_counter_output(struct perf_counter *counter, int nmi,
                                struct perf_sample_data *data)
 {
        int ret;
@@ -2626,10 +2816,6 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
        struct {
                u32 pid, tid;
        } tid_entry;
-        struct {
-                u64 id;
-                u64 counter;
-        } group_entry;
        struct perf_callchain_entry *callchain = NULL;
        int callchain_size = 0;
        u64 time;
@@ -2684,10 +2870,8 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
        if (sample_type & PERF_SAMPLE_PERIOD)
                header.size += sizeof(u64);
-        if (sample_type & PERF_SAMPLE_GROUP) {
+        if (sample_type & PERF_SAMPLE_READ)
-                header.size += sizeof(u64) +
+                header.size += perf_counter_read_size(counter);
-                        counter->nr_siblings * sizeof(group_entry);
-        }
        if (sample_type & PERF_SAMPLE_CALLCHAIN) {
                callchain = perf_callchain(data->regs);
@@ -2699,6 +2883,18 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
                        header.size += sizeof(u64);
        }
+        if (sample_type & PERF_SAMPLE_RAW) {
+                int size = sizeof(u32);
+                if (data->raw)
+                        size += data->raw->size;
+                else
+                        size += sizeof(u32);
+                WARN_ON_ONCE(size & (sizeof(u64)-1));
+                header.size += size;
+        }
        ret = perf_output_begin(&handle, counter, header.size, nmi, 1);
        if (ret)
                return;
@@ -2732,26 +2928,8 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
        if (sample_type & PERF_SAMPLE_PERIOD)
                perf_output_put(&handle, data->period);
-        /*
+        if (sample_type & PERF_SAMPLE_READ)
-         * XXX PERF_SAMPLE_GROUP vs inherited counters seems difficult.
+                perf_output_read(&handle, counter);
-         */
-        if (sample_type & PERF_SAMPLE_GROUP) {
-                struct perf_counter *leader, *sub;
-                u64 nr = counter->nr_siblings;
-                perf_output_put(&handle, nr);
-                leader = counter->group_leader;
-                list_for_each_entry(sub, &leader->sibling_list, list_entry) {
-                        if (sub != counter)
-                                sub->pmu->read(sub);
-                        group_entry.id = primary_counter_id(sub);
-                        group_entry.counter = atomic64_read(&sub->count);
-                        perf_output_put(&handle, group_entry);
-                }
-        }
        if (sample_type & PERF_SAMPLE_CALLCHAIN) {
                if (callchain)
@@ -2762,6 +2940,22 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
                }
        }
+        if (sample_type & PERF_SAMPLE_RAW) {
+                if (data->raw) {
+                        perf_output_put(&handle, data->raw->size);
+                        perf_output_copy(&handle, data->raw->data, data->raw->size);
+                } else {
+                        struct {
+                                u32     size;
+                                u32     data;
+                        } raw = {
+                                .size = sizeof(u32),
+                                .data = 0,
+                        };
+                        perf_output_put(&handle, raw);
+                }
+        }
        perf_output_end(&handle);
 }
@@ -2774,8 +2968,6 @@ struct perf_read_event {
        u32                             pid;
        u32                             tid;
-        u64                             value;
-        u64                             format[3];
 };
 static void
@@ -2787,80 +2979,74 @@ perf_counter_read_event(struct perf_counter *counter,
                .header = {
                        .type = PERF_EVENT_READ,
                        .misc = 0,
-                        .size = sizeof(event) - sizeof(event.format),
+                        .size = sizeof(event) + perf_counter_read_size(counter),
                },
                .pid = perf_counter_pid(counter, task),
                .tid = perf_counter_tid(counter, task),
-                .value = atomic64_read(&counter->count),
        };
-        int ret, i = 0;
+        int ret;
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
-                event.header.size += sizeof(u64);
-                event.format[i++] = counter->total_time_enabled;
-        }
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
-                event.header.size += sizeof(u64);
-                event.format[i++] = counter->total_time_running;
-        }
-        if (counter->attr.read_format & PERF_FORMAT_ID) {
-                event.header.size += sizeof(u64);
-                event.format[i++] = primary_counter_id(counter);
-        }
        ret = perf_output_begin(&handle, counter, event.header.size, 0, 0);
        if (ret)
                return;
-        perf_output_copy(&handle, &event, event.header.size);
+        perf_output_put(&handle, event);
+        perf_output_read(&handle, counter);
        perf_output_end(&handle);
 }
 /*
- * fork tracking
+ * task tracking -- fork/exit
+ *
+ * enabled by: attr.comm | attr.mmap | attr.task
 */
-struct perf_fork_event {
+struct perf_task_event {
-        struct task_struct      *task;
+        struct task_struct              *task;
+        struct perf_counter_context     *task_ctx;
        struct {
                struct perf_event_header        header;
                u32                             pid;
                u32                             ppid;
+                u32                             tid;
+                u32                             ptid;
        } event;
 };
-static void perf_counter_fork_output(struct perf_counter *counter,
+static void perf_counter_task_output(struct perf_counter *counter,
-                                     struct perf_fork_event *fork_event)
+                                     struct perf_task_event *task_event)
 {
        struct perf_output_handle handle;
-        int size = fork_event->event.header.size;
+        int size = task_event->event.header.size;
-        struct task_struct *task = fork_event->task;
+        struct task_struct *task = task_event->task;
        int ret = perf_output_begin(&handle, counter, size, 0, 0);
        if (ret)
                return;
-        fork_event->event.pid = perf_counter_pid(counter, task);
+        task_event->event.pid = perf_counter_pid(counter, task);
-        fork_event->event.ppid = perf_counter_pid(counter, task->real_parent);
+        task_event->event.ppid = perf_counter_pid(counter, current);
+        task_event->event.tid = perf_counter_tid(counter, task);
+        task_event->event.ptid = perf_counter_tid(counter, current);
-        perf_output_put(&handle, fork_event->event);
+        perf_output_put(&handle, task_event->event);
        perf_output_end(&handle);
 }
-static int perf_counter_fork_match(struct perf_counter *counter)
+static int perf_counter_task_match(struct perf_counter *counter)
 {
-        if (counter->attr.comm || counter->attr.mmap)
+        if (counter->attr.comm || counter->attr.mmap || counter->attr.task)
                return 1;
        return 0;
 }
-static void perf_counter_fork_ctx(struct perf_counter_context *ctx,
+static void perf_counter_task_ctx(struct perf_counter_context *ctx,
-                                  struct perf_fork_event *fork_event)
+                                  struct perf_task_event *task_event)
 {
        struct perf_counter *counter;
@@ -2869,54 +3055,62 @@ static void perf_counter_fork_ctx(struct perf_counter_context *ctx,
        rcu_read_lock();
        list_for_each_entry_rcu(counter, &ctx->event_list, event_entry) {
-                if (perf_counter_fork_match(counter))
+                if (perf_counter_task_match(counter))
-                        perf_counter_fork_output(counter, fork_event);
+                        perf_counter_task_output(counter, task_event);
        }
        rcu_read_unlock();
 }
-static void perf_counter_fork_event(struct perf_fork_event *fork_event)
+static void perf_counter_task_event(struct perf_task_event *task_event)
 {
        struct perf_cpu_context *cpuctx;
-        struct perf_counter_context *ctx;
+        struct perf_counter_context *ctx = task_event->task_ctx;
        cpuctx = &get_cpu_var(perf_cpu_context);
-        perf_counter_fork_ctx(&cpuctx->ctx, fork_event);
+        perf_counter_task_ctx(&cpuctx->ctx, task_event);
        put_cpu_var(perf_cpu_context);
        rcu_read_lock();
-        /*
+        if (!ctx)
-         * doesn't really matter which of the child contexts the
+                ctx = rcu_dereference(task_event->task->perf_counter_ctxp);
-         * events ends up in.
-         */
-        ctx = rcu_dereference(current->perf_counter_ctxp);
        if (ctx)
-                perf_counter_fork_ctx(ctx, fork_event);
+                perf_counter_task_ctx(ctx, task_event);
        rcu_read_unlock();
 }
-void perf_counter_fork(struct task_struct *task)
+static void perf_counter_task(struct task_struct *task,
+                              struct perf_counter_context *task_ctx,
+                              int new)
 {
-        struct perf_fork_event fork_event;
+        struct perf_task_event task_event;
        if (!atomic_read(&nr_comm_counters) &&
-            !atomic_read(&nr_mmap_counters))
+            !atomic_read(&nr_mmap_counters) &&
+            !atomic_read(&nr_task_counters))
                return;
-        fork_event = (struct perf_fork_event){
+        task_event = (struct perf_task_event){
-                .task   = task,
+                .task     = task,
-                .event  = {
+                .task_ctx = task_ctx,
+                .event    = {
                        .header = {
-                                .type = PERF_EVENT_FORK,
+                                .type = new ? PERF_EVENT_FORK : PERF_EVENT_EXIT,
                                .misc = 0,
-                                .size = sizeof(fork_event.event),
+                                .size = sizeof(task_event.event),
                        },
                        /* .pid  */
                        /* .ppid */
+                        /* .tid  */
+                        /* .ptid */
                },
        };
-        perf_counter_fork_event(&fork_event);
+        perf_counter_task_event(&task_event);
+}
+void perf_counter_fork(struct task_struct *task)
+{
+        perf_counter_task(task, NULL, 1);
 }
 /*
@@ -3305,125 +3499,111 @@ int perf_counter_overflow(struct perf_counter *counter, int nmi,
 * Generic software counter infrastructure
 */
-static void perf_swcounter_update(struct perf_counter *counter)
+/*
+ * We directly increment counter->count and keep a second value in
+ * counter->hw.period_left to count intervals. This period counter
+ * is kept in the range [-sample_period, 0] so that we can use the
+ * sign as trigger.
+ */
+static u64 perf_swcounter_set_period(struct perf_counter *counter)
 {
        struct hw_perf_counter *hwc = &counter->hw;
-        u64 prev, now;
+        u64 period = hwc->last_period;
-        s64 delta;
+        u64 nr, offset;
+        s64 old, val;
+        hwc->last_period = hwc->sample_period;
 again:
-        prev = atomic64_read(&hwc->prev_count);
+        old = val = atomic64_read(&hwc->period_left);
-        now = atomic64_read(&hwc->count);
+        if (val < 0)
-        if (atomic64_cmpxchg(&hwc->prev_count, prev, now) != prev)
+                return 0;
-                goto again;
-        delta = now - prev;
+        nr = div64_u64(period + val, period);
+        offset = nr * period;
+        val -= offset;
+        if (atomic64_cmpxchg(&hwc->period_left, old, val) != old)
+                goto again;
-        atomic64_add(delta, &counter->count);
+        return nr;
-        atomic64_sub(delta, &hwc->period_left);
 }
-static void perf_swcounter_set_period(struct perf_counter *counter)
+static void perf_swcounter_overflow(struct perf_counter *counter,
+                                    int nmi, struct perf_sample_data *data)
 {
        struct hw_perf_counter *hwc = &counter->hw;
-        s64 left = atomic64_read(&hwc->period_left);
+        u64 overflow;
-        s64 period = hwc->sample_period;
-        if (unlikely(left <= -period)) {
+        data->period = counter->hw.last_period;
-                left = period;
+        overflow = perf_swcounter_set_period(counter);
-                atomic64_set(&hwc->period_left, left);
-                hwc->last_period = period;
-        }
-        if (unlikely(left <= 0)) {
+        if (hwc->interrupts == MAX_INTERRUPTS)
-                left += period;
+                return;
-                atomic64_add(period, &hwc->period_left);
-                hwc->last_period = period;
-        }
-        atomic64_set(&hwc->prev_count, -left);
+        for (; overflow; overflow--) {
-        atomic64_set(&hwc->count, -left);
+                if (perf_counter_overflow(counter, nmi, data)) {
+                        /*
+                         * We inhibit the overflow from happening when
+                         * hwc->interrupts == MAX_INTERRUPTS.
+                         */
+                        break;
+                }
+        }
 }
-static enum hrtimer_restart perf_swcounter_hrtimer(struct hrtimer *hrtimer)
+static void perf_swcounter_unthrottle(struct perf_counter *counter)
 {
-        enum hrtimer_restart ret = HRTIMER_RESTART;
-        struct perf_sample_data data;
-        struct perf_counter *counter;
-        u64 period;
-        counter = container_of(hrtimer, struct perf_counter, hw.hrtimer);
-        counter->pmu->read(counter);
-        data.addr = 0;
-        data.regs = get_irq_regs();
        /*
-         * In case we exclude kernel IPs or are somehow not in interrupt
+         * Nothing to do, we already reset hwc->interrupts.
-         * context, provide the next best thing, the user IP.
         */
-        if ((counter->attr.exclude_kernel || !data.regs) &&
+}
-                        !counter->attr.exclude_user)
-                data.regs = task_pt_regs(current);
-        if (data.regs) {
+static void perf_swcounter_add(struct perf_counter *counter, u64 nr,
-                if (perf_counter_overflow(counter, 0, &data))
+                               int nmi, struct perf_sample_data *data)
-                        ret = HRTIMER_NORESTART;
+{
-        }
+        struct hw_perf_counter *hwc = &counter->hw;
-        period = max_t(u64, 10000, counter->hw.sample_period);
+        atomic64_add(nr, &counter->count);
-        hrtimer_forward_now(hrtimer, ns_to_ktime(period));
-        return ret;
+        if (!hwc->sample_period)
-}
+                return;
-static void perf_swcounter_overflow(struct perf_counter *counter,
+        if (!data->regs)
-                                    int nmi, struct perf_sample_data *data)
+                return;
-{
-        data->period = counter->hw.last_period;
-        perf_swcounter_update(counter);
+        if (!atomic64_add_negative(nr, &hwc->period_left))
-        perf_swcounter_set_period(counter);
+                perf_swcounter_overflow(counter, nmi, data);
-        if (perf_counter_overflow(counter, nmi, data))
-                /* soft-disable the counter */
-                ;
 }
 static int perf_swcounter_is_counting(struct perf_counter *counter)
 {
-        struct perf_counter_context *ctx;
+        /*
-        unsigned long flags;
+         * The counter is active, we're good!
-        int count;
+         */
        if (counter->state == PERF_COUNTER_STATE_ACTIVE)
                return 1;
+        /*
+         * The counter is off/error, not counting.
+         */
        if (counter->state != PERF_COUNTER_STATE_INACTIVE)
                return 0;
        /*
-         * If the counter is inactive, it could be just because
+         * The counter is inactive, if the context is active
-         * its task is scheduled out, or because it's in a group
+         * we're part of a group that didn't make it on the 'pmu',
-         * which could not go on the PMU.  We want to count in
+         * not counting.
-         * the first case but not the second.  If the context is
-         * currently active then an inactive software counter must
-         * be the second case.  If it's not currently active then
-         * we need to know whether the counter was active when the
-         * context was last active, which we can determine by
-         * comparing counter->tstamp_stopped with ctx->time.
-         *
-         * We are within an RCU read-side critical section,
-         * which protects the existence of *ctx.
         */
-        ctx = counter->ctx;
+        if (counter->ctx->is_active)
-        spin_lock_irqsave(&ctx->lock, flags);
+                return 0;
-        count = 1;
-        /* Re-check state now we have the lock */
+        /*
-        if (counter->state < PERF_COUNTER_STATE_INACTIVE ||
+         * We're inactive and the context is too, this means the
-            counter->ctx->is_active ||
+         * task is scheduled out, we're counting events that happen
-            counter->tstamp_stopped < ctx->time)
+         * to us, like migration events.
-                count = 0;
+         */
-        spin_unlock_irqrestore(&ctx->lock, flags);
+        return 1;
-        return count;
 }
 static int perf_swcounter_match(struct perf_counter *counter,
@@ -3449,15 +3629,6 @@ static int perf_swcounter_match(struct perf_counter *counter,
        return 1;
 }
-static void perf_swcounter_add(struct perf_counter *counter, u64 nr,
-                               int nmi, struct perf_sample_data *data)
-{
-        int neg = atomic64_add_negative(nr, &counter->hw.count);
-        if (counter->hw.sample_period && !neg && data->regs)
-                perf_swcounter_overflow(counter, nmi, data);
-}
 static void perf_swcounter_ctx_event(struct perf_counter_context *ctx,
                                     enum perf_type_id type,
                                     u32 event, u64 nr, int nmi,
@@ -3536,27 +3707,66 @@ void __perf_swcounter_event(u32 event, u64 nr, int nmi,
 static void perf_swcounter_read(struct perf_counter *counter)
 {
-        perf_swcounter_update(counter);
 }
 static int perf_swcounter_enable(struct perf_counter *counter)
 {
-        perf_swcounter_set_period(counter);
+        struct hw_perf_counter *hwc = &counter->hw;
+        if (hwc->sample_period) {
+                hwc->last_period = hwc->sample_period;
+                perf_swcounter_set_period(counter);
+        }
        return 0;
 }
 static void perf_swcounter_disable(struct perf_counter *counter)
 {
-        perf_swcounter_update(counter);
 }
 static const struct pmu perf_ops_generic = {
        .enable         = perf_swcounter_enable,
        .disable        = perf_swcounter_disable,
        .read           = perf_swcounter_read,
+        .unthrottle     = perf_swcounter_unthrottle,
 };
 /*
+ * hrtimer based swcounter callback
+ */
+static enum hrtimer_restart perf_swcounter_hrtimer(struct hrtimer *hrtimer)
+{
+        enum hrtimer_restart ret = HRTIMER_RESTART;
+        struct perf_sample_data data;
+        struct perf_counter *counter;
+        u64 period;
+        counter = container_of(hrtimer, struct perf_counter, hw.hrtimer);
+        counter->pmu->read(counter);
+        data.addr = 0;
+        data.regs = get_irq_regs();
+        /*
+         * In case we exclude kernel IPs or are somehow not in interrupt
+         * context, provide the next best thing, the user IP.
+         */
+        if ((counter->attr.exclude_kernel || !data.regs) &&
+                        !counter->attr.exclude_user)
+                data.regs = task_pt_regs(current);
+        if (data.regs) {
+                if (perf_counter_overflow(counter, 0, &data))
+                        ret = HRTIMER_NORESTART;
+        }
+        period = max_t(u64, 10000, counter->hw.sample_period);
+        hrtimer_forward_now(hrtimer, ns_to_ktime(period));
+        return ret;
+}
+/*
 * Software counter: cpu wall time clock
 */
@@ -3673,17 +3883,24 @@ static const struct pmu perf_ops_task_clock = {
 };
 #ifdef CONFIG_EVENT_PROFILE
-void perf_tpcounter_event(int event_id)
+void perf_tpcounter_event(int event_id, u64 addr, u64 count, void *record,
+                          int entry_size)
 {
+        struct perf_raw_record raw = {
+                .size = entry_size,
+                .data = record,
+        };
        struct perf_sample_data data = {
                .regs = get_irq_regs(),
-                .addr = 0,
+                .addr = addr,
+                .raw = &raw,
        };
        if (!data.regs)
                data.regs = task_pt_regs(current);
-        do_perf_swcounter_event(PERF_TYPE_TRACEPOINT, event_id, 1, 1, &data);
+        do_perf_swcounter_event(PERF_TYPE_TRACEPOINT, event_id, count, 1, &data);
 }
 EXPORT_SYMBOL_GPL(perf_tpcounter_event);
@@ -3697,6 +3914,14 @@ static void tp_perf_counter_destroy(struct perf_counter *counter)
 static const struct pmu *tp_perf_counter_init(struct perf_counter *counter)
 {
+        /*
+         * Raw tracepoint data is a severe data leak, only allow root to
+         * have these.
+         */
+        if ((counter->attr.sample_type & PERF_SAMPLE_RAW) &&
+                        !capable(CAP_SYS_ADMIN))
+                return ERR_PTR(-EPERM);
        if (ftrace_profile_enable(counter->attr.config))
                return NULL;
@@ -3830,9 +4055,9 @@ perf_counter_alloc(struct perf_counter_attr *attr,
        atomic64_set(&hwc->period_left, hwc->sample_period);
        /*
-         * we currently do not support PERF_SAMPLE_GROUP on inherited counters
+         * we currently do not support PERF_FORMAT_GROUP on inherited counters
         */
-        if (attr->inherit && (attr->sample_type & PERF_SAMPLE_GROUP))
+        if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP))
                goto done;
        switch (attr->type) {
@@ -3875,6 +4100,8 @@ done:
                        atomic_inc(&nr_mmap_counters);
                if (counter->attr.comm)
                        atomic_inc(&nr_comm_counters);
+                if (counter->attr.task)
+                        atomic_inc(&nr_task_counters);
        }
        return counter;
@@ -4236,8 +4463,10 @@ void perf_counter_exit_task(struct task_struct *child)
        struct perf_counter_context *child_ctx;
        unsigned long flags;
-        if (likely(!child->perf_counter_ctxp))
+        if (likely(!child->perf_counter_ctxp)) {
+                perf_counter_task(child, NULL, 0);
                return;
+        }
        local_irq_save(flags);
        /*
@@ -4262,8 +4491,14 @@ void perf_counter_exit_task(struct task_struct *child)
         * the counters from it.
         */
        unclone_ctx(child_ctx);
-        spin_unlock(&child_ctx->lock);
+        spin_unlock_irqrestore(&child_ctx->lock, flags);
-        local_irq_restore(flags);
+        /*
+         * Report the task dead after unscheduling the counters so that we
+         * won't get any samples after PERF_EVENT_EXIT. We can however still
+         * get a few PERF_EVENT_READ events.
+         */
+        perf_counter_task(child, child_ctx, 0);
        /*
         * We can recurse on the same lock type through:
@@ -4484,6 +4719,11 @@ perf_cpu_notify(struct notifier_block *self, unsigned long action, void *hcpu)
                perf_counter_init_cpu(cpu);
                break;
+        case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
+                hw_perf_counter_setup_online(cpu);
+                break;
        case CPU_DOWN_PREPARE:
        case CPU_DOWN_PREPARE_FROZEN:
                perf_counter_exit_cpu(cpu);
@@ -4508,6 +4748,8 @@ void __init perf_counter_init(void)
 {
        perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_UP_PREPARE,
                        (void *)(long)smp_processor_id());
+        perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_ONLINE,
+                        (void *)(long)smp_processor_id());
        register_cpu_notifier(&perf_cpu_nb);
 }
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index bece7c0b67b2..e33a21cb9407 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -521,11 +521,12 @@ void posix_cpu_timers_exit(struct task_struct *tsk)
 }
 void posix_cpu_timers_exit_group(struct task_struct *tsk)
 {
-        struct task_cputime cputime;
+        struct signal_struct *const sig = tsk->signal;
-        thread_group_cputimer(tsk, &cputime);
        cleanup_timers(tsk->signal->cpu_timers,
-                       cputime.utime, cputime.stime, cputime.sum_exec_runtime);
+                       cputime_add(tsk->utime, sig->utime),
+                       cputime_add(tsk->stime, sig->stime),
+                       tsk->se.sum_exec_runtime + sig->sum_sched_runtime);
 }
 static void clear_dead_task(struct k_itimer *timer, union cpu_time_count now)
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 052ec4d195c7..d089d052c4a9 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -202,6 +202,12 @@ static int no_timer_create(struct k_itimer *new_timer)
        return -EOPNOTSUPP;
 }
+static int no_nsleep(const clockid_t which_clock, int flags,
+                     struct timespec *tsave, struct timespec __user *rmtp)
+{
+        return -EOPNOTSUPP;
+}
 /*
 * Return nonzero if we know a priori this clockid_t value is bogus.
 */
@@ -254,6 +260,7 @@ static __init int init_posix_timers(void)
                .clock_get = posix_get_monotonic_raw,
                .clock_set = do_posix_clock_nosettime,
                .timer_create = no_timer_create,
+                .nsleep = no_nsleep,
        };
        register_posix_clock(CLOCK_REALTIME, &clock_realtime);
diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
index fcd107a78c5a..29bd4baf9e75 100644
--- a/kernel/rtmutex.c
+++ b/kernel/rtmutex.c
@@ -1039,16 +1039,14 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
        if (!rt_mutex_owner(lock) || try_to_steal_lock(lock, task)) {
                /* We got the lock for task. */
                debug_rt_mutex_lock(lock);
                rt_mutex_set_owner(lock, task, 0);
+                spin_unlock(&lock->wait_lock);
                rt_mutex_deadlock_account_lock(lock, task);
                return 1;
        }
        ret = task_blocks_on_rt_mutex(lock, waiter, task, detect_deadlock);
        if (ret && !waiter->task) {
                /*
                 * Reset the return value. We might have
diff --git a/kernel/sched_cpupri.c b/kernel/sched_cpupri.c
index e6c251790dde..d014efbf947a 100644
--- a/kernel/sched_cpupri.c
+++ b/kernel/sched_cpupri.c
@@ -81,8 +81,21 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p,
                if (cpumask_any_and(&p->cpus_allowed, vec->mask) >= nr_cpu_ids)
                        continue;
-                if (lowest_mask)
+                if (lowest_mask) {
                        cpumask_and(lowest_mask, &p->cpus_allowed, vec->mask);
+                        /*
+                         * We have to ensure that we have at least one bit
+                         * still set in the array, since the map could have
+                         * been concurrently emptied between the first and
+                         * second reads of vec->mask.  If we hit this
+                         * condition, simply act as though we never hit this
+                         * priority level and continue on.
+                         */
+                        if (cpumask_any(lowest_mask) >= nr_cpu_ids)
+                                continue;
+                }
                return 1;
        }
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 9ffb2b2ceba4..652e8bdef9aa 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -611,9 +611,13 @@ account_entity_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se)
 static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
 #ifdef CONFIG_SCHEDSTATS
+        struct task_struct *tsk = NULL;
+        if (entity_is_task(se))
+                tsk = task_of(se);
        if (se->sleep_start) {
                u64 delta = rq_of(cfs_rq)->clock - se->sleep_start;
-                struct task_struct *tsk = task_of(se);
                if ((s64)delta < 0)
                        delta = 0;
@@ -624,11 +628,11 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                se->sleep_start = 0;
                se->sum_sleep_runtime += delta;
-                account_scheduler_latency(tsk, delta >> 10, 1);
+                if (tsk)
+                        account_scheduler_latency(tsk, delta >> 10, 1);
        }
        if (se->block_start) {
                u64 delta = rq_of(cfs_rq)->clock - se->block_start;
-                struct task_struct *tsk = task_of(se);
                if ((s64)delta < 0)
                        delta = 0;
@@ -639,17 +643,19 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                se->block_start = 0;
                se->sum_sleep_runtime += delta;
-                /*
+                if (tsk) {
-                 * Blocking time is in units of nanosecs, so shift by 20 to
+                        /*
-                 * get a milliseconds-range estimation of the amount of
+                         * Blocking time is in units of nanosecs, so shift by
-                 * time that the task spent sleeping:
+                         * 20 to get a milliseconds-range estimation of the
-                 */
+                         * amount of time that the task spent sleeping:
-                if (unlikely(prof_on == SLEEP_PROFILING)) {
+                         */
+                        if (unlikely(prof_on == SLEEP_PROFILING)) {
-                        profile_hits(SLEEP_PROFILING, (void *)get_wchan(tsk),
+                                profile_hits(SLEEP_PROFILING,
-                                     delta >> 20);
+                                                (void *)get_wchan(tsk),
+                                                delta >> 20);
+                        }
+                        account_scheduler_latency(tsk, delta >> 10, 0);
                }
-                account_scheduler_latency(tsk, delta >> 10, 0);
        }
 #endif
 }
diff --git a/kernel/smp.c b/kernel/smp.c
index ad63d8501207..94188b8ecc33 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -57,7 +57,7 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
                        return NOTIFY_BAD;
                break;
-#ifdef CONFIG_CPU_HOTPLUG
+#ifdef CONFIG_HOTPLUG_CPU
        case CPU_UP_CANCELED:
        case CPU_UP_CANCELED_FROZEN:
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 98e02328c67d..58be76017fd0 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -49,6 +49,7 @@
 #include <linux/acpi.h>
 #include <linux/reboot.h>
 #include <linux/ftrace.h>
+#include <linux/security.h>
 #include <linux/slow-work.h>
 #include <linux/perf_counter.h>
@@ -1306,10 +1307,10 @@ static struct ctl_table vm_table[] = {
        {
                .ctl_name       = CTL_UNNUMBERED,
                .procname       = "mmap_min_addr",
-                .data           = &mmap_min_addr,
+                .data           = &dac_mmap_min_addr,
-                .maxlen         = sizeof(unsigned long),
+                .maxlen         = sizeof(unsigned long),
                .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = &mmap_min_addr_handler,
        },
 #ifdef CONFIG_NUMA
        {
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 1090b0aed9ba..7a34cb563fec 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -267,8 +267,8 @@ static void blk_trace_free(struct blk_trace *bt)
 {
        debugfs_remove(bt->msg_file);
        debugfs_remove(bt->dropped_file);
-        debugfs_remove(bt->dir);
        relay_close(bt->rchan);
+        debugfs_remove(bt->dir);
        free_percpu(bt->sequence);
        free_percpu(bt->msg_data);
        kfree(bt);
@@ -378,18 +378,8 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
 static int blk_remove_buf_file_callback(struct dentry *dentry)
 {
-        struct dentry *parent = dentry->d_parent;
        debugfs_remove(dentry);
-        /*
-        * this will fail for all but the last file, but that is ok. what we
-        * care about is the top level buts->name directory going away, when
-        * the last trace file is gone. Then we don't have to rmdir() that
-        * manually on trace stop, so it nicely solves the issue with
-        * force killing of running traces.
-        */
-        debugfs_remove(parent);
        return 0;
 }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 1f3ec2afa511..1e1d23c26308 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1662,7 +1662,7 @@ ftrace_regex_open(struct inode *inode, struct file *file, int enable)
        mutex_lock(&ftrace_regex_lock);
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND))
+            (file->f_flags & O_TRUNC))
                ftrace_filter_reset(enable);
        if (file->f_mode & FMODE_READ) {
@@ -2577,7 +2577,7 @@ ftrace_graph_open(struct inode *inode, struct file *file)
        mutex_lock(&graph_lock);
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND)) {
+            (file->f_flags & O_TRUNC)) {
                ftrace_graph_count = 0;
                memset(ftrace_graph_funcs, 0, sizeof(ftrace_graph_funcs));
        }
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index bf27bb7a63e2..a330513d96ce 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -735,6 +735,7 @@ ring_buffer_free(struct ring_buffer *buffer)
        put_online_cpus();
+        kfree(buffer->buffers);
        free_cpumask_var(buffer->cpumask);
        kfree(buffer);
@@ -1785,7 +1786,7 @@ void ring_buffer_discard_commit(struct ring_buffer *buffer,
         */
        RB_WARN_ON(buffer, !local_read(&cpu_buffer->committing));
-        if (!rb_try_to_discard(cpu_buffer, event))
+        if (rb_try_to_discard(cpu_buffer, event))
                goto out;
        /*
@@ -2383,7 +2384,6 @@ rb_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts)
                 * the box. Return the padding, and we will release
                 * the current locks, and try again.
                 */
-                rb_advance_reader(cpu_buffer);
                return event;
        case RINGBUF_TYPE_TIME_EXTEND:
@@ -2486,7 +2486,7 @@ static inline int rb_ok_to_lock(void)
         * buffer too. A one time deal is all you get from reading
         * the ring buffer from an NMI.
         */
-        if (likely(!in_nmi() && !oops_in_progress))
+        if (likely(!in_nmi()))
                return 1;
        tracing_off_permanent();
@@ -2519,6 +2519,8 @@ ring_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts)
        if (dolock)
                spin_lock(&cpu_buffer->reader_lock);
        event = rb_buffer_peek(buffer, cpu, ts);
+        if (event && event->type_len == RINGBUF_TYPE_PADDING)
+                rb_advance_reader(cpu_buffer);
        if (dolock)
                spin_unlock(&cpu_buffer->reader_lock);
        local_irq_restore(flags);
@@ -2590,12 +2592,9 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts)
                spin_lock(&cpu_buffer->reader_lock);
        event = rb_buffer_peek(buffer, cpu, ts);
-        if (!event)
+        if (event)
-                goto out_unlock;
+                rb_advance_reader(cpu_buffer);
-        rb_advance_reader(cpu_buffer);
- out_unlock:
        if (dolock)
                spin_unlock(&cpu_buffer->reader_lock);
        local_irq_restore(flags);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8bc8d8afea6a..c22b40f8f576 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -848,6 +848,7 @@ tracing_generic_entry_update(struct trace_entry *entry, unsigned long flags,
                ((pc & SOFTIRQ_MASK) ? TRACE_FLAG_SOFTIRQ : 0) |
                (need_resched() ? TRACE_FLAG_NEED_RESCHED : 0);
 }
+EXPORT_SYMBOL_GPL(tracing_generic_entry_update);
 struct ring_buffer_event *trace_buffer_lock_reserve(struct trace_array *tr,
                                                    int type,
@@ -2031,7 +2032,7 @@ static int tracing_open(struct inode *inode, struct file *file)
        /* If this file was open for write, then erase contents */
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND)) {
+            (file->f_flags & O_TRUNC)) {
                long cpu = (long) inode->i_private;
                if (cpu == TRACE_PIPE_ALL_CPU)
@@ -3085,7 +3086,8 @@ tracing_fill_pipe_page(size_t rem, struct trace_iterator *iter)
                        break;
                }
-                trace_consume(iter);
+                if (ret != TRACE_TYPE_NO_CONSUME)
+                        trace_consume(iter);
                rem -= count;
                if (!find_next_entry_inc(iter)) {
                        rem = 0;
@@ -4233,8 +4235,11 @@ static void __ftrace_dump(bool disable_tracing)
                iter.pos = -1;
                if (find_next_entry_inc(&iter) != NULL) {
-                        print_trace_line(&iter);
+                        int ret;
-                        trace_consume(&iter);
+                        ret = print_trace_line(&iter);
+                        if (ret != TRACE_TYPE_NO_CONSUME)
+                                trace_consume(&iter);
                }
                trace_printk_seq(&iter.seq);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 3548ae5cc780..8b9f4f6e9559 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -438,10 +438,6 @@ struct trace_entry *tracing_get_trace_entry(struct trace_array *tr,
 struct trace_entry *trace_find_next_entry(struct trace_iterator *iter,
                                          int *ent_cpu, u64 *ent_ts);
-void tracing_generic_entry_update(struct trace_entry *entry,
-                                  unsigned long flags,
-                                  int pc);
 void default_wait_pipe(struct trace_iterator *iter);
 void poll_wait_pipe(struct trace_iterator *iter);
diff --git a/kernel/trace/trace_event_profile.c b/kernel/trace/trace_event_profile.c
index 5b5895afecfe..11ba5bb4ed0a 100644
--- a/kernel/trace/trace_event_profile.c
+++ b/kernel/trace/trace_event_profile.c
@@ -14,7 +14,7 @@ int ftrace_profile_enable(int event_id)
        mutex_lock(&event_mutex);
        list_for_each_entry(event, &ftrace_events, list) {
-                if (event->id == event_id) {
+                if (event->id == event_id && event->profile_enable) {
                        ret = event->profile_enable(event);
                        break;
                }
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 53c8fd376a88..e75276a49cf5 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -376,7 +376,7 @@ ftrace_event_seq_open(struct inode *inode, struct file *file)
        const struct seq_operations *seq_ops;
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND))
+            (file->f_flags & O_TRUNC))
                ftrace_clear_events();
        seq_ops = inode->i_private;
@@ -940,7 +940,7 @@ event_create_dir(struct ftrace_event_call *call, struct dentry *d_events,
                entry = trace_create_file("enable", 0644, call->dir, call,
                                          enable);
-        if (call->id)
+        if (call->id && call->profile_enable)
                entry = trace_create_file("id", 0444, call->dir, call,
                                          id);
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 936c621bbf46..f32dc9d1ea7b 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -624,9 +624,6 @@ static int filter_add_subsystem_pred(struct filter_parse_state *ps,
                return -ENOSPC;
        }
-        filter->preds[filter->n_preds] = pred;
-        filter->n_preds++;
        list_for_each_entry(call, &ftrace_events, list) {
                if (!call->define_fields)
@@ -643,6 +640,9 @@ static int filter_add_subsystem_pred(struct filter_parse_state *ps,
                }
                replace_filter_string(call->filter, filter_string);
        }
+        filter->preds[filter->n_preds] = pred;
+        filter->n_preds++;
 out:
        return err;
 }
@@ -1029,12 +1029,17 @@ static int replace_preds(struct event_subsystem *system,
                if (elt->op == OP_AND || elt->op == OP_OR) {
                        pred = create_logical_pred(elt->op);
+                        if (!pred)
+                                return -ENOMEM;
                        if (call) {
                                err = filter_add_pred(ps, call, pred);
                                filter_free_pred(pred);
-                        } else
+                        } else {
                                err = filter_add_subsystem_pred(ps, system,
                                                        pred, filter_string);
+                                if (err)
+                                        filter_free_pred(pred);
+                        }
                        if (err)
                                return err;
@@ -1048,12 +1053,17 @@ static int replace_preds(struct event_subsystem *system,
                }
                pred = create_pred(elt->op, operand1, operand2);
+                if (!pred)
+                        return -ENOMEM;
                if (call) {
                        err = filter_add_pred(ps, call, pred);
                        filter_free_pred(pred);
-                } else
+                } else {
                        err = filter_add_subsystem_pred(ps, system, pred,
                                                        filter_string);
+                        if (err)
+                                filter_free_pred(pred);
+                }
                if (err)
                        return err;
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index d2249abafb53..420ec3487579 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -843,9 +843,16 @@ print_graph_function(struct trace_iterator *iter)
        switch (entry->type) {
        case TRACE_GRAPH_ENT: {
-                struct ftrace_graph_ent_entry *field;
+                /*
+                 * print_graph_entry() may consume the current event,
+                 * thus @field may become invalid, so we need to save it.
+                 * sizeof(struct ftrace_graph_ent_entry) is very small,
+                 * it can be safely saved at the stack.
+                 */
+                struct ftrace_graph_ent_entry *field, saved;
                trace_assign_type(field, entry);
-                return print_graph_entry(field, s, iter);
+                saved = *field;
+                return print_graph_entry(&saved, s, iter);
        }
        case TRACE_GRAPH_RET: {
                struct ftrace_graph_ret_entry *field;
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index 7b6278110827..687699d365ae 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -176,7 +176,7 @@ static int t_show(struct seq_file *m, void *v)
        const char *str = *fmt;
        int i;
-        seq_printf(m, "0x%lx : \"", (unsigned long)fmt);
+        seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
        /*
         * Tabs and new lines need to be converted.
diff --git a/kernel/wait.c b/kernel/wait.c
index ea7c3b4275cf..c4bd3d825f35 100644
--- a/kernel/wait.c
+++ b/kernel/wait.c
@@ -10,13 +10,14 @@
 #include <linux/wait.h>
 #include <linux/hash.h>
-void init_waitqueue_head(wait_queue_head_t *q)
+void __init_waitqueue_head(wait_queue_head_t *q, struct lock_class_key *key)
 {
        spin_lock_init(&q->lock);
+        lockdep_set_class(&q->lock, key);
        INIT_LIST_HEAD(&q->task_list);
 }
-EXPORT_SYMBOL(init_waitqueue_head);
+EXPORT_SYMBOL(__init_waitqueue_head);
 void add_wait_queue(wait_queue_head_t *q, wait_queue_t *wait)
 {
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 708e2a86d87b..600f473a5610 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -45,12 +45,14 @@
 */
-#ifndef STATIC
+#ifdef STATIC
+#define PREBOOT
+#else
 #include <linux/decompress/bunzip2.h>
-#endif /* !STATIC */
+#include <linux/slab.h>
+#endif /* STATIC */
 #include <linux/decompress/mm.h>
-#include <linux/slab.h>
 #ifndef INT_MAX
 #define INT_MAX 0x7fffffff
@@ -681,9 +683,7 @@ STATIC int INIT bunzip2(unsigned char *buf, int len,
        set_error_fn(error_fn);
        if (flush)
                outbuf = malloc(BZIP2_IOBUF_SIZE);
-        else
-                len -= 4; /* Uncompressed size hack active in pre-boot
-                             environment */
        if (!outbuf) {
                error("Could not allocate output bufer");
                return -1;
@@ -733,4 +733,14 @@ exit_0:
        return i;
 }
-#define decompress bunzip2
+#ifdef PREBOOT
+STATIC int INIT decompress(unsigned char *buf, int len,
+                        int(*fill)(void*, unsigned int),
+                        int(*flush)(void*, unsigned int),
+                        unsigned char *outbuf,
+                        int *pos,
+                        void(*error_fn)(char *x))
+{
+        return bunzip2(buf, len - 4, fill, flush, outbuf, pos, error_fn);
+}
+#endif
diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c
index e36b296fc9f8..68dfce59c1b8 100644
--- a/lib/decompress_inflate.c
+++ b/lib/decompress_inflate.c
@@ -19,13 +19,13 @@
 #include "zlib_inflate/inflate.h"
 #include "zlib_inflate/infutil.h"
+#include <linux/slab.h>
 #endif /* STATIC */
 #include <linux/decompress/mm.h>
-#include <linux/slab.h>
-#define INBUF_LEN (16*1024)
+#define GZIP_IOBUF_SIZE (16*1024)
 /* Included from initramfs et al code */
 STATIC int INIT gunzip(unsigned char *buf, int len,
@@ -55,7 +55,7 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
        if (buf)
                zbuf = buf;
        else {
-                zbuf = malloc(INBUF_LEN);
+                zbuf = malloc(GZIP_IOBUF_SIZE);
                len = 0;
        }
        if (!zbuf) {
@@ -77,7 +77,7 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
        }
        if (len == 0)
-                len = fill(zbuf, INBUF_LEN);
+                len = fill(zbuf, GZIP_IOBUF_SIZE);
        /* verify the gzip header */
        if (len < 10 ||
@@ -113,7 +113,7 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
        while (rc == Z_OK) {
                if (strm->avail_in == 0) {
                        /* TODO: handle case where both pos and fill are set */
-                        len = fill(zbuf, INBUF_LEN);
+                        len = fill(zbuf, GZIP_IOBUF_SIZE);
                        if (len < 0) {
                                rc = -1;
                                error("read error");
diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c
index 32123a1340e6..0b954e04bd30 100644
--- a/lib/decompress_unlzma.c
+++ b/lib/decompress_unlzma.c
@@ -29,12 +29,14 @@
 *Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
-#ifndef STATIC
+#ifdef STATIC
+#define PREBOOT
+#else
 #include <linux/decompress/unlzma.h>
+#include <linux/slab.h>
 #endif /* STATIC */
 #include <linux/decompress/mm.h>
-#include <linux/slab.h>
 #define MIN(a, b) (((a) < (b)) ? (a) : (b))
@@ -543,9 +545,7 @@ STATIC inline int INIT unlzma(unsigned char *buf, int in_len,
        int ret = -1;
        set_error_fn(error_fn);
-        if (!flush)
-                in_len -= 4; /* Uncompressed size hack active in pre-boot
-                                environment */
        if (buf)
                inbuf = buf;
        else
@@ -645,4 +645,15 @@ exit_0:
        return ret;
 }
-#define decompress unlzma
+#ifdef PREBOOT
+STATIC int INIT decompress(unsigned char *buf, int in_len,
+                              int(*fill)(void*, unsigned int),
+                              int(*flush)(void*, unsigned int),
+                              unsigned char *output,
+                              int *posp,
+                              void(*error_fn)(char *x)
+        )
+{
+        return unlzma(buf, in_len - 4, fill, flush, output, posp, error_fn);
+}
+#endif
diff --git a/lib/flex_array.c b/lib/flex_array.c
index 0e7894ce8882..08f1636d296a 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -254,7 +254,6 @@ void *flex_array_get(struct flex_array *fa, int element_nr)
 {
        int part_nr = fa_element_to_part_nr(fa, element_nr);
        struct flex_array_part *part;
-        int index;
        if (element_nr >= fa->total_nr_elements)
                return NULL;
@@ -264,6 +263,5 @@ void *flex_array_get(struct flex_array *fa, int element_nr)
                part = (struct flex_array_part *)&fa->parts[0];
        else
                part = fa->parts[part_nr];
-        index = index_inside_part(fa, element_nr);
        return &part->elements[index_inside_part(fa, element_nr)];
 }
diff --git a/mm/Kconfig b/mm/Kconfig
index c948d4ca8bde..fe5f674d7a7d 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -225,9 +225,9 @@ config DEFAULT_MMAP_MIN_ADDR
          For most ia64, ppc64 and x86 users with lots of address space
          a value of 65536 is reasonable and should cause no problems.
          On arm and other archs it should not be higher than 32768.
-          Programs which use vm86 functionality would either need additional
+          Programs which use vm86 functionality or have some need to map
-          permissions from either the LSM or the capabilities module or have
+          this low address space will need CAP_SYS_RAWIO or disable this
-          this protection disabled.
+          protection by setting the value to 0.
          This value can be changed after boot using the
          /proc/sys/vm/mmap_min_addr tunable.
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index e08e2c4da63a..7dd9d9f80694 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -191,25 +191,27 @@ static int mpol_new_bind(struct mempolicy *pol, const nodemask_t *nodes)
 * Must be called holding task's alloc_lock to protect task's mems_allowed
 * and mempolicy.  May also be called holding the mmap_semaphore for write.
 */
-static int mpol_set_nodemask(struct mempolicy *pol, const nodemask_t *nodes)
+static int mpol_set_nodemask(struct mempolicy *pol,
+                     const nodemask_t *nodes, struct nodemask_scratch *nsc)
 {
-        nodemask_t cpuset_context_nmask;
        int ret;
        /* if mode is MPOL_DEFAULT, pol is NULL. This is right. */
        if (pol == NULL)
                return 0;
+        /* Check N_HIGH_MEMORY */
+        nodes_and(nsc->mask1,
+                  cpuset_current_mems_allowed, node_states[N_HIGH_MEMORY]);
        VM_BUG_ON(!nodes);
        if (pol->mode == MPOL_PREFERRED && nodes_empty(*nodes))
                nodes = NULL;   /* explicit local allocation */
        else {
                if (pol->flags & MPOL_F_RELATIVE_NODES)
-                        mpol_relative_nodemask(&cpuset_context_nmask, nodes,
+                        mpol_relative_nodemask(&nsc->mask2, nodes,&nsc->mask1);
-                                               &cpuset_current_mems_allowed);
                else
-                        nodes_and(cpuset_context_nmask, *nodes,
+                        nodes_and(nsc->mask2, *nodes, nsc->mask1);
-                                  cpuset_current_mems_allowed);
                if (mpol_store_user_nodemask(pol))
                        pol->w.user_nodemask = *nodes;
                else
@@ -217,8 +219,10 @@ static int mpol_set_nodemask(struct mempolicy *pol, const nodemask_t *nodes)
                                                cpuset_current_mems_allowed;
        }
-        ret = mpol_ops[pol->mode].create(pol,
+        if (nodes)
-                                nodes ? &cpuset_context_nmask : NULL);
+                ret = mpol_ops[pol->mode].create(pol, &nsc->mask2);
+        else
+                ret = mpol_ops[pol->mode].create(pol, NULL);
        return ret;
 }
@@ -620,12 +624,17 @@ static long do_set_mempolicy(unsigned short mode, unsigned short flags,
 {
        struct mempolicy *new, *old;
        struct mm_struct *mm = current->mm;
+        NODEMASK_SCRATCH(scratch);
        int ret;
-        new = mpol_new(mode, flags, nodes);
+        if (!scratch)
-        if (IS_ERR(new))
+                return -ENOMEM;
-                return PTR_ERR(new);
+        new = mpol_new(mode, flags, nodes);
+        if (IS_ERR(new)) {
+                ret = PTR_ERR(new);
+                goto out;
+        }
        /*
         * prevent changing our mempolicy while show_numa_maps()
         * is using it.
@@ -635,13 +644,13 @@ static long do_set_mempolicy(unsigned short mode, unsigned short flags,
        if (mm)
                down_write(&mm->mmap_sem);
        task_lock(current);
-        ret = mpol_set_nodemask(new, nodes);
+        ret = mpol_set_nodemask(new, nodes, scratch);
        if (ret) {
                task_unlock(current);
                if (mm)
                        up_write(&mm->mmap_sem);
                mpol_put(new);
-                return ret;
+                goto out;
        }
        old = current->mempolicy;
        current->mempolicy = new;
@@ -654,7 +663,10 @@ static long do_set_mempolicy(unsigned short mode, unsigned short flags,
                up_write(&mm->mmap_sem);
        mpol_put(old);
-        return 0;
+        ret = 0;
+out:
+        NODEMASK_SCRATCH_FREE(scratch);
+        return ret;
 }
 /*
@@ -1014,12 +1026,20 @@ static long do_mbind(unsigned long start, unsigned long len,
                if (err)
                        return err;
        }
-        down_write(&mm->mmap_sem);
+        {
-        task_lock(current);
+                NODEMASK_SCRATCH(scratch);
-        err = mpol_set_nodemask(new, nmask);
+                if (scratch) {
-        task_unlock(current);
+                        down_write(&mm->mmap_sem);
+                        task_lock(current);
+                        err = mpol_set_nodemask(new, nmask, scratch);
+                        task_unlock(current);
+                        if (err)
+                                up_write(&mm->mmap_sem);
+                } else
+                        err = -ENOMEM;
+                NODEMASK_SCRATCH_FREE(scratch);
+        }
        if (err) {
-                up_write(&mm->mmap_sem);
                mpol_put(new);
                return err;
        }
@@ -1891,6 +1911,7 @@ restart:
 * Install non-NULL @mpol in inode's shared policy rb-tree.
 * On entry, the current task has a reference on a non-NULL @mpol.
 * This must be released on exit.
+ * This is called at get_inode() calls and we can use GFP_KERNEL.
 */
 void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
 {
@@ -1902,19 +1923,24 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
        if (mpol) {
                struct vm_area_struct pvma;
                struct mempolicy *new;
+                NODEMASK_SCRATCH(scratch);
+                if (!scratch)
+                        return;
                /* contextualize the tmpfs mount point mempolicy */
                new = mpol_new(mpol->mode, mpol->flags, &mpol->w.user_nodemask);
                if (IS_ERR(new)) {
                        mpol_put(mpol); /* drop our ref on sb mpol */
+                        NODEMASK_SCRATCH_FREE(scratch);
                        return;         /* no valid nodemask intersection */
                }
                task_lock(current);
-                ret = mpol_set_nodemask(new, &mpol->w.user_nodemask);
+                ret = mpol_set_nodemask(new, &mpol->w.user_nodemask, scratch);
                task_unlock(current);
                mpol_put(mpol); /* drop our ref on sb mpol */
                if (ret) {
+                        NODEMASK_SCRATCH_FREE(scratch);
                        mpol_put(new);
                        return;
                }
@@ -1924,6 +1950,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
                mpol_put(new);                  /* drop initial ref */
+                NODEMASK_SCRATCH_FREE(scratch);
        }
 }
@@ -2140,13 +2167,18 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
                err = 1;
        else {
                int ret;
+                NODEMASK_SCRATCH(scratch);
-                task_lock(current);
+                if (scratch) {
-                ret = mpol_set_nodemask(new, &nodes);
+                        task_lock(current);
-                task_unlock(current);
+                        ret = mpol_set_nodemask(new, &nodes, scratch);
-                if (ret)
+                        task_unlock(current);
+                } else
+                        ret = -ENOMEM;
+                NODEMASK_SCRATCH_FREE(scratch);
+                if (ret) {
                        err = 1;
-                else if (no_context) {
+                        mpol_put(new);
+                } else if (no_context) {
                        /* save for contextualization */
                        new->w.user_nodemask = nodes;
                }
diff --git a/mm/mempool.c b/mm/mempool.c
index a46eb1b4bb66..32e75d400503 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -303,14 +303,14 @@ EXPORT_SYMBOL(mempool_free_slab);
 */
 void *mempool_kmalloc(gfp_t gfp_mask, void *pool_data)
 {
-        size_t size = (size_t)(long)pool_data;
+        size_t size = (size_t)pool_data;
        return kmalloc(size, gfp_mask);
 }
 EXPORT_SYMBOL(mempool_kmalloc);
 void *mempool_kzalloc(gfp_t gfp_mask, void *pool_data)
 {
-        size_t size = (size_t) pool_data;
+        size_t size = (size_t)pool_data;
        return kzalloc(size, gfp_mask);
 }
 EXPORT_SYMBOL(mempool_kzalloc);
diff --git a/mm/mmap.c b/mm/mmap.c
index 34579b23ebd5..8101de490c73 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -88,9 +88,6 @@ int sysctl_overcommit_ratio = 50;	/* default is 50% */
 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
 struct percpu_counter vm_committed_as;
-/* amount of vm to protect from userspace access */
-unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
 /*
 * Check that a process has enough memory to allocate a new virtual
 * mapping. 0 means there is enough memory for the allocation to
diff --git a/mm/nommu.c b/mm/nommu.c
index 53cab10fece4..28754c40be98 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -69,9 +69,6 @@ int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
 int heap_stack_gap = 0;
-/* amount of vm to protect from userspace access */
-unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
 atomic_long_t mmap_pages_allocated;
 EXPORT_SYMBOL(mem_map);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e50566ebf9f9..94b3388c188b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
 {
+        int ret;
        l2cap_load();
        hci_register_cb(&rfcomm_cb);
        rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
        if (IS_ERR(rfcomm_thread)) {
-                hci_unregister_cb(&rfcomm_cb);
+                ret = PTR_ERR(rfcomm_thread);
-                return PTR_ERR(rfcomm_thread);
+                goto out_thread;
        }
        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                BT_ERR("Failed to create RFCOMM info file");
-        rfcomm_init_sockets();
+        ret = rfcomm_init_ttys();
+        if (ret)
+                goto out_tty;
-#ifdef CONFIG_BT_RFCOMM_TTY
+        ret = rfcomm_init_sockets();
-        rfcomm_init_ttys();
+        if (ret)
-#endif
+                goto out_sock;
        BT_INFO("RFCOMM ver %s", VERSION);
        return 0;
+out_sock:
+        rfcomm_cleanup_ttys();
+out_tty:
+        kthread_stop(rfcomm_thread);
+out_thread:
+        hci_unregister_cb(&rfcomm_cb);
+        return ret;
 }
 static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
        kthread_stop(rfcomm_thread);
-#ifdef CONFIG_BT_RFCOMM_TTY
        rfcomm_cleanup_ttys();
-#endif
        rfcomm_cleanup_sockets();
 }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7f482784e9f7..0b85e8116859 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1132,7 +1132,7 @@ error:
        return err;
 }
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
 {
        class_remove_file(bt_class, &class_attr_rfcomm);
diff --git a/net/core/dev.c b/net/core/dev.c
index 70c27e0c7c32..6a94475aee85 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3865,10 +3865,12 @@ int dev_unicast_delete(struct net_device *dev, void *addr)
        ASSERT_RTNL();
+        netif_addr_lock_bh(dev);
        err = __hw_addr_del(&dev->uc, addr, dev->addr_len,
                            NETDEV_HW_ADDR_T_UNICAST);
        if (!err)
                __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_delete);
@@ -3889,10 +3891,12 @@ int dev_unicast_add(struct net_device *dev, void *addr)
        ASSERT_RTNL();
+        netif_addr_lock_bh(dev);
        err = __hw_addr_add(&dev->uc, addr, dev->addr_len,
                            NETDEV_HW_ADDR_T_UNICAST);
        if (!err)
                __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_add);
@@ -3949,7 +3953,8 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
 *      @from: source device
 *
 *      Add newly added addresses to the destination device and release
- *      addresses that have no users left.
+ *      addresses that have no users left. The source device must be
+ *      locked by netif_tx_lock_bh.
 *
 *      This function is intended to be called from the dev->set_rx_mode
 *      function of layered software devices.
@@ -3958,14 +3963,14 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
 {
        int err = 0;
-        ASSERT_RTNL();
        if (to->addr_len != from->addr_len)
                return -EINVAL;
+        netif_addr_lock_bh(to);
        err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
+        netif_addr_unlock_bh(to);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_sync);
@@ -3981,27 +3986,27 @@ EXPORT_SYMBOL(dev_unicast_sync);
 */
 void dev_unicast_unsync(struct net_device *to, struct net_device *from)
 {
-        ASSERT_RTNL();
        if (to->addr_len != from->addr_len)
                return;
+        netif_addr_lock_bh(from);
+        netif_addr_lock(to);
        __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
        __dev_set_rx_mode(to);
+        netif_addr_unlock(to);
+        netif_addr_unlock_bh(from);
 }
 EXPORT_SYMBOL(dev_unicast_unsync);
 static void dev_unicast_flush(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
+        netif_addr_lock_bh(dev);
        __hw_addr_flush(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
 static void dev_unicast_init(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
        __hw_addr_init(&dev->uc);
 }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b7292a2719dc..197283072cc8 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -488,7 +488,7 @@ int net_assign_generic(struct net *net, int id, void *data)
         */
        ng->len = id;
-        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len);
+        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
        rcu_assign_pointer(net->gen, ng);
        call_rcu(&old_ng->rcu, net_generic_release);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c29d75d8f1b1..090e9991ac2a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                hbuffer[k++] = hex_asc_lo(n->ha[j]);
                hbuffer[k++] = ':';
        }
-        hbuffer[--k] = 0;
+        if (k != 0)
+                --k;
+        hbuffer[k] = 0;
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
        }
 #endif
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aca22b00b6a3..07e7e41816be 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 {
        struct ieee80211_local *local = (void *) data;
-        if (local->quiescing)
+        if (local->quiescing || local->suspended)
                return;
        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
        rcu_read_unlock();
-        /* flush again, in case driver queued work */
-        flush_workqueue(local->hw.workqueue);
-        /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
        /* remove STAs */
        spin_lock_irqsave(&local->sta_lock, flags);
        list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                drv_remove_interface(local, &conf);
        }
+        /* stop hardware - this must stop RX */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                drv_stop(local);
+        }
+        /*
+         * flush again, in case driver queued work -- it
+         * shouldn't be doing (or cancel everything in the
+         * stop callback) that but better safe than sorry.
+         */
+        flush_workqueue(local->hw.workqueue);
        local->suspended = true;
+        /* need suspended to be visible before quiescing is false */
+        barrier();
        local->quiescing = false;
        return 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910a..0936fc24942d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                return;
        }
+        /*
+         * If we're suspending, it is possible although not too likely
+         * that we'd be receiving frames after having already partially
+         * quiesced the stack. We can't process such frames then since
+         * that might, for example, cause stations to be added or other
+         * driver callbacks be invoked.
+         */
+        if (unlikely(local->quiescing || local->suspended)) {
+                kfree_skb(skb);
+                return;
+        }
        if (status->flag & RX_FLAG_HT) {
                /* rate_idx is MCS index */
                if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index b0e582f2d37a..16e6c4378ff1 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -151,7 +151,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                        addr6 = addr;
                        mask6 = mask;
                        map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
-                        if (map4 == NULL)
+                        if (map6 == NULL)
                                goto cfg_unlbl_map_add_failure;
                        map6->type = NETLBL_NLTYPE_UNLABELED;
                        ipv6_addr_copy(&map6->list.addr, addr6);
diff --git a/net/socket.c b/net/socket.c
index 791d71a36a93..6d4716559047 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
        if (more)
                flags |= MSG_MORE;
-        return sock->ops->sendpage(sock, page, offset, size, flags);
+        return kernel_sendpage(sock, page, offset, size, flags);
 }
 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5e14371cda70..75a406d33619 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1089,17 +1089,18 @@ static void handle_reg_beacon(struct wiphy *wiphy,
        chan->beacon_found = true;
+        if (wiphy->disable_beacon_hints)
+                return;
        chan_before.center_freq = chan->center_freq;
        chan_before.flags = chan->flags;
-        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
-            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
                chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
                channel_changed = true;
        }
-        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
-            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
                chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
                channel_changed = true;
        }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index e37829a49dc4..4e167a8e11be 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -30,7 +30,8 @@ int set_regdom(const struct ieee80211_regdomain *rd);
 * non-radar 5 GHz channels.
 *
 * Drivers do not need to call this, cfg80211 will do it for after a scan
- * on a newly found BSS.
+ * on a newly found BSS. If you cannot make use of this feature you can
+ * set the wiphy->disable_beacon_hints to true.
 */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                        struct ieee80211_channel *beacon_chan,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 9271118e1fc4..7e595ce24eeb 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -118,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
        if (!ie1 && !ie2)
                return 0;
-        if (!ie1)
+        if (!ie1 || !ie2)
                return -1;
        r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
@@ -171,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a,
        ie = find_ie(WLAN_EID_MESH_CONFIG,
                     a->information_elements,
                     a->len_information_elements);
+        if (!ie)
+                return false;
        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
                return false;
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index 7109e2b5bc0a..911ba7ffab84 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -393,7 +393,7 @@ while (<IN>) {
            $read_function = 0;
        }
        # print out any recorded offsets
-        update_funcs() if ($text_found);
+        update_funcs() if (defined($ref_func));
        # reset all markers and arrays
        $text_found = 0;
@@ -403,7 +403,6 @@ while (<IN>) {
    # section found, now is this a start of a function?
    } elsif ($read_function && /$function_regex/) {
        $text_found = 1;
-        $offset = hex $1;
        $text = $2;
        # if this is either a local function or a weak function
@@ -412,10 +411,15 @@ while (<IN>) {
        if (!defined($locals{$text}) && !defined($weak{$text})) {
            $ref_func = $text;
            $read_function = 0;
+            $offset = hex $1;
        } else {
            # if we already have a function, and this is weak, skip it
-            if (!defined($ref_func) || !defined($weak{$text})) {
+            if (!defined($ref_func) && !defined($weak{$text}) &&
+                 # PPC64 can have symbols that start with .L and
+                 # gcc considers these special. Don't use them!
+                 $text !~ /^\.L/) {
                $ref_func = $text;
+                $offset = hex $1;
            }
        }
    } elsif ($read_headers && /$mcount_section/) {
@@ -440,7 +444,7 @@ while (<IN>) {
 }
 # dump out anymore offsets that may have been found
-update_funcs() if ($text_found);
+update_funcs() if (defined($ref_func));
 # If we did not find any mcount callers, we are done (do nothing).
 if (!$opened) {
diff --git a/security/Kconfig b/security/Kconfig
index d23c839038f0..9c60c346a91d 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -113,6 +113,22 @@ config SECURITY_ROOTPLUG
          If you are unsure how to answer this question, answer N.
+config LSM_MMAP_MIN_ADDR
+        int "Low address space for LSM to from user allocation"
+        depends on SECURITY && SECURITY_SELINUX
+        default 65535
+        help
+          This is the portion of low virtual memory which should be protected
+          from userspace allocation.  Keeping a user from writing to low pages
+          can help reduce the impact of kernel NULL pointer bugs.
+          For most ia64, ppc64 and x86 users with lots of address space
+          a value of 65536 is reasonable and should cause no problems.
+          On arm and other archs it should not be higher than 32768.
+          Programs which use vm86 functionality or have some need to map
+          this low address space will need the permission specific to the
+          systems running LSM.
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig
diff --git a/security/Makefile b/security/Makefile
index c67557cdaa85..b56e7f9ecbc2 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -8,7 +8,7 @@ subdir-$(CONFIG_SECURITY_SMACK)		+= smack
 subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
 # always enable default capabilities
-obj-y           += commoncap.o
+obj-y           += commoncap.o min_addr.o
 # Object file lists
 obj-$(CONFIG_SECURITY)                  += security.o capability.o
diff --git a/security/capability.c b/security/capability.c
index 21b6cead6a8e..88f752e8152c 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -330,15 +330,6 @@ static int cap_file_ioctl(struct file *file, unsigned int command,
        return 0;
 }
-static int cap_file_mmap(struct file *file, unsigned long reqprot,
-                         unsigned long prot, unsigned long flags,
-                         unsigned long addr, unsigned long addr_only)
-{
-        if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO))
-                return -EACCES;
-        return 0;
-}
 static int cap_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
                             unsigned long prot)
 {
diff --git a/security/commoncap.c b/security/commoncap.c
index 48b7e0228fa3..e3097c0a1311 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -984,3 +984,33 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
                cap_sys_admin = 1;
        return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
+/*
+ * cap_file_mmap - check if able to map given addr
+ * @file: unused
+ * @reqprot: unused
+ * @prot: unused
+ * @flags: unused
+ * @addr: address attempting to be mapped
+ * @addr_only: unused
+ *
+ * If the process is attempting to map memory below mmap_min_addr they need
+ * CAP_SYS_RAWIO.  The other parameters to this function are unused by the
+ * capability security module.  Returns 0 if this mapping should be allowed
+ * -EPERM if not.
+ */
+int cap_file_mmap(struct file *file, unsigned long reqprot,
+                  unsigned long prot, unsigned long flags,
+                  unsigned long addr, unsigned long addr_only)
+{
+        int ret = 0;
+        if (addr < dac_mmap_min_addr) {
+                ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
+                                  SECURITY_CAP_AUDIT);
+                /* set PF_SUPERPRIV if it turns out we allow the low mmap */
+                if (ret == 0)
+                        current->flags |= PF_SUPERPRIV;
+        }
+        return ret;
+}
diff --git a/security/min_addr.c b/security/min_addr.c
new file mode 100644
index 000000000000..14cc7b3b8d03
--- /dev/null
+++ b/security/min_addr.c
@@ -0,0 +1,49 @@
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/security.h>
+#include <linux/sysctl.h>
+/* amount of vm to protect from userspace access by both DAC and the LSM*/
+unsigned long mmap_min_addr;
+/* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */
+unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
+/* amount of vm to protect from userspace using the LSM = CONFIG_LSM_MMAP_MIN_ADDR */
+/*
+ * Update mmap_min_addr = max(dac_mmap_min_addr, CONFIG_LSM_MMAP_MIN_ADDR)
+ */
+static void update_mmap_min_addr(void)
+{
+#ifdef CONFIG_LSM_MMAP_MIN_ADDR
+        if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+                mmap_min_addr = dac_mmap_min_addr;
+        else
+                mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR;
+#else
+        mmap_min_addr = dac_mmap_min_addr;
+#endif
+}
+/*
+ * sysctl handler which just sets dac_mmap_min_addr = the new value and then
+ * calls update_mmap_min_addr() so non MAP_FIXED hints get rounded properly
+ */
+int mmap_min_addr_handler(struct ctl_table *table, int write, struct file *filp,
+                          void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int ret;
+        ret = proc_doulongvec_minmax(table, write, filp, buffer, lenp, ppos);
+        update_mmap_min_addr();
+        return ret;
+}
+int __init init_mmap_min_addr(void)
+{
+        update_mmap_min_addr();
+        return 0;
+}
+pure_initcall(init_mmap_min_addr);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 15c2a08a66f1..8d8b69c5664e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1285,6 +1285,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
                                           context, len);
                if (rc == -ERANGE) {
+                        kfree(context);
                        /* Need a larger buffer.  Query for the right size. */
                        rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
                                                   NULL, 0);
@@ -1292,7 +1294,6 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                                dput(dentry);
                                goto out_unlock;
                        }
-                        kfree(context);
                        len = rc;
                        context = kmalloc(len+1, GFP_NOFS);
                        if (!context) {
@@ -3029,9 +3030,21 @@ static int selinux_file_mmap(struct file *file, unsigned long reqprot,
        int rc = 0;
        u32 sid = current_sid();
-        if (addr < mmap_min_addr)
+        /*
+         * notice that we are intentionally putting the SELinux check before
+         * the secondary cap_file_mmap check.  This is such a likely attempt
+         * at bad behaviour/exploit that we always want to get the AVC, even
+         * if DAC would have also denied the operation.
+         */
+        if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
                rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
                                  MEMPROTECT__MMAP_ZERO, NULL);
+                if (rc)
+                        return rc;
+        }
+        /* do DAC check on address space usage */
+        rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
        if (rc || addr_only)
                return rc;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 88480c0c58a0..c7df01b72cac 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -174,7 +174,7 @@ static int codec_exec_verb(struct hda_codec *codec, unsigned int cmd,
        mutex_lock(&bus->cmd_mutex);
        err = bus->ops.command(bus, cmd);
        if (!err && res)
-                *res = bus->ops.get_response(bus);
+                *res = bus->ops.get_response(bus, codec->addr);
        mutex_unlock(&bus->cmd_mutex);
        snd_hda_power_down(codec);
        if (res && *res == -1 && bus->rirb_error) {
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index cad79efaabc9..1b75f28ed092 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -568,7 +568,7 @@ struct hda_bus_ops {
        /* send a single command */
        int (*command)(struct hda_bus *bus, unsigned int cmd);
        /* get a response from the last command */
-        unsigned int (*get_response)(struct hda_bus *bus);
+        unsigned int (*get_response)(struct hda_bus *bus, unsigned int addr);
        /* free the private data */
        void (*private_free)(struct hda_bus *);
        /* attach a PCM stream */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 77c1b840ca8b..175f07a381ba 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -253,7 +253,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 /* STATESTS int mask: S3,SD2,SD1,SD0 */
 #define AZX_MAX_CODECS          4
-#define STATESTS_INT_MASK       0x0f
+#define STATESTS_INT_MASK       ((1 << AZX_MAX_CODECS) - 1)
 /* SD_CTL bits */
 #define SD_CTL_STREAM_RESET     0x01    /* stream reset bit */
@@ -361,8 +361,8 @@ struct azx_rb {
        dma_addr_t addr;        /* physical address of CORB/RIRB buffer */
        /* for RIRB */
        unsigned short rp, wp;  /* read/write pointers */
-        int cmds;               /* number of pending requests */
+        int cmds[AZX_MAX_CODECS];       /* number of pending requests */
-        u32 res;                /* last read value */
+        u32 res[AZX_MAX_CODECS];        /* last read value */
 };
 struct azx {
@@ -418,7 +418,7 @@ struct azx {
        unsigned int probing :1; /* codec probing phase */
        /* for debugging */
-        unsigned int last_cmd;  /* last issued command (to sync) */
+        unsigned int last_cmd[AZX_MAX_CODECS];
        /* for pending irqs */
        struct work_struct irq_pending_work;
@@ -513,6 +513,7 @@ static int azx_alloc_cmd_io(struct azx *chip)
 static void azx_init_cmd_io(struct azx *chip)
 {
+        spin_lock_irq(&chip->reg_lock);
        /* CORB set up */
        chip->corb.addr = chip->rb.addr;
        chip->corb.buf = (u32 *)chip->rb.area;
@@ -531,7 +532,8 @@ static void azx_init_cmd_io(struct azx *chip)
        /* RIRB set up */
        chip->rirb.addr = chip->rb.addr + 2048;
        chip->rirb.buf = (u32 *)(chip->rb.area + 2048);
-        chip->rirb.wp = chip->rirb.rp = chip->rirb.cmds = 0;
+        chip->rirb.wp = chip->rirb.rp = 0;
+        memset(chip->rirb.cmds, 0, sizeof(chip->rirb.cmds));
        azx_writel(chip, RIRBLBASE, (u32)chip->rirb.addr);
        azx_writel(chip, RIRBUBASE, upper_32_bits(chip->rirb.addr));
@@ -543,30 +545,60 @@ static void azx_init_cmd_io(struct azx *chip)
        azx_writew(chip, RINTCNT, 1);
        /* enable rirb dma and response irq */
        azx_writeb(chip, RIRBCTL, ICH6_RBCTL_DMA_EN | ICH6_RBCTL_IRQ_EN);
+        spin_unlock_irq(&chip->reg_lock);
 }
 static void azx_free_cmd_io(struct azx *chip)
 {
+        spin_lock_irq(&chip->reg_lock);
        /* disable ringbuffer DMAs */
        azx_writeb(chip, RIRBCTL, 0);
        azx_writeb(chip, CORBCTL, 0);
+        spin_unlock_irq(&chip->reg_lock);
+}
+static unsigned int azx_command_addr(u32 cmd)
+{
+        unsigned int addr = cmd >> 28;
+        if (addr >= AZX_MAX_CODECS) {
+                snd_BUG();
+                addr = 0;
+        }
+        return addr;
+}
+static unsigned int azx_response_addr(u32 res)
+{
+        unsigned int addr = res & 0xf;
+        if (addr >= AZX_MAX_CODECS) {
+                snd_BUG();
+                addr = 0;
+        }
+        return addr;
 }
 /* send a command */
 static int azx_corb_send_cmd(struct hda_bus *bus, u32 val)
 {
        struct azx *chip = bus->private_data;
+        unsigned int addr = azx_command_addr(val);
        unsigned int wp;
+        spin_lock_irq(&chip->reg_lock);
        /* add command to corb */
        wp = azx_readb(chip, CORBWP);
        wp++;
        wp %= ICH6_MAX_CORB_ENTRIES;
-        spin_lock_irq(&chip->reg_lock);
+        chip->rirb.cmds[addr]++;
-        chip->rirb.cmds++;
        chip->corb.buf[wp] = cpu_to_le32(val);
        azx_writel(chip, CORBWP, wp);
        spin_unlock_irq(&chip->reg_lock);
        return 0;
@@ -578,13 +610,14 @@ static int azx_corb_send_cmd(struct hda_bus *bus, u32 val)
 static void azx_update_rirb(struct azx *chip)
 {
        unsigned int rp, wp;
+        unsigned int addr;
        u32 res, res_ex;
        wp = azx_readb(chip, RIRBWP);
        if (wp == chip->rirb.wp)
                return;
        chip->rirb.wp = wp;
-                
        while (chip->rirb.rp != wp) {
                chip->rirb.rp++;
                chip->rirb.rp %= ICH6_MAX_RIRB_ENTRIES;
@@ -592,18 +625,24 @@ static void azx_update_rirb(struct azx *chip)
                rp = chip->rirb.rp << 1; /* an RIRB entry is 8-bytes */
                res_ex = le32_to_cpu(chip->rirb.buf[rp + 1]);
                res = le32_to_cpu(chip->rirb.buf[rp]);
+                addr = azx_response_addr(res_ex);
                if (res_ex & ICH6_RIRB_EX_UNSOL_EV)
                        snd_hda_queue_unsol_event(chip->bus, res, res_ex);
-                else if (chip->rirb.cmds) {
+                else if (chip->rirb.cmds[addr]) {
-                        chip->rirb.res = res;
+                        chip->rirb.res[addr] = res;
                        smp_wmb();
-                        chip->rirb.cmds--;
+                        chip->rirb.cmds[addr]--;
-                }
+                } else
+                        snd_printk(KERN_ERR SFX "spurious response %#x:%#x, "
+                                   "last cmd=%#08x\n",
+                                   res, res_ex,
+                                   chip->last_cmd[addr]);
        }
 }
 /* receive a response */
-static unsigned int azx_rirb_get_response(struct hda_bus *bus)
+static unsigned int azx_rirb_get_response(struct hda_bus *bus,
+                                          unsigned int addr)
 {
        struct azx *chip = bus->private_data;
        unsigned long timeout;
@@ -616,10 +655,10 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus)
                        azx_update_rirb(chip);
                        spin_unlock_irq(&chip->reg_lock);
                }
-                if (!chip->rirb.cmds) {
+                if (!chip->rirb.cmds[addr]) {
                        smp_rmb();
                        bus->rirb_error = 0;
-                        return chip->rirb.res; /* the last value */
+                        return chip->rirb.res[addr]; /* the last value */
                }
                if (time_after(jiffies, timeout))
                        break;
@@ -633,7 +672,8 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus)
        if (chip->msi) {
                snd_printk(KERN_WARNING SFX "No response from codec, "
-                           "disabling MSI: last cmd=0x%08x\n", chip->last_cmd);
+                           "disabling MSI: last cmd=0x%08x\n",
+                           chip->last_cmd[addr]);
                free_irq(chip->irq, chip);
                chip->irq = -1;
                pci_disable_msi(chip->pci);
@@ -648,7 +688,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus)
        if (!chip->polling_mode) {
                snd_printk(KERN_WARNING SFX "azx_get_response timeout, "
                           "switching to polling mode: last cmd=0x%08x\n",
-                           chip->last_cmd);
+                           chip->last_cmd[addr]);
                chip->polling_mode = 1;
                goto again;
        }
@@ -672,7 +712,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus)
        snd_printk(KERN_ERR "hda_intel: azx_get_response timeout, "
                   "switching to single_cmd mode: last cmd=0x%08x\n",
-                   chip->last_cmd);
+                   chip->last_cmd[addr]);
        chip->single_cmd = 1;
        bus->response_reset = 0;
        /* re-initialize CORB/RIRB */
@@ -692,7 +732,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus)
 */
 /* receive a response */
-static int azx_single_wait_for_response(struct azx *chip)
+static int azx_single_wait_for_response(struct azx *chip, unsigned int addr)
 {
        int timeout = 50;
@@ -700,7 +740,7 @@ static int azx_single_wait_for_response(struct azx *chip)
                /* check IRV busy bit */
                if (azx_readw(chip, IRS) & ICH6_IRS_VALID) {
                        /* reuse rirb.res as the response return value */
-                        chip->rirb.res = azx_readl(chip, IR);
+                        chip->rirb.res[addr] = azx_readl(chip, IR);
                        return 0;
                }
                udelay(1);
@@ -708,7 +748,7 @@ static int azx_single_wait_for_response(struct azx *chip)
        if (printk_ratelimit())
                snd_printd(SFX "get_response timeout: IRS=0x%x\n",
                           azx_readw(chip, IRS));
-        chip->rirb.res = -1;
+        chip->rirb.res[addr] = -1;
        return -EIO;
 }
@@ -716,6 +756,7 @@ static int azx_single_wait_for_response(struct azx *chip)
 static int azx_single_send_cmd(struct hda_bus *bus, u32 val)
 {
        struct azx *chip = bus->private_data;
+        unsigned int addr = azx_command_addr(val);
        int timeout = 50;
        bus->rirb_error = 0;
@@ -728,7 +769,7 @@ static int azx_single_send_cmd(struct hda_bus *bus, u32 val)
                        azx_writel(chip, IC, val);
                        azx_writew(chip, IRS, azx_readw(chip, IRS) |
                                   ICH6_IRS_BUSY);
-                        return azx_single_wait_for_response(chip);
+                        return azx_single_wait_for_response(chip, addr);
                }
                udelay(1);
        }
@@ -739,10 +780,11 @@ static int azx_single_send_cmd(struct hda_bus *bus, u32 val)
 }
 /* receive a response */
-static unsigned int azx_single_get_response(struct hda_bus *bus)
+static unsigned int azx_single_get_response(struct hda_bus *bus,
+                                            unsigned int addr)
 {
        struct azx *chip = bus->private_data;
-        return chip->rirb.res;
+        return chip->rirb.res[addr];
 }
 /*
@@ -757,7 +799,7 @@ static int azx_send_cmd(struct hda_bus *bus, unsigned int val)
 {
        struct azx *chip = bus->private_data;
-        chip->last_cmd = val;
+        chip->last_cmd[azx_command_addr(val)] = val;
        if (chip->single_cmd)
                return azx_single_send_cmd(bus, val);
        else
@@ -765,13 +807,14 @@ static int azx_send_cmd(struct hda_bus *bus, unsigned int val)
 }
 /* get a response */
-static unsigned int azx_get_response(struct hda_bus *bus)
+static unsigned int azx_get_response(struct hda_bus *bus,
+                                     unsigned int addr)
 {
        struct azx *chip = bus->private_data;
        if (chip->single_cmd)
-                return azx_single_get_response(bus);
+                return azx_single_get_response(bus, addr);
        else
-                return azx_rirb_get_response(bus);
+                return azx_rirb_get_response(bus, addr);
 }
 #ifdef CONFIG_SND_HDA_POWER_SAVE
@@ -1243,10 +1286,12 @@ static int probe_codec(struct azx *chip, int addr)
                (AC_VERB_PARAMETERS << 8) | AC_PAR_VENDOR_ID;
        unsigned int res;
+        mutex_lock(&chip->bus->cmd_mutex);
        chip->probing = 1;
        azx_send_cmd(chip->bus, cmd);
-        res = azx_get_response(chip->bus);
+        res = azx_get_response(chip->bus, addr);
        chip->probing = 0;
+        mutex_unlock(&chip->bus->cmd_mutex);
        if (res == -1)
                return -EIO;
        snd_printdd(SFX "codec #%d probed OK\n", addr);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b95df5d5dcc2..fea976793ae5 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -559,7 +559,7 @@ static int alc_pin_mode_get(struct snd_kcontrol *kcontrol,
        /* Find enumerated value for current pinctl setting */
        i = alc_pin_mode_min(dir);
-        while (alc_pin_mode_values[i] != pinctl && i <= alc_pin_mode_max(dir))
+        while (i <= alc_pin_mode_max(dir) && alc_pin_mode_values[i] != pinctl)
                i++;
        *valp = i <= alc_pin_mode_max(dir) ? i: alc_pin_mode_min(dir);
        return 0;
@@ -13563,6 +13563,8 @@ static int patch_alc269(struct hda_codec *codec)
                set_capture_mixer(spec);
        set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
+        spec->vmaster_nid = 0x02;
        codec->patch_ops = alc_patch_ops;
        if (board_config == ALC269_AUTO)
                spec->init_hook = alc269_auto_init;
@@ -15157,7 +15159,7 @@ static struct snd_pci_quirk alc861vd_cfg_tbl[] = {
        SND_PCI_QUIRK(0x10de, 0x03f0, "Realtek ALC660 demo", ALC660VD_3ST),
        SND_PCI_QUIRK(0x1179, 0xff00, "Toshiba A135", ALC861VD_LENOVO),
        /*SND_PCI_QUIRK(0x1179, 0xff00, "DALLAS", ALC861VD_DALLAS),*/ /*lenovo*/
-        SND_PCI_QUIRK(0x1179, 0xff01, "DALLAS", ALC861VD_DALLAS),
+        SND_PCI_QUIRK(0x1179, 0xff01, "Toshiba A135", ALC861VD_LENOVO),
        SND_PCI_QUIRK(0x1179, 0xff03, "Toshiba P205", ALC861VD_LENOVO),
        SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba L30-149", ALC861VD_DALLAS),
        SND_PCI_QUIRK(0x1565, 0x820d, "Biostar NF61S SE", ALC861VD_6ST_DIG),
@@ -15577,9 +15579,12 @@ static int patch_alc861vd(struct hda_codec *codec)
        spec->stream_digital_playback = &alc861vd_pcm_digital_playback;
        spec->stream_digital_capture = &alc861vd_pcm_digital_capture;
-        spec->adc_nids = alc861vd_adc_nids;
+        if (!spec->adc_nids) {
-        spec->num_adc_nids = ARRAY_SIZE(alc861vd_adc_nids);
+                spec->adc_nids = alc861vd_adc_nids;
-        spec->capsrc_nids = alc861vd_capsrc_nids;
+                spec->num_adc_nids = ARRAY_SIZE(alc861vd_adc_nids);
+        }
+        if (!spec->capsrc_nids)
+                spec->capsrc_nids = alc861vd_capsrc_nids;
        set_capture_mixer(spec);
        set_beep_amp(spec, 0x0b, 0x05, HDA_INPUT);
@@ -17496,9 +17501,12 @@ static int patch_alc662(struct hda_codec *codec)
        spec->stream_digital_playback = &alc662_pcm_digital_playback;
        spec->stream_digital_capture = &alc662_pcm_digital_capture;
-        spec->adc_nids = alc662_adc_nids;
+        if (!spec->adc_nids) {
-        spec->num_adc_nids = ARRAY_SIZE(alc662_adc_nids);
+                spec->adc_nids = alc662_adc_nids;
-        spec->capsrc_nids = alc662_capsrc_nids;
+                spec->num_adc_nids = ARRAY_SIZE(alc662_adc_nids);
+        }
+        if (!spec->capsrc_nids)
+                spec->capsrc_nids = alc662_capsrc_nids;
        if (!spec->cap_mixer)
                set_capture_mixer(spec);
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 5383d8cff88b..456ef6ac12e4 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2266,7 +2266,7 @@ static struct snd_pci_quirk stac927x_cfg_tbl[] = {
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0227, "Dell Vostro 1400  ", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022e, "Dell     ", STAC_DELL_BIOS),
-        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell Inspiron 1525", STAC_DELL_3ST),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell Inspiron 1525", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0242, "Dell     ", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0243, "Dell     ", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x02ff, "Dell     ", STAC_DELL_BIOS),
@@ -5645,6 +5645,13 @@ static int patch_stac927x(struct hda_codec *codec)
                /* GPIO2 High = Enable EAPD */
                spec->eapd_mask = spec->gpio_mask = spec->gpio_dir = 0x04;
                spec->gpio_data = 0x04;
+                switch (codec->subsystem_id) {
+                case 0x1028022f:
+                        /* correct EAPD to be GPIO0 */
+                        spec->eapd_mask = spec->gpio_mask = 0x01;
+                        spec->gpio_dir = spec->gpio_data = 0x01;
+                        break;
+                };
                spec->dmic_nids = stac927x_dmic_nids;
                spec->num_dmics = STAC927X_NUM_DMICS;
diff --git a/sound/soc/fsl/efika-audio-fabric.c b/sound/soc/fsl/efika-audio-fabric.c
index 85b0e7569504..3326e2a1e863 100644
--- a/sound/soc/fsl/efika-audio-fabric.c
+++ b/sound/soc/fsl/efika-audio-fabric.c
@@ -30,6 +30,8 @@
 #include "mpc5200_psc_ac97.h"
 #include "../codecs/stac9766.h"
+#define DRV_NAME "efika-audio-fabric"
 static struct snd_soc_device device;
 static struct snd_soc_card card;
diff --git a/sound/soc/fsl/pcm030-audio-fabric.c b/sound/soc/fsl/pcm030-audio-fabric.c
index 8766f7a3893d..b928ef7d28eb 100644
--- a/sound/soc/fsl/pcm030-audio-fabric.c
+++ b/sound/soc/fsl/pcm030-audio-fabric.c
@@ -30,6 +30,8 @@
 #include "mpc5200_psc_ac97.h"
 #include "../codecs/wm9712.h"
+#define DRV_NAME "pcm030-audio-fabric"
 static struct snd_soc_device device;
 static struct snd_soc_card card;
diff --git a/tools/perf/Documentation/perf-examples.txt b/tools/perf/Documentation/perf-examples.txt
new file mode 100644
index 000000000000..8eb6c489fb15
--- /dev/null
+++ b/tools/perf/Documentation/perf-examples.txt
@@ -0,0 +1,225 @@
+                ------------------------------
+                ****** perf by examples ******
+                ------------------------------
+[ From an e-mail by Ingo Molnar, http://lkml.org/lkml/2009/8/4/346 ]
+First, discovery/enumeration of available counters can be done via
+'perf list':
+titan:~> perf list
+  [...]
+  kmem:kmalloc                             [Tracepoint event]
+  kmem:kmem_cache_alloc                    [Tracepoint event]
+  kmem:kmalloc_node                        [Tracepoint event]
+  kmem:kmem_cache_alloc_node               [Tracepoint event]
+  kmem:kfree                               [Tracepoint event]
+  kmem:kmem_cache_free                     [Tracepoint event]
+  kmem:mm_page_free_direct                 [Tracepoint event]
+  kmem:mm_pagevec_free                     [Tracepoint event]
+  kmem:mm_page_alloc                       [Tracepoint event]
+  kmem:mm_page_alloc_zone_locked           [Tracepoint event]
+  kmem:mm_page_pcpu_drain                  [Tracepoint event]
+  kmem:mm_page_alloc_extfrag               [Tracepoint event]
+Then any (or all) of the above event sources can be activated and
+measured. For example the page alloc/free properties of a 'hackbench
+run' are:
+ titan:~> perf stat -e kmem:mm_page_pcpu_drain -e kmem:mm_page_alloc
+ -e kmem:mm_pagevec_free -e kmem:mm_page_free_direct ./hackbench 10
+ Time: 0.575
+ Performance counter stats for './hackbench 10':
+          13857  kmem:mm_page_pcpu_drain
+          27576  kmem:mm_page_alloc
+           6025  kmem:mm_pagevec_free
+          20934  kmem:mm_page_free_direct
+    0.613972165  seconds time elapsed
+You can observe the statistical properties as well, by using the
+'repeat the workload N times' feature of perf stat:
+ titan:~> perf stat --repeat 5 -e kmem:mm_page_pcpu_drain -e
+   kmem:mm_page_alloc -e kmem:mm_pagevec_free -e
+   kmem:mm_page_free_direct ./hackbench 10
+ Time: 0.627
+ Time: 0.644
+ Time: 0.564
+ Time: 0.559
+ Time: 0.626
+ Performance counter stats for './hackbench 10' (5 runs):
+          12920  kmem:mm_page_pcpu_drain    ( +-   3.359% )
+          25035  kmem:mm_page_alloc         ( +-   3.783% )
+           6104  kmem:mm_pagevec_free       ( +-   0.934% )
+          18376  kmem:mm_page_free_direct   ( +-   4.941% )
+    0.643954516  seconds time elapsed   ( +-   2.363% )
+Furthermore, these tracepoints can be used to sample the workload as
+well. For example the page allocations done by a 'git gc' can be
+captured the following way:
+ titan:~/git> perf record -f -e kmem:mm_page_alloc -c 1 ./git gc
+ Counting objects: 1148, done.
+ Delta compression using up to 2 threads.
+ Compressing objects: 100% (450/450), done.
+ Writing objects: 100% (1148/1148), done.
+ Total 1148 (delta 690), reused 1148 (delta 690)
+ [ perf record: Captured and wrote 0.267 MB perf.data (~11679 samples) ]
+To check which functions generated page allocations:
+ titan:~/git> perf report
+ # Samples: 10646
+ #
+ # Overhead          Command               Shared Object
+ # ........  ...............  ..........................
+ #
+    23.57%       git-repack  /lib64/libc-2.5.so
+    21.81%              git  /lib64/libc-2.5.so
+    14.59%              git  ./git
+    11.79%       git-repack  ./git
+     7.12%              git  /lib64/ld-2.5.so
+     3.16%       git-repack  /lib64/libpthread-2.5.so
+     2.09%       git-repack  /bin/bash
+     1.97%               rm  /lib64/libc-2.5.so
+     1.39%               mv  /lib64/ld-2.5.so
+     1.37%               mv  /lib64/libc-2.5.so
+     1.12%       git-repack  /lib64/ld-2.5.so
+     0.95%               rm  /lib64/ld-2.5.so
+     0.90%  git-update-serv  /lib64/libc-2.5.so
+     0.73%  git-update-serv  /lib64/ld-2.5.so
+     0.68%             perf  /lib64/libpthread-2.5.so
+     0.64%       git-repack  /usr/lib64/libz.so.1.2.3
+Or to see it on a more finegrained level:
+titan:~/git> perf report --sort comm,dso,symbol
+# Samples: 10646
+#
+# Overhead          Command               Shared Object  Symbol
+# ........  ...............  ..........................  ......
+#
+     9.35%       git-repack  ./git                       [.] insert_obj_hash
+     9.12%              git  ./git                       [.] insert_obj_hash
+     7.31%              git  /lib64/libc-2.5.so          [.] memcpy
+     6.34%       git-repack  /lib64/libc-2.5.so          [.] _int_malloc
+     6.24%       git-repack  /lib64/libc-2.5.so          [.] memcpy
+     5.82%       git-repack  /lib64/libc-2.5.so          [.] __GI___fork
+     5.47%              git  /lib64/libc-2.5.so          [.] _int_malloc
+     2.99%              git  /lib64/libc-2.5.so          [.] memset
+Furthermore, call-graph sampling can be done too, of page
+allocations - to see precisely what kind of page allocations there
+are:
+ titan:~/git> perf record -f -g -e kmem:mm_page_alloc -c 1 ./git gc
+ Counting objects: 1148, done.
+ Delta compression using up to 2 threads.
+ Compressing objects: 100% (450/450), done.
+ Writing objects: 100% (1148/1148), done.
+ Total 1148 (delta 690), reused 1148 (delta 690)
+ [ perf record: Captured and wrote 0.963 MB perf.data (~42069 samples) ]
+ titan:~/git> perf report -g
+ # Samples: 10686
+ #
+ # Overhead          Command               Shared Object
+ # ........  ...............  ..........................
+ #
+    23.25%       git-repack  /lib64/libc-2.5.so
+                |
+                |--50.00%-- _int_free
+                |
+                |--37.50%-- __GI___fork
+                |          make_child
+                |
+                |--12.50%-- ptmalloc_unlock_all2
+                |          make_child
+                |
+                 --6.25%-- __GI_strcpy
+    21.61%              git  /lib64/libc-2.5.so
+                |
+                |--30.00%-- __GI_read
+                |          |
+                |           --83.33%-- git_config_from_file
+                |                     git_config
+                |                     |
+   [...]
+Or you can observe the whole system's page allocations for 10
+seconds:
+titan:~/git> perf stat -a -e kmem:mm_page_pcpu_drain -e
+kmem:mm_page_alloc -e kmem:mm_pagevec_free -e
+kmem:mm_page_free_direct sleep 10
+ Performance counter stats for 'sleep 10':
+         171585  kmem:mm_page_pcpu_drain
+         322114  kmem:mm_page_alloc
+          73623  kmem:mm_pagevec_free
+         254115  kmem:mm_page_free_direct
+   10.000591410  seconds time elapsed
+Or observe how fluctuating the page allocations are, via statistical
+analysis done over ten 1-second intervals:
+ titan:~/git> perf stat --repeat 10 -a -e kmem:mm_page_pcpu_drain -e
+   kmem:mm_page_alloc -e kmem:mm_pagevec_free -e
+   kmem:mm_page_free_direct sleep 1
+ Performance counter stats for 'sleep 1' (10 runs):
+          17254  kmem:mm_page_pcpu_drain    ( +-   3.709% )
+          34394  kmem:mm_page_alloc         ( +-   4.617% )
+           7509  kmem:mm_pagevec_free       ( +-   4.820% )
+          25653  kmem:mm_page_free_direct   ( +-   3.672% )
+    1.058135029  seconds time elapsed   ( +-   3.089% )
+Or you can annotate the recorded 'git gc' run on a per symbol basis
+and check which instructions/source-code generated page allocations:
+ titan:~/git> perf annotate __GI___fork
+ ------------------------------------------------
+  Percent |      Source code & Disassembly of libc-2.5.so
+ ------------------------------------------------
+          :
+          :
+          :      Disassembly of section .plt:
+          :      Disassembly of section .text:
+          :
+          :      00000031a2e95560 <__fork>:
+ [...]
+     0.00 :        31a2e95602:   b8 38 00 00 00          mov    $0x38,%eax
+     0.00 :        31a2e95607:   0f 05                   syscall
+    83.42 :        31a2e95609:   48 3d 00 f0 ff ff       cmp    $0xfffffffffffff000,%rax
+     0.00 :        31a2e9560f:   0f 87 4d 01 00 00       ja     31a2e95762 <__fork+0x202>
+     0.00 :        31a2e95615:   85 c0                   test   %eax,%eax
+( this shows that 83.42% of __GI___fork's page allocations come from
+  the 0x38 system call it performs. )
+etc. etc. - a lot more is possible. I could list a dozen of
+other different usecases straight away - neither of which is
+possible via /proc/vmstat.
+/proc/vmstat is not in the same league really, in terms of
+expressive power of system analysis and performance
+analysis.
+All that the above results needed were those new tracepoints
+in include/tracing/events/kmem.h.
+        Ingo
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index 1dbc1eeb4c01..6be696b0a2bb 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -29,13 +29,67 @@ OPTIONS
        Select the PMU event. Selection can be a symbolic event name
        (use 'perf list' to list all events) or a raw PMU
        event (eventsel+umask) in the form of rNNN where NNN is a
-         hexadecimal event descriptor.
+        hexadecimal event descriptor.
 -a::
-        system-wide collection
+        System-wide collection.
 -l::
-        scale counter values
+        Scale counter values.
+-p::
+--pid=::
+        Record events on existing pid.
+-r::
+--realtime=::
+        Collect data with this RT SCHED_FIFO priority.
+-A::
+--append::
+        Append to the output file to do incremental profiling.
+-f::
+--force::
+        Overwrite existing data file.
+-c::
+--count=::
+        Event period to sample.
+-o::
+--output=::
+        Output file name.
+-i::
+--inherit::
+        Child tasks inherit counters.
+-F::
+--freq=::
+        Profile at this frequency.
+-m::
+--mmap-pages=::
+        Number of mmap data pages.
+-g::
+--call-graph::
+        Do call-graph (stack chain/backtrace) recording.
+-v::
+--verbose::
+        Be more verbose (show counter open errors, etc).
+-s::
+--stat::
+        Per thread counts.
+-d::
+--data::
+        Sample addresses.
+-n::
+--no-samples::
+        Don't sample.
 SEE ALSO
 --------
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 0d74346d21ab..484080dd5b6f 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -40,7 +40,7 @@ OPTIONS
 -a::
        system-wide collection
-S::
+-c::
        scale counter values
 EXAMPLES
diff --git a/tools/perf/Documentation/perf-top.txt b/tools/perf/Documentation/perf-top.txt
index 539d01289725..4a7d558dc309 100644
--- a/tools/perf/Documentation/perf-top.txt
+++ b/tools/perf/Documentation/perf-top.txt
@@ -3,36 +3,122 @@ perf-top(1)
 NAME
 ----
-perf-top - Run a command and profile it
+perf-top - System profiling tool.
 SYNOPSIS
 --------
 [verse]
-'perf top' [-e <EVENT> | --event=EVENT] [-l] [-a] <command>
+'perf top' [-e <EVENT> | --event=EVENT] [<options>]
 DESCRIPTION
 -----------
-This command runs a command and gathers a performance counter profile
+This command generates and displays a performance counter profile in realtime.
-from it.
 OPTIONS
 -------
-<command>...::
+-a::
-        Any command you can specify in a shell.
+--all-cpus::
+        System-wide collection.  (default)
+-c <count>::
+--count=<count>::
+        Event period to sample.
+-C <cpu>::
+--CPU=<cpu>::
+        CPU to profile.
+-d <seconds>::
+--delay=<seconds>::
+        Number of seconds to delay between refreshes.
-e::
+-e <event>::
--event=::
+--event=<event>::
        Select the PMU event. Selection can be a symbolic event name
        (use 'perf list' to list all events) or a raw PMU
        event (eventsel+umask) in the form of rNNN where NNN is a
-         hexadecimal event descriptor.
+        hexadecimal event descriptor.
-a::
+-E <entries>::
-        system-wide collection
+--entries=<entries>::
+        Display this many functions.
+-f <count>::
+--count-filter=<count>::
+        Only display functions with more events than this.
+-F <freq>::
+--freq=<freq>::
+        Profile at this frequency.
+-i::
+--inherit::
+        Child tasks inherit counters, only makes sens with -p option.
+-k <path>::
+--vmlinux=<path>::
+        Path to vmlinux.  Required for annotation functionality.
+-m <pages>::
+--mmap-pages=<pages>::
+        Number of mmapped data pages.
+-p <pid>::
+--pid=<pid>::
+        Profile events on existing pid.
+-r <priority>::
+--realtime=<priority>::
+        Collect data with this RT SCHED_FIFO priority.
+-s <symbol>::
+--sym-annotate=<symbol>::
+        Annotate this symbol.  Requires -k option.
+-v::
+--verbose::
+        Be more verbose (show counter open errors, etc).
+-z::
+--zero::
+        Zero history across display updates.
+INTERACTIVE PROMPTING KEYS
+--------------------------
+[d]::
+        Display refresh delay.
+[e]::
+        Number of entries to display.
+[E]::
+        Event to display when multiple counters are active.
+[f]::
+        Profile display filter (>= hit count).
+[F]::
+        Annotation display filter (>= % of total).
+[s]::
+        Annotate symbol.
+[S]::
+        Stop annotation, return to full profile display.
+[w]::
+        Toggle between weighted sum and individual count[E]r profile.
+[z]::
+        Toggle event count zeroing across display updates.
+[qQ]::
+        Quit.
+Pressing any unmapped key displays a menu, and prompts for input.
-l::
-        scale counter values
 SEE ALSO
 --------
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index a5e9b876ca09..c045b4271e57 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -158,8 +158,10 @@ uname_P := $(shell sh -c 'uname -p 2>/dev/null || echo not')
 uname_V := $(shell sh -c 'uname -v 2>/dev/null || echo not')
 # If we're on a 64-bit kernel, use -m64
-ifneq ($(patsubst %64,%,$(uname_M)),$(uname_M))
+ifndef NO_64BIT
-  M64 := -m64
+        ifneq ($(patsubst %64,%,$(uname_M)),$(uname_M))
+          M64 := -m64
+        endif
 endif
 # CFLAGS and LDFLAGS are for the users to override from the command line.
@@ -345,7 +347,6 @@ BUILTIN_OBJS += builtin-stat.o
 BUILTIN_OBJS += builtin-top.o
 PERFLIBS = $(LIB_FILE)
-EXTLIBS = -lbfd
 #
 # Platform specific tweaks
@@ -374,6 +375,39 @@ ifeq ($(uname_S),Darwin)
        PTHREAD_LIBS =
 endif
+ifneq ($(shell sh -c "(echo '\#include <libelf.h>'; echo 'int main(void) { Elf * elf = elf_begin(0, ELF_C_READ_MMAP, 0); return (long)elf; }') | $(CC) -x c - $(ALL_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -o /dev/null $(ALL_LDFLAGS) > /dev/null 2>&1 && echo y"), y)
+        msg := $(error No libelf.h/libelf found, please install libelf-dev/elfutils-libelf-devel);
+endif
+ifdef NO_DEMANGLE
+        BASIC_CFLAGS += -DNO_DEMANGLE
+else
+        has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd > /dev/null 2>&1 && echo y")
+        ifeq ($(has_bfd),y)
+                EXTLIBS += -lbfd
+        else
+                has_bfd_iberty := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty > /dev/null 2>&1 && echo y")
+                ifeq ($(has_bfd_iberty),y)
+                        EXTLIBS += -lbfd -liberty
+                else
+                        has_bfd_iberty_z := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty -lz > /dev/null 2>&1 && echo y")
+                        ifeq ($(has_bfd_iberty_z),y)
+                                EXTLIBS += -lbfd -liberty -lz
+                        else
+                                has_cplus_demangle := $(shell sh -c "(echo 'extern char *cplus_demangle(const char *, int);'; echo 'int main(void) { cplus_demangle(0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -liberty > /dev/null 2>&1 && echo y")
+                                ifeq ($(has_cplus_demangle),y)
+                                        EXTLIBS += -liberty
+                                        BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
+                                else
+                                        msg := $(warning No bfd.h/libbfd found, install binutils-dev[el] to gain symbol demangling)
+                                        BASIC_CFLAGS += -DNO_DEMANGLE
+                                endif
+                        endif
+                endif
+        endif
+endif
 ifndef CC_LD_DYNPATH
        ifdef NO_R_TO_GCC_LINKER
                # Some gcc does not accept and pass -R to the linker to specify
diff --git a/tools/perf/builtin-list.c b/tools/perf/builtin-list.c
index f990fa8a35c9..d88c6961274c 100644
--- a/tools/perf/builtin-list.c
+++ b/tools/perf/builtin-list.c
@@ -10,11 +10,12 @@
 #include "perf.h"
-#include "util/parse-options.h"
 #include "util/parse-events.h"
+#include "util/cache.h"
 int cmd_list(int argc __used, const char **argv __used, const char *prefix __used)
 {
+        setup_pager();
        print_events();
        return 0;
 }
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 6da09928130f..3d051b9cf25f 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -34,7 +34,9 @@ static int			output;
 static const char               *output_name                    = "perf.data";
 static int                      group                           = 0;
 static unsigned int             realtime_prio                   = 0;
+static int                      raw_samples                     = 0;
 static int                      system_wide                     = 0;
+static int                      profile_cpu                     = -1;
 static pid_t                    target_pid                      = -1;
 static int                      inherit                         = 1;
 static int                      force                           = 0;
@@ -203,46 +205,48 @@ static void sig_atexit(void)
        kill(getpid(), signr);
 }
-static void pid_synthesize_comm_event(pid_t pid, int full)
+static pid_t pid_synthesize_comm_event(pid_t pid, int full)
 {
        struct comm_event comm_ev;
        char filename[PATH_MAX];
        char bf[BUFSIZ];
-        int fd;
+        FILE *fp;
-        size_t size;
+        size_t size = 0;
-        char *field, *sep;
        DIR *tasks;
        struct dirent dirent, *next;
+        pid_t tgid = 0;
-        snprintf(filename, sizeof(filename), "/proc/%d/stat", pid);
+        snprintf(filename, sizeof(filename), "/proc/%d/status", pid);
-        fd = open(filename, O_RDONLY);
+        fp = fopen(filename, "r");
-        if (fd < 0) {
+        if (fd == NULL) {
                /*
                 * We raced with a task exiting - just return:
                 */
                if (verbose)
                        fprintf(stderr, "couldn't open %s\n", filename);
-                return;
+                return 0;
        }
-        if (read(fd, bf, sizeof(bf)) < 0) {
-                fprintf(stderr, "couldn't read %s\n", filename);
-                exit(EXIT_FAILURE);
-        }
-        close(fd);
-        /* 9027 (cat) R 6747 9027 6747 34816 9027 ... */
        memset(&comm_ev, 0, sizeof(comm_ev));
-        field = strchr(bf, '(');
+        while (!comm_ev.comm[0] || !comm_ev.pid) {
-        if (field == NULL)
+                if (fgets(bf, sizeof(bf), fp) == NULL)
-                goto out_failure;
+                        goto out_failure;
-        sep = strchr(++field, ')');
-        if (sep == NULL)
+                if (memcmp(bf, "Name:", 5) == 0) {
-                goto out_failure;
+                        char *name = bf + 5;
-        size = sep - field;
+                        while (*name && isspace(*name))
-        memcpy(comm_ev.comm, field, size++);
+                                ++name;
+                        size = strlen(name) - 1;
-        comm_ev.pid = pid;
+                        memcpy(comm_ev.comm, name, size++);
+                } else if (memcmp(bf, "Tgid:", 5) == 0) {
+                        char *tgids = bf + 5;
+                        while (*tgids && isspace(*tgids))
+                                ++tgids;
+                        tgid = comm_ev.pid = atoi(tgids);
+                }
+        }
        comm_ev.header.type = PERF_EVENT_COMM;
        size = ALIGN(size, sizeof(u64));
        comm_ev.header.size = sizeof(comm_ev) - (sizeof(comm_ev.comm) - size);
@@ -251,7 +255,7 @@ static void pid_synthesize_comm_event(pid_t pid, int full)
                comm_ev.tid = pid;
                write_output(&comm_ev, comm_ev.header.size);
-                return;
+                goto out_fclose;
        }
        snprintf(filename, sizeof(filename), "/proc/%d/task", pid);
@@ -268,7 +272,10 @@ static void pid_synthesize_comm_event(pid_t pid, int full)
                write_output(&comm_ev, comm_ev.header.size);
        }
        closedir(tasks);
-        return;
+out_fclose:
+        fclose(fp);
+        return tgid;
 out_failure:
        fprintf(stderr, "couldn't get COMM and pgid, malformed %s\n",
@@ -276,7 +283,7 @@ out_failure:
        exit(EXIT_FAILURE);
 }
-static void pid_synthesize_mmap_samples(pid_t pid)
+static void pid_synthesize_mmap_samples(pid_t pid, pid_t tgid)
 {
        char filename[PATH_MAX];
        FILE *fp;
@@ -328,7 +335,7 @@ static void pid_synthesize_mmap_samples(pid_t pid)
                        mmap_ev.len -= mmap_ev.start;
                        mmap_ev.header.size = (sizeof(mmap_ev) -
                                               (sizeof(mmap_ev.filename) - size));
-                        mmap_ev.pid = pid;
+                        mmap_ev.pid = tgid;
                        mmap_ev.tid = pid;
                        write_output(&mmap_ev, mmap_ev.header.size);
@@ -347,14 +354,14 @@ static void synthesize_all(void)
        while (!readdir_r(proc, &dirent, &next) && next) {
                char *end;
-                pid_t pid;
+                pid_t pid, tgid;
                pid = strtol(dirent.d_name, &end, 10);
                if (*end) /* only interested in proper numerical dirents */
                        continue;
-                pid_synthesize_comm_event(pid, 1);
+                tgid = pid_synthesize_comm_event(pid, 1);
-                pid_synthesize_mmap_samples(pid);
+                pid_synthesize_mmap_samples(pid, tgid);
        }
        closedir(proc);
@@ -392,7 +399,7 @@ static void create_counter(int counter, int cpu, pid_t pid)
                                  PERF_FORMAT_TOTAL_TIME_RUNNING |
                                  PERF_FORMAT_ID;
-        attr->sample_type       = PERF_SAMPLE_IP | PERF_SAMPLE_TID;
+        attr->sample_type       |= PERF_SAMPLE_IP | PERF_SAMPLE_TID;
        if (freq) {
                attr->sample_type       |= PERF_SAMPLE_PERIOD;
@@ -412,6 +419,9 @@ static void create_counter(int counter, int cpu, pid_t pid)
        if (call_graph)
                attr->sample_type       |= PERF_SAMPLE_CALLCHAIN;
+        if (raw_samples)
+                attr->sample_type       |= PERF_SAMPLE_RAW;
        attr->mmap              = track;
        attr->comm              = track;
        attr->inherit           = (cpu < 0) && inherit;
@@ -425,6 +435,8 @@ try_again:
                if (err == EPERM)
                        die("Permission error - are you root?\n");
+                else if (err ==  ENODEV && profile_cpu != -1)
+                        die("No such device - did you specify an out-of-range profile CPU?\n");
                /*
                 * If it's cycles then fall back to hrtimer
@@ -524,10 +536,14 @@ static int __cmd_record(int argc, const char **argv)
        signal(SIGCHLD, sig_handler);
        signal(SIGINT, sig_handler);
-        if (!stat(output_name, &st) && !force && !append_file) {
+        if (!stat(output_name, &st) && st.st_size) {
-                fprintf(stderr, "Error, output file %s exists, use -A to append or -f to overwrite.\n",
+                if (!force && !append_file) {
-                                output_name);
+                        fprintf(stderr, "Error, output file %s exists, use -A to append or -f to overwrite.\n",
-                exit(-1);
+                                        output_name);
+                        exit(-1);
+                }
+        } else {
+                append_file = 0;
        }
        flags = O_CREAT|O_RDWR;
@@ -554,16 +570,22 @@ static int __cmd_record(int argc, const char **argv)
                if (pid == -1)
                        pid = getpid();
-                open_counters(-1, pid);
+                open_counters(profile_cpu, pid);
-        } else for (i = 0; i < nr_cpus; i++)
+        } else {
-                open_counters(i, target_pid);
+                if (profile_cpu != -1) {
+                        open_counters(profile_cpu, target_pid);
+                } else {
+                        for (i = 0; i < nr_cpus; i++)
+                                open_counters(i, target_pid);
+                }
+        }
        if (file_new)
                perf_header__write(header, output);
        if (!system_wide) {
-                pid_synthesize_comm_event(pid, 0);
+                pid_t tgid = pid_synthesize_comm_event(pid, 0);
-                pid_synthesize_mmap_samples(pid);
+                pid_synthesize_mmap_samples(pid, tgid);
        } else
                synthesize_all();
@@ -631,10 +653,14 @@ static const struct option options[] = {
                    "record events on existing pid"),
        OPT_INTEGER('r', "realtime", &realtime_prio,
                    "collect data with this RT SCHED_FIFO priority"),
+        OPT_BOOLEAN('R', "raw-samples", &raw_samples,
+                    "collect raw sample records from all opened counters"),
        OPT_BOOLEAN('a', "all-cpus", &system_wide,
                            "system-wide collection from all CPUs"),
        OPT_BOOLEAN('A', "append", &append_file,
                            "append to the output file to do incremental profiling"),
+        OPT_INTEGER('C', "profile_cpu", &profile_cpu,
+                            "CPU to profile on"),
        OPT_BOOLEAN('f', "force", &force,
                        "overwrite existing data file"),
        OPT_LONG('c', "count", &default_interval,
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index b20a4b6e31b7..b53a60fc12de 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -31,7 +31,7 @@
 static char             const *input_name = "perf.data";
 static char             *vmlinux = NULL;
-static char             default_sort_order[] = "comm,dso";
+static char             default_sort_order[] = "comm,dso,symbol";
 static char             *sort_order = default_sort_order;
 static char             *dso_list_str, *comm_list_str, *sym_list_str,
                        *col_width_list_str;
@@ -68,7 +68,7 @@ static int		callchain;
 static
 struct callchain_param  callchain_param = {
-        .mode   = CHAIN_GRAPH_ABS,
+        .mode   = CHAIN_GRAPH_REL,
        .min_percent = 0.5
 };
@@ -99,6 +99,7 @@ struct comm_event {
 struct fork_event {
        struct perf_event_header header;
        u32 pid, ppid;
+        u32 tid, ptid;
 };
 struct lost_event {
@@ -111,7 +112,9 @@ struct read_event {
        struct perf_event_header header;
        u32 pid,tid;
        u64 value;
-        u64 format[3];
+        u64 time_enabled;
+        u64 time_running;
+        u64 id;
 };
 typedef union event_union {
@@ -252,7 +255,7 @@ static int strcommon(const char *pathname)
 {
        int n = 0;
-        while (pathname[n] == cwd[n] && n < cwdlen)
+        while (n < cwdlen && pathname[n] == cwd[n])
                ++n;
        return n;
@@ -697,7 +700,8 @@ sort__sym_print(FILE *fp, struct hist_entry *self, unsigned int width __used)
        size_t ret = 0;
        if (verbose)
-                ret += repsep_fprintf(fp, "%#018llx  ", (u64)self->ip);
+                ret += repsep_fprintf(fp, "%#018llx %c ", (u64)self->ip,
+                                      dso__symtab_origin(self->dso));
        ret += repsep_fprintf(fp, "[%c] ", self->level);
        if (self->sym) {
@@ -887,6 +891,21 @@ ipchain__fprintf_graph(FILE *fp, struct callchain_list *chain, int depth,
        return ret;
 }
+static struct symbol *rem_sq_bracket;
+static struct callchain_list rem_hits;
+static void init_rem_hits(void)
+{
+        rem_sq_bracket = malloc(sizeof(*rem_sq_bracket) + 6);
+        if (!rem_sq_bracket) {
+                fprintf(stderr, "Not enough memory to display remaining hits\n");
+                return;
+        }
+        strcpy(rem_sq_bracket->name, "[...]");
+        rem_hits.sym = rem_sq_bracket;
+}
 static size_t
 callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
                        u64 total_samples, int depth, int depth_mask)
@@ -896,25 +915,34 @@ callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
        struct callchain_list *chain;
        int new_depth_mask = depth_mask;
        u64 new_total;
+        u64 remaining;
        size_t ret = 0;
        int i;
        if (callchain_param.mode == CHAIN_GRAPH_REL)
-                new_total = self->cumul_hit;
+                new_total = self->children_hit;
        else
                new_total = total_samples;
+        remaining = new_total;
        node = rb_first(&self->rb_root);
        while (node) {
+                u64 cumul;
                child = rb_entry(node, struct callchain_node, rb_node);
+                cumul = cumul_hits(child);
+                remaining -= cumul;
                /*
                 * The depth mask manages the output of pipes that show
                 * the depth. We don't want to keep the pipes of the current
-                 * level for the last child of this depth
+                 * level for the last child of this depth.
+                 * Except if we have remaining filtered hits. They will
+                 * supersede the last child
                 */
                next = rb_next(node);
-                if (!next)
+                if (!next && (callchain_param.mode != CHAIN_GRAPH_REL || !remaining))
                        new_depth_mask &= ~(1 << (depth - 1));
                /*
@@ -929,7 +957,7 @@ callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
                        ret += ipchain__fprintf_graph(fp, chain, depth,
                                                      new_depth_mask, i++,
                                                      new_total,
-                                                      child->cumul_hit);
+                                                      cumul);
                }
                ret += callchain__fprintf_graph(fp, child, new_total,
                                                depth + 1,
@@ -937,6 +965,19 @@ callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
                node = next;
        }
+        if (callchain_param.mode == CHAIN_GRAPH_REL &&
+                remaining && remaining != new_total) {
+                if (!rem_sq_bracket)
+                        return ret;
+                new_depth_mask &= ~(1 << (depth - 1));
+                ret += ipchain__fprintf_graph(fp, &rem_hits, depth,
+                                              new_depth_mask, 0, new_total,
+                                              remaining);
+        }
        return ret;
 }
@@ -1357,6 +1398,8 @@ static size_t output__fprintf(FILE *fp, u64 total_samples)
        unsigned int width;
        char *col_width = col_width_list_str;
+        init_rem_hits();
        fprintf(fp, "# Samples: %Ld\n", (u64)total_samples);
        fprintf(fp, "#\n");
@@ -1423,11 +1466,13 @@ print_entries:
        if (sort_order == default_sort_order &&
                        parent_pattern == default_parent_pattern) {
                fprintf(fp, "#\n");
-                fprintf(fp, "# (For more details, try: perf report --sort comm,dso,symbol)\n");
+                fprintf(fp, "# (For a higher level overview, try: perf report --sort comm,dso)\n");
                fprintf(fp, "#\n");
        }
        fprintf(fp, "\n");
+        free(rem_sq_bracket);
        return ret;
 }
@@ -1481,11 +1526,11 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
                more_data += sizeof(u64);
        }
-        dprintf("%p [%p]: PERF_EVENT_SAMPLE (IP, %d): %d: %p period: %Ld\n",
+        dprintf("%p [%p]: PERF_EVENT_SAMPLE (IP, %d): %d/%d: %p period: %Ld\n",
                (void *)(offset + head),
                (void *)(long)(event->header.size),
                event->header.misc,
-                event->ip.pid,
+                event->ip.pid, event->ip.tid,
                (void *)(long)ip,
                (long long)period);
@@ -1545,10 +1590,11 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
        if (show & show_mask) {
                struct symbol *sym = resolve_symbol(thread, &map, &dso, &ip);
-                if (dso_list && dso && dso->name && !strlist__has_entry(dso_list, dso->name))
+                if (dso_list && (!dso || !dso->name ||
+                                 !strlist__has_entry(dso_list, dso->name)))
                        return 0;
-                if (sym_list && sym && !strlist__has_entry(sym_list, sym->name))
+                if (sym_list && (!sym || !strlist__has_entry(sym_list, sym->name)))
                        return 0;
                if (hist_entry__add(thread, map, dso, sym, ip, chain, level, period)) {
@@ -1567,10 +1613,11 @@ process_mmap_event(event_t *event, unsigned long offset, unsigned long head)
        struct thread *thread = threads__findnew(event->mmap.pid);
        struct map *map = map__new(&event->mmap);
-        dprintf("%p [%p]: PERF_EVENT_MMAP %d: [%p(%p) @ %p]: %s\n",
+        dprintf("%p [%p]: PERF_EVENT_MMAP %d/%d: [%p(%p) @ %p]: %s\n",
                (void *)(offset + head),
                (void *)(long)(event->header.size),
                event->mmap.pid,
+                event->mmap.tid,
                (void *)(long)event->mmap.start,
                (void *)(long)event->mmap.len,
                (void *)(long)event->mmap.pgoff,
@@ -1608,15 +1655,27 @@ process_comm_event(event_t *event, unsigned long offset, unsigned long head)
 }
 static int
-process_fork_event(event_t *event, unsigned long offset, unsigned long head)
+process_task_event(event_t *event, unsigned long offset, unsigned long head)
 {
        struct thread *thread = threads__findnew(event->fork.pid);
        struct thread *parent = threads__findnew(event->fork.ppid);
-        dprintf("%p [%p]: PERF_EVENT_FORK: %d:%d\n",
+        dprintf("%p [%p]: PERF_EVENT_%s: (%d:%d):(%d:%d)\n",
                (void *)(offset + head),
                (void *)(long)(event->header.size),
-                event->fork.pid, event->fork.ppid);
+                event->header.type == PERF_EVENT_FORK ? "FORK" : "EXIT",
+                event->fork.pid, event->fork.tid,
+                event->fork.ppid, event->fork.ptid);
+        /*
+         * A thread clone will have the same PID for both
+         * parent and child.
+         */
+        if (thread == parent)
+                return 0;
+        if (event->header.type == PERF_EVENT_EXIT)
+                return 0;
        if (!thread || !parent || thread__fork(thread, parent)) {
                dprintf("problem processing PERF_EVENT_FORK, skipping event.\n");
@@ -1677,14 +1736,37 @@ static void trace_event(event_t *event)
        dprintf(".\n");
 }
+static struct perf_header       *header;
+static struct perf_counter_attr *perf_header__find_attr(u64 id)
+{
+        int i;
+        for (i = 0; i < header->attrs; i++) {
+                struct perf_header_attr *attr = header->attr[i];
+                int j;
+                for (j = 0; j < attr->ids; j++) {
+                        if (attr->id[j] == id)
+                                return &attr->attr;
+                }
+        }
+        return NULL;
+}
 static int
 process_read_event(event_t *event, unsigned long offset, unsigned long head)
 {
-        dprintf("%p [%p]: PERF_EVENT_READ: %d %d %Lu\n",
+        struct perf_counter_attr *attr = perf_header__find_attr(event->read.id);
+        dprintf("%p [%p]: PERF_EVENT_READ: %d %d %s %Lu\n",
                        (void *)(offset + head),
                        (void *)(long)(event->header.size),
                        event->read.pid,
                        event->read.tid,
+                        attr ? __event_name(attr->type, attr->config)
+                             : "FAIL",
                        event->read.value);
        return 0;
@@ -1706,7 +1788,8 @@ process_event(event_t *event, unsigned long offset, unsigned long head)
                return process_comm_event(event, offset, head);
        case PERF_EVENT_FORK:
-                return process_fork_event(event, offset, head);
+        case PERF_EVENT_EXIT:
+                return process_task_event(event, offset, head);
        case PERF_EVENT_LOST:
                return process_lost_event(event, offset, head);
@@ -1729,8 +1812,6 @@ process_event(event_t *event, unsigned long offset, unsigned long head)
        return 0;
 }
-static struct perf_header       *header;
 static u64 perf_header__sample_type(void)
 {
        u64 sample_type = 0;
@@ -1798,6 +1879,13 @@ static int __cmd_report(void)
                                        " -g?\n");
                        exit(-1);
                }
+        } else if (callchain_param.mode != CHAIN_NONE && !callchain) {
+                        callchain = 1;
+                        if (register_callchain_param(&callchain_param) < 0) {
+                                fprintf(stderr, "Can't register callchain"
+                                                " params\n");
+                                exit(-1);
+                        }
        }
        if (load_kernel() < 0) {
@@ -1936,6 +2024,13 @@ parse_callchain_opt(const struct option *opt __used, const char *arg,
        else if (!strncmp(tok, "fractal", strlen(arg)))
                callchain_param.mode = CHAIN_GRAPH_REL;
+        else if (!strncmp(tok, "none", strlen(arg))) {
+                callchain_param.mode = CHAIN_NONE;
+                callchain = 0;
+                return 0;
+        }
        else
                return -1;
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index f9510eeeb6c7..b4b06c7903e1 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -496,7 +496,7 @@ static const struct option options[] = {
                    "stat events on existing pid"),
        OPT_BOOLEAN('a', "all-cpus", &system_wide,
                    "system-wide collection from all CPUs"),
-        OPT_BOOLEAN('S', "scale", &scale,
+        OPT_BOOLEAN('c', "scale", &scale,
                    "scale/normalize counters"),
        OPT_BOOLEAN('v', "verbose", &verbose,
                    "be more verbose (show counter open errors, etc)"),
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index c0a423004e15..7de28ce9ca26 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -31,6 +31,8 @@
 #include <fcntl.h>
 #include <stdio.h>
+#include <termios.h>
+#include <unistd.h>
 #include <errno.h>
 #include <time.h>
@@ -54,7 +56,7 @@ static int			system_wide			=  0;
 static int                      default_interval                = 100000;
-static u64                      count_filter                    =  5;
+static int                      count_filter                    =  5;
 static int                      print_entries                   = 15;
 static int                      target_pid                      = -1;
@@ -69,15 +71,28 @@ static int			freq				=  0;
 static int                      verbose                         =  0;
 static char                     *vmlinux                        =  NULL;
-static char                     *sym_filter;
-static unsigned long            filter_start;
-static unsigned long            filter_end;
 static int                      delay_secs                      =  2;
 static int                      zero;
 static int                      dump_symtab;
 /*
+ * Source
+ */
+struct source_line {
+        u64                     eip;
+        unsigned long           count[MAX_COUNTERS];
+        char                    *line;
+        struct source_line      *next;
+};
+static char                     *sym_filter                     =  NULL;
+struct sym_entry                *sym_filter_entry               =  NULL;
+static int                      sym_pcnt_filter                 =  5;
+static int                      sym_counter                     =  0;
+static int                      display_weighted                = -1;
+/*
 * Symbols
 */
@@ -91,9 +106,237 @@ struct sym_entry {
        unsigned long           snap_count;
        double                  weight;
        int                     skip;
+        struct source_line      *source;
+        struct source_line      *lines;
+        struct source_line      **lines_tail;
+        pthread_mutex_t         source_lock;
 };
-struct sym_entry                *sym_filter_entry;
+/*
+ * Source functions
+ */
+static void parse_source(struct sym_entry *syme)
+{
+        struct symbol *sym;
+        struct module *module;
+        struct section *section = NULL;
+        FILE *file;
+        char command[PATH_MAX*2], *path = vmlinux;
+        u64 start, end, len;
+        if (!syme)
+                return;
+        if (syme->lines) {
+                pthread_mutex_lock(&syme->source_lock);
+                goto out_assign;
+        }
+        sym = (struct symbol *)(syme + 1);
+        module = sym->module;
+        if (module)
+                path = module->path;
+        if (!path)
+                return;
+        start = sym->obj_start;
+        if (!start)
+                start = sym->start;
+        if (module) {
+                section = module->sections->find_section(module->sections, ".text");
+                if (section)
+                        start -= section->vma;
+        }
+        end = start + sym->end - sym->start + 1;
+        len = sym->end - sym->start;
+        sprintf(command, "objdump --start-address=0x%016Lx --stop-address=0x%016Lx -dS %s", start, end, path);
+        file = popen(command, "r");
+        if (!file)
+                return;
+        pthread_mutex_lock(&syme->source_lock);
+        syme->lines_tail = &syme->lines;
+        while (!feof(file)) {
+                struct source_line *src;
+                size_t dummy = 0;
+                char *c;
+                src = malloc(sizeof(struct source_line));
+                assert(src != NULL);
+                memset(src, 0, sizeof(struct source_line));
+                if (getline(&src->line, &dummy, file) < 0)
+                        break;
+                if (!src->line)
+                        break;
+                c = strchr(src->line, '\n');
+                if (c)
+                        *c = 0;
+                src->next = NULL;
+                *syme->lines_tail = src;
+                syme->lines_tail = &src->next;
+                if (strlen(src->line)>8 && src->line[8] == ':') {
+                        src->eip = strtoull(src->line, NULL, 16);
+                        if (section)
+                                src->eip += section->vma;
+                }
+                if (strlen(src->line)>8 && src->line[16] == ':') {
+                        src->eip = strtoull(src->line, NULL, 16);
+                        if (section)
+                                src->eip += section->vma;
+                }
+        }
+        pclose(file);
+out_assign:
+        sym_filter_entry = syme;
+        pthread_mutex_unlock(&syme->source_lock);
+}
+static void __zero_source_counters(struct sym_entry *syme)
+{
+        int i;
+        struct source_line *line;
+        line = syme->lines;
+        while (line) {
+                for (i = 0; i < nr_counters; i++)
+                        line->count[i] = 0;
+                line = line->next;
+        }
+}
+static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
+{
+        struct source_line *line;
+        if (syme != sym_filter_entry)
+                return;
+        if (pthread_mutex_trylock(&syme->source_lock))
+                return;
+        if (!syme->source)
+                goto out_unlock;
+        for (line = syme->lines; line; line = line->next) {
+                if (line->eip == ip) {
+                        line->count[counter]++;
+                        break;
+                }
+                if (line->eip > ip)
+                        break;
+        }
+out_unlock:
+        pthread_mutex_unlock(&syme->source_lock);
+}
+static void lookup_sym_source(struct sym_entry *syme)
+{
+        struct symbol *symbol = (struct symbol *)(syme + 1);
+        struct source_line *line;
+        char pattern[PATH_MAX];
+        char *idx;
+        sprintf(pattern, "<%s>:", symbol->name);
+        if (symbol->module) {
+                idx = strstr(pattern, "\t");
+                if (idx)
+                        *idx = 0;
+        }
+        pthread_mutex_lock(&syme->source_lock);
+        for (line = syme->lines; line; line = line->next) {
+                if (strstr(line->line, pattern)) {
+                        syme->source = line;
+                        break;
+                }
+        }
+        pthread_mutex_unlock(&syme->source_lock);
+}
+static void show_lines(struct source_line *queue, int count, int total)
+{
+        int i;
+        struct source_line *line;
+        line = queue;
+        for (i = 0; i < count; i++) {
+                float pcnt = 100.0*(float)line->count[sym_counter]/(float)total;
+                printf("%8li %4.1f%%\t%s\n", line->count[sym_counter], pcnt, line->line);
+                line = line->next;
+        }
+}
+#define TRACE_COUNT     3
+static void show_details(struct sym_entry *syme)
+{
+        struct symbol *symbol;
+        struct source_line *line;
+        struct source_line *line_queue = NULL;
+        int displayed = 0;
+        int line_queue_count = 0, total = 0, more = 0;
+        if (!syme)
+                return;
+        if (!syme->source)
+                lookup_sym_source(syme);
+        if (!syme->source)
+                return;
+        symbol = (struct symbol *)(syme + 1);
+        printf("Showing %s for %s\n", event_name(sym_counter), symbol->name);
+        printf("  Events  Pcnt (>=%d%%)\n", sym_pcnt_filter);
+        pthread_mutex_lock(&syme->source_lock);
+        line = syme->source;
+        while (line) {
+                total += line->count[sym_counter];
+                line = line->next;
+        }
+        line = syme->source;
+        while (line) {
+                float pcnt = 0.0;
+                if (!line_queue_count)
+                        line_queue = line;
+                line_queue_count++;
+                if (line->count[sym_counter])
+                        pcnt = 100.0 * line->count[sym_counter] / (float)total;
+                if (pcnt >= (float)sym_pcnt_filter) {
+                        if (displayed <= print_entries)
+                                show_lines(line_queue, line_queue_count, total);
+                        else more++;
+                        displayed += line_queue_count;
+                        line_queue_count = 0;
+                        line_queue = NULL;
+                } else if (line_queue_count > TRACE_COUNT) {
+                        line_queue = line_queue->next;
+                        line_queue_count--;
+                }
+                line->count[sym_counter] = zero ? 0 : line->count[sym_counter] * 7 / 8;
+                line = line->next;
+        }
+        pthread_mutex_unlock(&syme->source_lock);
+        if (more)
+                printf("%d lines not displayed, maybe increase display entries [e]\n", more);
+}
 struct dso                      *kernel_dso;
@@ -112,6 +355,9 @@ static double sym_weight(const struct sym_entry *sym)
        double weight = sym->snap_count;
        int counter;
+        if (!display_weighted)
+                return weight;
        for (counter = 1; counter < nr_counters-1; counter++)
                weight *= sym->count[counter];
@@ -159,7 +405,7 @@ static void rb_insert_active_sym(struct rb_root *tree, struct sym_entry *se)
 static void print_sym_table(void)
 {
        int printed = 0, j;
-        int counter;
+        int counter, snap = !display_weighted ? sym_counter : 0;
        float samples_per_sec = samples/delay_secs;
        float ksamples_per_sec = (samples-userspace_samples)/delay_secs;
        float sum_ksamples = 0.0;
@@ -175,7 +421,7 @@ static void print_sym_table(void)
        pthread_mutex_unlock(&active_symbols_lock);
        list_for_each_entry_safe_from(syme, n, &active_symbols, node) {
-                syme->snap_count = syme->count[0];
+                syme->snap_count = syme->count[snap];
                if (syme->snap_count != 0) {
                        syme->weight = sym_weight(syme);
                        rb_insert_active_sym(&tmp, syme);
@@ -195,7 +441,7 @@ static void print_sym_table(void)
                samples_per_sec,
                100.0 - (100.0*((samples_per_sec-ksamples_per_sec)/samples_per_sec)));
-        if (nr_counters == 1) {
+        if (nr_counters == 1 || !display_weighted) {
                printf("%Ld", (u64)attrs[0].sample_period);
                if (freq)
                        printf("Hz ");
@@ -203,7 +449,9 @@ static void print_sym_table(void)
                        printf(" ");
        }
-        for (counter = 0; counter < nr_counters; counter++) {
+        if (!display_weighted)
+                printf("%s", event_name(sym_counter));
+        else for (counter = 0; counter < nr_counters; counter++) {
                if (counter)
                        printf("/");
@@ -228,6 +476,11 @@ static void print_sym_table(void)
        printf("------------------------------------------------------------------------------\n\n");
+        if (sym_filter_entry) {
+                show_details(sym_filter_entry);
+                return;
+        }
        if (nr_counters == 1)
                printf("             samples    pcnt");
        else
@@ -242,13 +495,13 @@ static void print_sym_table(void)
                struct symbol *sym = (struct symbol *)(syme + 1);
                double pcnt;
-                if (++printed > print_entries || syme->snap_count < count_filter)
+                if (++printed > print_entries || (int)syme->snap_count < count_filter)
                        continue;
                pcnt = 100.0 - (100.0 * ((sum_ksamples - syme->snap_count) /
                                         sum_ksamples));
-                if (nr_counters == 1)
+                if (nr_counters == 1 || !display_weighted)
                        printf("%20.2f - ", syme->weight);
                else
                        printf("%9.1f %10ld - ", syme->weight, syme->snap_count);
@@ -261,19 +514,250 @@ static void print_sym_table(void)
        }
 }
+static void prompt_integer(int *target, const char *msg)
+{
+        char *buf = malloc(0), *p;
+        size_t dummy = 0;
+        int tmp;
+        fprintf(stdout, "\n%s: ", msg);
+        if (getline(&buf, &dummy, stdin) < 0)
+                return;
+        p = strchr(buf, '\n');
+        if (p)
+                *p = 0;
+        p = buf;
+        while(*p) {
+                if (!isdigit(*p))
+                        goto out_free;
+                p++;
+        }
+        tmp = strtoul(buf, NULL, 10);
+        *target = tmp;
+out_free:
+        free(buf);
+}
+static void prompt_percent(int *target, const char *msg)
+{
+        int tmp = 0;
+        prompt_integer(&tmp, msg);
+        if (tmp >= 0 && tmp <= 100)
+                *target = tmp;
+}
+static void prompt_symbol(struct sym_entry **target, const char *msg)
+{
+        char *buf = malloc(0), *p;
+        struct sym_entry *syme = *target, *n, *found = NULL;
+        size_t dummy = 0;
+        /* zero counters of active symbol */
+        if (syme) {
+                pthread_mutex_lock(&syme->source_lock);
+                __zero_source_counters(syme);
+                *target = NULL;
+                pthread_mutex_unlock(&syme->source_lock);
+        }
+        fprintf(stdout, "\n%s: ", msg);
+        if (getline(&buf, &dummy, stdin) < 0)
+                goto out_free;
+        p = strchr(buf, '\n');
+        if (p)
+                *p = 0;
+        pthread_mutex_lock(&active_symbols_lock);
+        syme = list_entry(active_symbols.next, struct sym_entry, node);
+        pthread_mutex_unlock(&active_symbols_lock);
+        list_for_each_entry_safe_from(syme, n, &active_symbols, node) {
+                struct symbol *sym = (struct symbol *)(syme + 1);
+                if (!strcmp(buf, sym->name)) {
+                        found = syme;
+                        break;
+                }
+        }
+        if (!found) {
+                fprintf(stderr, "Sorry, %s is not active.\n", sym_filter);
+                sleep(1);
+                return;
+        } else
+                parse_source(found);
+out_free:
+        free(buf);
+}
+static void print_mapped_keys(void)
+{
+        char *name = NULL;
+        if (sym_filter_entry) {
+                struct symbol *sym = (struct symbol *)(sym_filter_entry+1);
+                name = sym->name;
+        }
+        fprintf(stdout, "\nMapped keys:\n");
+        fprintf(stdout, "\t[d]     display refresh delay.             \t(%d)\n", delay_secs);
+        fprintf(stdout, "\t[e]     display entries (lines).           \t(%d)\n", print_entries);
+        if (nr_counters > 1)
+                fprintf(stdout, "\t[E]     active event counter.              \t(%s)\n", event_name(sym_counter));
+        fprintf(stdout, "\t[f]     profile display filter (count).    \t(%d)\n", count_filter);
+        if (vmlinux) {
+                fprintf(stdout, "\t[F]     annotate display filter (percent). \t(%d%%)\n", sym_pcnt_filter);
+                fprintf(stdout, "\t[s]     annotate symbol.                   \t(%s)\n", name?: "NULL");
+                fprintf(stdout, "\t[S]     stop annotation.\n");
+        }
+        if (nr_counters > 1)
+                fprintf(stdout, "\t[w]     toggle display weighted/count[E]r. \t(%d)\n", display_weighted ? 1 : 0);
+        fprintf(stdout, "\t[z]     toggle sample zeroing.             \t(%d)\n", zero ? 1 : 0);
+        fprintf(stdout, "\t[qQ]    quit.\n");
+}
+static int key_mapped(int c)
+{
+        switch (c) {
+                case 'd':
+                case 'e':
+                case 'f':
+                case 'z':
+                case 'q':
+                case 'Q':
+                        return 1;
+                case 'E':
+                case 'w':
+                        return nr_counters > 1 ? 1 : 0;
+                case 'F':
+                case 's':
+                case 'S':
+                        return vmlinux ? 1 : 0;
+        }
+        return 0;
+}
+static void handle_keypress(int c)
+{
+        if (!key_mapped(c)) {
+                struct pollfd stdin_poll = { .fd = 0, .events = POLLIN };
+                struct termios tc, save;
+                print_mapped_keys();
+                fprintf(stdout, "\nEnter selection, or unmapped key to continue: ");
+                fflush(stdout);
+                tcgetattr(0, &save);
+                tc = save;
+                tc.c_lflag &= ~(ICANON | ECHO);
+                tc.c_cc[VMIN] = 0;
+                tc.c_cc[VTIME] = 0;
+                tcsetattr(0, TCSANOW, &tc);
+                poll(&stdin_poll, 1, -1);
+                c = getc(stdin);
+                tcsetattr(0, TCSAFLUSH, &save);
+                if (!key_mapped(c))
+                        return;
+        }
+        switch (c) {
+                case 'd':
+                        prompt_integer(&delay_secs, "Enter display delay");
+                        break;
+                case 'e':
+                        prompt_integer(&print_entries, "Enter display entries (lines)");
+                        break;
+                case 'E':
+                        if (nr_counters > 1) {
+                                int i;
+                                fprintf(stderr, "\nAvailable events:");
+                                for (i = 0; i < nr_counters; i++)
+                                        fprintf(stderr, "\n\t%d %s", i, event_name(i));
+                                prompt_integer(&sym_counter, "Enter details event counter");
+                                if (sym_counter >= nr_counters) {
+                                        fprintf(stderr, "Sorry, no such event, using %s.\n", event_name(0));
+                                        sym_counter = 0;
+                                        sleep(1);
+                                }
+                        } else sym_counter = 0;
+                        break;
+                case 'f':
+                        prompt_integer(&count_filter, "Enter display event count filter");
+                        break;
+                case 'F':
+                        prompt_percent(&sym_pcnt_filter, "Enter details display event filter (percent)");
+                        break;
+                case 'q':
+                case 'Q':
+                        printf("exiting.\n");
+                        exit(0);
+                case 's':
+                        prompt_symbol(&sym_filter_entry, "Enter details symbol");
+                        break;
+                case 'S':
+                        if (!sym_filter_entry)
+                                break;
+                        else {
+                                struct sym_entry *syme = sym_filter_entry;
+                                pthread_mutex_lock(&syme->source_lock);
+                                sym_filter_entry = NULL;
+                                __zero_source_counters(syme);
+                                pthread_mutex_unlock(&syme->source_lock);
+                        }
+                        break;
+                case 'w':
+                        display_weighted = ~display_weighted;
+                        break;
+                case 'z':
+                        zero = ~zero;
+                        break;
+        }
+}
 static void *display_thread(void *arg __used)
 {
        struct pollfd stdin_poll = { .fd = 0, .events = POLLIN };
-        int delay_msecs = delay_secs * 1000;
+        struct termios tc, save;
+        int delay_msecs, c;
+        tcgetattr(0, &save);
+        tc = save;
+        tc.c_lflag &= ~(ICANON | ECHO);
+        tc.c_cc[VMIN] = 0;
+        tc.c_cc[VTIME] = 0;
-        printf("PerfTop refresh period: %d seconds\n", delay_secs);
+repeat:
+        delay_msecs = delay_secs * 1000;
+        tcsetattr(0, TCSANOW, &tc);
+        /* trash return*/
+        getc(stdin);
        do {
                print_sym_table();
        } while (!poll(&stdin_poll, 1, delay_msecs) == 1);
-        printf("key pressed - exiting.\n");
+        c = getc(stdin);
-        exit(0);
+        tcsetattr(0, TCSAFLUSH, &save);
+        handle_keypress(c);
+        goto repeat;
        return NULL;
 }
@@ -285,6 +769,7 @@ static const char *skip_symbols[] = {
        "enter_idle",
        "exit_idle",
        "mwait_idle",
+        "mwait_idle_with_hints",
        "ppc64_runlatch_off",
        "pseries_dedicated_idle_sleep",
        NULL
@@ -292,7 +777,6 @@ static const char *skip_symbols[] = {
 static int symbol_filter(struct dso *self, struct symbol *sym)
 {
-        static int filter_match;
        struct sym_entry *syme;
        const char *name = sym->name;
        int i;
@@ -314,6 +798,10 @@ static int symbol_filter(struct dso *self, struct symbol *sym)
                return 1;
        syme = dso__sym_priv(self, sym);
+        pthread_mutex_init(&syme->source_lock, NULL);
+        if (!sym_filter_entry && sym_filter && !strcmp(name, sym_filter))
+                sym_filter_entry = syme;
        for (i = 0; skip_symbols[i]; i++) {
                if (!strcmp(skip_symbols[i], name)) {
                        syme->skip = 1;
@@ -321,29 +809,6 @@ static int symbol_filter(struct dso *self, struct symbol *sym)
                }
        }
-        if (filter_match == 1) {
-                filter_end = sym->start;
-                filter_match = -1;
-                if (filter_end - filter_start > 10000) {
-                        fprintf(stderr,
-                                "hm, too large filter symbol <%s> - skipping.\n",
-                                sym_filter);
-                        fprintf(stderr, "symbol filter start: %016lx\n",
-                                filter_start);
-                        fprintf(stderr, "                end: %016lx\n",
-                                filter_end);
-                        filter_end = filter_start = 0;
-                        sym_filter = NULL;
-                        sleep(1);
-                }
-        }
-        if (filter_match == 0 && sym_filter && !strcmp(name, sym_filter)) {
-                filter_match = 1;
-                filter_start = sym->start;
-        }
        return 0;
 }
@@ -379,8 +844,6 @@ out_delete_dso:
        return -1;
 }
-#define TRACE_COUNT     3
 /*
 * Binary search in the histogram table and record the hit:
 */
@@ -393,6 +856,7 @@ static void record_ip(u64 ip, int counter)
                if (!syme->skip) {
                        syme->count[counter]++;
+                        record_precise_ip(syme, counter, ip);
                        pthread_mutex_lock(&active_symbols_lock);
                        if (list_empty(&syme->node) || !syme->node.next)
                                __list_insert_active_sym(syme);
@@ -689,8 +1153,8 @@ static const struct option options[] = {
                            "put the counters into a counter group"),
        OPT_BOOLEAN('i', "inherit", &inherit,
                    "child tasks inherit counters"),
-        OPT_STRING('s', "sym-filter", &sym_filter, "pattern",
+        OPT_STRING('s', "sym-annotate", &sym_filter, "symbol name",
-                    "only display symbols matchig this pattern"),
+                    "symbol to annotate - requires -k option"),
        OPT_BOOLEAN('z', "zero", &zero,
                    "zero history across updates"),
        OPT_INTEGER('F', "freq", &freq,
@@ -733,6 +1197,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __used)
                delay_secs = 1;
        parse_symbols();
+        parse_source(sym_filter_entry);
        /*
         * Fill in the ones not specifically initialized via -c:
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 9d3c8141b8c1..011473411642 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -13,6 +13,7 @@
 #include <stdio.h>
 #include <stdbool.h>
 #include <errno.h>
+#include <math.h>
 #include "callchain.h"
@@ -26,10 +27,14 @@ rb_insert_callchain(struct rb_root *root, struct callchain_node *chain,
        struct rb_node **p = &root->rb_node;
        struct rb_node *parent = NULL;
        struct callchain_node *rnode;
+        u64 chain_cumul = cumul_hits(chain);
        while (*p) {
+                u64 rnode_cumul;
                parent = *p;
                rnode = rb_entry(parent, struct callchain_node, rb_node);
+                rnode_cumul = cumul_hits(rnode);
                switch (mode) {
                case CHAIN_FLAT:
@@ -40,7 +45,7 @@ rb_insert_callchain(struct rb_root *root, struct callchain_node *chain,
                        break;
                case CHAIN_GRAPH_ABS: /* Falldown */
                case CHAIN_GRAPH_REL:
-                        if (rnode->cumul_hit < chain->cumul_hit)
+                        if (rnode_cumul < chain_cumul)
                                p = &(*p)->rb_left;
                        else
                                p = &(*p)->rb_right;
@@ -87,7 +92,7 @@ static void __sort_chain_graph_abs(struct callchain_node *node,
        chain_for_each_child(child, node) {
                __sort_chain_graph_abs(child, min_hit);
-                if (child->cumul_hit >= min_hit)
+                if (cumul_hits(child) >= min_hit)
                        rb_insert_callchain(&node->rb_root, child,
                                            CHAIN_GRAPH_ABS);
        }
@@ -108,11 +113,11 @@ static void __sort_chain_graph_rel(struct callchain_node *node,
        u64 min_hit;
        node->rb_root = RB_ROOT;
-        min_hit = node->cumul_hit * min_percent / 100.0;
+        min_hit = ceil(node->children_hit * min_percent);
        chain_for_each_child(child, node) {
                __sort_chain_graph_rel(child, min_percent);
-                if (child->cumul_hit >= min_hit)
+                if (cumul_hits(child) >= min_hit)
                        rb_insert_callchain(&node->rb_root, child,
                                            CHAIN_GRAPH_REL);
        }
@@ -122,7 +127,7 @@ static void
 sort_chain_graph_rel(struct rb_root *rb_root, struct callchain_node *chain_root,
                     u64 min_hit __used, struct callchain_param *param)
 {
-        __sort_chain_graph_rel(chain_root, param->min_percent);
+        __sort_chain_graph_rel(chain_root, param->min_percent / 100.0);
        rb_root->rb_node = chain_root->rb_root.rb_node;
 }
@@ -211,7 +216,8 @@ add_child(struct callchain_node *parent, struct ip_callchain *chain,
        new = create_child(parent, false);
        fill_node(new, chain, start, syms);
-        new->cumul_hit = new->hit = 1;
+        new->children_hit = 0;
+        new->hit = 1;
 }
 /*
@@ -241,7 +247,8 @@ split_add_child(struct callchain_node *parent, struct ip_callchain *chain,
        /* split the hits */
        new->hit = parent->hit;
-        new->cumul_hit = parent->cumul_hit;
+        new->children_hit = parent->children_hit;
+        parent->children_hit = cumul_hits(new);
        new->val_nr = parent->val_nr - idx_local;
        parent->val_nr = idx_local;
@@ -249,6 +256,7 @@ split_add_child(struct callchain_node *parent, struct ip_callchain *chain,
        if (idx_total < chain->nr) {
                parent->hit = 0;
                add_child(parent, chain, idx_total, syms);
+                parent->children_hit++;
        } else {
                parent->hit = 1;
        }
@@ -269,13 +277,13 @@ __append_chain_children(struct callchain_node *root, struct ip_callchain *chain,
                unsigned int ret = __append_chain(rnode, chain, start, syms);
                if (!ret)
-                        goto cumul;
+                        goto inc_children_hit;
        }
        /* nothing in children, add to the current node */
        add_child(root, chain, start, syms);
-cumul:
+inc_children_hit:
-        root->cumul_hit++;
+        root->children_hit++;
 }
 static int
@@ -317,8 +325,6 @@ __append_chain(struct callchain_node *root, struct ip_callchain *chain,
        /* we match 100% of the path, increment the hit */
        if (i - start == root->val_nr && i == chain->nr) {
                root->hit++;
-                root->cumul_hit++;
                return 0;
        }
@@ -331,5 +337,7 @@ __append_chain(struct callchain_node *root, struct ip_callchain *chain,
 void append_chain(struct callchain_node *root, struct ip_callchain *chain,
                  struct symbol **syms)
 {
+        if (!chain->nr)
+                return;
        __append_chain_children(root, chain, syms, 0);
 }
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 7812122bea1d..a926ae4f5a16 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -7,6 +7,7 @@
 #include "symbol.h"
 enum chain_mode {
+        CHAIN_NONE,
        CHAIN_FLAT,
        CHAIN_GRAPH_ABS,
        CHAIN_GRAPH_REL
@@ -21,7 +22,7 @@ struct callchain_node {
        struct rb_root          rb_root; /* sorted tree of children */
        unsigned int            val_nr;
        u64                     hit;
-        u64                     cumul_hit; /* hit + hits of children */
+        u64                     children_hit;
 };
 struct callchain_param;
@@ -48,6 +49,11 @@ static inline void callchain_init(struct callchain_node *node)
        INIT_LIST_HEAD(&node->val);
 }
+static inline u64 cumul_hits(struct callchain_node *node)
+{
+        return node->hit + node->children_hit;
+}
 int register_callchain_param(struct callchain_param *param);
 void append_chain(struct callchain_node *root, struct ip_callchain *chain,
                  struct symbol **syms);
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 450384b3bbe5..b92a457ca32e 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -185,6 +185,8 @@ static void do_read(int fd, void *buf, size_t size)
                if (ret < 0)
                        die("failed to read");
+                if (ret == 0)
+                        die("failed to read: missing data");
                size -= ret;
                buf += ret;
@@ -213,9 +215,10 @@ struct perf_header *perf_header__read(int fd)
        for (i = 0; i < nr_attrs; i++) {
                struct perf_header_attr *attr;
-                off_t tmp = lseek(fd, 0, SEEK_CUR);
+                off_t tmp;
                do_read(fd, &f_attr, sizeof(f_attr));
+                tmp = lseek(fd, 0, SEEK_CUR);
                attr = perf_header_attr__new(&f_attr.attr);
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 7bdad8df22a6..044178408783 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -121,13 +121,29 @@ static unsigned long hw_cache_stat[C(MAX)] = {
           (strcmp(sys_dirent.d_name, ".")) &&                                 \
           (strcmp(sys_dirent.d_name, "..")))
+static int tp_event_has_id(struct dirent *sys_dir, struct dirent *evt_dir)
+{
+        char evt_path[MAXPATHLEN];
+        int fd;
+        snprintf(evt_path, MAXPATHLEN, "%s/%s/%s/id", debugfs_path,
+                        sys_dir->d_name, evt_dir->d_name);
+        fd = open(evt_path, O_RDONLY);
+        if (fd < 0)
+                return -EINVAL;
+        close(fd);
+        return 0;
+}
 #define for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next, file, st)    \
        while (!readdir_r(evt_dir, &evt_dirent, &evt_next) && evt_next)        \
        if (snprintf(file, MAXPATHLEN, "%s/%s/%s", debugfs_path,               \
                     sys_dirent.d_name, evt_dirent.d_name) &&                  \
           (!stat(file, &st)) && (S_ISDIR(st.st_mode)) &&                      \
           (strcmp(evt_dirent.d_name, ".")) &&                                 \
-           (strcmp(evt_dirent.d_name, "..")))
+           (strcmp(evt_dirent.d_name, "..")) &&                                \
+           (!tp_event_has_id(&sys_dirent, &evt_dirent)))
 #define MAX_EVENT_LENGTH 30
@@ -223,9 +239,15 @@ char *event_name(int counter)
 {
        u64 config = attrs[counter].config;
        int type = attrs[counter].type;
+        return __event_name(type, config);
+}
+char *__event_name(int type, u64 config)
+{
        static char buf[32];
-        if (attrs[counter].type == PERF_TYPE_RAW) {
+        if (type == PERF_TYPE_RAW) {
                sprintf(buf, "raw 0x%llx", config);
                return buf;
        }
@@ -357,6 +379,7 @@ static int parse_tracepoint_event(const char **strp,
                                    struct perf_counter_attr *attr)
 {
        const char *evt_name;
+        char *flags;
        char sys_name[MAX_EVENT_LENGTH];
        char id_buf[4];
        int fd;
@@ -378,6 +401,15 @@ static int parse_tracepoint_event(const char **strp,
        strncpy(sys_name, *strp, sys_length);
        sys_name[sys_length] = '\0';
        evt_name = evt_name + 1;
+        flags = strchr(evt_name, ':');
+        if (flags) {
+                *flags = '\0';
+                flags++;
+                if (!strncmp(flags, "record", strlen(flags)))
+                        attr->sample_type |= PERF_SAMPLE_RAW;
+        }
        evt_length = strlen(evt_name);
        if (evt_length >= MAX_EVENT_LENGTH)
                return 0;
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index 1ea5d09b6eb1..192a962e3a0f 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -10,6 +10,7 @@ extern int			nr_counters;
 extern struct perf_counter_attr attrs[MAX_COUNTERS];
 extern char *event_name(int ctr);
+extern char *__event_name(int type, u64 config);
 extern int parse_events(const struct option *opt, const char *str, int unset);
diff --git a/tools/perf/util/quote.c b/tools/perf/util/quote.c
index c6e5dc0dc82f..2726fe40eb5d 100644
--- a/tools/perf/util/quote.c
+++ b/tools/perf/util/quote.c
@@ -318,7 +318,7 @@ char *quote_path_relative(const char *in, int len,
                strbuf_addch(out, '"');
        if (prefix) {
                int off = 0;
-                while (prefix[off] && off < len && prefix[off] == in[off])
+                while (off < len && prefix[off] && prefix[off] == in[off])
                        if (prefix[off] == '/') {
                                prefix += off + 1;
                                in += off + 1;
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 28106059bf12..5c0f42e6b33b 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -6,14 +6,18 @@
 #include <libelf.h>
 #include <gelf.h>
 #include <elf.h>
-#include <bfd.h>
 const char *sym_hist_filter;
-#ifndef DMGL_PARAMS
+enum dso_origin {
-#define DMGL_PARAMS      (1 << 0)       /* Include function args */
+        DSO__ORIG_KERNEL = 0,
-#define DMGL_ANSI        (1 << 1)       /* Include const, volatile, etc */
+        DSO__ORIG_JAVA_JIT,
-#endif
+        DSO__ORIG_FEDORA,
+        DSO__ORIG_UBUNTU,
+        DSO__ORIG_BUILDID,
+        DSO__ORIG_DSO,
+        DSO__ORIG_NOT_FOUND,
+};
 static struct symbol *symbol__new(u64 start, u64 len,
                                  const char *name, unsigned int priv_size,
@@ -72,6 +76,7 @@ struct dso *dso__new(const char *name, unsigned int sym_priv_size)
                self->sym_priv_size = sym_priv_size;
                self->find_symbol = dso__find_symbol;
                self->slen_calculated = 0;
+                self->origin = DSO__ORIG_NOT_FOUND;
        }
        return self;
@@ -565,7 +570,7 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
                goto out_elf_end;
        secstrs = elf_getdata(sec_strndx, NULL);
-        if (symstrs == NULL)
+        if (secstrs == NULL)
                goto out_elf_end;
        nr_syms = shdr.sh_size / shdr.sh_entsize;
@@ -652,11 +657,85 @@ out_close:
        return err;
 }
+#define BUILD_ID_SIZE 128
+static char *dso__read_build_id(struct dso *self, int verbose)
+{
+        int i;
+        GElf_Ehdr ehdr;
+        GElf_Shdr shdr;
+        Elf_Data *build_id_data;
+        Elf_Scn *sec;
+        char *build_id = NULL, *bid;
+        unsigned char *raw;
+        Elf *elf;
+        int fd = open(self->name, O_RDONLY);
+        if (fd < 0)
+                goto out;
+        elf = elf_begin(fd, ELF_C_READ_MMAP, NULL);
+        if (elf == NULL) {
+                if (verbose)
+                        fprintf(stderr, "%s: cannot read %s ELF file.\n",
+                                __func__, self->name);
+                goto out_close;
+        }
+        if (gelf_getehdr(elf, &ehdr) == NULL) {
+                if (verbose)
+                        fprintf(stderr, "%s: cannot get elf header.\n", __func__);
+                goto out_elf_end;
+        }
+        sec = elf_section_by_name(elf, &ehdr, &shdr, ".note.gnu.build-id", NULL);
+        if (sec == NULL)
+                goto out_elf_end;
+        build_id_data = elf_getdata(sec, NULL);
+        if (build_id_data == NULL)
+                goto out_elf_end;
+        build_id = malloc(BUILD_ID_SIZE);
+        if (build_id == NULL)
+                goto out_elf_end;
+        raw = build_id_data->d_buf + 16;
+        bid = build_id;
+        for (i = 0; i < 20; ++i) {
+                sprintf(bid, "%02x", *raw);
+                ++raw;
+                bid += 2;
+        }
+        if (verbose >= 2)
+                printf("%s(%s): %s\n", __func__, self->name, build_id);
+out_elf_end:
+        elf_end(elf);
+out_close:
+        close(fd);
+out:
+        return build_id;
+}
+char dso__symtab_origin(const struct dso *self)
+{
+        static const char origin[] = {
+                [DSO__ORIG_KERNEL] =   'k',
+                [DSO__ORIG_JAVA_JIT] = 'j',
+                [DSO__ORIG_FEDORA] =   'f',
+                [DSO__ORIG_UBUNTU] =   'u',
+                [DSO__ORIG_BUILDID] =  'b',
+                [DSO__ORIG_DSO] =      'd',
+        };
+        if (self == NULL || self->origin == DSO__ORIG_NOT_FOUND)
+                return '!';
+        return origin[self->origin];
+}
 int dso__load(struct dso *self, symbol_filter_t filter, int verbose)
 {
-        int size = strlen(self->name) + sizeof("/usr/lib/debug%s.debug");
+        int size = PATH_MAX;
-        char *name = malloc(size);
+        char *name = malloc(size), *build_id = NULL;
-        int variant = 0;
        int ret = -1;
        int fd;
@@ -665,26 +744,43 @@ int dso__load(struct dso *self, symbol_filter_t filter, int verbose)
        self->adjust_symbols = 0;
-        if (strncmp(self->name, "/tmp/perf-", 10) == 0)
+        if (strncmp(self->name, "/tmp/perf-", 10) == 0) {
-                return dso__load_perf_map(self, filter, verbose);
+                ret = dso__load_perf_map(self, filter, verbose);
+                self->origin = ret > 0 ? DSO__ORIG_JAVA_JIT :
+                                         DSO__ORIG_NOT_FOUND;
+                return ret;
+        }
+        self->origin = DSO__ORIG_FEDORA - 1;
 more:
        do {
-                switch (variant) {
+                self->origin++;
-                case 0: /* Fedora */
+                switch (self->origin) {
+                case DSO__ORIG_FEDORA:
                        snprintf(name, size, "/usr/lib/debug%s.debug", self->name);
                        break;
-                case 1: /* Ubuntu */
+                case DSO__ORIG_UBUNTU:
                        snprintf(name, size, "/usr/lib/debug%s", self->name);
                        break;
-                case 2: /* Sane people */
+                case DSO__ORIG_BUILDID:
+                        build_id = dso__read_build_id(self, verbose);
+                        if (build_id != NULL) {
+                                snprintf(name, size,
+                                         "/usr/lib/debug/.build-id/%.2s/%s.debug",
+                                        build_id, build_id + 2);
+                                free(build_id);
+                                break;
+                        }
+                        self->origin++;
+                        /* Fall thru */
+                case DSO__ORIG_DSO:
                        snprintf(name, size, "%s", self->name);
                        break;
                default:
                        goto out;
                }
-                variant++;
                fd = open(name, O_RDONLY);
        } while (fd < 0);
@@ -705,6 +801,8 @@ more:
        }
 out:
        free(name);
+        if (ret < 0 && strstr(self->name, " (deleted)") != NULL)
+                return 0;
        return ret;
 }
@@ -820,6 +918,9 @@ int dso__load_kernel(struct dso *self, const char *vmlinux,
        if (err <= 0)
                err = dso__load_kallsyms(self, filter, verbose);
+        if (err > 0)
+                self->origin = DSO__ORIG_KERNEL;
        return err;
 }
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 2f92b21c712d..b53bf0125c1b 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -7,6 +7,30 @@
 #include <linux/rbtree.h>
 #include "module.h"
+#ifdef HAVE_CPLUS_DEMANGLE
+extern char *cplus_demangle(const char *, int);
+static inline char *bfd_demangle(void __used *v, const char *c, int i)
+{
+        return cplus_demangle(c, i);
+}
+#else
+#ifdef NO_DEMANGLE
+static inline char *bfd_demangle(void __used *v, const char __used *c,
+                                 int __used i)
+{
+        return NULL;
+}
+#else
+#include <bfd.h>
+#endif
+#endif
+#ifndef DMGL_PARAMS
+#define DMGL_PARAMS      (1 << 0)       /* Include function args */
+#define DMGL_ANSI        (1 << 1)       /* Include const, volatile, etc */
+#endif
 struct symbol {
        struct rb_node  rb_node;
        u64             start;
@@ -26,6 +50,7 @@ struct dso {
        unsigned int     sym_priv_size;
        unsigned char    adjust_symbols;
        unsigned char    slen_calculated;
+        unsigned char    origin;
        char             name[0];
 };
@@ -49,6 +74,7 @@ int dso__load_modules(struct dso *self, symbol_filter_t filter, int verbose);
 int dso__load(struct dso *self, symbol_filter_t filter, int verbose);
 size_t dso__fprintf(struct dso *self, FILE *fp);
+char dso__symtab_origin(const struct dso *self);
 void symbol__init(void);
 #endif /* _PERF_SYMBOL_ */
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 1eddae94bab3..1150c6d5c7b8 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -95,8 +95,6 @@ static int ioapic_service(struct kvm_ioapic *ioapic, unsigned int idx)
                if (injected && pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
                        pent->fields.remote_irr = 1;
        }
-        if (!pent->fields.trig_mode)
-                ioapic->irr &= ~(1 << idx);
        return injected;
 }
@@ -136,7 +134,8 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
                mask_after = ioapic->redirtbl[index].fields.mask;
                if (mask_before != mask_after)
                        kvm_fire_mask_notifiers(ioapic->kvm, index, mask_after);
-                if (ioapic->irr & (1 << index))
+                if (ioapic->redirtbl[index].fields.trig_mode == IOAPIC_LEVEL_TRIG
+                    && ioapic->irr & (1 << index))
                        ioapic_service(ioapic, index);
                break;
        }
@@ -184,9 +183,10 @@ int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
                if (!level)
                        ioapic->irr &= ~mask;
                else {
+                        int edge = (entry.fields.trig_mode == IOAPIC_EDGE_TRIG);
                        ioapic->irr |= mask;
-                        if ((!entry.fields.trig_mode && old_irr != ioapic->irr)
+                        if ((edge && old_irr != ioapic->irr) ||
-                            || !entry.fields.remote_irr)
+                            (!edge && !entry.fields.remote_irr))
                                ret = ioapic_service(ioapic, irq);
                }
        }
diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
index a8bd466d00cc..ddc17f0e2f35 100644
--- a/virt/kvm/irq_comm.c
+++ b/virt/kvm/irq_comm.c
@@ -160,7 +160,8 @@ void kvm_notify_acked_irq(struct kvm *kvm, unsigned irqchip, unsigned pin)
        unsigned gsi = pin;
        list_for_each_entry(e, &kvm->irq_routing, link)
-                if (e->irqchip.irqchip == irqchip &&
+                if (e->type == KVM_IRQ_ROUTING_IRQCHIP &&
+                    e->irqchip.irqchip == irqchip &&
                    e->irqchip.pin == pin) {
                        gsi = e->gsi;
                        break;
@@ -259,6 +260,7 @@ static int setup_routing_entry(struct kvm_kernel_irq_routing_entry *e,
        int delta;
        e->gsi = ue->gsi;
+        e->type = ue->type;
        switch (ue->type) {
        case KVM_IRQ_ROUTING_IRQCHIP:
                delta = 0;